From af30833fe2c7629ee2102853a4c01b71f56acf43 Mon Sep 17 00:00:00 2001
From: Ondrej Holy <oholy@redhat.com>
Date: Tue, 28 Aug 2018 14:24:08 +0200
Subject: [PATCH] Fix various defects reported by covscan
This patch fixes the following important defects reported by covscan:
server/libvncserver/main.c:178: leaked_storage: Variable "i" going out of scope leaks the storage it points to.
server/libvncserver/rfbserver.c:195: leaked_storage: Variable "cl" going out of scope leaks the storage it points to.
server/libvncserver/rfbserver.c:1161: overwrite_var: Overwriting "i" in "i = sraRgnGetIterator(updateRegion)" leaks the storage that "i"
server/libvncserver/rfbserver.c:1232: deref_arg: Calling "sraRgnReleaseIterator" dereferences freed pointer "i".
server/libvncserver/rfbserver.c:1291: leaked_storage: Variable "i" going out of scope leaks the storage it points to.
server/libvncserver/sockets.c:635: leaked_handle: Handle variable "sock" going out of scope leaks the handle.
server/libvncserver/sockets.c:635: leaked_handle: Handle variable "sock6" going out of scope leaks the handle.
server/libvncserver/sockets.c:639: leaked_handle: Handle variable "sock" going out of scope leaks the handle.
server/libvncserver/sockets.c:639: leaked_handle: Handle variable "sock6" going out of scope leaks the handle.
server/libvncserver/sockets.c:663: overwrite_var: Overwriting handle "sock" in "sock = NewSocketListenTCP((struct sockaddr *)s4, 16U)" leaks the handle.
server/libvncserver/sockets.c:677: overwrite_var: Overwriting handle "sock" in "sock = NewSocketListenTCP((struct sockaddr *)s6, 46U)" leaks the handle.
server/libvncserver/sockets.c:691: leaked_handle: Handle variable "sock" going out of scope leaks the handle.
server/libvncserver/tableinit24.c:150:7: warning: this 'if' clause does not guard... [-Wmisleading-indentation]
server/miniupnp/minissdpc.c:43: buffer_size_warning: Calling strncpy with a maximum size argument of 108 bytes on destination array "addr.sun_path" of size 108 bytes might leave the destination string unterminated.
server/miniupnp/miniupnpc.c:405: leaked_handle: Handle variable "sudp" going out of scope leaks the handle.
server/smclient/eggsmclient-xsmp.c:1171: missing_va_end: va_end was not called for "ap".
---
server/libvncserver/main.c | 2 ++
server/libvncserver/rfbserver.c | 7 +++++++
server/libvncserver/sockets.c | 6 +++---
server/libvncserver/tableinit24.c | 8 ++++----
server/miniupnp/minissdpc.c | 2 +-
server/miniupnp/miniupnpc.c | 1 +
server/smclient/eggsmclient-xsmp.c | 1 +
7 files changed, 19 insertions(+), 8 deletions(-)
diff --git a/server/libvncserver/main.c b/server/libvncserver/main.c
index 016bbff..0d9a737 100644
--- a/server/libvncserver/main.c
+++ b/server/libvncserver/main.c
@@ -175,6 +175,8 @@ void rfbDoCopyRegion(rfbScreenInfoPtr rfbScreen,sraRegionPtr copyRegion,int dx,i
}
rfbScheduleCopyRegion(rfbScreen,copyRegion,dx,dy);
+
+ sraRgnReleaseIterator(i);
}
void rfbDoCopyRect(rfbScreenInfoPtr rfbScreen,int x1,int y1,int x2,int y2,int dx,int dy)
diff --git a/server/libvncserver/rfbserver.c b/server/libvncserver/rfbserver.c
index 0a60fb2..a880b53 100644
--- a/server/libvncserver/rfbserver.c
+++ b/server/libvncserver/rfbserver.c
@@ -192,6 +192,7 @@ rfbNewClient(rfbScreenInfoPtr rfbScreen,
if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0) {
rfbLogPerror("fcntl failed");
close(sock);
+ free(cl);
return NULL;
}
#endif
@@ -200,6 +201,7 @@ rfbNewClient(rfbScreenInfoPtr rfbScreen,
(char *)&one, sizeof(one)) < 0) {
rfbLogPerror("setsockopt failed");
close(sock);
+ free(cl);
return NULL;
}
@@ -1089,6 +1091,7 @@ rfbSendFramebufferUpdate(rfbClientPtr cl,
int h = rect.y2 - y;
nUpdateRegionRects += (((h-1) / (ZLIB_MAX_SIZE( w ) / w)) + 1);
}
+ sraRgnReleaseIterator(i);
#ifdef VINO_HAVE_JPEG
} else if (cl->preferredEncoding == rfbEncodingTight) {
nUpdateRegionRects = 0;
@@ -1141,6 +1144,8 @@ rfbSendFramebufferUpdate(rfbClientPtr cl,
UNLOCK(cl->cursorMutex);
+ i = NULL;
+
if (sendCursorShape) {
cl->cursorWasChanged = FALSE;
if (!rfbSendCursorShape(cl))
@@ -1288,6 +1293,8 @@ rfbSendCopyRegion(rfbClientPtr cl,
}
+ sraRgnReleaseIterator(i);
+
return TRUE;
}
diff --git a/server/libvncserver/sockets.c b/server/libvncserver/sockets.c
index ee755eb..2366e19 100644
--- a/server/libvncserver/sockets.c
+++ b/server/libvncserver/sockets.c
@@ -625,12 +625,12 @@ ListenOnTCPPort(rfbScreenInfoPtr rfbScreen, int port, const char *netIface)
rfbLog("Listening IPv4://0.0.0.0:%d\n", port);
#ifdef VINO_ENABLE_IPV6
- if(sock6 > 0) {
+ if(sock6 >= 0) {
psock[*ptot] = sock6;
*ptot += 1;
}
#endif
- if(sock > 0) {
+ if(sock >= 0) {
psock[*ptot] = sock;
*ptot += 1;
}
@@ -683,7 +683,7 @@ ListenOnTCPPort(rfbScreenInfoPtr rfbScreen, int port, const char *netIface)
}
#endif
- if(sock > 0) {
+ if(sock >= 0) {
psock[*ptot] = sock;
*ptot += 1;
sock = -1;
diff --git a/server/libvncserver/tableinit24.c b/server/libvncserver/tableinit24.c
index 39e9920..575a501 100644
--- a/server/libvncserver/tableinit24.c
+++ b/server/libvncserver/tableinit24.c
@@ -149,9 +149,9 @@ rfbInitOneRGBTable24 (uint8_t *table, int inMax, int outMax, int outShift,
*(uint32_t *)&table[3*i] = outValue;
if(!rfbEndianTest)
memmove(table+3*i,table+3*i+1,3);
- if (swap) {
- c = table[3*i]; table[3*i] = table[3*i+2];
- table[3*i+2] = c;
- }
+ if (swap) {
+ c = table[3*i]; table[3*i] = table[3*i+2];
+ table[3*i+2] = c;
+ }
}
}
diff --git a/server/miniupnp/minissdpc.c b/server/miniupnp/minissdpc.c
index d37599f..64772f9 100644
--- a/server/miniupnp/minissdpc.c
+++ b/server/miniupnp/minissdpc.c
@@ -40,7 +40,7 @@ getDevicesFromMiniSSDPD(const char * devtype, const char * socketpath)
return NULL;
}
addr.sun_family = AF_UNIX;
- strncpy(addr.sun_path, socketpath, sizeof(addr.sun_path));
+ strncpy(addr.sun_path, socketpath, sizeof(addr.sun_path) - 1);
if(connect(s, (struct sockaddr *)&addr, sizeof(struct sockaddr_un)) < 0)
{
/*syslog(LOG_WARNING, "connect(\"%s\"): %m", socketpath);*/
diff --git a/server/miniupnp/miniupnpc.c b/server/miniupnp/miniupnpc.c
index f9d620e..718526a 100644
--- a/server/miniupnp/miniupnpc.c
+++ b/server/miniupnp/miniupnpc.c
@@ -402,6 +402,7 @@ struct UPNPDev * upnpDiscover(int delay, const char * multicastif,
#endif
{
PRINT_SOCKET_ERROR("setsockopt");
+ closesocket(sudp);
return NULL;
}
diff --git a/server/smclient/eggsmclient-xsmp.c b/server/smclient/eggsmclient-xsmp.c
index d5cf3b5..5ca976f 100644
--- a/server/smclient/eggsmclient-xsmp.c
+++ b/server/smclient/eggsmclient-xsmp.c
@@ -1162,6 +1162,7 @@ array_prop (const char *name, ...)
pv.value = value;
g_array_append_val (vals, pv);
}
+ va_end (ap);
prop->num_vals = vals->len;
prop->vals = (SmPropValue *)vals->data;
--
2.19.0