Use-after-free in sentry__value_merge_objects on allocation failure #1538
Description
Title: Use-after-free in sentry__value_merge_objects on allocation failure
sentry__value_merge_objects() can corrupt the source object when sentry_value_set_by_key() fails due to OOM. The source object is left with a dangling pointer to freed memory.
The incref happens after sentry_value_set_by_key:
sentry-native/src/sentry_value.c
Lines 1114 to 1118 in f230fa2
But set_by_key decrefs the value on failure:
sentry-native/src/sentry_value.c
Lines 670 to 672 in f230fa2
If the source value has refcount 1, the decref frees it and the source object is left with a dangling pointer.
sentry__value_clone does it correctly — incref before set_by_key:
sentry-native/src/sentry_value.c
Lines 816 to 817 in f230fa2
The affected function is called from sentry__scope_apply_to_event to merge the global scope's tags, extra, and propagation context into events. On OOM, this corrupts the global scope, affecting all subsequent event captures.
Possible fix: swap the incref to before set_by_key, matching the pattern in sentry__value_clone.