Merge pull request #1814 from zhangzl2013/memory

Fix potential memory leak.

channels/serial/client/serial_tty.c

@@ -426,8 +426,10 @@ BOOL serial_tty_read(SERIAL_TTY* tty, BYTE* buffer, UINT32* Length)
 
 		ptermios = (struct termios*) calloc(1, sizeof(struct termios));
 
-		if (tcgetattr(tty->fd, ptermios) < 0)
+		if (tcgetattr(tty->fd, ptermios) < 0) {
+			free(ptermios);
 			return FALSE;
+		}
 
 		/**
 		 * If a timeout is set, do a blocking read, which times out after some time.
@@ -448,6 +450,7 @@ BOOL serial_tty_read(SERIAL_TTY* tty, BYTE* buffer, UINT32* Length)
 
 		tcsetattr(tty->fd, TCSANOW, ptermios);
 		tty->timeout = timeout;
+		free(ptermios);
 	}
 
 	ZeroMemory(buffer, *Length);

client/common/file.c

@@ -674,6 +674,7 @@ BOOL freerdp_client_write_rdp_file(const rdpFile* file, const char* name, BOOL u
 	if (freerdp_client_write_rdp_file_buffer(file, buffer, length + 1) != length)
 	{
 		fprintf(stderr, "freerdp_client_write_rdp_file: error writing to output buffer\n");
+		free(buffer);
 		return FALSE;
 	}
 

libfreerdp/codec/region.c

@@ -737,8 +737,10 @@ BOOL region16_intersect_rect(REGION16 *dst, const REGION16 *src, const RECTANGLE
 		free(dst->data);
 
 	dst->data = realloc(newItems, newItems->size);
-	if (!dst->data)
+	if (!dst->data) {
+		free(newItems);
 		return FALSE;
+	}
 
 	dst->extents = newExtents;
 	return region16_simplify_bands(dst);

libfreerdp/core/gateway/ncacn_http.c

@@ -329,6 +329,7 @@ rdpNtlmHttp* ntlm_http_new()
 out_free_ntlm:
 	ntlm_free(ntlm_http->ntlm);
 out_free:
+	free(ntlm_http);
 	return NULL;
 }
 

libfreerdp/core/gateway/tsg.c

@@ -360,6 +360,10 @@ BOOL TsProxyCreateTunnelReadResponse(rdpTsg* tsg, RPC_PDU* pdu)
 				if (MsgBytes > TSG_MESSAGING_MAX_MESSAGE_LENGTH)
 				{
 					fprintf(stderr, "Out of Spec Message Length %d", MsgBytes);
+					free(tsgCaps);
+					free(versionCaps);
+					free(packetCapsResponse);
+					free(packet);
 					return FALSE;
 				}
 				offset += MsgBytes;
@@ -373,6 +377,10 @@ BOOL TsProxyCreateTunnelReadResponse(rdpTsg* tsg, RPC_PDU* pdu)
 
 			default:
 				fprintf(stderr, "Unexpected Message Type: 0x%X\n", (int) MessageSwitchValue);
+				free(tsgCaps);
+				free(versionCaps);
+				free(packetCapsResponse);
+				free(packet);
 				return FALSE;
 
 		}
@@ -619,6 +627,7 @@ BOOL TsProxyAuthorizeTunnelReadResponse(rdpTsg* tsg, RPC_PDU* pdu)
 	{
 		fprintf(stderr, "status: E_PROXY_NAP_ACCESSDENIED (0x%08X)\n", E_PROXY_NAP_ACCESSDENIED);
 		fprintf(stderr, "Ensure that the Gateway Connection Authorization Policy is correct\n");
+		free(packet);
 		return FALSE;
 	}
 

libfreerdp/core/license.c

@@ -1057,6 +1057,7 @@ void license_send_platform_challenge_response_packet(rdpLicense* license)
 	if (!rc4)
 	{
 		fprintf(stderr, "%s: unable to allocate a rc4\n", __FUNCTION__);
+		free(buffer);
 		return;
 	}
 	crypto_rc4(rc4, HWID_LENGTH, license->HardwareId, buffer);

winpr/libwinpr/pipe/pipe.c

@@ -145,7 +145,7 @@ HANDLE CreateNamedPipeA(LPCSTR lpName, DWORD dwOpenMode, DWORD dwPipeMode, DWORD
 	if (pNamedPipe->serverfd == -1)
 	{
 		fprintf(stderr, "CreateNamedPipeA: socket error, %s\n", strerror(errno));
-		return INVALID_HANDLE_VALUE;
+		goto err_out;
 	}
 
 	ZeroMemory(&s, sizeof(struct sockaddr_un));
@@ -157,7 +157,7 @@ HANDLE CreateNamedPipeA(LPCSTR lpName, DWORD dwOpenMode, DWORD dwPipeMode, DWORD
 	if (status != 0)
 	{
 		fprintf(stderr, "CreateNamedPipeA: bind error, %s\n", strerror(errno));
-		return INVALID_HANDLE_VALUE;
+		goto err_out;
 	}
 
 	status = listen(pNamedPipe->serverfd, 2);
@@ -165,7 +165,7 @@ HANDLE CreateNamedPipeA(LPCSTR lpName, DWORD dwOpenMode, DWORD dwPipeMode, DWORD
 	if (status != 0)
 	{
 		fprintf(stderr, "CreateNamedPipeA: listen error, %s\n", strerror(errno));
-		return INVALID_HANDLE_VALUE;
+		goto err_out;
 	}
 
 	UnixChangeFileMode(pNamedPipe->lpFilePath, 0xFFFF);
@@ -181,6 +181,13 @@ HANDLE CreateNamedPipeA(LPCSTR lpName, DWORD dwOpenMode, DWORD dwPipeMode, DWORD
 	}
 
 	return hNamedPipe;
+err_out:
+	if (pNamedPipe) {
+		if (pNamedPipe->serverfd != -1)
+			close(pNamedPipe->serverfd);
+		free(pNamedPipe);
+	}
+	return INVALID_HANDLE_VALUE;
 }
 
 HANDLE CreateNamedPipeW(LPCWSTR lpName, DWORD dwOpenMode, DWORD dwPipeMode, DWORD nMaxInstances,

winpr/libwinpr/rpc/ndr.c

@@ -241,7 +241,6 @@ CLIENT_CALL_RETURN NdrClientCall(PMIDL_STUB_DESC pStubDescriptor, PFORMAT_STRING
 	MIDL_STUB_MESSAGE stubMsg;
 	INTERPRETER_FLAGS flags;
 	INTERPRETER_OPT_FLAGS optFlags;
-	INTERPRETER_OPT_FLAGS2 extFlags;
 	NDR_PROC_HEADER* procHeader;
 	NDR_OI2_PROC_HEADER* oi2ProcHeader;
 	CLIENT_CALL_RETURN client_call_return;
@@ -297,6 +296,7 @@ CLIENT_CALL_RETURN NdrClientCall(PMIDL_STUB_DESC pStubDescriptor, PFORMAT_STRING
 
 	if (optFlags.HasExtensions)
 	{
+		INTERPRETER_OPT_FLAGS2 extFlags;
 		NDR_PROC_HEADER_EXTS* extensions = (NDR_PROC_HEADER_EXTS*) pFormat;
 
 		pFormat += extensions->Size;
@@ -324,14 +324,13 @@ CLIENT_CALL_RETURN NdrClientCall(PMIDL_STUB_DESC pStubDescriptor, PFORMAT_STRING
 			}
 		}
 #endif
+		fprintf(stderr, "ExtFlags: ");
+		NdrPrintExtFlags(extFlags);
+		fprintf(stderr, "\n");
 	}
 
 	stubMsg.StackTop = (unsigned char*) stackTop;
 
-	fprintf(stderr, "ExtFlags: ");
-	NdrPrintExtFlags(extFlags);
-	fprintf(stderr, "\n");
-
 	NdrProcessParams(&stubMsg, pFormat, NDR_PHASE_SIZE, fpuStack, numberParams);
 
 	fprintf(stderr, "stubMsg BufferLength: %d\n", (int) stubMsg.BufferLength);

winpr/libwinpr/synch/timer.c

@@ -648,12 +648,15 @@ BOOL CreateTimerQueueTimer(PHANDLE phNewTimer, HANDLE TimerQueue,
 	WINPR_TIMER_QUEUE* timerQueue;
 	WINPR_TIMER_QUEUE_TIMER* timer;
 
+	if (!TimerQueue)
+		return FALSE;
+
 	timespec_gettimeofday(&CurrentTime);
 
 	timerQueue = (WINPR_TIMER_QUEUE*) TimerQueue;
 	timer = (WINPR_TIMER_QUEUE_TIMER*) malloc(sizeof(WINPR_TIMER_QUEUE_TIMER));
 
-	if (!timer || !TimerQueue)
+	if (!timer)
 		return FALSE;
 
 	WINPR_HANDLE_SET_TYPE(timer, HANDLE_TYPE_TIMER_QUEUE_TIMER);

winpr/libwinpr/utils/collections/BufferPool.c

@@ -277,6 +277,9 @@ void* BufferPool_Take(wBufferPool* pool, int size)
 	return buffer;
 
 out_error:
+	if (buffer)
+		free(buffer);
+
 	if (pool->synchronized)
 		LeaveCriticalSection(&pool->lock);
 	return NULL;

winpr/libwinpr/utils/collections/ListDictionary.c

@@ -144,8 +144,8 @@ int ListDictionary_GetKeys(wListDictionary* listDictionary, ULONG_PTR** ppKeys)
 		}
 	}
 
-	pKeys = (ULONG_PTR*) malloc(sizeof(ULONG_PTR*) * count);
-	ZeroMemory(pKeys, sizeof(ULONG_PTR*) * count);
+	pKeys = (ULONG_PTR*) malloc(sizeof(ULONG_PTR) * count);
+	ZeroMemory(pKeys, sizeof(ULONG_PTR) * count);
 
 	index = 0;