NXrender.c, render.c: fix memory handling bugs

nx-X11/programs/Xserver/hw/nxagent/NXrender.c

@@ -1001,6 +1001,7 @@ ProcRenderCompositeGlyphs (ClientPtr client)
 	listsBase = (GlyphListPtr) malloc (nlist * sizeof (GlyphListRec));
 	if (!listsBase)
 	{
+	    if (glyphsBase != glyphsLocal)
 		free(glyphsBase);
 	    return BadAlloc;
 	}
@@ -1009,7 +1010,9 @@ ProcRenderCompositeGlyphs (ClientPtr client)
     elementsBase = malloc(nlist * sizeof(XGlyphElt8));
     if (!elementsBase)
     {
+	if (glyphsBase != glyphsLocal)
 	    free(glyphsBase);
+	if (listsBase != listsLocal)
 	    free(listsBase);
 	return BadAlloc;
     }
@@ -1044,6 +1047,9 @@ ProcRenderCompositeGlyphs (ClientPtr client)
 			free (glyphsBase);
 		    if (listsBase != listsLocal)
 			free (listsBase);
+#ifdef NXAGENT_SERVER
+		    free(elementsBase);
+#endif
 		    return RenderErrBase + BadGlyphSet;
 		}
 	    }
@@ -1101,7 +1107,16 @@ ProcRenderCompositeGlyphs (ClientPtr client)
 	}
     }
     if (buffer > end)
+    {
+	if (glyphsBase != glyphsLocal)
+	    free(glyphsBase);
+	if (listsBase != listsLocal)
+	    free(listsBase);
+#ifdef NXAGENT_SERVER
+	free(elementsBase);
+#endif
 	return BadLength;
+    }
 
     /*
      * We need to know the glyphs extents to synchronize

nx-X11/programs/Xserver/render/render.c

@@ -1347,9 +1347,8 @@ ProcRenderCompositeGlyphs (ClientPtr client)
 	listsBase = (GlyphListPtr) malloc (nlist * sizeof (GlyphListRec));
 	if (!listsBase)
 	{
+	    if (glyphsBase != glyphsLocal)
 	        free(glyphsBase);
-	    free(listsBase);
-
 	    return BadAlloc;
 	}
     }
@@ -1417,8 +1416,13 @@ ProcRenderCompositeGlyphs (ClientPtr client)
 	}
     }
     if (buffer > end)
+    {
+	if (glyphsBase != glyphsLocal)
+	    free(glyphsBase);
+	if (listsBase != listsLocal)
+	    free(listsBase);
 	return BadLength;
-
+    }
     CompositeGlyphs (stuff->op,
 		     pSrc,
 		     pDst,