Bug 690607

ws = jbig2_word_stream_buf_new(ctx, segment_data + offset, segment->data_length
- offset); allocated in jbig2_parse_text_region is not always freed. The code
clears ws after passing it to jbig2_arith_new() apparently assuming it doesn't
need to be freed in this case, but jbig2_arith_new() doesn't take ownership of
this memory so it still needs to be freed. It's consistent with how other places
in the code deal with jbig2_word_stream_buf_new() and jbig2_arith_new().

This patch fixes it:


Index: jbig2_text.c
===================================================================
--- jbig2_text.c        (revision 1236)
+++ jbig2_text.c        (working copy)
@@ -686,7 +686,6 @@
        }
 
        as = jbig2_arith_new(ctx, ws);
-       ws = 0;
 
         params.IADT = jbig2_arith_int_ctx_new(ctx);
         params.IAFS = jbig2_arith_int_ctx_new(ctx);
@@ -733,8 +732,8 @@
        jbig2_arith_int_ctx_free(ctx, params.IARDX);
        jbig2_arith_int_ctx_free(ctx, params.IARDY);
        jbig2_free(ctx->allocator, as);
-       jbig2_word_stream_buf_free(ctx, ws);
     }
+    jbig2_word_stream_buf_free(ctx, ws);
 
     jbig2_free(ctx->allocator, dicts);