3 files changed, 27 insertions, 6 deletions

diff --git a/main/editline/readline.c b/main/editline/readline.c
index 4729fa952..77827c3f9 100644
--- a/main/editline/readline.c
+++ b/main/editline/readline.c
@@ -549,6 +549,7 @@ _history_expand_command(const char *command, size_t cmdlen, char **result)
 						from = strdup(search);
 					else {
 						from = NULL;
+						free(line);
 						return (-1);
 					}
 				}
@@ -609,8 +610,13 @@ _history_expand_command(const char *command, size_t cmdlen, char **result)
 		end = max - ((end < -1) ? 1 : 0);
 
 	/* check boundaries ... */
-	if (start > max || end > max || start > end)
+	if (start > max || end > max || start > end) {
+		for (i = 0; i <= max; i++) {
+			free(arr[i]);
+		}
+		free(arr), arr = (char **) NULL;
 		return (-1);
+	}
 
 	for (i = 0; i <= max; i++) {
 		char *temp;
diff --git a/main/editline/term.c b/main/editline/term.c
index fb627cabb..63cec6e43 100644
--- a/main/editline/term.c
+++ b/main/editline/term.c
@@ -472,7 +472,7 @@ term_rebuffer_display(EditLine *el)
 private int
 term_alloc_display(EditLine *el)
 {
-	int i;
+	int i, j;
 	char **b;
 	coord_t *c = &el->el_term.t_size;
 
@@ -481,8 +481,13 @@ term_alloc_display(EditLine *el)
 		return (-1);
 	for (i = 0; i < c->v; i++) {
 		b[i] = (char *) el_malloc((size_t) (sizeof(char) * (c->h + 1)));
-		if (b[i] == NULL)
+		if (b[i] == NULL) {
+			for (j = 0; j < i; j++) {
+				el_free(b[j]);
+			}
+			el_free(b);
 			return (-1);
+		}
 	}
 	b[c->v] = NULL;
 	el->el_display = b;
@@ -492,8 +497,13 @@ term_alloc_display(EditLine *el)
 		return (-1);
 	for (i = 0; i < c->v; i++) {
 		b[i] = (char *) el_malloc((size_t) (sizeof(char) * (c->h + 1)));
-		if (b[i] == NULL)
+		if (b[i] == NULL) {
+			for (j = 0; j < i; j++) {
+				el_free(b[j]);
+			}
+			el_free(b);
 			return (-1);
+		}
 	}
 	b[c->v] = NULL;
 	el->el_vdisplay = b;
diff --git a/main/editline/tokenizer.c b/main/editline/tokenizer.c
index f0de39bc9..67398c686 100644
--- a/main/editline/tokenizer.c
+++ b/main/editline/tokenizer.c
@@ -113,12 +113,17 @@ tok_init(const char *ifs)
 	tok->argc = 0;
 	tok->amax = AINCR;
 	tok->argv = (char **) tok_malloc(sizeof(char *) * tok->amax);
-	if (tok->argv == NULL)
+	if (tok->argv == NULL) {
+		tok_free(tok);
 		return (NULL);
+	}
 	tok->argv[0] = NULL;
 	tok->wspace = (char *) tok_malloc(WINCR);
-	if (tok->wspace == NULL)
+	if (tok->wspace == NULL) {
+		tok_free(tok->argv);
+		tok_free(tok);
 		return (NULL);
+	}
 	tok->wmax = tok->wspace + WINCR;
 	tok->wstart = tok->wspace;
 	tok->wptr = tok->wspace;