Fix memory leaks, reported by Huihui Huang in GitHub issue 4872.

cmd-display-menu.c

@@ -394,7 +394,7 @@ cmd_display_popup_exec(struct cmd *self, struct cmdq_item *item)
 	const char		*style = args_get(args, 's');
 	const char		*border_style = args_get(args, 'S');
 	char			*cwd = NULL, *cause = NULL, **argv = NULL;
-	char			*title;
+	char			*title = NULL;
 	int			 modify = popup_present(tc);
 	int			 flags = -1, argc = 0;
 	enum box_lines		 lines = BOX_LINES_DEFAULT;
@@ -418,8 +418,7 @@ cmd_display_popup_exec(struct cmd *self, struct cmdq_item *item)
 			    &cause);
 			if (cause != NULL) {
 				cmdq_error(item, "height %s", cause);
-				free(cause);
-				return (CMD_RETURN_ERROR);
+				goto fail;
 			}
 		}
 
@@ -429,8 +428,7 @@ cmd_display_popup_exec(struct cmd *self, struct cmdq_item *item)
 			    &cause);
 			if (cause != NULL) {
 				cmdq_error(item, "width %s", cause);
-				free(cause);
-				return (CMD_RETURN_ERROR);
+				goto fail;
 			}
 		}
 
@@ -439,7 +437,7 @@ cmd_display_popup_exec(struct cmd *self, struct cmdq_item *item)
 		if (h > tty->sy)
 			h = tty->sy;
 		if (!cmd_display_menu_get_pos(tc, item, args, &px, &py, w, h))
-			return (CMD_RETURN_NORMAL);
+			goto out;
 
 		value = args_get(args, 'd');
 		if (value != NULL)
@@ -479,8 +477,7 @@ cmd_display_popup_exec(struct cmd *self, struct cmdq_item *item)
 		    &cause);
 		if (cause != NULL) {
 			cmdq_error(item, "popup-border-lines %s", cause);
-			free(cause);
-			return (CMD_RETURN_ERROR);
+			goto fail;
 		}
 	}
 
@@ -508,22 +505,29 @@ cmd_display_popup_exec(struct cmd *self, struct cmdq_item *item)
 
 	if (modify) {
 		popup_modify(tc, title, style, border_style, lines, flags);
-		free(title);
-		return (CMD_RETURN_NORMAL);
+		goto out;
 	}
 	if (popup_display(flags, lines, item, px, py, w, h, env, shellcmd, argc,
-	    argv, cwd, title, tc, s, style, border_style, NULL, NULL) != 0) {
-		cmd_free_argv(argc, argv);
-		if (env != NULL)
-			environ_free(env);
-		free(cwd);
-		free(title);
-		return (CMD_RETURN_NORMAL);
-	}
-	if (env != NULL)
-		environ_free(env);
+	    argv, cwd, title, tc, s, style, border_style, NULL, NULL) != 0)
+		goto out;
+	environ_free(env);
 	free(cwd);
 	free(title);
 	cmd_free_argv(argc, argv);
 	return (CMD_RETURN_WAIT);
+
+out:
+	cmd_free_argv(argc, argv);
+	environ_free(env);
+	free(cwd);
+	free(title);
+	return (CMD_RETURN_NORMAL);
+
+fail:
+	free(cause);
+	cmd_free_argv(argc, argv);
+	environ_free(env);
+	free(cwd);
+	free(title);
+	return (CMD_RETURN_ERROR);
 }

environ.c

@@ -57,6 +57,9 @@ environ_free(struct environ *env)
 {
 	struct environ_entry	*envent, *envent1;
 
+	if (env == NULL)
+		return;
+
 	RB_FOREACH_SAFE(envent, environ, env, envent1) {
 		RB_REMOVE(environ, env, envent);
 		free(envent->name);