Esme Povirk (@madewokherd) commented about dlls/windowscodecs/pngformat.c:
else
{
BYTE *ptr = data;
for (int i = 0; i < value.caui.cElems; ++i, ptr += 2)
value.caui.pElems[i] = read_ushort_be(ptr);
}
- }
- else
- {
hr = WINCODEC_ERR_BADMETADATAHEADER;
- }
- free(data);
- if (SUCCEEDED(hr))
hr = create_bkgd_item(&value, &result);
I think if this fails, it doesn't take ownership of `value`, and `value` will need to be freed.