Round #2 of scan-build warnings cleanup

include/bits.c

@@ -118,7 +118,8 @@ int main(int argc, char **argv)
 {
     FILE *f;
     int flag;
-    const char *fn, *hb;
+    char *p = NULL;
+    const char *hb;
 
     if (argc > 1 && strcmp(argv[1], "--version") == 0) {
 	printf("some version");
@@ -126,14 +127,11 @@ int main(int argc, char **argv)
     }
 
     if(argc < 2){
-	fn = "bits.h";
 	hb = "__BITS_H__";
 	f = stdout;
     } else {
-	char *p;
+	p = malloc(strlen(argv[1]) + 5);
-	fn = argv[1];
+	sprintf(p, "__%s__", argv[1]);
-	p = malloc(strlen(fn) + 5);
-	sprintf(p, "__%s__", fn);
 	hb = p;
 	for(; *p; p++){
 	    if(!isalnum((unsigned char)*p))

lib/asn1/der_put.c

@@ -502,12 +502,14 @@ _heim_time2generalizedtime (time_t t, heim_octet_string *s, int gtimep)
      struct tm tm;
      const size_t len = gtimep ? 15 : 13;
 
+     s->data = NULL;
+     s->length = 0;
+     if (_der_gmtime(t, &tm) == NULL)
+	 return ASN1_BAD_TIMEFORMAT;
      s->data = malloc(len + 1);
      if (s->data == NULL)
 	 return ENOMEM;
      s->length = len;
-     if (_der_gmtime(t, &tm) == NULL)
-	 return ASN1_BAD_TIMEFORMAT;
      if (gtimep)
 	 snprintf (s->data, len + 1, "%04d%02d%02d%02d%02d%02dZ",
 		   tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday,

lib/base/db.c

@@ -500,6 +500,8 @@ heim_db_begin(heim_db_t db, int read_only, heim_error_t *error)
 
     if (db->plug->beginf) {
 	ret = db->plug->beginf(db->db_data, read_only, error);
+        if (ret)
+            return ret;
     } else if (!db->in_transaction) {
 	/* Try to emulate transactions */
 

lib/base/heimbase.c

@@ -986,7 +986,7 @@ heim_path_vcreate(heim_object_t ptr, size_t size, heim_object_t leaf,
 					  heim_number_get_int(path_element),
 					  leaf);
     }
-    return 0;
+    return ret;
 
 err:
     if (error && !*error) {

lib/gssapi/krb5/8003.c

@@ -157,7 +157,7 @@ _gsskrb5_create_8003_checksum (
 	*p++ = (fwd_data->length >> 8) & 0xFF;    /* Dlgth  */
 	memcpy(p, (unsigned char *) fwd_data->data, fwd_data->length);
 
-	p += fwd_data->length;
+	/* p += fwd_data->length; */ /* commented out to quiet warning */
     }
 
     return GSS_S_COMPLETE;

lib/gssapi/krb5/accept_sec_context.c

@@ -482,6 +482,7 @@ gsskrb5_acceptor_start(OM_uint32 * minor_status,
     if (kret) {
 	ret = GSS_S_FAILURE;
 	*minor_status = kret;
+	return ret;
     }
 
     kret = krb5_copy_principal(context,

lib/gssapi/krb5/add_cred.c

@@ -154,8 +154,6 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_add_cred (
 	if (cred->keytab) {
 	    char *name = NULL;
 
-	    major = GSS_S_FAILURE;
-
             *minor_status = krb5_kt_get_full_name(context, cred->keytab,
                                                   &name);
 	    if (*minor_status)
@@ -171,8 +169,6 @@ OM_uint32 GSSAPI_CALLCONV _gsskrb5_add_cred (
 	    const char *type, *name;
 	    char *type_name = NULL;
 
-	    major = GSS_S_FAILURE;
-
 	    type = krb5_cc_get_type(context, cred->ccache);
 	    if (type == NULL){
 		*minor_status = ENOMEM;

lib/gssapi/krb5/arcfour.c

@@ -1114,6 +1114,7 @@ _gssapi_wrap_iov_arcfour(OM_uint32 *minor_status,
     if (kret) {
 	*minor_status = kret;
 	major_status = GSS_S_FAILURE;
+        return major_status;
     }
 
     {

lib/gssapi/krb5/cfx.c

@@ -391,7 +391,6 @@ _gssapi_wrap_cfx_iov(OM_uint32 *minor_status,
 	if (IS_DCE_STYLE(ctx))
 	    rrc -= ec;
 	gsshsize += gsstsize;
-	gsstsize = 0;
     } else if (GSS_IOV_BUFFER_FLAGS(trailer->type) & GSS_IOV_BUFFER_FLAG_ALLOCATE) {
 	major_status = _gk_allocate_buffer(minor_status, trailer, gsstsize);
 	if (major_status)
@@ -683,6 +682,7 @@ unrotate_iov(OM_uint32 *minor_status, size_t rrc, gss_iov_buffer_desc *iov, int
 	    if (iov[i].buffer.length <= skip) {
 		skip -= iov[i].buffer.length;
 	    } else {
+                /* copy back to original buffer */
 		memcpy(((uint8_t *)iov[i].buffer.value) + skip, q, iov[i].buffer.length - skip);
 		q += iov[i].buffer.length - skip;
 		skip = 0;
@@ -697,13 +697,14 @@ unrotate_iov(OM_uint32 *minor_status, size_t rrc, gss_iov_buffer_desc *iov, int
 	    GSS_IOV_BUFFER_TYPE(iov[i].type) == GSS_IOV_BUFFER_TYPE_PADDING ||
 	    GSS_IOV_BUFFER_TYPE(iov[i].type) == GSS_IOV_BUFFER_TYPE_TRAILER)
 	{
-	    memcpy(q, iov[i].buffer.value, min(iov[i].buffer.length, skip));
+	    memcpy(iov[i].buffer.value, q, min(iov[i].buffer.length, skip));
 	    if (iov[i].buffer.length > skip)
 		break;
 	    skip -= iov[i].buffer.length;
 	    q += iov[i].buffer.length;
 	}
     }
+    free(p);
     return GSS_S_COMPLETE;
 }
 
@@ -930,7 +931,6 @@ _gssapi_unwrap_cfx_iov(OM_uint32 *minor_status,
 	    }
 
 	    gsshsize += gsstsize;
-	    gsstsize = 0;
 	} else if (trailer->buffer.length != gsstsize) {
 	    major_status = GSS_S_DEFECTIVE_TOKEN;
 	    goto failure;

lib/gssapi/krb5/context_time.c

@@ -49,6 +49,7 @@ _gsskrb5_lifetime_left(OM_uint32 *minor_status,
 
     kret = krb5_timeofday(context, &now);
     if (kret) {
+        *lifetime_rec = 0;
 	*minor_status = kret;
 	return GSS_S_FAILURE;
     }

lib/gssapi/krb5/creds.c

@@ -229,6 +229,10 @@ _gsskrb5_import_cred(OM_uint32 * minor_status,
 
 	ret = krb5_cc_store_cred(context, id, &creds);
 	krb5_free_cred_contents(context, &creds);
+	if (ret) {
+	    *minor_status = ret;
+	    return GSS_S_FAILURE;
+	}
 
 	flags |= GSS_CF_DESTROY_CRED_ON_RELEASE;
 

lib/gssapi/krb5/init_sec_context.c

@@ -787,14 +787,11 @@ repl_mutual
 			       repl);
 
     *minor_status = 0;
-    if (time_rec) {
+    if (time_rec)
-	ret = _gsskrb5_lifetime_left(minor_status,
+        _gsskrb5_lifetime_left(minor_status,
-				     context,
+                               context,
-				     ctx->endtime,
+                               ctx->endtime,
-				     time_rec);
+                               time_rec);
-    } else {
-	ret = GSS_S_COMPLETE;
-    }
     if (ret_flags)
 	*ret_flags = ctx->flags;
 

lib/gssapi/krb5/verify_mic.c

@@ -254,15 +254,11 @@ retry:
   krb5_crypto_destroy (context, crypto);
   ret = krb5_crypto_init(context, key,
 			 ETYPE_DES3_CBC_SHA1, &crypto);
-  if (ret){
+  if (ret == 0)
-      *minor_status = ret;
+      ret = krb5_verify_checksum(context, crypto,
-      return GSS_S_FAILURE;
+                                 KRB5_KU_USAGE_SIGN,
-  }
+                                 tmp, message_buffer->length + 8,
-
+                                 &csum);
-  ret = krb5_verify_checksum (context, crypto,
-			      KRB5_KU_USAGE_SIGN,
-			      tmp, message_buffer->length + 8,
-			      &csum);
   free (tmp);
   if (ret) {
       krb5_crypto_destroy (context, crypto);

lib/gssapi/mech/gss_indicate_mechs.c

@@ -43,6 +43,7 @@ gss_indicate_mechs(OM_uint32 *minor_status,
 	if (major_status)
 		return (major_status);
 
+        /* XXX We ignore ENOMEM from gss_add_oid_set_member() */
 	HEIM_SLIST_FOREACH(m, &_gss_mechs, gm_link) {
 		if (m->gm_mech.gm_indicate_mechs) {
 			major_status = m->gm_mech.gm_indicate_mechs(
@@ -50,11 +51,11 @@ gss_indicate_mechs(OM_uint32 *minor_status,
 			if (major_status)
 				continue;
 			for (i = 0; i < set->count; i++)
-				major_status = gss_add_oid_set_member(
+				gss_add_oid_set_member(
 				    minor_status, &set->elements[i], mech_set);
 			gss_release_oid_set(minor_status, &set);
 		} else {
-			major_status = gss_add_oid_set_member(
+			gss_add_oid_set_member(
 			    minor_status, &m->gm_mech_oid, mech_set);
 		}
 	}

lib/gssapi/ntlm/creds.c

@@ -62,6 +62,7 @@ _gss_ntlm_inquire_cred
 	if (n == NULL || n->user == NULL || n->domain == NULL) {
 	    if (n)
 		free(n->user);
+            free(n);
 	    *minor_status = ENOMEM;
 	    return GSS_S_FAILURE;
 	}

lib/gssapi/test_cred.c

@@ -154,6 +154,8 @@ acquire_add_release_add(gss_name_t name, gss_cred_usage_t usage)
 			    NULL,
 			    NULL,
 			    NULL);
+    if (maj_stat != GSS_S_COMPLETE)
+	gss_err(1, min_stat, "add_cred 2 %d != GSS_S_COMPLETE", (int)maj_stat);
 
     maj_stat = gss_release_cred(&min_stat, &cred2);
     if (maj_stat != GSS_S_COMPLETE)
@@ -161,7 +163,7 @@ acquire_add_release_add(gss_name_t name, gss_cred_usage_t usage)
 
     maj_stat = gss_release_cred(&min_stat, &cred3);
     if (maj_stat != GSS_S_COMPLETE)
-	gss_err(1, min_stat, "release 2 %d != GSS_S_COMPLETE", (int)maj_stat);
+	gss_err(1, min_stat, "release 3 %d != GSS_S_COMPLETE", (int)maj_stat);
 }
 
 static int version_flag = 0;

lib/gssapi/test_ntlm.c

@@ -333,5 +333,5 @@ main(int argc, char **argv)
     ret += test_libntlm_v2(0);
     ret += test_libntlm_v2(NTLM_NEG_KEYEX);
 
-    return 0;
+    return ret;
 }

lib/hcrypto/evp-pkcs11.c

@@ -121,17 +121,13 @@ p11_module_init_once(void *context)
             fprintf(stderr, "p11_module_init(%s): %s\n", PKCS11_MODULE_PATH, dlerror());
     }
 #endif
-    if (pkcs11_module_handle == NULL) {
+    if (pkcs11_module_handle == NULL)
-        rv = CKR_LIBRARY_LOAD_FAILED;
         goto cleanup;
-    }
 
     C_GetFunctionList_fn = (CK_RV (*)(CK_FUNCTION_LIST_PTR_PTR))
 	dlsym(pkcs11_module_handle, "C_GetFunctionList");
-    if (C_GetFunctionList_fn == NULL) {
+    if (C_GetFunctionList_fn == NULL)
-        rv = CKR_LIBRARY_LOAD_FAILED;
         goto cleanup;
-    }
 
     rv = C_GetFunctionList_fn(&module);
     if (rv != CKR_OK)

lib/hcrypto/evp.c

@@ -603,7 +603,8 @@ EVP_CIPHER_CTX_cleanup(EVP_CIPHER_CTX *c)
 	    return ret;
     }
     if (c->cipher_data) {
-	memset(c->cipher_data, 0, c->cipher->ctx_size);
+        if (c->cipher)
+            memset(c->cipher_data, 0, c->cipher->ctx_size);
 	free(c->cipher_data);
 	c->cipher_data = NULL;
     }

lib/hcrypto/test_rand.c

@@ -103,10 +103,7 @@ main(int argc, char **argv)
 	exit(0);
     }
 
-    argc -= idx;
+    if (argc != idx)
-    argv += idx;
-
-    if (argc != 0)
 	usage(1);
 
     buffer = emalloc(len);

lib/hdb/common.c

@@ -222,9 +222,11 @@ hdb_remove_aliases(krb5_context context, HDB *db, krb5_data *key)
     for (i = 0; i < aliases->aliases.len; i++) {
 	krb5_data akey;
 
-	hdb_principal2key(context, &aliases->aliases.val[i], &akey);
+	code = hdb_principal2key(context, &aliases->aliases.val[i], &akey);
-	code = db->hdb__del(context, db, akey);
+        if (code == 0) {
-	krb5_data_free(&akey);
+            code = db->hdb__del(context, db, akey);
+            krb5_data_free(&akey);
+        }
 	if (code) {
 	    free_hdb_entry(&oldentry);
 	    return code;
@@ -251,14 +253,16 @@ hdb_add_aliases(krb5_context context, HDB *db,
 	hdb_entry_alias entryalias;
 	entryalias.principal = entry->entry.principal;
 
-	hdb_principal2key(context, &aliases->aliases.val[i], &key);
 	code = hdb_entry_alias2value(context, &entryalias, &value);
 	if (code) {
 	    krb5_data_free(&key);
 	    return code;
 	}
-	code = db->hdb__put(context, db, flags, key, value);
+	code = hdb_principal2key(context, &aliases->aliases.val[i], &key);
-	krb5_data_free(&key);
+        if (code == 0) {
+            code = db->hdb__put(context, db, flags, key, value);
+            krb5_data_free(&key);
+        }
 	krb5_data_free(&value);
 	if (code)
 	    return code;
@@ -283,9 +287,11 @@ hdb_check_aliases(krb5_context context, HDB *db, hdb_entry_ex *entry)
 	hdb_entry_alias alias;
 	krb5_data akey, value;
 
-	hdb_principal2key(context, &aliases->aliases.val[i], &akey);
+	code = hdb_principal2key(context, &aliases->aliases.val[i], &akey);
-	code = db->hdb__get(context, db, akey, &value);
+        if (code == 0) {
-	krb5_data_free(&akey);
+            code = db->hdb__get(context, db, akey, &value);
+            krb5_data_free(&akey);
+        }
 	if (code == HDB_ERR_NOENTRY)
 	    continue;
 	else if (code)

lib/hdb/hdb-sqlite.c

@@ -635,7 +635,6 @@ hdb_sqlite_store(krb5_context context, HDB *db, unsigned flags,
             ret = HDB_ERR_EXISTS;
             goto rollback;
         }
-        ret = 0;
 
 	ret = bind_principal(context, entry->entry.principal, hsdb->add_principal, 1);
 	if (ret)
@@ -663,8 +662,6 @@ hdb_sqlite_store(krb5_context context, HDB *db, unsigned flags,
 
         entry_id = sqlite3_column_int64(get_ids, 1);
 
-        ret = 0;
-
     } else if(ret == SQLITE_ROW) { /* Found a principal */
 
         if(! (flags & HDB_F_REPLACE)) /* Not allowed to replace it */

lib/hdb/hdb.c

@@ -420,6 +420,7 @@ hdb_list_builtin(krb5_context context, char **list)
             if (asprintf(&f, "%sfoo", h->prefix) == -1)
                 f = NULL;
             if ((sym = make_sym(h->prefix)) == NULL) {
+                free(buf);
                 free(f);
                 return krb5_enomem(context);
             }

lib/hdb/keys.c

@@ -167,15 +167,14 @@ parse_key_set(krb5_context context, const char *key,
 	       salt with, this is mostly useful with null salt for
 	       v4 compat, and a cell name for afs compat */
 	    salt->saltvalue.data = strdup(buf[i]);
-	    if (salt->saltvalue.data == NULL) {
+	    if (salt->saltvalue.data == NULL)
-		krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
+                return krb5_enomem(context);
-		return ENOMEM;
-	    }
 	    salt->saltvalue.length = strlen(buf[i]);
 	}
     }
 
     if(enctypes == NULL || salt->salttype == 0) {
+	krb5_free_salt(context, *salt);
 	krb5_set_error_message(context, EINVAL, "bad value for default_keys `%s'", key);
 	return EINVAL;
     }
@@ -689,6 +688,7 @@ hdb_generate_key_set(krb5_context context, krb5_principal principal,
 	if (ret) {
 	    krb5_warn(context, ret, "bad value for default_keys `%s'", *kp);
 	    ret = 0;
+            krb5_free_salt(context, salt);
 	    continue;
 	}
 

lib/hx509/cert.c

@@ -1846,7 +1846,7 @@ match_alt_name(const GeneralName *n, const Certificate *c,
 	       int *same, int *match)
 {
     GeneralNames sa;
-    int ret;
+    int ret = 0;
     size_t i, j;
 
     i = 0;
@@ -1861,7 +1861,7 @@ match_alt_name(const GeneralName *n, const Certificate *c,
 	for (j = 0; j < sa.len; j++) {
 	    if (n->element == sa.val[j].element) {
 		*same = 1;
-		ret = match_general_name(n, &sa.val[j], match);
+		match_general_name(n, &sa.val[j], match);
 	    }
 	}
 	free_GeneralNames(&sa);
@@ -1900,7 +1900,7 @@ match_tree(const GeneralSubtrees *t, const Certificate *c, int *match)
 	    certname.u.directoryName.u.rdnSequence =
 		c->tbsCertificate.subject.u.rdnSequence;
 
-	    ret = match_general_name(&t->val[i].base, &certname, &name);
+	    match_general_name(&t->val[i].base, &certname, &name);
 	}
 
 	/* Handle subjectAltNames, this is icky since they
@@ -1908,7 +1908,7 @@ match_tree(const GeneralSubtrees *t, const Certificate *c, int *match)
 	 * same type. So if there have been a match of type, require
 	 * altname to be set.
 	 */
-	ret = match_alt_name(&t->val[i].base, c, &same, &alt_name);
+	match_alt_name(&t->val[i].base, c, &same, &alt_name);
     }
     if (name && (!same || alt_name))
 	*match = 1;

lib/hx509/name.c

@@ -238,14 +238,17 @@ _hx509_Name_to_string(const Name *n, char **str)
 		size_t k;
 
 		ret = wind_ucs2utf8_length(bmp, bmplen, &k);
-		if (ret)
+		if (ret) {
+                    free(oidname);
 		    return ret;
+                }
 
 		ss = malloc(k + 1);
 		if (ss == NULL)
 		    _hx509_abort("allocation failure"); /* XXX */
 		ret = wind_ucs2utf8(bmp, bmplen, ss, NULL);
 		if (ret) {
+                    free(oidname);
 		    free(ss);
 		    return ret;
 		}
@@ -263,8 +266,10 @@ _hx509_Name_to_string(const Name *n, char **str)
 		size_t k;
 
 		ret = wind_ucs4utf8_length(uni, unilen, &k);
-		if (ret)
+		if (ret) {
+                    free(oidname);
 		    return ret;
+                }
 
 		ss = malloc(k + 1);
 		if (ss == NULL)
@@ -272,6 +277,7 @@ _hx509_Name_to_string(const Name *n, char **str)
 		ret = wind_ucs4utf8(uni, unilen, ss, NULL);
 		if (ret) {
 		    free(ss);
+                    free(oidname);
 		    return ret;
 		}
 		ss[k] = '\0';

lib/kadm5/iprop-log.c

@@ -400,7 +400,7 @@ int
 last_version(struct last_version_options *opt, int argc, char **argv)
 {
     kadm5_server_context *server_context;
-    char *alt_argv[2];
+    char *alt_argv[2] = { NULL, NULL };
     krb5_error_code ret;
     uint32_t version;
     size_t i;
@@ -410,7 +410,6 @@ last_version(struct last_version_options *opt, int argc, char **argv)
 
     if (argc == 0) {
         alt_argv[0] = strdup(server_context->log_context.log_file);
-        alt_argv[1] = NULL;
         if (alt_argv[0] == NULL)
             krb5_err(context, 1, errno, "strdup");
         argv = alt_argv;
@@ -451,6 +450,7 @@ last_version(struct last_version_options *opt, int argc, char **argv)
     }
 
     kadm5_destroy(server_context);
+    free(alt_argv[0]);
     return 0;
 }
 

lib/krb5/cache.c

@@ -1754,8 +1754,10 @@ krb5_cc_get_lifetime(krb5_context context, krb5_ccache id, time_t *t)
 	return krb5_enomem(context);
 
     ret = krb5_cc_start_seq_get(context, id, &cursor);
-    if (ret)
+    if (ret) {
+        free(start_realm);
 	return ret;
+    }
 
     while ((ret = krb5_cc_next_cred(context, id, &cursor, &cred)) == 0) {
 	/**

lib/krb5/dcache.c

@@ -547,8 +547,10 @@ static krb5_error_code KRB5_CALLCONV
 dcc_get_cache_first(krb5_context context, krb5_cc_cursor *cursor)
 {
     struct dcache_iter *iter;
+    krb5_error_code ret;
     char *name;
 
+    *cursor = NULL;
     iter = calloc(1, sizeof(*iter));
     if (iter == NULL)
 	return krb5_enomem(context);
@@ -562,18 +564,17 @@ dcc_get_cache_first(krb5_context context, krb5_cc_cursor *cursor)
 	return KRB5_CC_FORMAT;
     }
 
-#if 1
-    free(name);
-    return KRB5_CC_FORMAT;
-#else
-
-    /* XXX */
     ret = dcc_resolve(context, NULL, name);
     free(name);
+    if (ret) {
+        free(iter);
+        return ret;
+    }
+
+    /* XXX We need to opendir() here */
 
     *cursor = iter;
     return 0;
-#endif
 }
 
 static krb5_error_code KRB5_CALLCONV
@@ -588,6 +589,8 @@ dcc_get_cache_next(krb5_context context, krb5_cc_cursor cursor, krb5_ccache *id)
 	krb5_clear_error_message(context);
 	return KRB5_CC_END;
     }
+
+    /* XXX We need to readdir() here */
     iter->first = 0;
 
     return KRB5_CC_END;
@@ -601,6 +604,7 @@ dcc_end_cache_get(krb5_context context, krb5_cc_cursor cursor)
     if (iter == NULL)
         return krb5_einval(context, 2);
 
+    /* XXX We need to closedir() here */
     if (iter->dc)
 	dcc_release(context, iter->dc);
     free(iter);

lib/krb5/expand_path.c

@@ -465,7 +465,6 @@ _krb5_expand_path_tokensv(krb5_context context,
     char *tok_begin, *tok_end, *append;
     char **extra_tokens = NULL;
     const char *path_left;
-    const char *s;
     size_t nargs = 0;
     size_t len = 0;
     va_list ap;
@@ -478,9 +477,9 @@ _krb5_expand_path_tokensv(krb5_context context,
     *ppath_out = NULL;
 
     va_start(ap, ppath_out);
-    while ((s = va_arg(ap, const char *))) {
+    while (va_arg(ap, const char *)) {
 	nargs++;
-        s = va_arg(ap, const char *);
+        va_arg(ap, const char *);
     }
     va_end(ap);
     nargs *= 2;
@@ -494,7 +493,7 @@ _krb5_expand_path_tokensv(krb5_context context,
 	    return krb5_enomem(context);
 	va_start(ap, ppath_out);
 	for (i = 0; i < nargs; i++) {
-	    s = va_arg(ap, const char *); /* token key */
+	    char *s = va_arg(ap, const char *); /* token key */
 	    if (s == NULL)
 		break;
 	    extra_tokens[i] = strdup(s);

lib/krb5/fcache.c

@@ -964,12 +964,12 @@ cred_delete(krb5_context context,
     if (srealm && strcmp(srealm, "X-CACHECONF:") == 0) {
 	ret = krb5_principal_set_realm(context, cred->server, "X-RMED-CONF:");
 	if (ret)
-	    return;
+	    goto out;
     }
 
     sp = krb5_storage_emem();
     if (sp == NULL)
-	return;
+	goto out;
     krb5_storage_set_eof_code(sp, KRB5_CC_END);
     storage_set_flags(context, sp, FCACHE(id)->version);
 

lib/krb5/keytab_file.c

@@ -486,6 +486,8 @@ loop:
     if(start) *start = pos;
     if(end) *end = pos + 4 + len;
  out:
+    if (ret)
+        krb5_kt_free_entry(context, entry);
     krb5_storage_seek(cursor->sp, pos + 4 + len, SEEK_SET);
     return ret;
 }

lib/krb5/keytab_keyfile.c

@@ -127,7 +127,7 @@ static krb5_error_code KRB5_CALLCONV
 akf_resolve(krb5_context context, const char *name, krb5_keytab id)
 {
     int ret;
-    struct akf_data *d = malloc(sizeof (struct akf_data));
+    struct akf_data *d = calloc(1, sizeof (struct akf_data));
 
     if (d == NULL)
 	return krb5_enomem(context);

lib/krb5/pkinit.c

@@ -307,8 +307,10 @@ cert2epi(hx509_context context, void *ctx, hx509_cert c)
 			   id.issuerAndSerialNumber->length,
 			   &iasn, &size, ret);
 	free_IssuerAndSerialNumber(&iasn);
-	if (ret)
+	if (ret) {
+            free_ExternalPrincipalIdentifier(&id);
 	    return ret;
+        }
 	if (id.issuerAndSerialNumber->length != size)
 	    abort();
     }

lib/krb5/principal.c

@@ -1357,6 +1357,7 @@ krb5_sname_to_principal(krb5_context context,
 	if (ret) {
 	    _krb5_debug(context, 5, "Failed to get name canon rules: ret = %d",
 			ret);
+	    free(remote_host);
 	    return ret;
 	}
 	if (rules[0].type == KRB5_NCRT_NSS &&
@@ -1784,8 +1785,6 @@ apply_name_canon_rule(krb5_context context, krb5_name_canon_rule rules,
     if (ndots > rule->maxdots)
             return 0;
 
-    ret = 0;
-
     if (rule->match_domain != NULL &&
         !is_domain_suffix(orig_hostname, rule->match_domain))
         return 0;

lib/krb5/store.c

@@ -450,6 +450,7 @@ krb5_ret_int(krb5_storage *sp,
     int ret;
     unsigned char v[8];
     uint64_t w;
+    *value = 0; /* quiets warnings */
     ret = sp->fetch(sp, v, len);
     if (ret < 0)
 	return errno;

lib/roken/getcap.c

@@ -280,6 +280,7 @@ getent(char **cap, size_t *len, char **db_array, int fd,
 		!= NULL) {
 		free(record);
 		retval = cdbget(capdbp, &record, name);
+                /* record is no longer for us to free here */
 		if (retval < 0) {
 		    /* no record available */
 		    (void)capdbp->close(capdbp);
@@ -400,17 +401,20 @@ getent(char **cap, size_t *len, char **db_array, int fd,
 				 */
 		    if (rp >= r_end) {
 			u_int pos;
+                        char *tmp;
 			size_t newsize;
 
 			pos = rp - record;
 			newsize = r_end - record + BFRAG;
-			record = realloc(record, newsize);
+			tmp = realloc(record, newsize);
-			if (record == NULL) {
+			if (tmp == NULL) {
 			    errno = ENOMEM;
 			    if (myfd)
 				(void)close(fd);
+                            free(record);
 			    return (-2);
 			}
+                        record = tmp;
 			r_end = record + newsize;
 			rp = record + pos;
 		    }
@@ -448,8 +452,10 @@ getent(char **cap, size_t *len, char **db_array, int fd,
 	    break;
     }
 
-    if (!foundit)
+    if (!foundit) {
+        free(record);
 	return (-1);
+    }
 
     /*
      * Got the capability record, but now we have to expand all tc=name
@@ -541,19 +547,22 @@ getent(char **cap, size_t *len, char **db_array, int fd,
 	    if (diff >= r_end - rp) {
 		u_int pos, tcpos, tcposend;
 		size_t newsize;
+                char *tmp;
 
 		pos = rp - record;
 		newsize = r_end - record + diff + BFRAG;
 		tcpos = tcstart - record;
 		tcposend = tcend - record;
-		record = realloc(record, newsize);
+		tmp = realloc(record, newsize);
-		if (record == NULL) {
+		if (tmp == NULL) {
 		    errno = ENOMEM;
 		    if (myfd)
 			(void)close(fd);
 		    free(icap);
+                    free(record);
 		    return (-2);
 		}
+                record = tmp;
 		r_end = record + newsize;
 		rp = record + pos;
 		tcstart = record + tcpos;
@@ -584,12 +593,15 @@ getent(char **cap, size_t *len, char **db_array, int fd,
     if (myfd)
 	(void)close(fd);
     *len = rp - record - 1;	/* don't count NUL */
-    if (r_end > rp)
+    if (r_end > rp) {
-	if ((record =
+        char *tmp = realloc(record, (size_t)(rp - record));
-	     realloc(record, (size_t)(rp - record))) == NULL) {
+	if (tmp == NULL) {
 	    errno = ENOMEM;
+            free(record);
 	    return (-2);
 	}
+        record = tmp;
+    }
 
     *cap = record;
     if (tc_not_resolved)
@@ -886,9 +898,14 @@ cgetustr(char *buf, const char *cap, char **str)
     /*
      * Give back any extra memory and return value and success.
      */
-    if (m_room != 0)
+    if (m_room != 0) {
-	if ((mem = realloc(mem, (size_t)(mp - mem))) == NULL)
+        char *tmp = realloc(mem, (size_t)(mp - mem));
+	if (tmp == NULL) {
+            free(mem);
 	    return (-2);
+        }
+        mem = tmp;
+    }
     *str = mem;
     return (len);
 }

lib/roken/tsearch.c

@@ -117,14 +117,13 @@ rk_tdelete(const void * vkey, void ** vrootp,
 	int (*compar)(const void *, const void *))
 {
 	node_t **rootp = (node_t **)vrootp;
-	node_t *p, *q, *r;
+	node_t *q, *r;
 	int cmp;
 
-	if (rootp == NULL || (p = *rootp) == NULL)
+	if (rootp == NULL || *rootp == NULL)
 		return NULL;
 
 	while ((cmp = (*compar)(vkey, (*rootp)->key)) != 0) {
-		p = *rootp;
 		rootp = (cmp < 0) ?
 		    &(*rootp)->llink :		/* follow llink branch */
 		    &(*rootp)->rlink;		/* follow rlink branch */

lib/sl/slc-gram.y

@@ -328,6 +328,7 @@ gen_command(struct assignment *as)
     cprint(1, "    { ");
     fprintf(cfile, "\"%s\", ", a->u.value);
     fprintf(cfile, "%s_wrap, ", f);
+    free(f);
     b = find(as, "argument");
     if(b)
 	fprintf(cfile, "\"%s %s\", ", a->u.value, b->u.value);