You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
178 lines
6.9 KiB
178 lines
6.9 KiB
From af30833fe2c7629ee2102853a4c01b71f56acf43 Mon Sep 17 00:00:00 2001
|
|
From: Ondrej Holy <oholy@redhat.com>
|
|
Date: Tue, 28 Aug 2018 14:24:08 +0200
|
|
Subject: [PATCH] Fix various defects reported by covscan
|
|
|
|
This patch fixes the following important defects reported by covscan:
|
|
server/libvncserver/main.c:178: leaked_storage: Variable "i" going out of scope leaks the storage it points to.
|
|
server/libvncserver/rfbserver.c:195: leaked_storage: Variable "cl" going out of scope leaks the storage it points to.
|
|
server/libvncserver/rfbserver.c:1161: overwrite_var: Overwriting "i" in "i = sraRgnGetIterator(updateRegion)" leaks the storage that "i"
|
|
server/libvncserver/rfbserver.c:1232: deref_arg: Calling "sraRgnReleaseIterator" dereferences freed pointer "i".
|
|
server/libvncserver/rfbserver.c:1291: leaked_storage: Variable "i" going out of scope leaks the storage it points to.
|
|
server/libvncserver/sockets.c:635: leaked_handle: Handle variable "sock" going out of scope leaks the handle.
|
|
server/libvncserver/sockets.c:635: leaked_handle: Handle variable "sock6" going out of scope leaks the handle.
|
|
server/libvncserver/sockets.c:639: leaked_handle: Handle variable "sock" going out of scope leaks the handle.
|
|
server/libvncserver/sockets.c:639: leaked_handle: Handle variable "sock6" going out of scope leaks the handle.
|
|
server/libvncserver/sockets.c:663: overwrite_var: Overwriting handle "sock" in "sock = NewSocketListenTCP((struct sockaddr *)s4, 16U)" leaks the handle.
|
|
server/libvncserver/sockets.c:677: overwrite_var: Overwriting handle "sock" in "sock = NewSocketListenTCP((struct sockaddr *)s6, 46U)" leaks the handle.
|
|
server/libvncserver/sockets.c:691: leaked_handle: Handle variable "sock" going out of scope leaks the handle.
|
|
server/libvncserver/tableinit24.c:150:7: warning: this 'if' clause does not guard... [-Wmisleading-indentation]
|
|
server/miniupnp/minissdpc.c:43: buffer_size_warning: Calling strncpy with a maximum size argument of 108 bytes on destination array "addr.sun_path" of size 108 bytes might leave the destination string unterminated.
|
|
server/miniupnp/miniupnpc.c:405: leaked_handle: Handle variable "sudp" going out of scope leaks the handle.
|
|
server/smclient/eggsmclient-xsmp.c:1171: missing_va_end: va_end was not called for "ap".
|
|
---
|
|
server/libvncserver/main.c | 2 ++
|
|
server/libvncserver/rfbserver.c | 7 +++++++
|
|
server/libvncserver/sockets.c | 6 +++---
|
|
server/libvncserver/tableinit24.c | 8 ++++----
|
|
server/miniupnp/minissdpc.c | 2 +-
|
|
server/miniupnp/miniupnpc.c | 1 +
|
|
server/smclient/eggsmclient-xsmp.c | 1 +
|
|
7 files changed, 19 insertions(+), 8 deletions(-)
|
|
|
|
diff --git a/server/libvncserver/main.c b/server/libvncserver/main.c
|
|
index 016bbff..0d9a737 100644
|
|
--- a/server/libvncserver/main.c
|
|
+++ b/server/libvncserver/main.c
|
|
@@ -175,6 +175,8 @@ void rfbDoCopyRegion(rfbScreenInfoPtr rfbScreen,sraRegionPtr copyRegion,int dx,i
|
|
}
|
|
|
|
rfbScheduleCopyRegion(rfbScreen,copyRegion,dx,dy);
|
|
+
|
|
+ sraRgnReleaseIterator(i);
|
|
}
|
|
|
|
void rfbDoCopyRect(rfbScreenInfoPtr rfbScreen,int x1,int y1,int x2,int y2,int dx,int dy)
|
|
diff --git a/server/libvncserver/rfbserver.c b/server/libvncserver/rfbserver.c
|
|
index 0a60fb2..a880b53 100644
|
|
--- a/server/libvncserver/rfbserver.c
|
|
+++ b/server/libvncserver/rfbserver.c
|
|
@@ -192,6 +192,7 @@ rfbNewClient(rfbScreenInfoPtr rfbScreen,
|
|
if (fcntl(sock, F_SETFL, O_NONBLOCK) < 0) {
|
|
rfbLogPerror("fcntl failed");
|
|
close(sock);
|
|
+ free(cl);
|
|
return NULL;
|
|
}
|
|
#endif
|
|
@@ -200,6 +201,7 @@ rfbNewClient(rfbScreenInfoPtr rfbScreen,
|
|
(char *)&one, sizeof(one)) < 0) {
|
|
rfbLogPerror("setsockopt failed");
|
|
close(sock);
|
|
+ free(cl);
|
|
return NULL;
|
|
}
|
|
|
|
@@ -1089,6 +1091,7 @@ rfbSendFramebufferUpdate(rfbClientPtr cl,
|
|
int h = rect.y2 - y;
|
|
nUpdateRegionRects += (((h-1) / (ZLIB_MAX_SIZE( w ) / w)) + 1);
|
|
}
|
|
+ sraRgnReleaseIterator(i);
|
|
#ifdef VINO_HAVE_JPEG
|
|
} else if (cl->preferredEncoding == rfbEncodingTight) {
|
|
nUpdateRegionRects = 0;
|
|
@@ -1141,6 +1144,8 @@ rfbSendFramebufferUpdate(rfbClientPtr cl,
|
|
|
|
UNLOCK(cl->cursorMutex);
|
|
|
|
+ i = NULL;
|
|
+
|
|
if (sendCursorShape) {
|
|
cl->cursorWasChanged = FALSE;
|
|
if (!rfbSendCursorShape(cl))
|
|
@@ -1288,6 +1293,8 @@ rfbSendCopyRegion(rfbClientPtr cl,
|
|
|
|
}
|
|
|
|
+ sraRgnReleaseIterator(i);
|
|
+
|
|
return TRUE;
|
|
}
|
|
|
|
diff --git a/server/libvncserver/sockets.c b/server/libvncserver/sockets.c
|
|
index ee755eb..2366e19 100644
|
|
--- a/server/libvncserver/sockets.c
|
|
+++ b/server/libvncserver/sockets.c
|
|
@@ -625,12 +625,12 @@ ListenOnTCPPort(rfbScreenInfoPtr rfbScreen, int port, const char *netIface)
|
|
rfbLog("Listening IPv4://0.0.0.0:%d\n", port);
|
|
|
|
#ifdef VINO_ENABLE_IPV6
|
|
- if(sock6 > 0) {
|
|
+ if(sock6 >= 0) {
|
|
psock[*ptot] = sock6;
|
|
*ptot += 1;
|
|
}
|
|
#endif
|
|
- if(sock > 0) {
|
|
+ if(sock >= 0) {
|
|
psock[*ptot] = sock;
|
|
*ptot += 1;
|
|
}
|
|
@@ -683,7 +683,7 @@ ListenOnTCPPort(rfbScreenInfoPtr rfbScreen, int port, const char *netIface)
|
|
}
|
|
#endif
|
|
|
|
- if(sock > 0) {
|
|
+ if(sock >= 0) {
|
|
psock[*ptot] = sock;
|
|
*ptot += 1;
|
|
sock = -1;
|
|
diff --git a/server/libvncserver/tableinit24.c b/server/libvncserver/tableinit24.c
|
|
index 39e9920..575a501 100644
|
|
--- a/server/libvncserver/tableinit24.c
|
|
+++ b/server/libvncserver/tableinit24.c
|
|
@@ -149,9 +149,9 @@ rfbInitOneRGBTable24 (uint8_t *table, int inMax, int outMax, int outShift,
|
|
*(uint32_t *)&table[3*i] = outValue;
|
|
if(!rfbEndianTest)
|
|
memmove(table+3*i,table+3*i+1,3);
|
|
- if (swap) {
|
|
- c = table[3*i]; table[3*i] = table[3*i+2];
|
|
- table[3*i+2] = c;
|
|
- }
|
|
+ if (swap) {
|
|
+ c = table[3*i]; table[3*i] = table[3*i+2];
|
|
+ table[3*i+2] = c;
|
|
+ }
|
|
}
|
|
}
|
|
diff --git a/server/miniupnp/minissdpc.c b/server/miniupnp/minissdpc.c
|
|
index d37599f..64772f9 100644
|
|
--- a/server/miniupnp/minissdpc.c
|
|
+++ b/server/miniupnp/minissdpc.c
|
|
@@ -40,7 +40,7 @@ getDevicesFromMiniSSDPD(const char * devtype, const char * socketpath)
|
|
return NULL;
|
|
}
|
|
addr.sun_family = AF_UNIX;
|
|
- strncpy(addr.sun_path, socketpath, sizeof(addr.sun_path));
|
|
+ strncpy(addr.sun_path, socketpath, sizeof(addr.sun_path) - 1);
|
|
if(connect(s, (struct sockaddr *)&addr, sizeof(struct sockaddr_un)) < 0)
|
|
{
|
|
/*syslog(LOG_WARNING, "connect(\"%s\"): %m", socketpath);*/
|
|
diff --git a/server/miniupnp/miniupnpc.c b/server/miniupnp/miniupnpc.c
|
|
index f9d620e..718526a 100644
|
|
--- a/server/miniupnp/miniupnpc.c
|
|
+++ b/server/miniupnp/miniupnpc.c
|
|
@@ -402,6 +402,7 @@ struct UPNPDev * upnpDiscover(int delay, const char * multicastif,
|
|
#endif
|
|
{
|
|
PRINT_SOCKET_ERROR("setsockopt");
|
|
+ closesocket(sudp);
|
|
return NULL;
|
|
}
|
|
|
|
diff --git a/server/smclient/eggsmclient-xsmp.c b/server/smclient/eggsmclient-xsmp.c
|
|
index d5cf3b5..5ca976f 100644
|
|
--- a/server/smclient/eggsmclient-xsmp.c
|
|
+++ b/server/smclient/eggsmclient-xsmp.c
|
|
@@ -1162,6 +1162,7 @@ array_prop (const char *name, ...)
|
|
pv.value = value;
|
|
g_array_append_val (vals, pv);
|
|
}
|
|
+ va_end (ap);
|
|
|
|
prop->num_vals = vals->len;
|
|
prop->vals = (SmPropValue *)vals->data;
|
|
--
|
|
2.19.0
|
|
|