model: free the partially built model when reading a JSON model fails

[lusoris]

Loading any model collection with the vmaf tool leaks 2413 bytes, and a build with LeakSanitizer exits 1 although the scores are correct.

Cause

vmaf_read_json_model() (libvmaf/src/read_json_model.c) allocates the model, its feature array, its name and its knot list, then parses. When parsing fails it returns the error and leaves the half-built model in *model. No caller frees it: vmaf_model_load() and vmaf_model_load_from_path() only pass the error on.

The tool takes this path for every model collection. libvmaf/tools/vmaf.c tries a single-model read first and falls back to the collection loader when that fails, which then overwrites the pointer.

Reproducer

Debug build with -Db_sanitize=address,undefined, master 6ec23e8f2 (reproduced there; the code is unchanged in 9e48141):

./build/tools/vmaf -r src01_hrc00_576x324.yuv -d src01_hrc01_576x324.yuv -w 576 -h 324 -p 420 -b 8 \
    -m path=model/vmaf_b_v0.6.3.json --frame_cnt 2 -q --json -o out.json

Direct leak of 200 byte(s) in 1 object(s) allocated from:
    #1 vmaf_read_json_model ../libvmaf/src/read_json_model.c:449
    #2 vmaf_read_json_model_from_path ../libvmaf/src/read_json_model.c:488
    #3 vmaf_model_load_from_path ../libvmaf/src/model.c:200
    #4 main ../libvmaf/tools/vmaf.c:234
Indirect leak of 2048 byte(s) ... read_json_model.c:454
Indirect leak of 160 byte(s) ... read_json_model.c:462
Indirect leak of 5 byte(s) ... vmaf_model_generate_name model.c:185
SUMMARY: AddressSanitizer: 2413 byte(s) leaked in 4 allocation(s).

Command	master	this branch
-m version=vmaf_b_v0.6.3	exit 1, 2413 bytes in 4 allocations	exit 0
-m path=model/vmaf_b_v0.6.3.json	exit 1, 2413 bytes in 4 allocations	exit 0
new test_model case, no sanitizer	fails: "a failed read handed back a partially built model"	8/8 pass

Fix

On failure, vmaf_read_json_model() destroys the model with vmaf_model_destroy() and resets *model to NULL. A successful read is unchanged. The allocation and parse steps move into a helper so there is one cleanup point.

Validation

x86-64 Linux, GCC 16.2.1, Meson 1.12.1, on master 9e48141b. Rebased on master 9e48141 (2026-10-02).

• Release build meson test (-Denable_float=true -Denable_checkasm=true): 25/25 on master, 25/25 here.
• -Db_sanitize=address,undefined -Db_lto=false build: 22 pass on master, 22 pass here. test_predict and test_pic_preallocation abort on LeakSanitizer reports and checkasm on a heap-buffer-overflow in adm_dwt2_16, the same way they do on unpatched master; this change does not touch them.
• Scores unchanged: the three Netflix reference pairs give identical per-frame and pooled results on master and on this branch, with the default CPU dispatch and with SIMD masked off.
• The collection output still has vmaf_bagging, vmaf_stddev, vmaf_ci_p95_lo and vmaf_ci_p95_hi.

The workflow run on this PR needs a maintainer's approval.