Bug 693463: Fix various memory leaks.

All these leaks were spotted by zeniko, so credit/thanks to him.

2 files changed, 46 insertions, 44 deletions

diff --git a/pdf/pdf_annot.c b/pdf/pdf_annot.c
index 99c13bd5..4d0d0f84 100644
--- a/pdf/pdf_annot.c
+++ b/pdf/pdf_annot.c
@@ -360,8 +360,9 @@ pdf_load_annots(pdf_document *xref, pdf_obj *annots, fz_matrix page_ctm)
 	int i, len;
 	fz_context *ctx = xref->ctx;
 
+	fz_var(annot);
+
 	head = tail = NULL;
-	annot = NULL;
 
 	len = pdf_array_len(annots);
 	for (i = 0; i < len; i++)
@@ -374,7 +375,11 @@ pdf_load_annots(pdf_document *xref, pdf_obj *annots, fz_matrix page_ctm)
 		ap = pdf_dict_gets(obj, "AP");
 		as = pdf_dict_gets(obj, "AS");
 
-		if (pdf_is_dict(ap))
+		if (!pdf_is_dict(ap))
+			continue;
+
+		annot = NULL;
+		fz_try(ctx)
 		{
 			pdf_hotspot *hp = &xref->hotspot;
 
@@ -394,7 +399,6 @@ pdf_load_annots(pdf_document *xref, pdf_obj *annots, fz_matrix page_ctm)
 			if (!pdf_is_stream(xref, pdf_to_num(n), pdf_to_gen(n)))
 				n = pdf_dict_get(n, as);
 
-
 			annot = fz_malloc_struct(ctx, pdf_annot);
 			annot->obj = pdf_keep_obj(obj);
 			annot->rect = pdf_to_rect(ctx, rect);
@@ -404,16 +408,9 @@ pdf_load_annots(pdf_document *xref, pdf_obj *annots, fz_matrix page_ctm)
 
 			if (pdf_is_stream(xref, pdf_to_num(n), pdf_to_gen(n)))
 			{
-				fz_try(ctx)
-				{
-					annot->ap = pdf_load_xobject(xref, n);
-					pdf_transform_annot(annot);
-					annot->ap_iteration = annot->ap->iteration;
-				}
-				fz_catch(ctx)
-				{
-					fz_warn(ctx, "ignoring broken annotation");
-				}
+				annot->ap = pdf_load_xobject(xref, n);
+				pdf_transform_annot(annot);
+				annot->ap_iteration = annot->ap->iteration;
 			}
 
 			annot->next = NULL;
@@ -429,6 +426,11 @@ pdf_load_annots(pdf_document *xref, pdf_obj *annots, fz_matrix page_ctm)
 				tail = annot;
 			}
 		}
+		fz_catch(ctx)
+		{
+			fz_free(ctx, annot);
+			fz_warn(ctx, "ignoring broken annotation");
+		}
 	}
 
 	return head;
diff --git a/pdf/pdf_xobject.c b/pdf/pdf_xobject.c
index 4d7243b6..86b45167 100644
--- a/pdf/pdf_xobject.c
+++ b/pdf/pdf_xobject.c
@@ -57,46 +57,46 @@ pdf_load_xobject(pdf_document *xref, pdf_obj *dict)
 	/* Store item immediately, to avoid possible recursion if objects refer back to this one */
 	pdf_store_item(ctx, dict, form, pdf_xobject_size(form));
 
-	obj = pdf_dict_gets(dict, "BBox");
-	form->bbox = pdf_to_rect(ctx, obj);
-
-	obj = pdf_dict_gets(dict, "Matrix");
-	if (obj)
-		form->matrix = pdf_to_matrix(ctx, obj);
-	else
-		form->matrix = fz_identity;
-
-	form->isolated = 0;
-	form->knockout = 0;
-	form->transparency = 0;
-
-	obj = pdf_dict_gets(dict, "Group");
-	if (obj)
+	fz_try(ctx)
 	{
-		pdf_obj *attrs = obj;
+		obj = pdf_dict_gets(dict, "BBox");
+		form->bbox = pdf_to_rect(ctx, obj);
 
-		form->isolated = pdf_to_bool(pdf_dict_gets(attrs, "I"));
-		form->knockout = pdf_to_bool(pdf_dict_gets(attrs, "K"));
+		obj = pdf_dict_gets(dict, "Matrix");
+		if (obj)
+			form->matrix = pdf_to_matrix(ctx, obj);
+		else
+			form->matrix = fz_identity;
 
-		obj = pdf_dict_gets(attrs, "S");
-		if (pdf_is_name(obj) && !strcmp(pdf_to_name(obj), "Transparency"))
-			form->transparency = 1;
+		form->isolated = 0;
+		form->knockout = 0;
+		form->transparency = 0;
 
-		obj = pdf_dict_gets(attrs, "CS");
+		obj = pdf_dict_gets(dict, "Group");
 		if (obj)
 		{
-			form->colorspace = pdf_load_colorspace(xref, obj);
-			if (!form->colorspace)
-				fz_throw(ctx, "cannot load xobject colorspace");
+			pdf_obj *attrs = obj;
+
+			form->isolated = pdf_to_bool(pdf_dict_gets(attrs, "I"));
+			form->knockout = pdf_to_bool(pdf_dict_gets(attrs, "K"));
+	
+			obj = pdf_dict_gets(attrs, "S");
+			if (pdf_is_name(obj) && !strcmp(pdf_to_name(obj), "Transparency"))
+				form->transparency = 1;
+
+			obj = pdf_dict_gets(attrs, "CS");
+			if (obj)
+			{
+				form->colorspace = pdf_load_colorspace(xref, obj);
+				if (!form->colorspace)
+					fz_throw(ctx, "cannot load xobject colorspace");
+			}
 		}
-	}
 
-	form->resources = pdf_dict_gets(dict, "Resources");
-	if (form->resources)
-		pdf_keep_obj(form->resources);
+		form->resources = pdf_dict_gets(dict, "Resources");
+		if (form->resources)
+			pdf_keep_obj(form->resources);
 
-	fz_try(ctx)
-	{
 		form->contents = pdf_keep_obj(dict);
 	}
 	fz_catch(ctx)