rrproperty.c: free newly allocated prop in more error paths

Reported by parfait 1.0:

Error: Memory leak (CWE 401)
   Memory leak of pointer 'prop' allocated with RRCreateOutputProperty(property)
        at line 220 of randr/rrproperty.c in function 'RRChangeOutputProperty'.
          'prop' allocated at line 154 with RRCreateOutputProperty(property).
          prop leaks when pending != 0 at line 160.
Error: Memory leak (CWE 401)
   Memory leak of pointer 'prop' allocated with RRCreateOutputProperty(property)
        at line 346 of randr/rrproperty.c in function 'RRConfigureOutputProperty'.
          'prop' allocated at line 334 with RRCreateOutputProperty(property).
        at line 350 of randr/rrproperty.c in function 'RRConfigureOutputProperty'.
          'prop' allocated at line 334 with RRCreateOutputProperty(property).

Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Keith Packard <keithp@keithp.com>

1 files changed, 10 insertions, 2 deletions

diff --git a/randr/rrproperty.c b/randr/rrproperty.c
index 7f0909287..67b546728 100644
--- a/randr/rrproperty.c
+++ b/randr/rrproperty.c
@@ -217,6 +217,8 @@ RRChangeOutputProperty(RROutputPtr output, Atom property, Atom type,
             !pScrPriv->rrOutputSetProperty(output->pScreen, output,
                                            prop->propertyName, &new_value)) {
             free(new_value.data);
+            if (add)
+                RRDestroyOutputProperty(prop);
             return BadValue;
         }
         free(prop_value->data);
@@ -342,12 +344,18 @@ RRConfigureOutputProperty(RROutputPtr output, Atom property,
     /*
      * ranges must have even number of values
      */
-    if (range && (num_values & 1))
+    if (range && (num_values & 1)) {
+        if (add)
+            RRDestroyOutputProperty(prop);
         return BadMatch;
+    }
 
     new_values = malloc(num_values * sizeof(INT32));
-    if (!new_values && num_values)
+    if (!new_values && num_values) {
+        if (add)
+            RRDestroyOutputProperty(prop);
         return BadAlloc;
+    }
     if (num_values)
         memcpy(new_values, values, num_values * sizeof(INT32));