We construct JSON objects e.g. for setting the VNC password but then just VIR_FREE the strings cointained inside. If it was the password string would be kept on the heap. Exchange some cpu cycles for a warm feeling of security. Signed-off-by: Peter Krempa <pkrempa(a)redhat.com&gt; --- src/util/virjson.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util/virjson.c b/src/util/virjson.c index d5d66f879f..db38fd0dc0 100644 --- a/src/util/virjson.c +++ b/src/util/virjson.c @@ -423,7 +423,7 @@ virJSONValueFree(virJSONValuePtr value) VIR_FREE(value->data.array.values); break; case VIR_JSON_TYPE_STRING: - VIR_FREE(value->data.string); + VIR_DISPOSE_STRING(value->data.string); break; case VIR_JSON_TYPE_NUMBER: VIR_FREE(value->data.number); -- 2.20.1