From 8a9ec85763809cd3e849d3b00750ba74222dee18 Mon Sep 17 00:00:00 2001
From: simon <simon@cda61777-01e9-0310-a592-d414129be87e>
Date: Mon, 1 Jul 2013 17:56:33 +0000
Subject: [PATCH] A collection of small bug fixes from Chris West, apparently
 spotted by Coverity: assorted language-use goofs like freeing the wrong thing
 or forgetting to initialise a string on all code paths.

git-svn-id: svn://svn.tartarus.org/sgt/putty@9889 cda61777-01e9-0310-a592-d414129be87e
---
 ssh.c         | 2 +-
 sshpubk.c     | 3 +--
 unix/gtkwin.c | 2 +-
 unix/uxpty.c  | 1 +
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/ssh.c b/ssh.c
index 6ee5528c..bbe81b61 100644
--- a/ssh.c
+++ b/ssh.c
@@ -9685,7 +9685,7 @@ static void ssh_free(void *handle)
     while (ssh->qhead) {
 	struct queued_handler *qh = ssh->qhead;
 	ssh->qhead = qh->next;
-	sfree(ssh->qhead);
+	sfree(qh);
     }
     ssh->qhead = ssh->qtail = NULL;
 
diff --git a/sshpubk.c b/sshpubk.c
index 76aa3436..bd3c5e47 100644
--- a/sshpubk.c
+++ b/sshpubk.c
@@ -257,8 +257,8 @@ int rsakey_pubblob(const Filename *filename, void **blob, int *bloblen,
 	    *blob = rsa_public_blob(&key, bloblen);
 	    freersakey(&key);
 	    ret = 1;
-	    fp = NULL;
 	}
+	fp = NULL; /* loadrsakey_main unconditionally closes fp */
     } else {
 	error = "not an SSH-1 RSA file";
     }
@@ -679,7 +679,6 @@ struct ssh2_userkey *ssh2_load_userkey(const Filename *filename,
 	cipher = 0;
 	cipherblk = 1;
     } else {
-	sfree(encryption);
 	goto error;
     }
 
diff --git a/unix/gtkwin.c b/unix/gtkwin.c
index da40e544..f403a807 100644
--- a/unix/gtkwin.c
+++ b/unix/gtkwin.c
@@ -1597,7 +1597,7 @@ void palette_set(void *frontend, int n, int r, int g, int b)
     struct gui_data *inst = (struct gui_data *)frontend;
     if (n >= 16)
 	n += 256 - 16;
-    if (n > NALLCOLOURS)
+    if (n >= NALLCOLOURS)
 	return;
     real_palette_set(inst, n, r, g, b);
     if (n == 258) {
diff --git a/unix/uxpty.c b/unix/uxpty.c
index 7ea7131c..99ff6386 100644
--- a/unix/uxpty.c
+++ b/unix/uxpty.c
@@ -633,6 +633,7 @@ int pty_real_select_result(Pty pty, int event, int status)
 	if (close_on_exit == FORCE_OFF ||
 	    (close_on_exit == AUTO && pty->exit_code != 0)) {
 	    char message[512];
+            message[0] = '\0';
 	    if (WIFEXITED(pty->exit_code))
 		sprintf(message, "\r\n[pterm: process terminated with exit"
 			" code %d]\r\n", WEXITSTATUS(pty->exit_code));
-- 
2.11.0