From dbef8e6c2bdd57e9a7b71babd4d8421d7d500c1b Mon Sep 17 00:00:00 2001
From: Nimrod Gileadi <nimrod@google.com>
Date: Fri, 1 Jul 2022 05:21:09 -0700
Subject: [PATCH] Fix memory leaks when loading an invalid model from MJB.

PiperOrigin-RevId: 458445745
Change-Id: I99229a66fc86f7763cfe2b5382229b0304bdfa9c
---
 src/engine/engine_io.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/engine/engine_io.c b/src/engine/engine_io.c
index 41fe9372..e40a7a45 100644
--- a/src/engine/engine_io.c
+++ b/src/engine/engine_io.c
@@ -669,14 +669,17 @@ mjModel* mj_loadModel(const char* filename, const mjVFS* vfs) {
   if (fp) {
     if (fread((void*)&m->opt, sizeof(mjOption), 1, fp) != 1) {
       mju_warning("Model file does not have a complete mjOption");
+      mj_deleteModel(m);
       return 0;
     }
     if (fread((void*)&m->vis, sizeof(mjVisual), 1, fp) != 1) {
       mju_warning("Model file does not have a complete mjVisual");
+      mj_deleteModel(m);
       return 0;
     }
     if (fread((void*)&m->stat, sizeof(mjStatistic), 1, fp) != 1) {
       mju_warning("Model file does not have a complete mjStatistic");
+      mj_deleteModel(m);
       return 0;
     }
     {
@@ -684,6 +687,7 @@ mjModel* mj_loadModel(const char* filename, const mjVFS* vfs) {
       #define X(type, name, nr, nc)                                            \
         if (fread(m->name, sizeof(type), (m->nr)*(nc), fp) != (m->nr)*(nc)) {  \
           mju_warning("Model file does not contain a large enough buffer");    \
+          mj_deleteModel(m);                                                   \
           return 0;                                                            \
         }
       MJMODEL_POINTERS