Fix memory leaks in bin, type parser, core meta and debug (#6594)

Co-authored-by: Anton Kochkov <anton.kochkov@gmail.com>

librz/bin/format/mach0/mach0.c

@@ -1872,6 +1872,9 @@ void *MACH0_(mach0_free)(struct MACH0_(obj_t) * mo) {
 	rz_skiplist_free(mo->relocs);
 	rz_hash_free(mo->hash);
 	rz_buf_free(mo->b);
+	rz_buf_free(mo->buf_patched);
+	rz_pvector_free(mo->sections_cache);
+	sdb_free(mo->kv);
 	free(mo);
 	return NULL;
 }
@@ -2449,7 +2452,7 @@ static int walk_exports(struct MACH0_(obj_t) * bin, ExportsIterator iterator, vo
 			goto beach;
 		}
 		if (state->i == child_count) {
-			rz_list_pop(states);
+			free(rz_list_pop(states));
 			continue;
 		}
 		if (!state->next_child) {

librz/bin/p/bin_mach0.inc

@@ -137,6 +137,7 @@ static void process_constructors(RzBinFile *bf, RzPVector /*<RzBinAddr *>*/ *ret
 			free(buf);
 		}
 	}
+	rz_pvector_free(secs);
 }
 
 static RzPVector /*<RzBinAddr *>*/ *mach0_entries(RzBinFile *bf) {

librz/core/cmd/cmd_debug.c

@@ -1592,7 +1592,7 @@ RZ_IPI void rz_core_debug_bp_add(RzCore *core, ut64 addr, const char *arg_perm,
 			rz_bp_item_set_name(bpi, name);
 			free(name);
 		} else {
-			bpi->name = rz_str_dup(f->name);
+			rz_bp_item_set_name(bpi, f->name);
 		}
 	} else {
 		char *name = rz_str_newf("0x%08" PFMT64x, addr);

librz/core/cmeta.c

@@ -396,6 +396,13 @@ static bool meta_string_guess_add(RzCore *core, ut64 addr, size_t limit, char **
 		return false;
 	}
 	*ds = rz_list_first_val(str_list);
+	RzListIter *it;
+	RzDetectedString *s;
+	rz_list_foreach (str_list, it, s) {
+		if (s != *ds) {
+			rz_detected_string_free(s);
+		}
+	}
 	rz_list_free(str_list);
 	rz_str_ncpy(name, (*ds)->string, limit);
 	name[limit] = '\0';
@@ -434,6 +441,7 @@ RZ_API bool rz_core_meta_string_add(RzCore *core, ut64 addr, ut64 size, RzStrEnc
 		}
 		encoding = ds->encoding;
 		n = ds->size;
+		rz_detected_string_free(ds);
 	}
 	if (!name) {
 		result = rz_meta_set_with_subtype(core->analysis, RZ_META_TYPE_STRING, encoding, addr, n, guessname);

librz/type/parser/types_parser.c

@@ -1212,6 +1212,9 @@ int parse_typedef_node(CParserState *state, TSNode node, const char *text, Parse
 		}
 		// If parsing successfull completed - we store the state
 		if (typedef_pair) {
+			// c_parser_new_typedef() may seed btype->type with a placeholder
+			// identifier; release it before overwriting with the resolved type.
+			rz_type_free(typedef_pair->btype->type);
 			typedef_pair->btype->type = rz_type_clone(type_pair->type);
 			parser_debug(state, "storing typedef \"%s\" -> \"%s\"\n", typedef_name, base_type_name);
 			c_parser_base_type_store(state, typedef_name, typedef_pair);
@@ -1222,9 +1225,16 @@ int parse_typedef_node(CParserState *state, TSNode node, const char *text, Parse
 		}
 		// FIXME: We should return multiple types at once
 		*tpair = typedef_pair;
+		// c_parser_new_typedef()/c_parser_base_type_store() copy the name, so the
+		// declarator string extracted above can be released each iteration.
+		free(typedef_name);
 		typedef_declarator = ts_node_next_named_sibling(typedef_declarator);
 	} while (!ts_node_is_null(typedef_declarator) && is_type_declarator(ts_node_type(typedef_declarator)));
 
+	// The underlying type pair was only needed to derive the typedef target; its
+	// RzBaseType is owned by the parser state, so drop the wrapper and its RzType.
+	rz_type_free(type_pair->type);
+	free(type_pair);
 	return 0;
 }