service: fix memleak in trigger handling

Signed-off-by: Felix Fietkau <nbd@openwrt.org>

diff --git a/service/trigger.c b/service/trigger.c
index b7bdbc5beb86c18205bb3bc3eb0d36f0c4f503b4..f4504011f8b6c0292b24fb3053ee608b75cd779b 100644 (file)
--- a/service/trigger.c
+++ b/service/trigger.c
@@ -88,13 +88,19 @@ static void q_job_run(struct runqueue *q, struct runqueue_task *t)
        j->cmd->handler(j, j->exec, j->env);
 }
 
+static void trigger_free(struct trigger *t)
+{
+       free(t->data);
+       list_del(&t->list);
+       free(t);
+}
+
 static void q_job_complete(struct runqueue *q, struct runqueue_task *p)
 {
        struct job *j = container_of(p, struct job, proc.task);
 
        if (j->trigger->remove) {
-               list_del(&j->trigger->list);
-               free(j->trigger);
+               trigger_free(j->trigger);
        } else {
                j->trigger->pending = 0;
        }
@@ -219,6 +225,7 @@ static void trigger_delay_cb(struct uloop_timeout *tout)
 
        json_script_run(&t->jctx, "foo", t->data);
        free(t->data);
+       t->data = NULL;
 }
 
 static struct trigger* _trigger_add(char *type, struct blob_attr *rule, int timeout, void *id)
@@ -302,8 +309,8 @@ void trigger_del(void *id)
                        t->remove = 1;
                        continue;
                }
-               list_del(&t->list);
-               free(t);
+
+               trigger_free(t);
        }
 }
 
@@ -323,6 +330,7 @@ void trigger_event(char *type, struct blob_attr *data)
                        continue;
                if (!strcmp(t->type, type)) {
                        if (t->timeout) {
+                               free(t->data);
                                t->data = blob_memdup(data);
                                uloop_timeout_set(&t->delay, t->timeout);
                        } else {