Various memory leak fixes.

In error cases, ensure we free objects correctly. Thanks to Zeniko
for finding the problems (and many of the solutions!)

2 files changed, 50 insertions, 28 deletions

diff --git a/xps/xps_doc.c b/xps/xps_doc.c
index b7bba194..c01b7561 100644
--- a/xps/xps_doc.c
+++ b/xps/xps_doc.c
@@ -159,6 +159,7 @@ xps_free_fixed_documents(xps_document *doc)
 	{
 		xps_fixdoc *next = fixdoc->next;
 		fz_free(doc->ctx, fixdoc->name);
+		fz_free(doc->ctx, fixdoc->outline);
 		fz_free(doc->ctx, fixdoc);
 		fixdoc = next;
 	}
diff --git a/xps/xps_png.c b/xps/xps_png.c
index 4ed9f121..f938c1bc 100644
--- a/xps/xps_png.c
+++ b/xps/xps_png.c
@@ -397,7 +397,7 @@ png_read_image(fz_context *ctx, struct info *info, unsigned char *p, int total)
 		info->size = passofs[7];
 	}
 
-	info->samples = fz_malloc(info->ctx, info->size);
+	info->samples = fz_malloc(ctx, info->size);
 
 	stm.zalloc = zalloc;
 	stm.zfree = zfree;
@@ -408,42 +408,63 @@ png_read_image(fz_context *ctx, struct info *info, unsigned char *p, int total)
 
 	code = inflateInit(&stm);
 	if (code != Z_OK)
-		fz_throw(info->ctx, "zlib error: %s", stm.msg);
-
-	/* Read remaining chunks until IEND */
-
-	while (total > 8)
 	{
-		size = getint(p);
-
-		if (size + 12 > total)
-			fz_throw(info->ctx, "premature end of data in png image");
-
-		if (!memcmp(p + 4, "PLTE", 4))
-			png_read_plte(info, p + 8, size);
-		if (!memcmp(p + 4, "tRNS", 4))
-			png_read_trns(info, p + 8, size);
-		if (!memcmp(p + 4, "pHYs", 4))
-			png_read_phys(info, p + 8, size);
-		if (!memcmp(p + 4, "IDAT", 4))
-			png_read_idat(info, p + 8, size, &stm);
-		if (!memcmp(p + 4, "IEND", 4))
-			break;
+		fz_free(ctx, info->samples);
+		fz_throw(ctx, "zlib error: %s", stm.msg);
+	}
 
-		p += size + 12;
-		total -= size + 12;
+	fz_try(ctx)
+	{
+		/* Read remaining chunks until IEND */
+		while (total > 8)
+		{
+			size = getint(p);
+
+			if (size + 12 > total)
+				fz_throw(info->ctx, "premature end of data in png image");
+
+			if (!memcmp(p + 4, "PLTE", 4))
+				png_read_plte(info, p + 8, size);
+			if (!memcmp(p + 4, "tRNS", 4))
+				png_read_trns(info, p + 8, size);
+			if (!memcmp(p + 4, "pHYs", 4))
+				png_read_phys(info, p + 8, size);
+			if (!memcmp(p + 4, "IDAT", 4))
+				png_read_idat(info, p + 8, size, &stm);
+			if (!memcmp(p + 4, "IEND", 4))
+				break;
+
+			p += size + 12;
+			total -= size + 12;
+		}
+	}
+	fz_catch(ctx)
+	{
+		inflateEnd(&stm);
+		fz_free(ctx, info->samples);
+		fz_rethrow(ctx);
 	}
 
 	code = inflateEnd(&stm);
 	if (code != Z_OK)
+	{
+		fz_free(ctx, info->samples);
 		fz_throw(info->ctx, "zlib error: %s", stm.msg);
+	}
 
 	/* Apply prediction filter and deinterlacing */
-
-	if (!info->interlace)
-		png_predict(info->samples, info->width, info->height, info->n, info->depth);
-	else
-		png_deinterlace(info, passw, passh, passofs);
+	fz_try(ctx)
+	{
+		if (!info->interlace)
+			png_predict(info->samples, info->width, info->height, info->n, info->depth);
+		else
+			png_deinterlace(info, passw, passh, passofs);
+	}
+	fz_catch(ctx)
+	{
+		fz_free(ctx, info->samples);
+		fz_rethrow(ctx);
+	}
 }
 
 static fz_pixmap *