[libpng16] Stop memory leak when returning from png_handle_eXIf() with an error

(Bug report from the OSS-fuzz project).

1 files changed, 5 insertions, 1 deletions

diff --git a/pngset.c b/pngset.c
index d62ac43b7..55a0e5c91 100644
--- a/pngset.c
+++ b/pngset.c
@@ -146,7 +146,11 @@ png_set_eXIf_1(png_const_structrp png_ptr, png_inforp info_ptr,
    if (png_ptr == NULL || info_ptr == NULL)
       return;
 
-   png_free_data(png_ptr, info_ptr, PNG_FREE_EXIF, 0);
+   if (info_ptr->exif)
+   {
+      png_free(png_ptr, info_ptr->exif);
+      info_ptr->exif = NULL;
+   }
 
    info_ptr->num_exif = num_exif;