OE uses inetcomm.dll(6.0.2900.5512) to create the news header, when I tried to interpret the disassemble codes as C codes, I found that INETCOMM!CreateNewsHeader calls INETCOMM!EscapePound to MemAlloc a LPWSTR (if needed), and uses the returned LPWSTR in eax, but at last, does not call ole32!CRetailMalloc_Free to free the LPWSTR! Is this a Memory leak bug?

HRESULT _stdcall CreateNewsHeader(IMimeMessageTree *pMTree, DWORD ReplyFlags, IVirtualStream *pVStream) {
DWORD countByte; //used as esi
WCHAR *pMessageIDEscapePound; //used as eax
WCHAR *pFormtString = 0; //ebp-404h
HRESULT hr; //ebp-408h
WCHAR *pAddress = 0; //ebp-40Ch
WCHAR *pMessageID = 0; //ebp-410h
WCHAR *pMessageIDDropAngles = 0; //ebp-414h
WCHAR *pNewsHeader = 0; //ebp-418h
WCHAR *pNewsHeaderHtml; //ebp-420h

pMTree-GetAddressFormatW(IAT_FROM, AFT_DISPLAY_BOTH, &pAddress);
MimeOleGetBodyPropW(pMTree, HBODY_ROOT, PID_HDR_MESSAGEID, 0, &pMessageID);
countByte = 2 * LoadStringWrapW(hModuleInetresDll, 1167, &pFormtString, 512);
if (pAddress) {
countByte += 2 * lstrlenW(pAddress);
else
pAddress = g_wszEmpty;
if (pMessageID) {
if (pMessageIDEscapePound = EscapePound(pMessageID)) {
DropAngles(pMessageIDEscapePound, &pMessageIDDropAngles);
else
DropAngles(pMessageID, &pMessageIDDropAngles);
countByte += 2 * lstrlenW(pMessageIDDropAngles);
} else
pMessageIDDropAngles = g_wszEmpty;
countByte += 2;
if (S_OK != MemAlloc(&pNewsHeader, countByte)) {
hr = MAKE_SCODE(SEVERITY_ERROR, FACILITY_WIN32, ERROR_OUTOFMEMORY);
goto epilog;
}
if (S_OK != (hr = pVStream-Write(L"DIV", 2 * lstrlenW(L"DIV"), NULL)))
goto epilog;
wnsprintfW(pNewsHeader, countByte, pFormtString, pAddress, pMessageIDDropAngles);
if (S_OK != (hr = EscapeStringToHTML(pNewsHeader, &pNewsHeaderHtml)))
goto epilog;
pVStream-Write(pNewsHeaderHtml, 2 * lstrlenW(pNewsHeaderHtml), NULL); //why not check hr?
RetailMalloc_Free(pNewsHeaderHtml);
hr = pVStream-Write(L"/DIV", 2 * lstrlenW(L"/DIV"), NULL);
epilog:
if (pAddress != g_wszEmpty)
RetailMalloc_Free(pAddress);
RetailMalloc_Free(pMessageID);
RetailMalloc_Free(pNewsHeader);
//no RetailMalloc_Free(pMessageIDEscapePound)!
return hr;
}