catalog: memory leak and crashes related fixes

* pj_transform() crashes on a catalog that has no matching grid
* pj_free() and pj_gc_unloadall() badly interact. No longer try to free the
  catalog object in pj_free(). That is the job of pj_gc_unloadall()
* Fix memory leaks in pj_gc_readcatalog() and pj_gc_unloadall()

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=1923

Credit to OSS Fuzz.

1 files changed, 6 insertions, 0 deletions

diff --git a/src/pj_gc_reader.c b/src/pj_gc_reader.c
index 4b54d05a..dc528b52 100644
--- a/src/pj_gc_reader.c
+++ b/src/pj_gc_reader.c
@@ -55,7 +55,10 @@ PJ_GridCatalog *pj_gc_readcatalog( projCtx ctx, const char *catalog_name )
 
     catalog = (PJ_GridCatalog *) calloc(1,sizeof(PJ_GridCatalog));
     if( !catalog )
+    {
+        pj_ctx_fclose(ctx, fid);
         return NULL;
+    }
     
     catalog->catalog_name = strdup(catalog_name);
     
@@ -82,12 +85,15 @@ PJ_GridCatalog *pj_gc_readcatalog( projCtx ctx, const char *catalog_name )
                     free( catalog->entries[i].definition );
                 free( catalog->catalog_name );
                 free( catalog );
+                pj_ctx_fclose(ctx, fid);
                 return NULL;
             }
             catalog->entries = new_entries;
         }
     }
 
+    pj_ctx_fclose(ctx, fid);
+
     return catalog;
 }