From 9a5217bdd4680e36f2e92838348bd4ea010d28a0 Mon Sep 17 00:00:00 2001
From: Guy Harris <guy@alum.mit.edu>
Date: Wed, 7 Mar 2018 00:49:28 -0800
Subject: [PATCH] Fix another leak, which happens with -E occurrence=l.

For each occurrence, if there was already an occurrence in the array, we
were just removing it. not freeing what it pointed to.

While we're at it, expand comments. and always check the array size with
"!= 0", not "> 0" - the value is unsigned, so they're equivalent, but
this makes the code more self-consistent.

Change-Id: I538f46b296a7721a39ba4366c2f6269e7e097b0d
Reviewed-on: https://code.wireshark.org/review/26328
Reviewed-by: Guy Harris <guy@alum.mit.edu>
---
 epan/print.c | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/epan/print.c b/epan/print.c
index 14b9a0ea52..7db68423c8 100644
--- a/epan/print.c
+++ b/epan/print.c
@@ -2334,20 +2334,36 @@ static void format_field_values(output_fields_t* fields, gpointer field_index, g
     switch (fields->occurrence) {
     case 'f':
         /* print the value of only the first occurrence of the field */
-        /* the value won't be used, free it */
         if (g_ptr_array_len(fv_p) != 0) {
+            /*
+             * This isn't the first occurrence, so the value won't be used;
+             * free it.
+             */
             g_free(value);
             return;
         }
         break;
     case 'l':
         /* print the value of only the last occurrence of the field */
-        g_ptr_array_set_size(fv_p, 0);
+        if (g_ptr_array_len(fv_p) != 0) {
+            /*
+             * This isn't the first occurrence, so there's already a
+             * value in the array, which won't be used; free the
+             * first (only) element in the array, and then remove
+             * it - this value will replace it.
+             */
+            g_free(g_ptr_array_index(fv_p, 0));
+            g_ptr_array_set_size(fv_p, 0);
+        }
         break;
     case 'a':
         /* print the value of all accurrences of the field */
-        /* If not the first, add the 'aggregator' */
-        if (g_ptr_array_len(fv_p) > 0) {
+        if (g_ptr_array_len(fv_p) != 0) {
+            /*
+             * This isn't the first occurrence. so add the "aggregator"
+             * character as a separator between the previous element
+             * and this element.
+             */
             g_ptr_array_add(fv_p, (gpointer)g_strdup_printf("%c", fields->aggregator));
         }
         break;