Fix memory leaks in lcms

third_party/lcms2-2.6/src/cmstypes.c

 //---------------------------------------------------------------------------------
 //
 //  Little Color Management System
 //  Copyright (c) 1998-2014 Marti Maria Saguer
 //
 // Permission is hereby granted, free of charge, to any person obtaining
 // a copy of this software and associated documentation files (the "Software"),
 // to deal in the Software without restriction, including without limitation
 // the rights to use, copy, modify, merge, publish, distribute, sublicense,
 // and/or sell copies of the Software, and to permit persons to whom the Software
@@ skipping 1094 matching lines @@
                }
 
            default:  // Curve
 
                if (Count > 0x7FFF)
                    return NULL; // This is to prevent bad guys for doing bad things
 
                NewGamma = cmsBuildTabulatedToneCurve16(self ->ContextID, Count, NULL);
                if (!NewGamma) return NULL;
 
-               if (!_cmsReadUInt16Array(io, Count, NewGamma -> Table16)) return NULL;
+               if (!_cmsReadUInt16Array(io, Count, NewGamma -> Table16)) {
+                 cmsFreeToneCurve(NewGamma);
+                 return NULL;
+               }
 
                *nItems = 1;
                return NewGamma;
     }
 
     cmsUNUSED_PARAMETER(SizeOfTag);
 }
 
 
 static
@@ skipping 1217 matching lines @@
 
     Data = (_cmsStageCLutData*) CLUT ->Data;
 
     // Precision can be 1 or 2 bytes
     if (Precision == 1) {
 
         cmsUInt8Number  v;
 
         for (i=0; i < Data ->nEntries; i++) {
 
-            if (io ->Read(io, &v, sizeof(cmsUInt8Number), 1) != 1) return NULL;
+            if (io ->Read(io, &v, sizeof(cmsUInt8Number), 1) != 1) {
+              cmsStageFree(CLUT);
+              return NULL;
+            }
             Data ->Tab.T[i] = FROM_8_TO_16(v);
         }
 
     }
     else
         if (Precision == 2) {
 
             if (!_cmsReadUInt16Array(io, Data->nEntries, Data ->Tab.T)) {
                 cmsStageFree(CLUT);
                 return NULL;
@@ skipping 725 matching lines @@
     prefix[31] = suffix[31] = 0;
 
     v = cmsAllocNamedColorList(self ->ContextID, count, nDeviceCoords, prefix, suffix);
     if (v == NULL) {
         cmsSignalError(self->ContextID, cmsERROR_RANGE, "Too many named colors '%d'", count);
         return NULL;
     }
 
     if (nDeviceCoords > cmsMAXCHANNELS) {
         cmsSignalError(self->ContextID, cmsERROR_RANGE, "Too many device coordinates '%d'", nDeviceCoords);
-        return 0;
+        goto Error;
     }
     for (i=0; i < count; i++) {
 
         cmsUInt16Number PCS[3];
         cmsUInt16Number Colorant[cmsMAXCHANNELS];
         char Root[33];
 
         memset(Colorant, 0, sizeof(Colorant));
-        if (io -> Read(io, Root, 32, 1) != 1) return NULL;
+        if (io -> Read(io, Root, 32, 1) != 1) goto Error;
         Root[32] = 0;
         if (!_cmsReadUInt16Array(io, 3, PCS)) goto Error;
         if (!_cmsReadUInt16Array(io, nDeviceCoords, Colorant)) goto Error;
 
         if (!cmsAppendNamedColor(v, Root, PCS, Colorant)) goto Error;
     }
 
     *nItems = 1;
     return (void*) v ;
 
@@ skipping 2437 matching lines @@
 
     for (pt = SupportedTags;
             pt != NULL;
             pt = pt ->Next) {
 
                 if (sig == pt -> Signature) return &pt ->Descriptor;
     }
 
     return NULL;
 }