From 1d200a63ac4e39035af35e80881aa4fdae5556c6 Mon Sep 17 00:00:00 2001
From: Christian Persch <chpe@src.gnome.org>
Date: Sat, 18 Nov 2017 18:40:03 +0100
Subject: matcher: Fix memory leak

Don't leak the GValueArray.

https://bugzilla.gnome.org/show_bug.cgi?id=790539
(cherry picked from commit dda73cc07250ea324b4227907197c39b93fcd365)
---
 src/matcher.cc | 12 +++++++-----
 src/table.cc   | 19 +++++++++++--------
 2 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/src/matcher.cc b/src/matcher.cc
index 10f3bc7..a4f7584 100644
--- a/src/matcher.cc
+++ b/src/matcher.cc
@@ -202,14 +202,16 @@ _vte_matcher_print(struct _vte_matcher *matcher)
  * we need to free those ourselves. */
 void
 _vte_matcher_free_params_array(struct _vte_matcher *matcher,
-		               GValueArray *params)
+                               GValueArray *params)
 {
 	guint i;
 	for (i = 0; i < params->n_values; i++) {
-		GValue *value = &params->values[i];
-		if (G_UNLIKELY (g_type_is_a (value->g_type, G_TYPE_POINTER))) {
-			g_free (g_value_get_pointer (value));
-		}
+                auto value = g_value_array_get_nth(params, i);
+                if (G_UNLIKELY (G_VALUE_HOLDS_POINTER(value))) {
+                        g_free(g_value_get_pointer(value));
+                } else if (G_UNLIKELY (G_VALUE_HOLDS_BOXED(value))) {
+                        g_value_array_free((GValueArray*)g_value_get_boxed(value));
+                }
 	}
 	if (G_UNLIKELY (matcher == NULL || matcher->free_params != NULL)) {
 		g_value_array_free (params);
diff --git a/src/table.cc b/src/table.cc
index 3c78f3a..09a6172 100644
--- a/src/table.cc
+++ b/src/table.cc
@@ -516,18 +516,14 @@ static void
 _vte_table_extract_numbers(GValueArray **array,
 			   struct _vte_table_arginfo *arginfo)
 {
-	GValue value = {0,};
-	GValue subvalue = {0,};
-	GValueArray *subarray = NULL;
-	gssize i;
-
         if (G_UNLIKELY (*array == NULL)) {
                 *array = g_value_array_new(1);
         }
 
+	GValue value = {0,};
 	g_value_init(&value, G_TYPE_LONG);
-	g_value_init(&subvalue, G_TYPE_VALUE_ARRAY);
-	i = 0;
+	gssize i = 0;
+        GValueArray *subarray = nullptr;
 	do {
 		long total = 0;
 		for (; i < arginfo->length && arginfo->start[i] != ';' && arginfo->start[i] != ':'; i++) {
@@ -546,13 +542,20 @@ _vte_table_extract_numbers(GValueArray **array,
 				g_value_array_append(*array, &value);
 			} else {
 				g_value_array_append(subarray, &value);
-				g_value_set_boxed(&subvalue, subarray);
+
+                                GValue subvalue = {0,};
+                                g_value_init(&subvalue, G_TYPE_VALUE_ARRAY);
+				g_value_take_boxed(&subvalue, subarray);
 				g_value_array_append(*array, &subvalue);
+                                g_value_unset(&subvalue);
+
 				subarray = NULL;
 			}
 		}
 	} while (i++ < arginfo->length);
 	g_value_unset(&value);
+        if (subarray != nullptr)
+                g_value_array_free(subarray);
 }
 
 static void
-- 
cgit v0.12