748c79
diff -up gnupg-2.2.20/common/server-help.c.coverity gnupg-2.2.20/common/server-help.c
748c79
--- gnupg-2.2.20/common/server-help.c.coverity	2019-02-11 10:59:34.000000000 +0100
748c79
+++ gnupg-2.2.20/common/server-help.c	2020-05-04 12:00:01.085945639 +0200
748c79
@@ -156,7 +156,7 @@ get_option_value (char *line, const char
748c79
   *pend = 0;
748c79
   *r_value = xtrystrdup (p);
748c79
   *pend = c;
748c79
-  if (!p)
748c79
+  if (!*r_value)
748c79
     return my_error_from_syserror ();
748c79
   return 0;
748c79
 }
748c79
diff -up gnupg-2.2.20/dirmngr/dns.c.coverity gnupg-2.2.20/dirmngr/dns.c
748c79
--- gnupg-2.2.20/dirmngr/dns.c.coverity	2019-07-09 11:08:45.000000000 +0200
748c79
+++ gnupg-2.2.20/dirmngr/dns.c	2020-05-04 18:04:12.285521661 +0200
748c79
@@ -10106,9 +10106,8 @@ static const struct {
748c79
 	{ "AR",         DNS_S_ADDITIONAL },
748c79
 };
748c79
 
748c79
-const char *(dns_strsection)(enum dns_section section) {
748c79
-	char _dst[DNS_STRMAXLEN + 1] = { 0 };
748c79
-	struct dns_buf dst = DNS_B_INTO(_dst, sizeof _dst);
748c79
+const char *(dns_strsection)(enum dns_section section, void *_dst, size_t lim) {
748c79
+	struct dns_buf dst = DNS_B_INTO(_dst, lim);
748c79
 	unsigned i;
748c79
 
748c79
 	for (i = 0; i < lengthof(dns_sections); i++) {
748c79
@@ -10156,9 +10155,8 @@ static const struct {
748c79
 	{ "IN", DNS_C_IN },
748c79
 };
748c79
 
748c79
-const char *(dns_strclass)(enum dns_class type) {
748c79
-	char _dst[DNS_STRMAXLEN + 1] = { 0 };
748c79
-	struct dns_buf dst = DNS_B_INTO(_dst, sizeof _dst);
748c79
+const char *(dns_strclass)(enum dns_class type, void *_dst, size_t lim) {
748c79
+	struct dns_buf dst = DNS_B_INTO(_dst, lim);
748c79
 	unsigned i;
748c79
 
748c79
 	for (i = 0; i < lengthof(dns_classes); i++) {
748c79
@@ -10193,9 +10191,8 @@ enum dns_class dns_iclass(const char *na
748c79
 } /* dns_iclass() */
748c79
 
748c79
 
748c79
-const char *(dns_strtype)(enum dns_type type) {
748c79
-	char _dst[DNS_STRMAXLEN + 1] = { 0 };
748c79
-	struct dns_buf dst = DNS_B_INTO(_dst, sizeof _dst);
748c79
+const char *(dns_strtype)(enum dns_type type, void *_dst, size_t lim) {
748c79
+	struct dns_buf dst = DNS_B_INTO(_dst, lim);
748c79
 	unsigned i;
748c79
 
748c79
 	for (i = 0; i < lengthof(dns_rrtypes); i++) {
748c79
diff -up gnupg-2.2.20/dirmngr/dns.h.coverity gnupg-2.2.20/dirmngr/dns.h
748c79
--- gnupg-2.2.20/dirmngr/dns.h.coverity	2019-03-07 13:03:26.000000000 +0100
748c79
+++ gnupg-2.2.20/dirmngr/dns.h	2020-05-04 18:04:12.287521625 +0200
748c79
@@ -272,15 +272,25 @@ enum dns_rcode {
748c79
  */
748c79
 #define DNS_STRMAXLEN 47 /* "QUESTION|ANSWER|AUTHORITY|ADDITIONAL" */
748c79
 
748c79
-DNS_PUBLIC const char *dns_strsection(enum dns_section);
748c79
+DNS_PUBLIC const char *dns_strsection(enum dns_section, void *, size_t);
748c79
+#define dns_strsection3(a, b, c) \
748c79
+				dns_strsection((a), (b), (c))
748c79
+#define dns_strsection1(a)	dns_strsection((a), (char [DNS_STRMAXLEN + 1]){ 0 }, DNS_STRMAXLEN + 1)
748c79
+#define dns_strsection(...)	DNS_PP_CALL(DNS_PP_XPASTE(dns_strsection, DNS_PP_NARG(__VA_ARGS__)), __VA_ARGS__)
748c79
 
748c79
 DNS_PUBLIC enum dns_section dns_isection(const char *);
748c79
 
748c79
-DNS_PUBLIC const char *dns_strclass(enum dns_class);
748c79
+DNS_PUBLIC const char *dns_strclass(enum dns_class, void *, size_t);
748c79
+#define dns_strclass3(a, b, c)	dns_strclass((a), (b), (c))
748c79
+#define dns_strclass1(a)	dns_strclass((a), (char [DNS_STRMAXLEN + 1]){ 0 }, DNS_STRMAXLEN + 1)
748c79
+#define dns_strclass(...)	DNS_PP_CALL(DNS_PP_XPASTE(dns_strclass, DNS_PP_NARG(__VA_ARGS__)), __VA_ARGS__)
748c79
 
748c79
 DNS_PUBLIC enum dns_class dns_iclass(const char *);
748c79
 
748c79
-DNS_PUBLIC const char *dns_strtype(enum dns_type);
748c79
+DNS_PUBLIC const char *dns_strtype(enum dns_type, void *, size_t);
748c79
+#define dns_strtype3(a, b, c)	dns_strtype((a), (b), (c))
748c79
+#define dns_strtype1(a)		dns_strtype((a), (char [DNS_STRMAXLEN + 1]){ 0 }, DNS_STRMAXLEN + 1)
748c79
+#define dns_strtype(...)	DNS_PP_CALL(DNS_PP_XPASTE(dns_strtype, DNS_PP_NARG(__VA_ARGS__)), __VA_ARGS__)
748c79
 
748c79
 DNS_PUBLIC enum dns_type dns_itype(const char *);
748c79
 
748c79
diff -up gnupg-2.2.20/dirmngr/domaininfo.c.coverity gnupg-2.2.20/dirmngr/domaininfo.c
748c79
--- gnupg-2.2.20/dirmngr/domaininfo.c.coverity	2019-07-09 11:08:45.000000000 +0200
748c79
+++ gnupg-2.2.20/dirmngr/domaininfo.c	2020-05-04 17:54:30.800899152 +0200
748c79
@@ -193,6 +193,7 @@ insert_or_update (const char *domain,
748c79
           log_error ("domaininfo: error allocating helper array: %s\n",
748c79
                      gpg_strerror (gpg_err_code_from_syserror ()));
748c79
           drop_extra = bucket;
748c79
+          xfree (di_new);
748c79
           goto leave;
748c79
         }
748c79
       narray = 0;
748c79
@@ -258,6 +259,8 @@ insert_or_update (const char *domain,
748c79
        * sensible strategy.  */
748c79
       drop_extra = domainbuckets[hash];
748c79
       domainbuckets[hash] = keep;
748c79
+
748c79
+      xfree (array);
748c79
     }
748c79
 
748c79
   /* Insert */
748c79
diff -up gnupg-2.2.20/dirmngr/http.c.coverity gnupg-2.2.20/dirmngr/http.c
748c79
--- gnupg-2.2.20/dirmngr/http.c.coverity	2019-11-18 18:44:33.000000000 +0100
748c79
+++ gnupg-2.2.20/dirmngr/http.c	2020-05-04 17:00:47.826878715 +0200
748c79
@@ -3656,7 +3656,6 @@ http_prepare_redirect (http_redir_info_t
748c79
       if (!newurl)
748c79
         {
748c79
           err = gpg_error_from_syserror ();
748c79
-          http_release_parsed_uri (locuri);
748c79
           return err;
748c79
         }
748c79
     }
748c79
@@ -3675,7 +3674,6 @@ http_prepare_redirect (http_redir_info_t
748c79
       if (!newurl)
748c79
         {
748c79
           err = gpg_error_from_syserror ();
748c79
-          http_release_parsed_uri (locuri);
748c79
           return err;
748c79
         }
748c79
     }
748c79
diff -up gnupg-2.2.20/dirmngr/ks-engine-hkp.c.coverity gnupg-2.2.20/dirmngr/ks-engine-hkp.c
748c79
--- gnupg-2.2.20/dirmngr/ks-engine-hkp.c.coverity	2019-11-18 18:44:33.000000000 +0100
748c79
+++ gnupg-2.2.20/dirmngr/ks-engine-hkp.c	2020-05-04 12:39:49.970920664 +0200
748c79
@@ -1426,7 +1426,7 @@ ks_hkp_search (ctrl_t ctrl, parsed_uri_t
748c79
   int reselect;
748c79
   unsigned int httpflags;
748c79
   char *httphost = NULL;
748c79
-  unsigned int http_status;
748c79
+  unsigned int http_status = 0;
748c79
   unsigned int tries = SEND_REQUEST_RETRIES;
748c79
   unsigned int extra_tries = SEND_REQUEST_EXTRA_RETRIES;
748c79
 
748c79
diff -up gnupg-2.2.20/g10/card-util.c.coverity gnupg-2.2.20/g10/card-util.c
748c79
--- gnupg-2.2.20/g10/card-util.c.coverity	2020-03-03 13:33:22.000000000 +0100
748c79
+++ gnupg-2.2.20/g10/card-util.c	2020-05-04 16:56:47.788157786 +0200
748c79
@@ -704,7 +704,7 @@ card_status (ctrl_t ctrl, estream_t fp,
748c79
 {
748c79
   int err;
748c79
   strlist_t card_list, sl;
748c79
-  char *serialno0, *serialno1;
748c79
+  char *serialno0, *serialno1 = NULL;
748c79
   int all_cards = 0;
748c79
   int any_card = 0;
748c79
 
748c79
@@ -749,6 +749,7 @@ card_status (ctrl_t ctrl, estream_t fp,
748c79
 
748c79
       current_card_status (ctrl, fp, NULL, 0);
748c79
       xfree (serialno1);
748c79
+      serialno1 = NULL;
748c79
 
748c79
       if (!all_cards)
748c79
         goto leave;
748c79
diff -up gnupg-2.2.20/g10/import.c.coverity gnupg-2.2.20/g10/import.c
748c79
--- gnupg-2.2.20/g10/import.c.coverity	2020-05-04 12:34:39.820379830 +0200
748c79
+++ gnupg-2.2.20/g10/import.c	2020-05-04 12:34:55.366106195 +0200
748c79
@@ -1888,7 +1888,7 @@ import_one_real (ctrl_t ctrl,
748c79
 
748c79
   if (opt.interactive && !silent)
748c79
     {
748c79
-      if (is_status_enabled())
748c79
+      if (uidnode && is_status_enabled())
748c79
         print_import_check (pk, uidnode->pkt->pkt.user_id);
748c79
       merge_keys_and_selfsig (ctrl, keyblock);
748c79
       tty_printf ("\n");
748c79
diff -up gnupg-2.2.20/g10/keygen.c.coverity gnupg-2.2.20/g10/keygen.c
748c79
--- gnupg-2.2.20/g10/keygen.c.coverity	2020-05-04 12:23:04.852613017 +0200
748c79
+++ gnupg-2.2.20/g10/keygen.c	2020-05-04 17:33:18.923891110 +0200
748c79
@@ -3075,7 +3075,7 @@ parse_key_parameter_part (ctrl_t ctrl,
748c79
   char *endp;
748c79
   const char *curve = NULL;
748c79
   int ecdh_or_ecdsa = 0;
748c79
-  unsigned int size;
748c79
+  unsigned int size = 0;
748c79
   int keyuse;
748c79
   int i;
748c79
   const char *s;
748c79
@@ -5719,12 +5719,20 @@ gen_card_key (int keyno, int algo, int i
748c79
      the self-signatures. */
748c79
   err = agent_readkey (NULL, 1, keyid, &public);
748c79
   if (err)
748c79
-    return err;
748c79
+    {
748c79
+      xfree (pkt);
748c79
+      xfree (pk);
748c79
+      return err;
748c79
+    }
748c79
   err = gcry_sexp_sscan (&s_key, NULL, public,
748c79
                          gcry_sexp_canon_len (public, 0, NULL, NULL));
748c79
   xfree (public);
748c79
   if (err)
748c79
-    return err;
748c79
+    {
748c79
+      xfree (pkt);
748c79
+      xfree (pk);
748c79
+      return err;
748c79
+    }
748c79
 
748c79
   if (algo == PUBKEY_ALGO_RSA)
748c79
     err = key_from_sexp (pk->pkey, s_key, "public-key", "ne");
748c79
@@ -5739,6 +5747,7 @@ gen_card_key (int keyno, int algo, int i
748c79
   if (err)
748c79
     {
748c79
       log_error ("key_from_sexp failed: %s\n", gpg_strerror (err) );
748c79
+      xfree (pkt);
748c79
       free_public_key (pk);
748c79
       return err;
748c79
     }
748c79
diff -up gnupg-2.2.20/g10/sig-check.c.coverity gnupg-2.2.20/g10/sig-check.c
748c79
--- gnupg-2.2.20/g10/sig-check.c.coverity	2020-05-04 12:18:18.515653963 +0200
748c79
+++ gnupg-2.2.20/g10/sig-check.c	2020-05-04 12:18:33.599388425 +0200
748c79
@@ -902,6 +902,7 @@ check_signature_over_key_or_uid (ctrl_t
748c79
                 {
748c79
                   /* Issued by a subkey.  */
748c79
                   signer = subk;
748c79
+                  *is_selfsig = 1;
748c79
                   break;
748c79
                 }
748c79
             }
748c79
diff -up gnupg-2.2.20/g10/sign.c.coverity gnupg-2.2.20/g10/sign.c
748c79
--- gnupg-2.2.20/g10/sign.c.coverity	2020-04-30 11:56:43.909360043 +0200
748c79
+++ gnupg-2.2.20/g10/sign.c	2020-05-04 12:08:56.651544958 +0200
748c79
@@ -823,7 +823,7 @@ write_signature_packets (ctrl_t ctrl,
748c79
       PKT_public_key *pk;
748c79
       PKT_signature *sig;
748c79
       gcry_md_hd_t md;
748c79
-      gpg_error_t err;
748c79
+      gpg_error_t err = 0;
748c79
 
748c79
       pk = sk_rover->pk;
748c79
 
748c79
diff -up gnupg-2.2.20/kbx/keybox-dump.c.coverity gnupg-2.2.20/kbx/keybox-dump.c
748c79
--- gnupg-2.2.20/kbx/keybox-dump.c.coverity	2019-08-23 15:59:06.000000000 +0200
748c79
+++ gnupg-2.2.20/kbx/keybox-dump.c	2020-05-04 17:25:53.365946213 +0200
748c79
@@ -786,11 +786,15 @@ _keybox_dump_cut_records (const char *fi
748c79
   while ( !(rc = _keybox_read_blob (&blob, fp, NULL)) )
748c79
     {
748c79
       if (recno > to)
748c79
-        break; /* Ready.  */
748c79
+        {
748c79
+          _keybox_release_blob (blob);
748c79
+          break; /* Ready.  */
748c79
+        }
748c79
       if (recno >= from)
748c79
         {
748c79
           if ((rc = _keybox_write_blob (blob, outfp)))
748c79
             {
748c79
+              _keybox_release_blob (blob);
748c79
               fprintf (stderr, "error writing output: %s\n",
748c79
                        gpg_strerror (rc));
748c79
               goto leave;
748c79
diff -up gnupg-2.2.20/tools/gpg-wks-server.c.coverity gnupg-2.2.20/tools/gpg-wks-server.c
748c79
--- gnupg-2.2.20/tools/gpg-wks-server.c.coverity	2020-02-10 16:12:13.000000000 +0100
748c79
+++ gnupg-2.2.20/tools/gpg-wks-server.c	2020-05-04 11:52:42.547643198 +0200
748c79
@@ -890,15 +890,18 @@ store_key_as_pending (const char *dir, e
748c79
     }
748c79
 
748c79
  leave:
748c79
-  if (err)
748c79
+  if (fname)
748c79
     {
748c79
-      es_fclose (outfp);
748c79
-      gnupg_remove (fname);
748c79
-    }
748c79
-  else if (es_fclose (outfp))
748c79
-    {
748c79
-      err = gpg_error_from_syserror ();
748c79
-      log_error ("error closing '%s': %s\n", fname, gpg_strerror (err));
748c79
+      if (err)
748c79
+        {
748c79
+          es_fclose (outfp);
748c79
+          gnupg_remove (fname);
748c79
+        }
748c79
+      else if (es_fclose (outfp))
748c79
+        {
748c79
+          err = gpg_error_from_syserror ();
748c79
+          log_error ("error closing '%s': %s\n", fname, gpg_strerror (err));
748c79
+        }
748c79
     }
748c79
 
748c79
   if (!err)
748c79
diff -up gnupg-2.2.20/tools/wks-util.c.coverity gnupg-2.2.20/tools/wks-util.c
748c79
--- gnupg-2.2.20/tools/wks-util.c.coverity	2020-05-04 12:02:21.839475031 +0200
748c79
+++ gnupg-2.2.20/tools/wks-util.c	2020-05-04 17:23:19.552726949 +0200
748c79
@@ -948,7 +948,7 @@ ensure_policy_file (const char *addrspec
748c79
 static gpg_error_t
748c79
 install_key_from_spec_file (const char *fname)
748c79
 {
748c79
-  gpg_error_t err;
748c79
+  gpg_error_t err = 0;
748c79
   estream_t fp;
748c79
   char *line = NULL;
748c79
   size_t linelen = 0;
748c79
@@ -1195,10 +1195,8 @@ wks_cmd_print_wkd_hash (const char *user
748c79
   char *addrspec, *fname;
748c79
 
748c79
   err = wks_fname_from_userid (userid, 1, &fname, &addrspec);
748c79
-  if (err)
748c79
-    return err;
748c79
-
748c79
-  es_printf ("%s %s\n", fname, addrspec);
748c79
+  if (!err)
748c79
+    es_printf ("%s %s\n", fname, addrspec);
748c79
 
748c79
   xfree (fname);
748c79
   xfree (addrspec);
748c79
@@ -1216,7 +1214,10 @@ wks_cmd_print_wkd_url (const char *useri
748c79
 
748c79
   err = wks_fname_from_userid (userid, 1, &fname, &addrspec);
748c79
   if (err)
748c79
-    return err;
748c79
+    {
748c79
+      xfree (addrspec);
748c79
+      return err;
748c79
+    }
748c79
 
748c79
   domain = strchr (addrspec, '@');
748c79
   if (domain)