From 4301f2aec4515d6f9d7d307479a5ab599da6b0bc Mon Sep 17 00:00:00 2001 From: J-P Nurmi Date: Wed, 11 Feb 2026 14:36:38 +0100 Subject: [PATCH 1/2] fix: prevent double-decref of event in envelope add functions Move `item->event` assignment after the payload allocation check in `sentry__envelope_add_event` and `sentry__envelope_add_transaction`. Previously, if `sentry__jsonwriter_into_string` failed, the event was already owned by the envelope item. Multiple callers decref the event and free the envelope on failure, leading to a double-decref because `sentry_envelope_free` also decrefs `item->event` via item cleanup. Co-Authored-By: Claude Opus 4.6 --- src/sentry_envelope.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/sentry_envelope.c b/src/sentry_envelope.c index fc81cea24..3e8225284 100644 --- a/src/sentry_envelope.c +++ b/src/sentry_envelope.c @@ -296,12 +296,12 @@ sentry__envelope_add_event(sentry_envelope_t *envelope, sentry_value_t event) sentry_uuid_t event_id; sentry__ensure_event_id(event, &event_id); - item->event = event; sentry__jsonwriter_write_value(jw, event); item->payload = sentry__jsonwriter_into_string(jw, &item->payload_len); if (!item->payload) { return NULL; } + item->event = event; sentry__envelope_item_set_header( item, "type", sentry_value_new_string("event")); @@ -381,12 +381,12 @@ sentry__envelope_add_transaction( sentry_uuid_t event_id; sentry__ensure_event_id(transaction, &event_id); - item->event = transaction; sentry__jsonwriter_write_value(jw, transaction); item->payload = sentry__jsonwriter_into_string(jw, &item->payload_len); if (!item->payload) { return NULL; } + item->event = transaction; sentry__envelope_item_set_header( item, "type", sentry_value_new_string("transaction")); From 5c518e4aa0786bdc758fabbab0667f640caedad0 Mon Sep 17 00:00:00 2001 From: J-P Nurmi Date: Wed, 11 Feb 2026 14:42:41 +0100 Subject: [PATCH 2/2] Update CHANGELOG.md --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index b7cd0c84f..122829877 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ **Fixes**: - Remove spurious decref in `sentry_capture_user_feedback()` ([#1510](https://github.com/getsentry/sentry-native/pull/1510)) +- Prevent double-decref of event in envelope add functions ([#1511](https://github.com/getsentry/sentry-native/pull/1511)) ## 0.12.6