sna/io: Free the heap clip boxes on error paths

Reported-by: Zdenek Kabelac <zkabelac@redhat.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

1 files changed, 6 insertions, 1 deletions

diff --git a/src/sna/sna_io.c b/src/sna/sna_io.c
index 3f39de50..0d6fbbbc 100644
--- a/src/sna/sna_io.c
+++ b/src/sna/sna_io.c
@@ -261,14 +261,19 @@ fallback:
 								       tmp.drawable.bitsPerPixel,
 								       KGEM_BUFFER_LAST,
 								       &ptr);
-					if (!dst_bo)
+					if (!dst_bo) {
+						if (clipped != stack)
+							free(clipped);
 						goto fallback;
+					}
 
 					if (!sna->render.copy_boxes(sna, GXcopy,
 								    dst, src_bo, src_dx, src_dy,
 								    &tmp, dst_bo, -tile.x1, -tile.y1,
 								    clipped, c-clipped)) {
 						kgem_bo_destroy(&sna->kgem, dst_bo);
+						if (clipped != stack)
+							free(clipped);
 						goto fallback;
 					}