security-context-v1: fix possible leaks on wl_client_create() and state copying errors

1 files changed, 13 insertions, 6 deletions

diff --git a/types/wlr_security_context_v1.c b/types/wlr_security_context_v1.c
index c675e9b8..ce7def5c 100644
--- a/types/wlr_security_context_v1.c
+++ b/types/wlr_security_context_v1.c
@@ -100,13 +100,18 @@ static void security_context_destroy(
 	free(security_context);
 }
 
+static void security_context_client_destroy(
+		struct wlr_security_context_v1_client *security_context_client) {
+	wl_list_remove(&security_context_client->destroy.link);
+	security_context_state_finish(&security_context_client->state);
+	free(security_context_client);
+}
+
 static void security_context_client_handle_destroy(struct wl_listener *listener,
 		void *data) {
 	struct wlr_security_context_v1_client *security_context_client =
 		wl_container_of(listener, security_context_client, destroy);
-	wl_list_remove(&security_context_client->destroy.link);
-	security_context_state_finish(&security_context_client->state);
-	free(security_context_client);
+	security_context_client_destroy(security_context_client);
 }
 
 static int security_context_handle_listen_fd_event(int listen_fd, uint32_t mask,
@@ -139,17 +144,19 @@ static int security_context_handle_listen_fd_event(int listen_fd, uint32_t mask,
 		if (client == NULL) {
 			wlr_log(WLR_ERROR, "wl_client_create failed");
 			close(client_fd);
+			free(security_context_client);
 			return 0;
 		}
 
+		security_context_client->destroy.notify = security_context_client_handle_destroy;
+		wl_client_add_destroy_listener(client, &security_context_client->destroy);
+
 		if (!security_context_state_copy(&security_context_client->state,
 				&security_context->state)) {
+			security_context_client_destroy(security_context_client);
 			wl_client_post_no_memory(client);
 			return 0;
 		}
-
-		security_context_client->destroy.notify = security_context_client_handle_destroy;
-		wl_client_add_destroy_listener(client, &security_context_client->destroy);
 	}
 
 	return 0;