exchange

commit 8e99ec3d9c532f66b30765d478b3806fa4336e2a
parent 298a99993bc2143f5105c77aa98c3a926b9950e3
Author: Christian Grothoff <christian@grothoff.org>
Date:   Sun, 28 Jun 2026 09:19:56 +0200

badness

Diffstat:
M
src/exchange/taler-exchange-httpd_post-melt.c
 | 
11
++++++++---
M
src/exchange/taler-exchange-httpd_post-withdraw.c
 | 
11
++++++++---

2 files changed, 16 insertions(+), 6 deletions(-)
diff --git a/src/exchange/taler-exchange-httpd_post-melt.c b/src/exchange/taler-exchange-httpd_post-melt.c
@@ -380,9 +380,14 @@ clean_melt_rc (struct TEH_RequestContext *rc)
   GNUNET_free (mc->request.denoms_h);
   for (uint8_t k = 0; k<TALER_CNC_KAPPA; k++)
   {
-    for (size_t i = 0; i<mc->request.refresh.num_coins; i++)
-      TALER_blinded_planchet_free (&mc->request.planchets[k][i]);
-    GNUNET_free (mc->request.planchets[k]);
+    if (NULL != mc->request.planchets[k])
+    {
+      /* num_coins is set long before planchets[k] is allocated,
+         so freeing it needs the above guard */
+      for (size_t i = 0; i<mc->request.refresh.num_coins; i++)
+        TALER_blinded_planchet_free (&mc->request.planchets[k][i]);
+      GNUNET_free (mc->request.planchets[k]);
+    }
     if (! mc->request.refresh.is_v27_refresh)
       GNUNET_free (mc->request.transfer_pubs[k]);
   }
diff --git a/src/exchange/taler-exchange-httpd_post-withdraw.c b/src/exchange/taler-exchange-httpd_post-withdraw.c
@@ -1197,9 +1197,14 @@ clean_withdraw_rc (struct TEH_RequestContext *rc)
     wc->lch = NULL;
   }
   GNUNET_free (wc->request.denoms_h);
-  for (unsigned int i = 0; i<wc->request.num_planchets; i++)
-    TALER_blinded_planchet_free (&wc->request.planchets[i]);
-  GNUNET_free (wc->request.planchets);
+  if (NULL != wc->request.planchets)
+  {
+    /* num_planchets is set long before planchets is allocated,
+       so this needs the above guard */
+    for (unsigned int i = 0; i<wc->request.num_planchets; i++)
+      TALER_blinded_planchet_free (&wc->request.planchets[i]);
+    GNUNET_free (wc->request.planchets);
+  }
   free_db_withdraw_data (&wc->request.withdraw);
   GNUNET_free (wc->request.cs_indices);
   if (wc->request.is_idempotent)