Fix memory leak in lcms, MPEmatrix_Read

third_party/lcms2-2.6/src/cmstypes.c

 //---------------------------------------------------------------------------------
 //
 //  Little Color Management System
 //  Copyright (c) 1998-2014 Marti Maria Saguer
 //
 // Permission is hereby granted, free of charge, to any person obtaining
 // a copy of this software and associated documentation files (the "Software"),
 // to deal in the Software without restriction, including without limitation
 // the rights to use, copy, modify, merge, publish, distribute, sublicense,
 // and/or sell copies of the Software, and to permit persons to whom the Software
@@ skipping 4185 matching lines @@
     if (Offsets == NULL) {
 
         _cmsFree(self ->ContextID, Matrix);
         return NULL;
     }
 
     for (i=0; i < nElems; i++) {
 
         cmsFloat32Number v;
 
-        if (!_cmsReadFloat32Number(io, &v)) return NULL;
+        if (!_cmsReadFloat32Number(io, &v)) {
+            _cmsFree(self ->ContextID, Matrix);
+            _cmsFree(self ->ContextID, Offsets);
+            return NULL;
+        }
         Matrix[i] = v;
     }
 
 
     for (i=0; i < OutputChans; i++) {
 
         cmsFloat32Number v;
 
-        if (!_cmsReadFloat32Number(io, &v)) return NULL;
+        if (!_cmsReadFloat32Number(io, &v)) {
+            _cmsFree(self ->ContextID, Matrix);
+            _cmsFree(self ->ContextID, Offsets);
+            return NULL;
+        }
         Offsets[i] = v;
     }
 
 
     mpe = cmsStageAllocMatrix(self ->ContextID, OutputChans, InputChans, Matrix, Offsets);
     _cmsFree(self ->ContextID, Matrix);
     _cmsFree(self ->ContextID, Offsets);
 
     *nItems = 1;
 
@@ skipping 1336 matching lines @@
 
     for (pt = SupportedTags;
             pt != NULL;
             pt = pt ->Next) {
 
                 if (sig == pt -> Signature) return &pt ->Descriptor;
     }
 
     return NULL;
 }