From 799c99d446a457811ebc01a97572504b3135caec Mon Sep 17 00:00:00 2001 From: Ewan Croft Date: Tue, 11 Aug 2026 01:39:27 +0100 Subject: [PATCH] fix(cli): fix use-after-free printing garbage in delete-record output wf_agent_session_data_free(&sd) freed sd.did (aliased by repo) before the success printf used it, so delete-record printed allocator bytes instead of the DID. Move the free after the print and free sd on the error path too. --- src/cli/cli_repo.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/cli/cli_repo.c b/src/cli/cli_repo.c index 61183d6..22a6994 100644 --- a/src/cli/cli_repo.c +++ b/src/cli/cli_repo.c @@ -105,13 +105,14 @@ int cmd_repo(int argc, char **argv) { const char *repo = sd.did ? sd.did : pos[1]; wf_status s = wf_agent_delete_record_typed(agent, repo, collection, rkey, NULL, NULL); - wf_agent_session_data_free(&sd); if (s != WF_OK) { fprintf(stderr, "error: deleteRecord failed (status %d)\n", (int)s); + wf_agent_session_data_free(&sd); wf_agent_free(agent); return 1; } printf("deleted %s/%s/%s\n", repo, collection, rkey); + wf_agent_session_data_free(&sd); wf_agent_free(agent); return 0; } @@ -249,9 +250,8 @@ int cmd_get_record(int argc, char **argv) { }; wf_response res = {0}; - wf_status s = - wf_xrpc_query_params(client, "com.atproto.repo.getRecord", params, 3, - &res); + wf_status s = wf_xrpc_query_params(client, "com.atproto.repo.getRecord", + params, 3, &res); wf_xrpc_client_free(client); if (s != WF_OK && s != WF_ERR_HTTP) { -- 2.51.2