Fixed leaks, NULL dereferences and broken init.

channels/rail/client/rail_main.c

@@ -575,6 +575,8 @@ BOOL VCAPITYPE VirtualChannelEntry(PCHANNEL_ENTRY_POINTS pEntryPoints)
 	CHANNEL_ENTRY_POINTS_FREERDP* pEntryPointsEx;
 
 	rail = (railPlugin*) calloc(1, sizeof(railPlugin));
+	if (!rail)
+		return FALSE;
 
 	rail->channelDef.options =
 			CHANNEL_OPTION_INITIALIZED |
@@ -591,7 +593,10 @@ BOOL VCAPITYPE VirtualChannelEntry(PCHANNEL_ENTRY_POINTS pEntryPoints)
 	{
 		context = (RailClientContext*) calloc(1, sizeof(RailClientContext));
 		if (!context)
+		{
+			free(rail);
 			return FALSE;
+		}
 
 		context->handle = (void*) rail;
 		context->custom = NULL;

client/Wayland/wlf_window.c

@@ -149,9 +149,9 @@ wlfWindow* wlf_CreateDesktopWindow(wlfContext* wlfc, char* name, int width, int
 		wlf_ResizeDesktopWindow(wlfc, window, width, height);
 
 		wl_surface_damage(window->surface, 0, 0, window->width, window->height);
-	}
 
 		wlf_SetWindowText(wlfc, window, name);
+	}
 
 	return window;
 }

client/X11/xf_tsmf.c

@@ -187,6 +187,7 @@ int xf_tsmf_xv_video_frame_event(TsmfClientContext* tsmf, TSMF_VIDEO_FRAME_EVENT
 	else
 	{
 		WLog_DBG(TAG, "pixel format 0x%X not supported by hardware.", pixfmt);
+		free(xrects);
 		return -1003;
 	}
 
@@ -213,6 +214,7 @@ int xf_tsmf_xv_video_frame_event(TsmfClientContext* tsmf, TSMF_VIDEO_FRAME_EVENT
 	if (!XShmAttach(xfc->display, &shminfo))
 	{
 		XFree(image);
+		free(xrects);
 		WLog_DBG(TAG, "XShmAttach failed.");
 		return -1004;
 	}

libfreerdp/codec/rfx.c

@@ -966,10 +966,9 @@ static BOOL rfx_process_message_tileset(RFX_CONTEXT* context, RFX_MESSAGE* messa
 			WaitForThreadpoolWorkCallbacks(work_objects[i], FALSE);
 			CloseThreadpoolWork(work_objects[i]);
 		}
-
+	}
 	free(work_objects);
 	free(params);
-	}
 
 	for (i = 0; i < message->numTiles; i++)
 	{

libfreerdp/common/assistance.c

@@ -184,7 +184,7 @@ int freerdp_assistance_parse_address_list(rdpAssistanceFile* file, char* list)
 		file->MachinePorts[i] = (UINT32) atoi(q);
 
 		if (!file->MachineAddresses[i])
-			return -1;
+			goto out;
 
 		q[-1] = ':';
 	}

libfreerdp/common/settings.c

@@ -117,7 +117,11 @@ int freerdp_addin_set_argument_value(ADDIN_ARGV* args, char* option, char* value
 
 	new_argv = (char**) realloc(args->argv, sizeof(char*) * (args->argc + 1));
 	if (!new_argv)
+	{
+		free(str);
 		return -1;
+	}
+
 	args->argv = new_argv;
 	args->argc++;
 	args->argv[args->argc - 1] = str;
@@ -151,7 +155,10 @@ int freerdp_addin_replace_argument_value(ADDIN_ARGV* args, char* previous, char*
 
 	new_argv = (char**) realloc(args->argv, sizeof(char*) * (args->argc + 1));
 	if (!new_argv)
+	{
+		free(str);
 		return -1;
+	}
 	args->argv = new_argv;
 	args->argc++;
 	args->argv[args->argc - 1] = str;

libfreerdp/core/gateway/http.c

@@ -615,7 +615,7 @@ HttpResponse* http_response_recv(rdpTls* tls)
 	int position;
 	char* line;
 	char* buffer;
-	char* header;
+	char* header = NULL;
 	char* payload;
 	int bodyLength;
 	int payloadOffset;
@@ -728,8 +728,6 @@ HttpResponse* http_response_recv(rdpTls* tls)
 				count++;
 			}
 
-			free(header);
-
 			if (!http_response_parse_header(response))
 				goto out_error;
 
@@ -779,10 +777,12 @@ HttpResponse* http_response_recv(rdpTls* tls)
 		}
 	}
 
+	free(header);
 	Stream_Free(s, TRUE);
 	return response;
 out_error:
 	http_response_free(response);
+	free(header);
 out_free:
 	Stream_Free(s, TRUE);
 	return NULL;

libfreerdp/core/metrics.c

@@ -25,7 +25,7 @@
 
 double metrics_write_bytes(rdpMetrics* metrics, UINT32 UncompressedBytes, UINT32 CompressedBytes)
 {
-	double CompressionRatio;
+	double CompressionRatio = 0.0;
 
 	metrics->TotalUncompressedBytes += UncompressedBytes;
 	metrics->TotalCompressedBytes += CompressedBytes;

libfreerdp/core/redirection.c

@@ -207,7 +207,7 @@ int rdp_redirection_apply_settings(rdpRdp* rdp)
 			settings->TargetNetAddresses[i] = _strdup(redirection->TargetNetAddresses[i]);
 			if (!settings->TargetNetAddresses[i])
 			{
-				for (--i; i >= 0; --i)
+				for (; i > 0; --i)
 					free(settings->TargetNetAddresses[i]);
 				return -1;
 			}

libfreerdp/core/settings.c

@@ -786,6 +786,13 @@ rdpSettings* freerdp_settings_clone(rdpSettings* settings)
 			goto out_fail;
 		}
 
+ 		if (_settings->DeviceArraySize < _settings->DeviceCount)
+		{
+			_settings->DeviceCount = 0;
+			_settings->DeviceArraySize = 0;
+			goto out_fail;
+		}
+
 		for (index = 0; index < _settings->DeviceCount; index++)
 		{
 			_settings->DeviceArray[index] = freerdp_device_clone(settings->DeviceArray[index]);
@@ -803,6 +810,13 @@ rdpSettings* freerdp_settings_clone(rdpSettings* settings)
 			goto out_fail;
 		}
 
+		if (_settings->StaticChannelArraySize < _settings->StaticChannelCount)
+		{
+			_settings->StaticChannelArraySize  = 0;
+			_settings->ChannelCount = 0;
+			goto out_fail;
+		}
+
 		for (index = 0; index < _settings->StaticChannelCount; index++)
 		{
 			_settings->StaticChannelArray[index] = freerdp_static_channel_clone(settings->StaticChannelArray[index]);
@@ -820,6 +834,13 @@ rdpSettings* freerdp_settings_clone(rdpSettings* settings)
 			goto out_fail;
 		}
 
+		if (_settings->DynamicChannelArraySize < _settings->DynamicChannelCount)
+		{
+			_settings->DynamicChannelCount = 0;
+			_settings->DynamicChannelArraySize = 0;
+			goto out_fail;
+		}
+
 		for (index = 0; index < _settings->DynamicChannelCount; index++)
 		{
 			_settings->DynamicChannelArray[index] = freerdp_dynamic_channel_clone(settings->DynamicChannelArray[index]);

libfreerdp/crypto/crypto.c

@@ -483,6 +483,7 @@ char** crypto_cert_subject_alt_name(X509* xcert, int* count, int** lengths)
 		if (!*lengths)
 		{
 			free(strings);
+			strings = NULL;
 			goto out;
 		}
 	}

libfreerdp/gdi/dc.c

@@ -105,7 +105,6 @@ HGDI_DC gdi_CreateDC(UINT32 flags, int bpp)
 
 fail:
 	gdi_DeleteDC(hDC);
-	free(hDC);
 	return NULL;
 }
 

winpr/libwinpr/asn1/asn1.c

@@ -117,6 +117,7 @@ LABEL_ENCODER_COMPLETE:
 			{
 				//if (ASN1BEREncCheck(encoder, 1))
 				{
+					if (encoder->buf)
 						*encoder->buf = 0;
 LABEL_SET_BUFFER:
 					if (pParent)

winpr/libwinpr/pipe/test/TestPipeCreateNamedPipeOverlapped.c

@@ -19,10 +19,10 @@ static LPTSTR lpszPipeName = _T("\\\\.\\pipe\\winpr_test_pipe_overlapped");
 static void* named_pipe_client_thread(void* arg)
 {
 	DWORD status;
-	HANDLE hEvent;
+	HANDLE hEvent = NULL;
-	HANDLE hNamedPipe;
+	HANDLE hNamedPipe = NULL;
-	BYTE* lpReadBuffer;
+	BYTE* lpReadBuffer = NULL;
-	BYTE* lpWriteBuffer;
+	BYTE* lpWriteBuffer = NULL;
 	BOOL fSuccess = FALSE;
 	OVERLAPPED overlapped;
 	DWORD nNumberOfBytesToRead;

winpr/libwinpr/shell/shell.c

@@ -78,6 +78,7 @@ BOOL GetUserProfileDirectoryA(HANDLE hToken, LPSTR lpProfileDir, LPDWORD lpcchSi
 	if ((status != 0) || !pw)
 	{
 		SetLastError(ERROR_INVALID_PARAMETER);
+		free (buf);
 		return FALSE;
 	}
 

winpr/libwinpr/utils/collections/Reference.c

@@ -157,19 +157,19 @@ wReferenceTable* ReferenceTable_New(BOOL synchronized, void* context, REFERENCE_
 {
 	wReferenceTable* referenceTable;
 
-	referenceTable = (wReferenceTable*) malloc(sizeof(wReferenceTable));
+	referenceTable = (wReferenceTable*) calloc(1, sizeof(wReferenceTable));
 	if (!referenceTable)
 		return NULL;
 
-	referenceTable->array = (wReference*) calloc(1, sizeof(wReference) * referenceTable->size);
-	if (!referenceTable->array)
-		goto error_array;
-
 	referenceTable->context = context;
 	referenceTable->ReferenceFree = ReferenceFree;
 
 	referenceTable->size = 32;
 
+	referenceTable->array = (wReference*) calloc(referenceTable->size, sizeof(wReference));
+	if (!referenceTable->array)
+		goto error_array;
+
 	referenceTable->synchronized = synchronized;
 	if (synchronized && !InitializeCriticalSectionAndSpinCount(&referenceTable->lock, 4000))
 		goto error_critical_section;

winpr/libwinpr/utils/sam.c

@@ -239,7 +239,10 @@ WINPR_SAM_ENTRY* SamLookupUserA(WINPR_SAM* sam, LPSTR User, UINT32 UserLength, L
 		return NULL;
 
 	if (!SamLookupStart(sam))
+	{
+		free(entry);
 		return NULL;
+	}
 
 	while (sam->line != NULL)
 	{