From 6f2c50e7fc23514dbaab0ecee12d88d52c23f056 Mon Sep 17 00:00:00 2001
From: John Bowler <jbowler@acm.org>
Date: Wed, 5 Nov 2014 17:11:59 -0600
Subject: [PATCH] [libpng16] Free all allocated memory in pngimage. The file
 buffer cache was left

allocated at the end of the program, harmless but it causes memory
leak reports from clang.
---
 CHANGES                     |  3 +++
 contrib/libtests/pngimage.c | 38 +++++++++++++++++++++++++++++++++++--
 2 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index 46a497455..d96b1d834 100644
--- a/CHANGES
+++ b/CHANGES
@@ -5057,6 +5057,9 @@ Version 1.6.15beta05 [November 5, 2014]
     seem to generate warnings when an unsigned value is implicitly
     converted to double. This is probably a GCC bug but this change
     avoids the issue by explicitly converting to (int) where safe.
+  Free all allocated memory in pngimage. The file buffer cache was left
+    allocated at the end of the program, harmless but it causes memory
+    leak reports from clang.
 
 Send comments/corrections/commendations to png-mng-implement at lists.sf.net
 (subscription required; visit
diff --git a/contrib/libtests/pngimage.c b/contrib/libtests/pngimage.c
index e8fad1687..957f61c3c 100644
--- a/contrib/libtests/pngimage.c
+++ b/contrib/libtests/pngimage.c
@@ -337,6 +337,9 @@ validate_T(void)
  *    In both cases the file data is held in a linked list of buffers - not all
  *    of these are in use at any time.
  */
+#define NEW(type) ((type *)malloc(sizeof (type)))
+#define DELETE(ptr) (free(ptr))
+
 struct buffer_list
 {
    struct buffer_list *next;         /* next buffer in list */
@@ -361,6 +364,25 @@ buffer_init(struct buffer *buffer)
    buffer->current = NULL;
 }
 
+static void
+buffer_destroy_list(struct buffer_list *list)
+{
+   if (list != NULL)
+   {
+      struct buffer_list *next = list->next;
+      DELETE(list);
+      buffer_destroy_list(next);
+   }
+}
+
+static void
+buffer_destroy(struct buffer *buffer)
+{
+   struct buffer_list *list = buffer->first.next;
+   buffer_init(buffer);
+   buffer_destroy_list(list);
+}
+
 #ifdef PNG_WRITE_SUPPORTED
 static void
 buffer_start_write(struct buffer *buffer)
@@ -390,8 +412,6 @@ get_buffer(png_structp pp)
    return (struct buffer*)png_get_io_ptr(pp);
 }
 
-#define NEW(type) ((type *)malloc(sizeof (type)))
-
 static struct buffer_list *
 buffer_extend(struct buffer_list *current)
 {
@@ -598,6 +618,17 @@ display_clean(struct display *dp)
    dp->results = 0; /* reset for next time */
 }
 
+static void
+display_destroy(struct display *dp)
+{
+    /* Release any memory held in the display. */
+#  ifdef PNG_WRITE_SUPPORTED
+      buffer_destroy(&dp->written_file);
+#  endif
+
+   buffer_destroy(&dp->original_file);
+}
+
 static struct display *
 get_dp(png_structp pp)
    /* The display pointer is always stored in the png_struct error pointer */
@@ -1605,6 +1636,9 @@ main(const int argc, const char * const * const argv)
          display_clean(&d);
       }
 
+      /* Release allocated memory */
+      display_destroy(&d);
+
       return errors != 0;
    }
 }