Misc fixes (coverity)

lib/krb5/crypto.c

@@ -2341,21 +2341,19 @@ _get_derived_key(krb5_context context,
     struct _krb5_key_data *d;
     unsigned char constant[5];
 
+    *key = NULL;
     for(i = 0; i < crypto->num_key_usage; i++)
 	if(crypto->key_usage[i].usage == usage) {
 	    *key = &crypto->key_usage[i].key;
 	    return 0;
 	}
     d = _new_derived_key(crypto, usage);
-    if (d == NULL) {
-        *key = NULL; /* quiet warning */
+    if (d == NULL)
 	return krb5_enomem(context);
-    }
-    krb5_copy_keyblock(context, crypto->key.key, &d->key);
-    _krb5_put_int(constant, usage, 5);
-    _krb5_derive_key(context, crypto->et, d, constant, sizeof(constant));
     *key = d;
-    return 0;
+    krb5_copy_keyblock(context, crypto->key.key, &d->key);
+    _krb5_put_int(constant, usage, sizeof(constant));
+    return _krb5_derive_key(context, crypto->et, d, constant, sizeof(constant));
 }
 
 /**

lib/krb5/expand_path.c

@@ -493,7 +493,7 @@ _krb5_expand_path_tokensv(krb5_context context,
 	    return krb5_enomem(context);
 	va_start(ap, ppath_out);
 	for (i = 0; i < nargs; i++) {
-	    char *s = va_arg(ap, const char *); /* token key */
+	    const char *s = va_arg(ap, const char *); /* token key */
 	    if (s == NULL)
 		break;
 	    extra_tokens[i] = strdup(s);

lib/krb5/fcache.c

@@ -450,6 +450,7 @@ again:
     ret = fstat(fd, &sb2);
     if (ret < 0) {
 	krb5_clear_error_message(context);
+	close(fd);
 	return errno;
     }
 

lib/krb5/pac.c

@@ -868,15 +868,14 @@ krb5_pac_verify(krb5_context context,
     {
 	krb5_data *copy;
 
+	if (pac->server_checksum->buffersize < 4 ||
+            pac->privsvr_checksum->buffersize < 4)
+	    return EINVAL;
+
 	ret = krb5_copy_data(context, &pac->data, &copy);
 	if (ret)
 	    return ret;
 
-	if (pac->server_checksum->buffersize < 4)
-	    return EINVAL;
-	if (pac->privsvr_checksum->buffersize < 4)
-	    return EINVAL;
-
 	memset((char *)copy->data + pac->server_checksum->offset_lo + 4,
 	       0,
 	       pac->server_checksum->buffersize - 4);

lib/krb5/salt.c

@@ -43,6 +43,7 @@ krb5_salttype_to_string (krb5_context context,
     struct _krb5_encryption_type *e;
     struct salt_type *st;
 
+    *string = NULL;
     e = _krb5_find_enctype (etype);
     if (e == NULL) {
 	krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,

lib/krb5/send_to_kdc.c

@@ -56,13 +56,11 @@
 static int
 init_port(const char *s, int fallback)
 {
-    if (s) {
-	int tmp;
+    int tmp;
 
-	sscanf (s, "%d", &tmp);
-	return htons(tmp);
-    } else
-	return fallback;
+    if (s && sscanf(s, "%d", &tmp) == 1)
+        return htons(tmp);
+    return fallback;
 }
 
 struct send_via_plugin_s {