From af30833fe2c7629ee2102853a4c01b71f56acf43 Mon Sep 17 00:00:00 2001 From: Ondrej Holy Date: Tue, 28 Aug 2018 14:24:08 +0200 Subject: [PATCH] Fix various defects reported by covscan This patch fixes the following important defects reported by covscan: server/libvncserver/main.c:178: leaked_storage: Variable "i" going out of scope leaks the storage it points to. server/libvncserver/rfbserver.c:195: leaked_storage: Variable "cl" going out of scope leaks the storage it points to. server/libvncserver/rfbserver.c:1161: overwrite_var: Overwriting "i" in "i = sraRgnGetIterator(updateRegion)" leaks the storage that "i" server/libvncserver/rfbserver.c:1232: deref_arg: Calling "sraRgnReleaseIterator" dereferences freed pointer "i". server/libvncserver/rfbserver.c:1291: leaked_storage: Variable "i" going out of scope leaks the storage it points to. server/libvncserver/sockets.c:635: leaked_handle: Handle variable "sock" going out of scope leaks the handle. server/libvncserver/sockets.c:635: leaked_handle: Handle variable "sock6" going out of scope leaks the handle. server/libvncserver/sockets.c:639: leaked_handle: Handle variable "sock" going out of scope leaks the handle. server/libvncserver/sockets.c:639: leaked_handle: Handle variable "sock6" going out of scope leaks the handle. server/libvncserver/sockets.c:663: overwrite_var: Overwriting handle "sock" in "sock = NewSocketListenTCP((struct sockaddr *)s4, 16U)" leaks the handle. server/libvncserver/sockets.c:677: overwrite_var: Overwriting handle "sock" in "sock = NewSocketListenTCP((struct sockaddr *)s6, 46U)" leaks the handle. server/libvncserver/sockets.c:691: leaked_handle: Handle variable "sock" going out of scope leaks the handle. server/libvncserver/tableinit24.c:150:7: warning: this 'if' clause does not guard... [-Wmisleading-indentation] server/miniupnp/minissdpc.c:43: buffer_size_warning: Calling strncpy with a maximum size argument of 108 bytes on destination array "addr.sun_path" of size 108 bytes might leave the destination string unterminated. server/miniupnp/miniupnpc.c:405: leaked_handle: Handle variable "sudp" going out of scope leaks the handle. server/smclient/eggsmclient-xsmp.c:1171: missing_va_end: va_end was not called for "ap". --- server/libvncserver/main.c | 2 ++ server/libvncserver/rfbserver.c | 7 +++++++ server/libvncserver/sockets.c | 6 +++--- server/libvncserver/tableinit24.c | 8 ++++---- server/miniupnp/minissdpc.c | 2 +- server/miniupnp/miniupnpc.c | 1 + server/smclient/eggsmclient-xsmp.c | 1 + 7 files changed, 19 insertions(+), 8 deletions(-) diff --git a/server/libvncserver/main.c b/server/libvncserver/main.c index 016bbff..0d9a737 100644 --- a/server/libvncserver/main.c +++ b/server/libvncserver/main.c @@ -175,6 +175,8 @@ void rfbDoCopyRegion(rfbScreenInfoPtr rfbScreen,sraRegionPtr copyRegion,int dx,i } rfbScheduleCopyRegion(rfbScreen,copyRegion,dx,dy); + + sraRgnReleaseIterator(i); } void rfbDoCopyRect(rfbScreenInfoPtr rfbScreen,int x1,int y1,int x2,int y2,int dx,int dy) diff --git a/server/libvncserver/rfbserver.c b/server/libvncserver/rfbserver.c index 0a60fb2..a880b53 100644 --- a/server/libvncserver/rfbserver.c +++ b/server/libvncserver/rfbserver.c @@ -192,6 +192,7 @@ rfbNewClient(rfbScreenInfoPtr rfbScreen, if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0) { rfbLogPerror("fcntl failed"); close(sock); + free(cl); return NULL; } #endif @@ -200,6 +201,7 @@ rfbNewClient(rfbScreenInfoPtr rfbScreen, (char *)&one, sizeof(one)) < 0) { rfbLogPerror("setsockopt failed"); close(sock); + free(cl); return NULL; } @@ -1089,6 +1091,7 @@ rfbSendFramebufferUpdate(rfbClientPtr cl, int h = rect.y2 - y; nUpdateRegionRects += (((h-1) / (ZLIB_MAX_SIZE( w ) / w)) + 1); } + sraRgnReleaseIterator(i); #ifdef VINO_HAVE_JPEG } else if (cl->preferredEncoding == rfbEncodingTight) { nUpdateRegionRects = 0; @@ -1141,6 +1144,8 @@ rfbSendFramebufferUpdate(rfbClientPtr cl, UNLOCK(cl->cursorMutex); + i = NULL; + if (sendCursorShape) { cl->cursorWasChanged = FALSE; if (!rfbSendCursorShape(cl)) @@ -1288,6 +1293,8 @@ rfbSendCopyRegion(rfbClientPtr cl, } + sraRgnReleaseIterator(i); + return TRUE; } diff --git a/server/libvncserver/sockets.c b/server/libvncserver/sockets.c index ee755eb..2366e19 100644 --- a/server/libvncserver/sockets.c +++ b/server/libvncserver/sockets.c @@ -625,12 +625,12 @@ ListenOnTCPPort(rfbScreenInfoPtr rfbScreen, int port, const char *netIface) rfbLog("Listening IPv4://0.0.0.0:%d\n", port); #ifdef VINO_ENABLE_IPV6 - if(sock6 > 0) { + if(sock6 >= 0) { psock[*ptot] = sock6; *ptot += 1; } #endif - if(sock > 0) { + if(sock >= 0) { psock[*ptot] = sock; *ptot += 1; } @@ -683,7 +683,7 @@ ListenOnTCPPort(rfbScreenInfoPtr rfbScreen, int port, const char *netIface) } #endif - if(sock > 0) { + if(sock >= 0) { psock[*ptot] = sock; *ptot += 1; sock = -1; diff --git a/server/libvncserver/tableinit24.c b/server/libvncserver/tableinit24.c index 39e9920..575a501 100644 --- a/server/libvncserver/tableinit24.c +++ b/server/libvncserver/tableinit24.c @@ -149,9 +149,9 @@ rfbInitOneRGBTable24 (uint8_t *table, int inMax, int outMax, int outShift, *(uint32_t *)&table[3*i] = outValue; if(!rfbEndianTest) memmove(table+3*i,table+3*i+1,3); - if (swap) { - c = table[3*i]; table[3*i] = table[3*i+2]; - table[3*i+2] = c; - } + if (swap) { + c = table[3*i]; table[3*i] = table[3*i+2]; + table[3*i+2] = c; + } } } diff --git a/server/miniupnp/minissdpc.c b/server/miniupnp/minissdpc.c index d37599f..64772f9 100644 --- a/server/miniupnp/minissdpc.c +++ b/server/miniupnp/minissdpc.c @@ -40,7 +40,7 @@ getDevicesFromMiniSSDPD(const char * devtype, const char * socketpath) return NULL; } addr.sun_family = AF_UNIX; - strncpy(addr.sun_path, socketpath, sizeof(addr.sun_path)); + strncpy(addr.sun_path, socketpath, sizeof(addr.sun_path) - 1); if(connect(s, (struct sockaddr *)&addr, sizeof(struct sockaddr_un)) < 0) { /*syslog(LOG_WARNING, "connect(\"%s\"): %m", socketpath);*/ diff --git a/server/miniupnp/miniupnpc.c b/server/miniupnp/miniupnpc.c index f9d620e..718526a 100644 --- a/server/miniupnp/miniupnpc.c +++ b/server/miniupnp/miniupnpc.c @@ -402,6 +402,7 @@ struct UPNPDev * upnpDiscover(int delay, const char * multicastif, #endif { PRINT_SOCKET_ERROR("setsockopt"); + closesocket(sudp); return NULL; } diff --git a/server/smclient/eggsmclient-xsmp.c b/server/smclient/eggsmclient-xsmp.c index d5cf3b5..5ca976f 100644 --- a/server/smclient/eggsmclient-xsmp.c +++ b/server/smclient/eggsmclient-xsmp.c @@ -1162,6 +1162,7 @@ array_prop (const char *name, ...) pv.value = value; g_array_append_val (vals, pv); } + va_end (ap); prop->num_vals = vals->len; prop->vals = (SmPropValue *)vals->data; -- 2.19.0