NEWS: finalize release

Fixes #21872.

log_syntax_callback sets 's', a.k.a. '*userdata', to POINTER_MAX to signal allocation failure.
If the error does not cause immediate failure of the program, and log_syntax_callback is called
again, it would try to use 's' as a pointer to a set and fail badly.

NEWS

@@ -1,6 +1,6 @@
 systemd System and Service Manager
 
-CHANGES WITH 250 in spe:
+CHANGES WITH 250:
 
         * Support for encrypted and authenticated credentials has been added.
           This extends the credential logic introduced with v247 to support

src/analyze/analyze-verify.c

@@ -26,6 +26,9 @@ static void log_syntax_callback(const char *unit, int level, void *userdata) {
         if (level > LOG_WARNING)
                 return;
 
+        if (*s == POINTER_MAX)
+                return;
+
         r = set_put_strdup(s, unit);
         if (r < 0) {
                 set_free_free(*s);

src/libsystemd/sd-journal/sd-journal.c

@@ -212,7 +212,7 @@ static Match *match_new(Match *p, MatchType t) {
         return m;
 }
 
-static void match_free(Match *m) {
+static Match *match_free(Match *m) {
         assert(m);
 
         while (m->matches)
@@ -222,18 +222,18 @@ static void match_free(Match *m) {
                 LIST_REMOVE(matches, m->parent->matches, m);
 
         free(m->data);
-        free(m);
+        return mfree(m);
 }
 
-static void match_free_if_empty(Match *m) {
+static Match *match_free_if_empty(Match *m) {
         if (!m || m->matches)
-                return;
+                return m;
 
-        match_free(m);
+        return match_free(m);
 }
 
 _public_ int sd_journal_add_match(sd_journal *j, const void *data, size_t size) {
-        Match *l3, *l4, *add_here = NULL, *m;
+        Match *l3, *l4, *add_here = NULL, *m = NULL;
         uint64_t hash;
 
         assert_return(j, -EINVAL);
@@ -322,10 +322,11 @@ _public_ int sd_journal_add_match(sd_journal *j, const void *data, size_t size)
         return 0;
 
 fail:
+        match_free(m);
         match_free_if_empty(add_here);
-        match_free_if_empty(j->level2);
+        j->level2 = match_free_if_empty(j->level2);
-        match_free_if_empty(j->level1);
+        j->level1 = match_free_if_empty(j->level1);
-        match_free_if_empty(j->level0);
+        j->level0 = match_free_if_empty(j->level0);
 
         return -ENOMEM;
 }