Fix memory leaks caught by clang’s scan-build