Created attachment 124903 [details] [review]
Patch file

In the definition of function 'XGetWindowProperty', if 'reply.format' is
8, 16, or 32, 'Success' is returned. In this case, if 'reply.nItems' is zero,
Xmalloc(1) allocates 1 byte of memory to prop.

Thus at cmsProp.c:140,
 /* xgwp_ret is Success*/ 
 /* format_ret is 8, 16 or 32*/ 
 /* nitems_ret is zero */  
if (xgwp_ret != Success || format_ret == 0 || nitems_ret == 0) {
	/* the property does not exist or is of an unexpected type or
           getting window property failed */
	return(XcmsFailure);
    }

Hence, memory allocated to prop_ret should be freed.

Assumption: In function 'XGetWindowProperty', 
            'reply.nItems' can be zero when 'reply.format' is valid.