ws = jbig2_word_stream_buf_new(ctx, segment_data + offset, segment->data_length - offset); allocated in jbig2_parse_text_region is not always freed. The code clears ws after passing it to jbig2_arith_new() apparently assuming it doesn't need to be freed in this case, but jbig2_arith_new() doesn't take ownership of this memory so it still needs to be freed. It's consistent with how other places in the code deal with jbig2_word_stream_buf_new() and jbig2_arith_new(). This patch fixes it: Index: jbig2_text.c =================================================================== --- jbig2_text.c (revision 1236) +++ jbig2_text.c (working copy) @@ -686,7 +686,6 @@ } as = jbig2_arith_new(ctx, ws); - ws = 0; params.IADT = jbig2_arith_int_ctx_new(ctx); params.IAFS = jbig2_arith_int_ctx_new(ctx); @@ -733,8 +732,8 @@ jbig2_arith_int_ctx_free(ctx, params.IARDX); jbig2_arith_int_ctx_free(ctx, params.IARDY); jbig2_free(ctx->allocator, as); - jbig2_word_stream_buf_free(ctx, ws); } + jbig2_word_stream_buf_free(ctx, ws); jbig2_free(ctx->allocator, dicts);
*** This bug has been marked as a duplicate of bug 690596 ***