lcms: Fix memory leak in ReadSegmentedCurve

third_party/lcms2-2.6/src/cmstypes.c

 //---------------------------------------------------------------------------------
 //
 //  Little Color Management System
 //  Copyright (c) 1998-2014 Marti Maria Saguer
 //
 // Permission is hereby granted, free of charge, to any person obtaining
 // a copy of this software and associated documentation files (the "Software"),
 // to deal in the Software without restriction, including without limitation
 // the rights to use, copy, modify, merge, publish, distribute, sublicense,
 // and/or sell copies of the Software, and to permit persons to whom the Software
@@ skipping 3950 matching lines @@
                     if (!_cmsReadFloat32Number(io, &f)) goto Error;
                     Segments[i].Params[j] = f;
                 }
                 }
                 break;
 
 
             case cmsSigSampledCurveSeg: {
                 cmsUInt32Number Count;
 
-                if (!_cmsReadUInt32Number(io, &Count)) return NULL;
+                if (!_cmsReadUInt32Number(io, &Count)) goto Error;
 
                 Segments[i].nGridPoints = Count;
                 Segments[i].SampledPoints = (cmsFloat32Number*) _cmsCalloc(self ->ContextID, Count, sizeof(cmsFloat32Number));
                 if (Segments[i].SampledPoints == NULL) goto Error;
 
                 for (j=0; j < Count; j++) {
                     if (!_cmsReadFloat32Number(io, &Segments[i].SampledPoints[j])) goto Error;
                 }
                 }
                 break;
 
             default:
                 {
                 char String[5];
 
                 _cmsTagSignature2String(String, (cmsTagSignature) ElementSig);
                 cmsSignalError(self->ContextID, cmsERROR_UNKNOWN_EXTENSION, "Unknown curve element type '%s' found.", String);
                 }
-                return NULL;
+                goto Error;
 
          }
      }
 
      Curve = cmsBuildSegmentedToneCurve(self ->ContextID, nSegments, Segments);
 
      for (i=0; i < nSegments; i++) {
          if (Segments[i].SampledPoints) _cmsFree(self ->ContextID, Segments[i].SampledPoints);
      }
      _cmsFree(self ->ContextID, Segments);
      return Curve;
 
 Error:
-     if (Segments) _cmsFree(self ->ContextID, Segments);
+     if (Segments) {
+         for (i=0; i < nSegments; i++) {
+             if (Segments[i].SampledPoints) _cmsFree(self ->ContextID, Segments[i].SampledPoints);
+         }
+         _cmsFree(self ->ContextID, Segments);
+     }
      return NULL;
 }
 
 
 static
 cmsBool ReadMPECurve(struct _cms_typehandler_struct* self,
                      cmsIOHANDLER* io,
                      void* Cargo,
                      cmsUInt32Number n,
                      cmsUInt32Number SizeOfTag)
@@ skipping 1555 matching lines @@
 
     for (pt = SupportedTags;
             pt != NULL;
             pt = pt ->Next) {
 
                 if (sig == pt -> Signature) return &pt ->Descriptor;
     }
 
     return NULL;
 }