From 61b24bf0b34865c1665d93f3929dd20f4b28e4b0 Mon Sep 17 00:00:00 2001
From: weizhenwei <weizhenwei1988@gmail.com>
Date: Thu, 22 Jun 2017 17:53:51 +0800
Subject: [PATCH] add NULL pointer check and set freed pointers to NULL
 afterward

---
 channels/drive/client/drive_main.c |  2 +-
 channels/rail/client/rail_main.c   | 23 ++++++++++++++++++++---
 libfreerdp/core/update.c           | 28 +++++++++++++++++++++++-----
 libfreerdp/core/window.c           | 22 +++++++++++++++++++---
 4 files changed, 63 insertions(+), 12 deletions(-)

diff --git a/channels/drive/client/drive_main.c b/channels/drive/client/drive_main.c
index f3911fec9..480a661b8 100644
--- a/channels/drive/client/drive_main.c
+++ b/channels/drive/client/drive_main.c
@@ -868,7 +868,7 @@ UINT drive_register_drive_path(PDEVICE_SERVICE_ENTRY_POINTS pEntryPoints,
 out_error:
 	MessageQueue_Free(drive->IrpQueue);
 	ListDictionary_Free(drive->files);
-	free(drive->path);
+	drive_free(drive);
 	free(drive);
 	return error;
 }
diff --git a/channels/rail/client/rail_main.c b/channels/rail/client/rail_main.c
index 061a3a9f3..08b73bae0 100644
--- a/channels/rail/client/rail_main.c
+++ b/channels/rail/client/rail_main.c
@@ -97,9 +97,26 @@ UINT rail_send_channel_data(railPlugin* rail, void* data, size_t length)
  */
 static void rail_client_clean_exec_order(RAIL_EXEC_ORDER* exec)
 {
-	free(exec->exeOrFile.string);
-	free(exec->workingDir.string);
-	free(exec->arguments.string);
+    if (!exec)
+        return;
+
+    if (exec->exeOrFile.string)
+    {
+    	free(exec->exeOrFile.string);
+    	exec->exeOrFile.string = NULL;
+    }
+
+    if (exec->workingDir.string)
+    {
+		free(exec->workingDir.string);
+		exec->workingDir.string = NULL;
+    }
+
+    if (exec->arguments.string)
+    {
+		free(exec->arguments.string);
+		exec->arguments.string = NULL;
+    }
 }
 
 /**
diff --git a/libfreerdp/core/update.c b/libfreerdp/core/update.c
index d7f32f569..9e0ba99a9 100644
--- a/libfreerdp/core/update.c
+++ b/libfreerdp/core/update.c
@@ -2041,11 +2041,28 @@ static void update_free_queued_message(void* obj)
 	update_message_queue_free_message(msg);
 }
 
-static void update_free_window_state(WINDOW_STATE_ORDER window_state)
+static void update_free_window_state(WINDOW_STATE_ORDER* window_state)
 {
-	free(window_state.titleInfo.string);
-	free(window_state.windowRects);
-	free(window_state.visibilityRects);
+    if (!window_state)
+        return;
+
+    if (window_state->titleInfo.string)
+    {
+        free(window_state->titleInfo.string);
+        window_state->titleInfo.string = NULL;
+    }
+
+    if (window_state->windowRects)
+    {
+        free(window_state->windowRects);
+        window_state->windowRects = NULL;
+    }
+
+    if (window_state->visibilityRects)
+    {
+        free(window_state->visibilityRects);
+        window_state->visibilityRects = NULL;
+    }
 }
 
 rdpUpdate* update_new(rdpRdp* rdp)
@@ -2147,10 +2164,11 @@ void update_free(rdpUpdate* update)
 		free(update->secondary);
 		free(update->altsec);
 		free(update->window->monitored_desktop.windowIds);
-		update_free_window_state(update->window->window_state);
+		update_free_window_state(&update->window->window_state);
 		if (update->window->window_icon.iconInfo)
 		{
 			update_free_window_icon_info(update->window->window_icon.iconInfo);
+			update->window->window_icon.iconInfo = NULL;
 		}
 		free(update->window);
 		MessageQueue_Free(update->queue);
diff --git a/libfreerdp/core/window.c b/libfreerdp/core/window.c
index 3626fe407..41970db26 100644
--- a/libfreerdp/core/window.c
+++ b/libfreerdp/core/window.c
@@ -364,6 +364,7 @@ BOOL update_read_window_icon_order(wStream* s, WINDOW_ORDER_INFO* orderInfo, WIN
 	if (window_icon->iconInfo)
 	{
 		update_free_window_icon_info(window_icon->iconInfo);
+		window_icon->iconInfo = NULL;
 	}
 
 	window_icon->iconInfo = (ICON_INFO*) calloc(1, sizeof(ICON_INFO));
@@ -599,9 +600,24 @@ BOOL update_recv_desktop_info_order(rdpUpdate* update, wStream* s, WINDOW_ORDER_
 
 void update_free_window_icon_info(ICON_INFO* iconInfo)
 {
-	free(iconInfo->bitsColor);
-	free(iconInfo->bitsMask);
-	free(iconInfo->colorTable);
+    if (iconInfo->bitsColor)
+    {
+        free(iconInfo->bitsColor);
+        iconInfo->bitsColor = NULL;
+    }
+
+    if (iconInfo->bitsMask)
+    {
+        free(iconInfo->bitsMask);
+        iconInfo->bitsMask = NULL;
+    }
+
+    if (iconInfo->colorTable)
+    {
+        free(iconInfo->colorTable);
+        iconInfo->colorTable = NULL;
+    }
+
 	free(iconInfo);
 }