please check @hughsie, thanks
(the scan-build 2 leaks were false-positive - not sure why and how to shut it)