Misc fixes (coverity)

lib/krb5/auth_context.c

@@ -292,9 +292,9 @@ copy_key(krb5_context context,
 	 krb5_keyblock *in,
 	 krb5_keyblock **out)
 {
-    if(in)
+    *out = NULL;
+    if (in)
 	return krb5_copy_keyblock(context, in, out);
-    *out = NULL; /* is this right? */
     return 0;
 }
 

lib/krb5/krbhst.c

@@ -592,8 +592,10 @@ add_plugin_host(struct krb5_krbhst_data *kd,
     hostlen = strlen(host);
 
     hi = calloc(1, sizeof(*hi) + hostlen);
-    if(hi == NULL)
+    if (hi == NULL) {
+        freeaddrinfo(ai);
 	return ENOMEM;
+    }
 
     hi->proto = proto;
     hi->port  = hi->def_port = portnum;

lib/krb5/pkinit.c

@@ -1133,8 +1133,10 @@ pk_rd_pa_reply_enckey(krb5_context context,
 
 	    ret = der_put_length_and_tag (ptr + ph - 1, ph, content.length,
 					  ASN1_C_UNIV, CONS, UT_Sequence, &l);
-	    if (ret)
+	    if (ret) {
+                free(ptr);
 		return ret;
+            }
 	    free(content.data);
 	    content.data = ptr;
 	    content.length += ph;

lib/krb5/rd_req.c

@@ -243,33 +243,26 @@ krb5_verify_authenticator_checksum(krb5_context context,
 				   size_t len)
 {
     krb5_error_code ret;
-    krb5_keyblock *key;
+    krb5_keyblock *key = NULL;
     krb5_authenticator authenticator;
     krb5_crypto crypto;
 
-    ret = krb5_auth_con_getauthenticator (context,
-				      ac,
-				      &authenticator);
-    if(ret)
+    ret = krb5_auth_con_getauthenticator(context, ac, &authenticator);
+    if (ret)
 	return ret;
-    if(authenticator->cksum == NULL) {
-	krb5_free_authenticator(context, &authenticator);
-	return -17;
+    if (authenticator->cksum == NULL) {
+	ret = -17;
+        goto out;
     }
     ret = krb5_auth_con_getkey(context, ac, &key);
-    if(ret) {
-	krb5_free_authenticator(context, &authenticator);
-	return ret;
-    }
+    if (ret)
+        goto out;
     ret = krb5_crypto_init(context, key, 0, &crypto);
-    if(ret)
+    if (ret)
 	goto out;
-    ret = krb5_verify_checksum (context,
-				crypto,
-				KRB5_KU_AP_REQ_AUTH_CKSUM,
-				data,
-				len,
-				authenticator->cksum);
+    ret = krb5_verify_checksum(context, crypto,
+                               KRB5_KU_AP_REQ_AUTH_CKSUM,
+                               data, len, authenticator->cksum);
     krb5_crypto_destroy(context, crypto);
 out:
     krb5_free_authenticator(context, &authenticator);

lib/krb5/send_to_kdc.c

@@ -851,6 +851,8 @@ submit_request(krb5_context context, krb5_sendto_ctx ctx, krb5_krbhst_info *hi)
 
 	host = heim_alloc(sizeof(*host), "sendto-host", deallocate_host);
 	if (host == NULL) {
+            if (freeai)
+                freeaddrinfo(ai);
 	    rk_closesocket(fd);
 	    return ENOMEM;
 	}

lib/krb5/verify_krb5_conf.c

@@ -163,22 +163,22 @@ check_host(krb5_context context, const char *path, char *data)
 
     /* XXX data could be a list of hosts that this code can't handle */
     /* XXX copied from krbhst.c */
-    if(strncmp(p, "http://", 7) == 0){
+    if (strncmp(p, "http://", 7) == 0){
         p += 7;
 	hints.ai_socktype = SOCK_STREAM;
 	strlcpy(service, "http", sizeof(service));
 	defport = 80;
-    } else if(strncmp(p, "http/", 5) == 0) {
+    } else if (strncmp(p, "http/", 5) == 0) {
         p += 5;
 	hints.ai_socktype = SOCK_STREAM;
 	strlcpy(service, "http", sizeof(service));
 	defport = 80;
-    }else if(strncmp(p, "tcp/", 4) == 0){
+    } else if (strncmp(p, "tcp/", 4) == 0){
         p += 4;
 	hints.ai_socktype = SOCK_STREAM;
 	strlcpy(service, "kerberos", sizeof(service));
 	defport = 88;
-    } else if(strncmp(p, "udp/", 4) == 0) {
+    } else if (strncmp(p, "udp/", 4) == 0) {
         p += 4;
 	hints.ai_socktype = SOCK_DGRAM;
 	strlcpy(service, "kerberos", sizeof(service));
@@ -188,14 +188,14 @@ check_host(krb5_context context, const char *path, char *data)
 	strlcpy(service, "kerberos", sizeof(service));
 	defport = 88;
     }
-    if(strsep_copy(&p, ":", hostname, sizeof(hostname)) < 0) {
+    if (strsep_copy(&p, ":", hostname, sizeof(hostname)) < 0) {
 	return 1;
     }
     hostname[strcspn(hostname, "/")] = '\0';
-    if(p != NULL) {
+    if (p != NULL) {
 	char *end;
 	int tmp = strtol(p, &end, 0);
-	if(end == p) {
+	if (end == p) {
 	    krb5_warnx(context, "%s: failed to parse port number in %s",
 		       path, data);
 	    return 1;
@@ -204,14 +204,15 @@ check_host(krb5_context context, const char *path, char *data)
 	snprintf(service, sizeof(service), "%u", defport);
     }
     ret = getaddrinfo(hostname, service, &hints, &ai);
-    if(ret == EAI_SERVICE && !isdigit((unsigned char)service[0])) {
+    if (ret == EAI_SERVICE && !isdigit((unsigned char)service[0])) {
 	snprintf(service, sizeof(service), "%u", defport);
 	ret = getaddrinfo(hostname, service, &hints, &ai);
     }
-    if(ret != 0) {
+    if (ret != 0) {
 	krb5_warnx(context, "%s: %s (%s)", path, gai_strerror(ret), hostname);
 	return 1;
     }
+    freeaddrinfo(ai);
     return 0;
 }