[BUG] [C] Double free / memory corruption in generated C client for array requestBody using list_t*

Bug Report Checklist

• Have you provided a full/minimal spec to reproduce the issue?
• Have you validated the input using an OpenAPI validator?
• Have you tested with the latest master to confirm the issue still exists?
• Have you searched for related issues/PRs?
• What's the actual output vs expected output?
• [Optional] Sponsorship to speed up the bug fix or feature request (example)

Description

The C client generator produces functions for endpoints with a list_t* when the requestBody is an array. In the generated code, both the parent cJSON object and its child array are deleted separately, causing a double free / memory corruption. This issue only occurs when the requestBody is an array type, not with a simple object.

openapi-generator version

7.15.0

OpenAPI declaration file content or url

openapi: 3.0.0
info:
  title: Test API
  version: 1.0.0
paths:
  /user/createWithList:
    post:
      tags:
        - user
      summary: Creates list of users
      operationId: createUsersWithListInput
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/User'
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/User'
components:
  schemas:
    User:
      type: object
      properties:
        id:
          type: integer
          format: int64
        username:
          type: string
        email:
          type: string

Generation Details

CLI command used:

openapi-generator-cli generate -i minimal.yaml -g c -o c_client_array_bug

Steps to reproduce

1. Use the minimal YAML specification provided above.

2. Generate the C client using the OpenAPI Generator CLI:

java -cp ../openapi-generator-cli-7.15.0.jar \
     -Dlog.level=ERROR org.openapitools.codegen.OpenAPIGenerator generate \
     -i minimal.yaml -o c_client_array_bug -g c

3. Create a main.c file with the following content:

#include <stdio.h>
#include <stdlib.h>
#include "apiClient.h"
#include "UserAPI.h"
#include "user.h"
#include "list.h"
#include <string.h>

int main() {
    apiClient_t *apiClient = apiClient_create();
    if (!apiClient) return 1;

    list_t *userList = list_createList();
    if (!userList) {
        apiClient_free(apiClient);
        return 1;
    }

    user_t *u1 = user_create(
        10,               // id
        "theUser",        // username
        "john@email.com"  // email
    );
    list_addElement(userList, u1);

    UserAPI_createUsersWithListInput(apiClient, userList);

    listEntry_t *entry;
    list_ForEach(entry, userList) {
        user_free(entry->data);
    }
    list_freeList(userList);
    apiClient_free(apiClient);

    printf("Done\n");
    return 0;
}

4. Compile the code including all generated sources and dependencies:

gcc c_client_array_bug/api/*.c \
    c_client_array_bug/model/*.c \
    c_client_array_bug/src/apiClient.c \
    c_client_array_bug/src/list.c \
    c_client_array_bug/external/cJSON.c \
    main.c \
    -I./c_client_array_bug/include -I./c_client_array_bug/api \
    -I./c_client_array_bug/model -I./c_client_array_bug/external \
    -lm -lcurl -g

5. Run the executable and observe a segmentation fault due to double free when deleting cJSON objects.

Example gdb backtrace:

(gdb) where
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff7d5a859 in __GI_abort () at abort.c:79
#2  0x00007ffff7dc5266 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff7eef298 "%s\n")
#3  0x00007ffff7dcd2fc in malloc_printerr (str=str@entry=0x7ffff7ef1670 "double free or corruption (out)") at malloc.c:5347
#4  0x00007ffff7dcefa0 in _int_free (av=0x7ffff7f24b80 <main_arena>, p=0x555555584620, have_lock=<optimized out>) at malloc.c:4314
#5  0x0000555555559047 in cJSON_Delete (item=0x555555584630) at c_client_array_bug/external/cJSON.c:232
#6  0x0000555555558fd5 in cJSON_Delete (item=0x555555584500) at c_client_array_bug/external/cJSON.c:222
#7  0x00005555555569b8 in UserAPI_createUsersWithListInput (apiClient=0x5555555843c0, user=0x555555569900)
    at c_client_array_bug/api/UserAPI.c:107
#8  0x000055555555dae6 in main () at main.c:35

Related issues/PRs

None found specifically for list_t* / array requestBody causing double free.

Suggest a fix

Only delete the top-level container (localVarItemJSON_user) after adding all items.
Do not delete child arrays separately.

Start with the minimal.yaml reproduction and inspect the generated api/UserAPI.c cleanup around the requestBody list, then trace ownership through external/cJSON.c. Re-run the supplied generation, compilation, and executable steps; done means the array requestBody client completes without the reported double free or memory corruption.