Fix possible memory leaks.

Thanks to Johann Haarhoff.

src/subs.c

@@ -219,6 +219,20 @@ cleanup:
 	return 1;
 }
 
+static void _sub_topic_tokens_free(struct _sub_token *tokens)
+{
+	struct _sub_token *tail;
+
+	while(tokens){
+		tail = tokens->next;
+		if(tokens->topic){
+			_mosquitto_free(tokens->topic);
+		}
+		_mosquitto_free(tokens);
+		tokens = tail;
+	}
+}
+
 static int _sub_add(struct mosquitto_db *db, struct mosquitto *context, int qos, struct _mosquitto_subhier *subhier, struct _sub_token *tokens)
 {
 	struct _mosquitto_subhier *branch, *last = NULL;
@@ -369,7 +383,7 @@ int mqtt3_sub_add(struct mosquitto_db *db, struct mosquitto *context, const char
 {
 	int rc = 0;
 	struct _mosquitto_subhier *subhier, *child;
-	struct _sub_token *tokens = NULL, *tail;
+	struct _sub_token *tokens = NULL;
 
 	assert(root);
 	assert(sub);
@@ -387,11 +401,13 @@ int mqtt3_sub_add(struct mosquitto_db *db, struct mosquitto *context, const char
 	if(!subhier){
 		child = _mosquitto_malloc(sizeof(struct _mosquitto_subhier));
 		if(!child){
+			_sub_topic_tokens_free(tokens);
 			_mosquitto_log_printf(NULL, MOSQ_LOG_ERR, "Error: Out of memory.");
 			return MOSQ_ERR_NOMEM;
 		}
 		child->topic = _mosquitto_strdup(tokens->topic);
 		if(!child->topic){
+			_sub_topic_tokens_free(tokens);
 			_mosquitto_log_printf(NULL, MOSQ_LOG_ERR, "Error: Out of memory.");
 			return MOSQ_ERR_NOMEM;
 		}
@@ -408,12 +424,8 @@ int mqtt3_sub_add(struct mosquitto_db *db, struct mosquitto *context, const char
 		rc = _sub_add(db, context, qos, child, tokens);
 	}
 
-	while(tokens){
-		tail = tokens->next;
-		_mosquitto_free(tokens->topic);
-		_mosquitto_free(tokens);
-		tokens = tail;
-	}
+	_sub_topic_tokens_free(tokens);
+
 	/* We aren't worried about -1 (already subscribed) return codes. */
 	if(rc == -1) rc = MOSQ_ERR_SUCCESS;
 	return rc;
@@ -423,7 +435,7 @@ int mqtt3_sub_remove(struct mosquitto_db *db, struct mosquitto *context, const c
 {
 	int rc = 0;
 	struct _mosquitto_subhier *subhier;
-	struct _sub_token *tokens = NULL, *tail;
+	struct _sub_token *tokens = NULL;
 
 	assert(root);
 	assert(sub);
@@ -439,12 +451,7 @@ int mqtt3_sub_remove(struct mosquitto_db *db, struct mosquitto *context, const c
 		subhier = subhier->next;
 	}
 
-	while(tokens){
-		tail = tokens->next;
-		_mosquitto_free(tokens->topic);
-		_mosquitto_free(tokens);
-		tokens = tail;
-	}
+	_sub_topic_tokens_free(tokens);
 
 	return rc;
 }
@@ -453,7 +460,7 @@ int mqtt3_db_messages_queue(struct mosquitto_db *db, const char *source_id, cons
 {
 	int rc = 0;
 	struct _mosquitto_subhier *subhier;
-	struct _sub_token *tokens = NULL, *tail;
+	struct _sub_token *tokens = NULL;
 
 	assert(db);
 	assert(topic);
@@ -473,12 +480,7 @@ int mqtt3_db_messages_queue(struct mosquitto_db *db, const char *source_id, cons
 		}
 		subhier = subhier->next;
 	}
-	while(tokens){
-		tail = tokens->next;
-		_mosquitto_free(tokens->topic);
-		_mosquitto_free(tokens);
-		tokens = tail;
-	}
+	_sub_topic_tokens_free(tokens);
 
 	return rc;
 }