out_cloudwatch_logs: fix log stream leak when group allocation fails

[ParakhJaggi]

In get_or_create_log_stream(), the branch handling a failed flb_sds_create() for the group name returns without releasing the partially initialised log_stream, leaking both the struct and the already allocated name field:

new_stream->name = flb_sds_create(stream_name);
if (new_stream->name == NULL) {
    flb_errno();
    flb_free(new_stream);      /* frees */
    return NULL;
}
new_stream->group = flb_sds_create(group_name);
if (new_stream->group == NULL) {
    flb_errno();
    return NULL;               /* frees nothing */
}

The asymmetry with the branch directly above, and with the create_log_stream() failure path below which already calls log_stream_destroy(), suggests this was an oversight rather than intentional.

This change uses log_stream_destroy() in that branch as well. It null checks every field, so it handles the partially initialised struct correctly.

The path is only reached when an allocation fails, which in practice means the process is already under memory pressure, so the leak compounds exactly when it can least be afforded.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• [N/A] Example configuration file for the change
• [N/A] Debug log output from testing the change
• Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• [N/A] Run local packaging test showing all targets (including any new ones) build.
• [N/A] Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• [N/A] Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• Bug Fixes
  • Improved error handling when creating CloudWatch log streams to ensure partially initialized resources are properly released if setup fails.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7acdeed3-5447-44be-b56b-984788902cc1

📥 Commits

Reviewing files that changed from the base of the PR and between a1d6fb1 and cf18bdc.

📒 Files selected for processing (1)

• plugins/out_cloudwatch_logs/cloudwatch_api.c

---

📝 Walkthrough

Walkthrough

The CloudWatch log stream creation path now destroys a partially initialized log stream when group-name allocation fails.

Changes

CloudWatch log stream creation

Layer / File(s)	Summary
Partial stream cleanup plugins/out_cloudwatch_logs/cloudwatch_api.c	The creation path destroys the newly allocated log stream when group-name allocation fails.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: cosmo0920

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the log stream memory leak fix in out_cloudwatch_logs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}