libtiff: Merge branch 'tiff2ps_fax2tiff_476' into 'master'

From 462f1f475f86417bec5baf18a9edf008f33b6770 Mon Sep 17 00:00:00 2001
From: Lee Howard <[EMAIL REDACTED]>
Date: Sat, 18 May 2024 16:17:10 +0000
Subject: [PATCH] Fix fax2ps and fax2tiff memory leaks.

Fixes #476
---
 libtiff/tif_fax3.c | 10 +++++++++-
 tools/fax2ps.c     |  5 +++++
 tools/fax2tiff.c   | 16 ++++++++++++++++
 3 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/libtiff/tif_fax3.c b/libtiff/tif_fax3.c
index 5ac5b2da..01a78473 100644
--- a/libtiff/tif_fax3.c
+++ b/libtiff/tif_fax3.c
@@ -569,7 +569,11 @@ static int Fax3SetupState(TIFF *tif)
 
       TIFFroundup and TIFFSafeMultiply return zero on integer overflow
     */
-    dsp->runs = (uint32_t *)NULL;
+    if (dsp->runs != NULL)
+    {
+        _TIFFfreeExt(tif, dsp->runs);
+        dsp->runs = (uint32_t *)NULL;
+    }
     dsp->nruns = TIFFroundup_32(rowpixels + 1, 32);
     if (needsRefLine)
     {
@@ -611,6 +615,10 @@ static int Fax3SetupState(TIFF *tif)
          * is referenced.  The reference line must
          * be initialized to be ``white'' (done elsewhere).
          */
+        if (esp->refline != NULL)
+        {
+            _TIFFfreeExt(tif, esp->refline);
+        }
         esp->refline = (unsigned char *)_TIFFmallocExt(tif, rowbytes);
         if (esp->refline == NULL)
         {
diff --git a/tools/fax2ps.c b/tools/fax2ps.c
index 5f8fe557..893e6c96 100644
--- a/tools/fax2ps.c
+++ b/tools/fax2ps.c
@@ -388,9 +388,11 @@ int main(int argc, char **argv)
                 maxline = atoi(optarg);
                 break;
             case 'h':
+                free(pages);
                 usage(EXIT_SUCCESS);
                 break;
             case '?':
+                free(pages);
                 usage(EXIT_FAILURE);
         }
     if (npages > 0)
@@ -422,6 +424,7 @@ int main(int argc, char **argv)
         if (fd == NULL)
         {
             fprintf(stderr, "Could not obtain temporary file.\n");
+            free(pages);
             exit(EXIT_FAILURE);
         }
 #if defined(HAVE_SETMODE) && defined(O_BINARY)
@@ -433,6 +436,7 @@ int main(int argc, char **argv)
             {
                 fclose(fd);
                 fprintf(stderr, "Could not copy stdin to temporary file.\n");
+                free(pages);
                 exit(EXIT_FAILURE);
             }
         }
@@ -455,6 +459,7 @@ int main(int argc, char **argv)
     printf("%%%%Pages: %u\n", totalPages);
     printf("%%%%EOF\n");
 
+    free(pages);
     return (EXIT_SUCCESS);
 }
 
diff --git a/tools/fax2tiff.c b/tools/fax2tiff.c
index 645931c1..52ed097a 100644
--- a/tools/fax2tiff.c
+++ b/tools/fax2tiff.c
@@ -238,6 +238,11 @@ int main(int argc, char *argv[])
     refbuf = _TIFFmalloc(TIFFhowmany8(xsize));
     if (rowbuf == NULL || refbuf == NULL)
     {
+        TIFFClose(out);
+        if (rowbuf)
+            _TIFFfree(rowbuf);
+        if (refbuf)
+            _TIFFfree(refbuf);
         fprintf(stderr, "%s: Not enough memory\n", argv[0]);
         return (EXIT_FAILURE);
     }
@@ -248,6 +253,11 @@ int main(int argc, char *argv[])
         if (out == NULL)
         {
             fprintf(stderr, "%s: Can not create fax.tif\n", argv[0]);
+            TIFFClose(out);
+            if (rowbuf)
+                _TIFFfree(rowbuf);
+            if (refbuf)
+                _TIFFfree(refbuf);
             return (EXIT_FAILURE);
         }
     }
@@ -261,6 +271,11 @@ int main(int argc, char *argv[])
     if (faxTIFF == NULL)
     {
         fprintf(stderr, "%s: Can not create fake input file\n", argv[0]);
+        TIFFClose(out);
+        if (rowbuf)
+            _TIFFfree(rowbuf);
+        if (refbuf)
+            _TIFFfree(refbuf);
         return (EXIT_FAILURE);
     }
     TIFFSetMode(faxTIFF, O_RDONLY);
@@ -392,6 +407,7 @@ int copyFaxFile(TIFF *tifin, TIFF *tifout)
     if (!ReadOK(tifin, tifin->tif_rawdata, tifin->tif_rawdatasize))
     {
         TIFFError(tifin->tif_name, "Read error at scanline 0");
+        _TIFFfree(tifin->tif_rawdata);
         return (0);
     }
     tifin->tif_rawcp = tifin->tif_rawdata;