Misc fixes (coverity)

kcm/acquire.c

@@ -50,6 +50,7 @@ kcm_ccache_acquire(krb5_context context,
     char *in_tkt_service = NULL;
     const char *estr;
 
+    *credp = NULL;
     memset(&cred, 0, sizeof(cred));
 
     KCM_ASSERT_VALID(ccache);
@@ -82,7 +83,7 @@ kcm_ccache_acquire(krb5_context context,
 	    kcm_log(0, "Failed to unparse service principal name for cache %s: %s",
 		    ccache->name, estr);
 	    krb5_free_error_message(context, estr);
-	    return ret;
+	    goto out;
 	}
     }
 
@@ -121,14 +122,9 @@ kcm_ccache_acquire(krb5_context context,
 	kcm_log(0, "Failed to acquire credentials for cache %s: %s",
 		ccache->name, estr);
 	krb5_free_error_message(context, estr);
-	if (in_tkt_service != NULL)
-	    free(in_tkt_service);
 	goto out;
     }
 
-    if (in_tkt_service != NULL)
-	free(in_tkt_service);
-
     /* Swap them in */
     kcm_ccache_remove_creds_internal(context, ccache);
 
@@ -143,6 +139,7 @@ kcm_ccache_acquire(krb5_context context,
     }
 
 out:
+    free(in_tkt_service);
     if (opt)
 	krb5_get_init_creds_opt_free(context, opt);
 

kcm/protocol.c

@@ -1137,17 +1137,19 @@ kcm_op_set_default_cache(krb5_context context,
     }
     if (c == NULL) {
 	c = malloc(sizeof(*c));
-	if (c == NULL)
+	if (c == NULL) {
+            free(name);
 	    return ENOMEM;
+        }
 	c->session = client->session;
 	c->uid = client->uid;
-	c->name = strdup(name);
+	c->name = name;
 
 	c->next = default_caches;
 	default_caches = c;
     } else {
 	free(c->name);
-	c->name = strdup(name);
+	c->name = name;
     }
 
     return 0;

kpasswd/kpasswd-generator.c

@@ -80,7 +80,7 @@ generate_requests (const char *filename, unsigned nreq)
     krb5_error_code ret;
     int i;
     char **words;
-    unsigned nwords;
+    unsigned nwords, k;
 
     ret = krb5_init_context(&context);
     if (ret)
@@ -162,6 +162,10 @@ generate_requests (const char *filename, unsigned nreq)
 	krb5_free_cred_contents(context, &cred);
 	krb5_get_init_creds_opt_free(context, opt);
     }
+
+    for (k = 0; k < nwords; k++)
+        free(words[k]);
+    free(words);
 }
 
 static int version_flag	= 0;

lib/hx509/ks_file.c

@@ -96,9 +96,10 @@ try_decrypt(hx509_context context,
 			 password, passwordlen,
 			 1, key, NULL);
     if (ret <= 0) {
-	hx509_set_error_string(context, 0, HX509_CRYPTO_INTERNAL_ERROR,
+	ret = HX509_CRYPTO_INTERNAL_ERROR;
+	hx509_set_error_string(context, 0, ret,
 			       "Failed to do string2key for private key");
-	return HX509_CRYPTO_INTERNAL_ERROR;
+        goto out;
     }
 
     clear.data = malloc(len);

lib/hx509/softp11.c

@@ -543,6 +543,8 @@ add_cert(hx509_context hxctx, void *ctx, hx509_cert cert)
 	CK_FLAGS flags;
 
 	type = CKO_PRIVATE_KEY;
+
+        /* Note to static analyzers: `o' is still referred to via globals */
 	o = add_st_object();
 	if (o == NULL) {
 	    ret = CKR_DEVICE_MEMORY;
@@ -593,6 +595,7 @@ add_cert(hx509_context hxctx, void *ctx, hx509_cert cert)
     hx509_xfree(issuer_data.data);
     hx509_xfree(subject_data.data);
 
+    /* Note to static analyzers: `o' is still referred to via globals */
     return 0;
 }
 

lib/kadm5/init_c.c

@@ -596,8 +596,10 @@ kadm5_c_init_with_context(krb5_context context,
 				      client_name,
 				      service_name,
 				      password, prompter, keytab, ccache, &cc);
-	if(ret)
+	if (ret) {
-	    return ret; /* XXX */
+            kadm5_c_destroy(ctx);
+	    return ret;
+        }
 	ccache = cc;
     }
 

lib/krb5/auth_context.c

@@ -292,9 +292,9 @@ copy_key(krb5_context context,
 	 krb5_keyblock *in,
 	 krb5_keyblock **out)
 {
+    *out = NULL;
     if (in)
 	return krb5_copy_keyblock(context, in, out);
-    *out = NULL; /* is this right? */
     return 0;
 }
 

lib/krb5/krbhst.c

@@ -592,8 +592,10 @@ add_plugin_host(struct krb5_krbhst_data *kd,
     hostlen = strlen(host);
 
     hi = calloc(1, sizeof(*hi) + hostlen);
-    if(hi == NULL)
+    if (hi == NULL) {
+        freeaddrinfo(ai);
 	return ENOMEM;
+    }
 
     hi->proto = proto;
     hi->port  = hi->def_port = portnum;

lib/krb5/pkinit.c

@@ -1133,8 +1133,10 @@ pk_rd_pa_reply_enckey(krb5_context context,
 
 	    ret = der_put_length_and_tag (ptr + ph - 1, ph, content.length,
 					  ASN1_C_UNIV, CONS, UT_Sequence, &l);
-	    if (ret)
+	    if (ret) {
+                free(ptr);
 		return ret;
+            }
 	    free(content.data);
 	    content.data = ptr;
 	    content.length += ph;

lib/krb5/rd_req.c

@@ -243,33 +243,26 @@ krb5_verify_authenticator_checksum(krb5_context context,
 				   size_t len)
 {
     krb5_error_code ret;
-    krb5_keyblock *key;
+    krb5_keyblock *key = NULL;
     krb5_authenticator authenticator;
     krb5_crypto crypto;
 
-    ret = krb5_auth_con_getauthenticator (context,
+    ret = krb5_auth_con_getauthenticator(context, ac, &authenticator);
-				      ac,
-				      &authenticator);
     if (ret)
 	return ret;
     if (authenticator->cksum == NULL) {
-	krb5_free_authenticator(context, &authenticator);
+	ret = -17;
-	return -17;
+        goto out;
     }
     ret = krb5_auth_con_getkey(context, ac, &key);
-    if(ret) {
+    if (ret)
-	krb5_free_authenticator(context, &authenticator);
+        goto out;
-	return ret;
-    }
     ret = krb5_crypto_init(context, key, 0, &crypto);
     if (ret)
 	goto out;
-    ret = krb5_verify_checksum (context,
+    ret = krb5_verify_checksum(context, crypto,
-				crypto,
                                KRB5_KU_AP_REQ_AUTH_CKSUM,
-				data,
+                               data, len, authenticator->cksum);
-				len,
-				authenticator->cksum);
     krb5_crypto_destroy(context, crypto);
 out:
     krb5_free_authenticator(context, &authenticator);

lib/krb5/send_to_kdc.c

@@ -851,6 +851,8 @@ submit_request(krb5_context context, krb5_sendto_ctx ctx, krb5_krbhst_info *hi)
 
 	host = heim_alloc(sizeof(*host), "sendto-host", deallocate_host);
 	if (host == NULL) {
+            if (freeai)
+                freeaddrinfo(ai);
 	    rk_closesocket(fd);
 	    return ENOMEM;
 	}

lib/krb5/verify_krb5_conf.c

@@ -212,6 +212,7 @@ check_host(krb5_context context, const char *path, char *data)
 	krb5_warnx(context, "%s: %s (%s)", path, gai_strerror(ret), hostname);
 	return 1;
     }
+    freeaddrinfo(ai);
     return 0;
 }