Alex Henrie : wineusb: Fix memory leaks on error paths in usb_submit_urb (scan-build).

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 9e3f1a15066c78010a5d17be3fdefa612549d117
URL:    https://gitlab.winehq.org/wine/wine/-/commit/9e3f1a15066c78010a5d17be3fdefa6...

Author: Alex Henrie 
Date:   Tue Jun  6 00:02:12 2023 -0600

wineusb: Fix memory leaks on error paths in usb_submit_urb (scan-build).

---

dlls/wineusb.sys/unixlib.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/dlls/wineusb.sys/unixlib.c b/dlls/wineusb.sys/unixlib.c
index 8116e46c67c..95220dd3828 100644
--- a/dlls/wineusb.sys/unixlib.c
+++ b/dlls/wineusb.sys/unixlib.c
@@ -449,7 +449,10 @@ static NTSTATUS usb_submit_urb(void *args)
             transfer_ctx->transfer_buffer = params->transfer_buffer;

if (!(transfer = libusb_alloc_transfer(0)))
+            {
+                free(transfer_ctx);
                 return STATUS_NO_MEMORY;
+            }
             irp->Tail.Overlay.DriverContext[0] = transfer;

if (pipe.type == UsbdPipeTypeBulk)
@@ -465,6 +468,7 @@ static NTSTATUS usb_submit_urb(void *args)
             else
             {
                 WARN("Invalid pipe type %#x.\n", pipe.type);
+                free(transfer_ctx);
                 libusb_free_transfer(transfer);
                 return USBD_STATUS_INVALID_PIPE_HANDLE;
             }
@@ -489,11 +493,15 @@ static NTSTATUS usb_submit_urb(void *args)
             transfer_ctx->transfer_buffer = params->transfer_buffer;

if (!(transfer = libusb_alloc_transfer(0)))
+            {
+                free(transfer_ctx);
                 return STATUS_NO_MEMORY;
+            }
             irp->Tail.Overlay.DriverContext[0] = transfer;

if (!(buffer = malloc(sizeof(struct libusb_control_setup) + req->TransferBufferLength)))
             {
+                free(transfer_ctx);
                 libusb_free_transfer(transfer);
                 return STATUS_NO_MEMORY;
             }
@@ -549,11 +557,15 @@ static NTSTATUS usb_submit_urb(void *args)
                 FIXME("Unhandled flags %#x.\n", (int)req->TransferFlags);

if (!(transfer = libusb_alloc_transfer(0)))
+            {
+                free(transfer_ctx);
                 return STATUS_NO_MEMORY;
+            }
             irp->Tail.Overlay.DriverContext[0] = transfer;

if (!(buffer = malloc(sizeof(struct libusb_control_setup) + req->TransferBufferLength)))
             {
+                free(transfer_ctx);
                 libusb_free_transfer(transfer);
                 return STATUS_NO_MEMORY;
             }