From 5ff3092fd57aed67911ca0d217d761b00b34fbeb Mon Sep 17 00:00:00 2001
From: Stefano Bonicatti <stefano.bonicatti@gmail.com>
Date: Thu, 7 Nov 2024 16:13:46 +0100
Subject: [PATCH] Fix a leak in DiskArbitrationEventPublisher::getProperty
 (#8463)

---
 osquery/events/darwin/diskarbitration.cpp | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/osquery/events/darwin/diskarbitration.cpp b/osquery/events/darwin/diskarbitration.cpp
index bff997b7aae..5ffd9b60b33 100644
--- a/osquery/events/darwin/diskarbitration.cpp
+++ b/osquery/events/darwin/diskarbitration.cpp
@@ -261,9 +261,11 @@ std::string DiskArbitrationEventPublisher::getProperty(
   } else if (CFGetTypeID(value) == CFBooleanGetTypeID()) {
     return (CFBooleanGetValue((CFBooleanRef)value)) ? "1" : "0";
   } else if (CFGetTypeID(value) == CFUUIDGetTypeID()) {
-    return stringFromCFString(
-        CFUUIDCreateString(kCFAllocatorDefault, (CFUUIDRef)value));
+    auto cf_string = CFUUIDCreateString(kCFAllocatorDefault, (CFUUIDRef)value);
+    auto string = stringFromCFString(cf_string);
+    CFRelease(cf_string);
+    return string;
   }
   return "";
 }
-}
+} // namespace osquery