BUG: Free the previous filename when an ASCII header repeats the attribute

[gdevenyi]

nifti_image_from_ascii() walks the attributes of an ASCII header and
assigns the two filename fields with

nim->fname = nifti_strdup(rhs) ;
nim->iname = nifti_strdup(rhs) ;

Nothing stops a header from carrying header_filename or image_filename
twice, and nothing rejects the repeat, so the second assignment drops
the first string. The input comes from a file, so the leak is
attacker-controlled in size and count: one copy per repetition.

Direct leak of 5 byte(s) in 1 object(s) allocated from:
    #0 malloc
    #1 nifti_strdup nifti2_io.c:1301
    #2 nifti_image_from_ascii nifti2_io.c:8874

Freeing before the assignment costs one call and keeps the last value,
which is what the function already documented by overwriting. The
fields are NULL until the first assignment, and free(NULL) is defined,
so no other path changes.

The same two lines exist in nifti1_io.c and are fixed there too.

Found by fuzzing nifti_image_from_ascii() with clang's libFuzzer under
AddressSanitizer.

---

How to reproduce, and the sanitizer builds used, are in the commit message. Found with clang libFuzzer harnesses over nifti_image_read(), the two header converters, nifti_image_from_ascii() and axml_read_buf(), run under AddressSanitizer, UndefinedBehaviorSanitizer and MemorySanitizer.

One commit on master, independent of my other open PRs. ctest passes on master with this branch alone (343/343, excluding the nifti_c22_copy_image failure that #31 fixes), and on the union of all my branches under ASan+UBSan, TSan and MSan.

[hjmjohnson]

The commit messages in this range were rewritten to remove trailers that do not belong in permanent history: Co-Authored-By: naming an AI tool, and Claude-Session: URLs that resolve for nobody. Only messages changed — the tree at the tip of master is byte-identical, and author, committer, and dates are preserved.

This PR's commit on the rewritten master:

• b4c689473e BUG: Free the previous filename when an ASCII header repeats the attribute

The SHA recorded above by GitHub is from the pre-rewrite history and no longer resolves.