Bug 27606

492 static void
 493 write_extensions (int fd, uint32_t str_offset,
 494                   uint32_t cache_extension_offset)
 495 {
 496   assert ((cache_extension_offset % 4) == 0);
 497 
 498   /* The length and contents of the glibc-hwcaps section.  */
 499   uint32_t hwcaps_count = glibc_hwcaps_count ();
 500   uint32_t hwcaps_offset = cache_extension_offset + cache_extension_size;
 501   uint32_t hwcaps_size = hwcaps_count * sizeof (uint32_t);
 502   uint32_t *hwcaps_array = xmalloc (hwcaps_size);

We allocate hwcaps_array.

 545   if (write (fd, ext, ext_size) != ext_size
 546       || write (fd, hwcaps_array, hwcaps_size) != hwcaps_size
 547       || write (fd, generator, strlen (generator)) != strlen (generator))
 548     error (EXIT_FAILURE, errno, _("Writing of cache extension data failed"));
 549 
 550   free (ext);
 551 }
 552 

Then we go out of scope without freeing hwcaps_array.