From e32a9a61f6364fa58c9f7f1f7985652819f5ac80 Mon Sep 17 00:00:00 2001
From: Max Kellermann <max.kellermann@gmail.com>
Date: Fri, 21 Feb 2020 18:52:12 +0100
Subject: [PATCH] Func: fix memory leaks in check_built_in_call()

All error branches leak the `fmt_str_arg->Eval(0)` return value.
---
 src/Func.cc | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/Func.cc b/src/Func.cc
index cd5062af9b..3b385b11f5 100644
--- a/src/Func.cc
+++ b/src/Func.cc
@@ -828,6 +828,7 @@ bool check_built_in_call(BuiltinFunc* f, CallExpr* call)
 
 			if ( ! *fmt_str )
 				{
+				Unref(fmt_str_val);
 				call->Error("format string ends with bare '%'");
 				return false;
 				}
@@ -839,11 +840,13 @@ bool check_built_in_call(BuiltinFunc* f, CallExpr* call)
 
 		if ( args.length() != num_fmt + 1 )
 			{
+			Unref(fmt_str_val);
 			call->Error("mismatch between format string to fmt() and number of arguments passed");
 			return false;
 			}
 		}
 
+	Unref(fmt_str_val);
 	return true;
 	}