Fix leak in failure path of libusb_get_max_packet_size()

If libusb_get_max_packet_size() or libusb_get_max_iso_packet_size()
fails to find the endpoint, it leaks the configuration descriptor.  Fix
this.

Signed-off-by: John Sheu <sheu@google.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>

diff --git a/libusb/core.c b/libusb/core.c
index 7af20ce..f3d7ece 100644 (file)
--- a/libusb/core.c
+++ b/libusb/core.c
@@ -899,10 +899,14 @@ int API_EXPORTED libusb_get_max_packet_size(libusb_device *dev,
        }
 
        ep = find_endpoint(config, endpoint);
-       if (!ep)
-               return LIBUSB_ERROR_NOT_FOUND;
+       if (!ep) {
+               r = LIBUSB_ERROR_NOT_FOUND;
+               goto out;
+       }
 
        r = ep->wMaxPacketSize;
+
+out:
        libusb_free_config_descriptor(config);
        return r;
 }
@@ -950,17 +954,21 @@ int API_EXPORTED libusb_get_max_iso_packet_size(libusb_device *dev,
        }
 
        ep = find_endpoint(config, endpoint);
-       if (!ep)
-               return LIBUSB_ERROR_NOT_FOUND;
+       if (!ep) {
+               r = LIBUSB_ERROR_NOT_FOUND;
+               goto out;
+       }
 
        val = ep->wMaxPacketSize;
        ep_type = (enum libusb_transfer_type) (ep->bmAttributes & 0x3);
-       libusb_free_config_descriptor(config);
 
        r = val & 0x07ff;
        if (ep_type == LIBUSB_TRANSFER_TYPE_ISOCHRONOUS
                        || ep_type == LIBUSB_TRANSFER_TYPE_INTERRUPT)
                r *= (1 + ((val >> 11) & 3));
+
+out:
+       libusb_free_config_descriptor(config);
        return r;
 }