Leak in Load_SBit_Png on malformed png.
Migrated from: [SAVANNAH-59322]
bungeman reported:
With FreeType at 6a2b3e40 the attached file causes a leak in Load_SBit_Png. The issue is that 'rows' is allocated but will not be freed in the event that the call to 'png_read_image' fails and calls 'longjmp'. The opportunistic 'FT_FREE( rows )' which exists is fine, but it will also need to be freed in the 'DestroyExit:' section.
diff --git a/src/sfnt/pngshim.c b/src/sfnt/pngshim.c
index f550161..d4e43a9 100644
--- a/src/sfnt/pngshim.c
+++ b/src/sfnt/pngshim.c
@@ -443,6 +443,7 @@
png_read_end( png, info ),
DestroyExit:
+ FT_FREE( rows ),
png_destroy_read_struct( &png, &info, NULL ),
FT_Stream_Close( &stream ),