A collection of small bug fixes from Chris West, apparently spotted by

Coverity: assorted language-use goofs like freeing the wrong thing or
forgetting to initialise a string on all code paths.

git-svn-id: svn://svn.tartarus.org/sgt/putty@9889 cda61777-01e9-0310-a592-d414129be87e

diff --git a/ssh.c b/ssh.c
index 6ee5528..bbe81b6 100644 (file)
--- a/ssh.c
+++ b/ssh.c
@@ -9685,7 +9685,7 @@ static void ssh_free(void *handle)
     while (ssh->qhead) {
        struct queued_handler *qh = ssh->qhead;
        ssh->qhead = qh->next;
-       sfree(ssh->qhead);
+       sfree(qh);
     }
     ssh->qhead = ssh->qtail = NULL;
 

diff --git a/sshpubk.c b/sshpubk.c
index 76aa343..bd3c5e4 100644 (file)
--- a/sshpubk.c
+++ b/sshpubk.c
@@ -257,8 +257,8 @@ int rsakey_pubblob(const Filename *filename, void **blob, int *bloblen,
            *blob = rsa_public_blob(&key, bloblen);
            freersakey(&key);
            ret = 1;
-           fp = NULL;
        }
+       fp = NULL; /* loadrsakey_main unconditionally closes fp */
     } else {
        error = "not an SSH-1 RSA file";
     }
@@ -679,7 +679,6 @@ struct ssh2_userkey *ssh2_load_userkey(const Filename *filename,
        cipher = 0;
        cipherblk = 1;
     } else {
-       sfree(encryption);
        goto error;
     }
 

diff --git a/unix/gtkwin.c b/unix/gtkwin.c
index da40e54..f403a80 100644 (file)
--- a/unix/gtkwin.c
+++ b/unix/gtkwin.c
@@ -1597,7 +1597,7 @@ void palette_set(void *frontend, int n, int r, int g, int b)
     struct gui_data *inst = (struct gui_data *)frontend;
     if (n >= 16)
        n += 256 - 16;
-    if (n > NALLCOLOURS)
+    if (n >= NALLCOLOURS)
        return;
     real_palette_set(inst, n, r, g, b);
     if (n == 258) {

diff --git a/unix/uxpty.c b/unix/uxpty.c
index 7ea7131..99ff638 100644 (file)
--- a/unix/uxpty.c
+++ b/unix/uxpty.c
@@ -633,6 +633,7 @@ int pty_real_select_result(Pty pty, int event, int status)
        if (close_on_exit == FORCE_OFF ||
            (close_on_exit == AUTO && pty->exit_code != 0)) {
            char message[512];
+            message[0] = '\0';
            if (WIFEXITED(pty->exit_code))
                sprintf(message, "\r\n[pterm: process terminated with exit"
                        " code %d]\r\n", WEXITSTATUS(pty->exit_code));