Memory leak in attribute.c

Hi,
I found a memory leak in magick/attribute.c, in function
GenerateEXIFAttribute(). There is an allocation of a string:
final=AllocateString("");
but when function returns with False it is never freed.
Here's a quick fix for that problem (the patch is for yesterday snapshot):

#v+
--- attribute.c-orig	2006-01-04 18:51:50.000000000 +0100
+++ attribute.c	2006-01-04 18:52:47.000000000 +0100
@@ -1173,14 +1173,18 @@
         break;
       }
   }
-  if (index < 0)
+  if (index < 0) {
+    MagickFreeMemory(final);
     return(False);
+  }
   /*
     If EXIF data exists, then try to parse the request for a tag.
   */
   key=(char *) &specification[5];
-  if ((key == (char *) NULL) || (*key == '\0'))
+  if ((key == (char *) NULL) || (*key == '\0')) {
+    MagickFreeMemory(final);
     return(False);
+  }
   while (isspace((int) (*key)))
     key++;
   all=0;
@@ -1216,9 +1220,10 @@
       tag=0;
       key++;
       n=strlen(key);
-      if (n != 4)
+      if (n != 4) {
+        MagickFreeMemory(final);
         return(False);
-      else
+      } else
         {
           /*
             Parse tag specification as a hex number.
@@ -1238,8 +1243,10 @@
                 else
                   if ((c >= 'a') && (c <= 'f'))
                     tag|=c-('a'-10);
-                  else
+                  else {
+                    MagickFreeMemory(final);
                     return(False);
+		  }
             }
           } while (*key != '\0');
         }
@@ -1263,8 +1270,10 @@
       break;
     }
   }
-  if (tag < 0)
+  if (tag < 0) {
+    MagickFreeMemory(final);
     return(False);
+  }
   length=image->generic_profile[index].length;
   info=image->generic_profile[index].info;
   while (length != 0)
@@ -1283,8 +1292,10 @@
       continue;
     break;
   }
-  if (length < 16)
+  if (length < 16) {
+    MagickFreeMemory(final);
     return(False);
+  }
   tiffp=info;
   id=Read16u(0,tiffp);
   morder=0;
@@ -1293,16 +1304,22 @@
   else
     if (id == 0x4D4D) /* MSB */
       morder=1;
-    else
+    else {
+      MagickFreeMemory(final);
       return(False);
-  if (Read16u(morder,tiffp+2) != 0x002a)
+    }
+  if (Read16u(morder,tiffp+2) != 0x002a) {
+    MagickFreeMemory(final);
     return(False);
+  }
   /*
     This is the offset to the first IFD.
   */
   offset=Read32u(morder,tiffp+4);
-  if (offset >= length)
+  if (offset >= length) {
+    MagickFreeMemory(final);
     return(False);
+  }
   /*
     Set the pointer to the first IFD and follow it were it leads.
   */
#v-

-- 
 _  <= Michał Kowalczuk => <==== (http://)|(mailto:sammael@)sammael.pl/? ====>
( ` <= GG#2113900 => <===== who | grep -i brunette | date; cd ~; ============>
 \  /||\ /||\ /||\ |~~| <==== unzip; strip; touch; finger; mount; fsck; =====>
,_)/~|| ` || ` ||~\|~_|_   <== more; yes; fsck; fsck; fsck; umount; sleep ===>



-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_id=7637&alloc_id=16865&op=click