Suricata

While reviewing the SMTP Eve JSON logging code, I noticed an ownership issue in EveEmailLogJsonData() in src/output-json-email-common.c.

When smtp_state NULL, the function frees the provided SCJsonBuilder and returns failure:

However, the builder is owned by the caller. For example, EveEmailLogJson() continues to operate on the same builder after the call:

This makes ownership handling inconsistent: the callee frees a caller-owned object while the caller assumes it remains valid for subsequent cleanup.

Suggested fix:

Do not free sjs in EveEmailLogJsonData().
Simply return failure when smtp_state NULL.
Optionally add defensive NULL checks in EveSmtpDataLogger() for state and vtx.
I have not verified whether the NULL-state path is reachable during normal runtime, so I am reporting this as a correctness / hardening issue rather than a confirmed security issue.