dbus: client: notify: fix reference counting

There's a reference overflow when adding chips to the global list and an
underflow when fetching existing chips from that list in connect_line().
Fix both issues.

Fixes: a5ab76da1e0a ("dbus: add the D-Bus daemon, command-line client and tests")
Link: https://lore.kernel.org/r/20241007-dbus-memory-fixes-v1-1-0d56d1aa032d@linaro.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>

diff --git a/dbus/client/notify.c b/dbus/client/notify.c
index 5c73343e3ffaf35c8b9143140860bc63cc39130e..6d51a6f65747629035339666a8a48415add42545 100644 (file)
--- a/dbus/client/notify.c
+++ b/dbus/client/notify.c
@@ -211,10 +211,10 @@ static void connect_line(gpointer elem, gpointer user_data)
        if (data->scoped_chip) {
                if (g_list_length(data->chips) == 0) {
                        chip = gpiodbus_object_get_chip(chip_obj);
-                       data->chips = g_list_append(data->chips,
-                                                   g_object_ref(chip));
+                       data->chips = g_list_append(data->chips, chip);
                } else {
                        chip = g_list_first(data->chips)->data;
+                       g_object_ref(chip);
                }
        } else {
                chip = gpiodbus_object_get_chip(chip_obj);