A collection of small bug fixes from Chris West, apparently spotted by

Coverity: assorted language-use goofs like freeing the wrong thing or
forgetting to initialise a string on all code paths.

[originally from svn r9889]

diff --git a/ssh.c b/ssh.c
index 6ee5528caffa0a6407ea162745418ded90b1c521..bbe81b61e17c90cdd427702589d1b234d7fe4a77 100644 (file)
--- a/ssh.c
+++ b/ssh.c
@@ -9685,7 +9685,7 @@ static void ssh_free(void *handle)
     while (ssh->qhead) {
        struct queued_handler *qh = ssh->qhead;
        ssh->qhead = qh->next;
-       sfree(ssh->qhead);
+       sfree(qh);
     }
     ssh->qhead = ssh->qtail = NULL;
 

diff --git a/sshpubk.c b/sshpubk.c
index 76aa343619b9038659de9a9cef2bc22ba55a8761..bd3c5e47c4cc66b5661844155e9e35acffa392ce 100644 (file)
--- a/sshpubk.c
+++ b/sshpubk.c
@@ -257,8 +257,8 @@ int rsakey_pubblob(const Filename *filename, void **blob, int *bloblen,
            *blob = rsa_public_blob(&key, bloblen);
            freersakey(&key);
            ret = 1;
-           fp = NULL;
        }
+       fp = NULL; /* loadrsakey_main unconditionally closes fp */
     } else {
        error = "not an SSH-1 RSA file";
     }
@@ -679,7 +679,6 @@ struct ssh2_userkey *ssh2_load_userkey(const Filename *filename,
        cipher = 0;
        cipherblk = 1;
     } else {
-       sfree(encryption);
        goto error;
     }
 

diff --git a/unix/gtkwin.c b/unix/gtkwin.c
index da40e5447324d5fc84a933d1e71874bb30eb24b5..f403a80796dcb568997c9a52d40ff433f2f15616 100644 (file)
--- a/unix/gtkwin.c
+++ b/unix/gtkwin.c
@@ -1597,7 +1597,7 @@ void palette_set(void *frontend, int n, int r, int g, int b)
     struct gui_data *inst = (struct gui_data *)frontend;
     if (n >= 16)
        n += 256 - 16;
-    if (n > NALLCOLOURS)
+    if (n >= NALLCOLOURS)
        return;
     real_palette_set(inst, n, r, g, b);
     if (n == 258) {

diff --git a/unix/uxpty.c b/unix/uxpty.c
index 7ea7131c9d173da1bb8ac4240cf0c195874348ed..99ff6386d01e5a3053a4dece83ddad6be6d338c2 100644 (file)
--- a/unix/uxpty.c
+++ b/unix/uxpty.c
@@ -633,6 +633,7 @@ int pty_real_select_result(Pty pty, int event, int status)
        if (close_on_exit == FORCE_OFF ||
            (close_on_exit == AUTO && pty->exit_code != 0)) {
            char message[512];
+            message[0] = '\0';
            if (WIFEXITED(pty->exit_code))
                sprintf(message, "\r\n[pterm: process terminated with exit"
                        " code %d]\r\n", WEXITSTATUS(pty->exit_code));