Texture replacement: Plug leaks on error paths

- Release the file reference when loading a level fails or finds nothing,
  since only a loaded level takes ownership of it.
- Free the PNG image when the size changed since the header was read.
- Delete the VFS when a pack without an ini has no hash-named textures.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

GPU/Common/ReplacedTexture.cpp

@@ -278,6 +278,14 @@ void ReplacedTexture::Prepare(VFSBackend *vfs) {
 		}
 
 		result = LoadLevelData(fileRef, desc_.filenames[i], i, &pixelFormat);
+		// A level that got loaded owns the reference. Otherwise (error, or nothing to load) it's ours to free.
+		bool kept = false;
+		for (const ReplacedTextureLevel &level : levels_) {
+			kept = kept || level.fileRef == fileRef;
+		}
+		if (!kept) {
+			vfs_->ReleaseFile(fileRef);
+		}
 		if (result == LoadLevelResult::DONE) {
 			// Loaded all the levels we're gonna get.
 			fmt = pixelFormat;
@@ -730,6 +738,7 @@ ReplacedTexture::LoadLevelResult ReplacedTexture::LoadLevelData(VFSFileReference
 		}
 		if (png.width > (uint32_t)level.w || png.height > (uint32_t)level.h) {
 			ERROR_LOG(Log::TexReplacement, "Texture replacement changed since header read: %s", filename.c_str());
+			png_image_free(&png);
 			return LoadLevelResult::LOAD_ERROR;
 		}
 

GPU/Common/TextureReplacer.cpp

@@ -230,6 +230,7 @@ bool TextureReplacer::LoadIni(std::string *error, bool notify) {
 
 			if (filenameMap.empty()) {
 				WARN_LOG(Log::TexReplacement, "No replacement textures found.");
+				delete dir;
 				return false;
 			}