From 123f50acb34ef8d7482b5c61d9a149d285991ca6 Mon Sep 17 00:00:00 2001
From: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
Date: Thu, 5 Feb 2026 16:07:43 +0300
Subject: [PATCH] render: fix multiple mem leaks on err paths

Free nested allocations when initialization fails.
Several code paths returned early on error without releasing
memory owned by embedded structures, leading to leaks.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Mikhail Dmitrichenko <m.dmitrichenko222@gmail.com>
(cherry picked from commit 809402414e4b84ad5c084221c7b4da9bd2c5d55d)

Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2146>
---
 render/picture.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/render/picture.c b/render/picture.c
index d08f30a8a..c3db211b7 100644
--- a/render/picture.c
+++ b/render/picture.c
@@ -912,6 +912,7 @@ CreateLinearGradientPicture(Picture pid, xPointFixed * p1, xPointFixed * p2,
 
     initGradient(pPicture->pSourcePict, nStops, stops, colors, error);
     if (*error) {
+        free(pPicture->pSourcePict);
         free(pPicture);
         return 0;
     }
@@ -957,6 +958,7 @@ CreateRadialGradientPicture(Picture pid, xPointFixed * inner,
 
     initGradient(pPicture->pSourcePict, nStops, stops, colors, error);
     if (*error) {
+        free(pPicture->pSourcePict);
         free(pPicture);
         return 0;
     }
@@ -995,6 +997,7 @@ CreateConicalGradientPicture(Picture pid, xPointFixed * center, xFixed angle,
 
     initGradient(pPicture->pSourcePict, nStops, stops, colors, error);
     if (*error) {
+        free(pPicture->pSourcePict);
         free(pPicture);
         return 0;
     }