Merge pull request #724 from dnobori/180928_fixbugs

Merge PR #724: Fix bugs reported by Coverity Scan.

src/Cedar/Client.c

@@ -9982,7 +9982,7 @@ char *DecryptPassword(BUF *b)
 	}
 
 	str = ZeroMalloc(b->Size + 1);
-	c = NewCrypt(key, sizeof(key));
+	c = NewCrypt(key, sizeof(key)); // NOTE by Daiyuu Nobori 2018-09-28: This is not a bug! Do not try to fix it!!
 	Encrypt(c, str, b->Buf, b->Size);
 	FreeCrypt(c);
 
@@ -10028,7 +10028,7 @@ BUF *EncryptPassword(char *password)
 	size = StrLen(password) + 1;
 	tmp = ZeroMalloc(size);
 
-	c = NewCrypt(key, sizeof(key));
+	c = NewCrypt(key, sizeof(key)); // NOTE by Daiyuu Nobori 2018-09-28: This is not a bug! Do not try to fix it!!
 	Encrypt(c, tmp, password, size - 1);
 	FreeCrypt(c);
 

src/Cedar/Connection.c

@@ -1579,7 +1579,7 @@ SEND_START:
 				{
 					// Packet data array
 					void **datas = MallocFast(sizeof(void *) * num_packet);
-					UINT *sizes = MallocFast(sizeof(UINT *) * num_packet);
+					UINT *sizes = MallocFast(sizeof(UINT) * num_packet);
 					UINT i;
 
 					i = 0;

src/Cedar/Hub.c

@@ -3717,9 +3717,12 @@ bool HubPaPutPacket(SESSION *s, void *data, UINT size)
 		CancelList(s->CancelList);
 
 		// Yield
-		if (hub->Option != NULL && hub->Option->YieldAfterStorePacket)
+		if (hub != NULL)
 		{
-			YieldCpu();
+			if (hub->Option != NULL && hub->Option->YieldAfterStorePacket)
+			{
+				YieldCpu();
+			}
 		}
 
 		return true;

src/Cedar/Protocol.c

@@ -6011,7 +6011,7 @@ bool ServerDownloadSignature(CONNECTION *c, char **error_detail_str)
 			{
 				// Compare posted data with the WaterMark
 				if ((data_size == StrLen(HTTP_VPN_TARGET_POSTDATA) && (Cmp(data, HTTP_VPN_TARGET_POSTDATA, data_size) == 0))
-					|| (Cmp(data, WaterMark, SizeOfWaterMark()) == 0))
+					|| ((data_size >= SizeOfWaterMark()) && Cmp(data, WaterMark, SizeOfWaterMark()) == 0))
 				{
 					// Check the WaterMark
 					Free(data);

src/Cedar/Server.c

@@ -2054,6 +2054,12 @@ UINT SiCalcPoint(SERVER *s, UINT num, UINT weight)
 
 	server_max_sessions = GetServerCapsInt(s, "i_max_sessions");
 
+	if (server_max_sessions == 0)
+	{
+		// Avoid divide by zero
+		server_max_sessions = 1;
+	}
+
 	return (UINT)(((double)server_max_sessions -
 		MIN((double)num * 100.0 / (double)weight, (double)server_max_sessions))
 		* (double)FARM_BASE_POINT / (double)server_max_sessions);

src/Cedar/Virtual.c

@@ -5307,7 +5307,7 @@ TCP_RESET:
 			seq64 = n->RecvSeq + (UINT64)seq - (n->RecvSeqInit + n->RecvSeq) % X32;
 			if ((n->RecvSeqInit + n->RecvSeq) % X32 > seq)
 			{
-				if (((n->RecvSeqInit + n->RecvSeq) % X32 - ack) >= 0x80000000)
+				if (((n->RecvSeqInit + n->RecvSeq) % X32 - seq) >= 0x80000000)
 				{
 					seq64 = n->RecvSeq + (UINT64)seq + X32 - (n->RecvSeqInit + n->RecvSeq) % X32;
 				}

src/Cedar/WebUI.c

@@ -1222,7 +1222,7 @@ static wchar_t *WpSecureNAT(WEBUI *wu, LIST *params)
 	// Get the enable / disable state of the current SecureNAT
 	{
 		RPC_HUB_STATUS t;
-		Zero(&t, sizeof(&t));
+		Zero(&t, sizeof(t));
 		StrCpy(t.HubName, sizeof(t.HubName), hubname);
 
 		retcode = StGetHubStatus(context->Admin, &t);
@@ -1649,7 +1649,7 @@ static LIST *WuAnalyzeTarget(char *target,char *filename, UINT size)
 
 			while(*body != '=' && *body != '\0')
 			{
-				*body ++;
+				body++;
 			}
 			if(*body == '=')
 			{

src/Mayaqua/Kernel.c

@@ -513,7 +513,7 @@ void GetHomeDirW(wchar_t *path, UINT size)
 		if (GetEnvW(L"HOMEDRIVE", drive, sizeof(drive)) &&
 			GetEnvW(L"HOMEPATH", hpath, sizeof(hpath)))
 		{
-			UniFormat(path, sizeof(path), L"%s%s", drive, hpath);
+			UniFormat(path, size, L"%s%s", drive, hpath);
 		}
 		else
 		{

src/Mayaqua/Network.c

@@ -15081,7 +15081,7 @@ void GetMachineNameEx(char *name, UINT size, bool no_load_hosts)
 			{
 				if (GetMachineNameFromHosts(tmp2, sizeof(tmp2)))
 				{
-					StrCpy(name, sizeof(name), tmp2);
+					StrCpy(name, size, tmp2);
 				}
 			}
 		}

src/Mayaqua/Secure.c

@@ -1824,7 +1824,7 @@ SECURE *OpenSec(UINT id)
 		return NULL;
 	}
 
-	sec->SlotIdList = (UINT *)ZeroMalloc(sizeof(UINT *) * sec->NumSlot);
+	sec->SlotIdList = (UINT *)ZeroMalloc(sizeof(UINT) * sec->NumSlot);
 
 	if (sec->Api->C_GetSlotList(TRUE, sec->SlotIdList, &sec->NumSlot) != CKR_OK)
 	{

src/Mayaqua/TcpIp.c

@@ -999,7 +999,7 @@ BUF *BuildICMPv6NeighborSoliciation(IPV6_ADDR *src_ip, IPV6_ADDR *target_ip, UCH
 UCHAR IPv6GetNextHeaderFromQueue(QUEUE *q)
 {
 	UINT *p;
-	UCHAR v;
+	UCHAR v = 0;
 	// Validate arguments
 	if (q == NULL)
 	{
@@ -1007,8 +1007,11 @@ UCHAR IPv6GetNextHeaderFromQueue(QUEUE *q)
 	}
 
 	p = (UINT *)GetNext(q);
-	v = (UCHAR)(*p);
-	Free(p);
+	if (p != NULL)
+	{
+		v = (UCHAR)(*p);
+		Free(p);
+	}
 
 	return v;
 }

src/Mayaqua/Unix.c

@@ -906,6 +906,8 @@ void *UnixNewSingleInstance(char *instance_name)
 
 	if (fcntl(fd, F_SETLK, &lock) == -1)
 	{
+		close(fd);
+		(void)remove(name);
 		return NULL;
 	}
 	else