fix memory leaks and one potential null deref found by coverity. from netbsd.

millert@ ok

6 files changed, 41 insertions, 19 deletions

diff --git a/bin/ksh/c_ksh.c b/bin/ksh/c_ksh.c
index 7a1751d930a..92f561c9ad4 100644
--- a/bin/ksh/c_ksh.c
+++ b/bin/ksh/c_ksh.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: c_ksh.c,v 1.29 2006/03/12 00:26:58 deraadt Exp $	*/
+/*	$OpenBSD: c_ksh.c,v 1.30 2007/08/02 10:50:25 fgsch Exp $	*/
 
 /*
  * built-in Korn commands: c_*
@@ -23,6 +23,7 @@ c_cd(char **wp)
 	char *dir, *try, *pwd;
 	int phys_path;
 	char *cdpath;
+	char *fdir = NULL;
 
 	while ((optc = ksh_getopt(wp, &builtin_opt, "LP")) != -1)
 		switch (optc) {
@@ -84,7 +85,7 @@ c_cd(char **wp)
 		olen = strlen(wp[0]);
 		nlen = strlen(wp[1]);
 		elen = strlen(current_wd + ilen + olen) + 1;
-		dir = alloc(ilen + nlen + elen, ATEMP);
+		fdir = dir = alloc(ilen + nlen + elen, ATEMP);
 		memcpy(dir, current_wd, ilen);
 		memcpy(dir + ilen, wp[1], nlen);
 		memcpy(dir + ilen + nlen, current_wd + ilen + olen, elen);
@@ -116,6 +117,8 @@ c_cd(char **wp)
 			bi_errorf("%s: bad directory", dir);
 		else
 			bi_errorf("%s - %s", try, strerror(errno));
+		if (fdir)
+			afree(fdir, ATEMP);
 		return 1;
 	}
 
@@ -149,6 +152,9 @@ c_cd(char **wp)
 	if (printpath || cdnode)
 		shprintf("%s\n", pwd);
 
+	if (fdir)
+		afree(fdir, ATEMP);
+
 	return 0;
 }
 
@@ -157,7 +163,7 @@ c_pwd(char **wp)
 {
 	int optc;
 	int physical = Flag(FPHYSICAL);
-	char *p;
+	char *p, *freep = NULL;
 
 	while ((optc = ksh_getopt(wp, &builtin_opt, "LP")) != -1)
 		switch (optc) {
@@ -181,7 +187,7 @@ c_pwd(char **wp)
 	if (p && access(p, R_OK) < 0)
 		p = (char *) 0;
 	if (!p) {
-		p = ksh_get_wd((char *) 0, 0);
+		freep = p = ksh_get_wd((char *) 0, 0);
 		if (!p) {
 			bi_errorf("can't get current directory - %s",
 			    strerror(errno));
@@ -189,6 +195,8 @@ c_pwd(char **wp)
 		}
 	}
 	shprintf("%s\n", p);
+	if (freep)
+		afree(freep, ATEMP);
 	return 0;
 }
 
diff --git a/bin/ksh/c_sh.c b/bin/ksh/c_sh.c
index 89e0f30dbcf..716dc7c70af 100644
--- a/bin/ksh/c_sh.c
+++ b/bin/ksh/c_sh.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: c_sh.c,v 1.35 2006/04/10 14:38:59 jaredy Exp $	*/
+/*	$OpenBSD: c_sh.c,v 1.36 2007/08/02 10:50:25 fgsch Exp $	*/
 
 /*
  * built-in Bourne commands
@@ -414,6 +414,7 @@ int
 c_eval(char **wp)
 {
 	struct source *s;
+	int rv;
 
 	if (ksh_getopt(wp, &builtin_opt, null) == '?')
 		return 1;
@@ -447,7 +448,9 @@ c_eval(char **wp)
 		exstat = subst_exstat;
 	}
 
-	return shell(s, false);
+	rv = shell(s, false);
+	afree(s, ATEMP);
+	return (rv);
 }
 
 int
@@ -595,7 +598,8 @@ c_brkcont(char **wp)
 		 * shall be used.  Doesn't say to print an error but we
 		 * do anyway 'cause the user messed up.
 		 */
-		last_ep->flags &= ~EF_BRKCONT_PASS;
+		if (last_ep)
+			last_ep->flags &= ~EF_BRKCONT_PASS;
 		warningf(true, "%s: can only %s %d level(s)",
 		    wp[0], wp[0], n - quit);
 	}
diff --git a/bin/ksh/edit.c b/bin/ksh/edit.c
index 7033ef1d2c8..c575d543d99 100644
--- a/bin/ksh/edit.c
+++ b/bin/ksh/edit.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: edit.c,v 1.32 2007/08/01 10:08:56 fgsch Exp $	*/
+/*	$OpenBSD: edit.c,v 1.33 2007/08/02 10:50:25 fgsch Exp $	*/
 
 /*
  * Command line editing - common code
@@ -431,12 +431,18 @@ x_file_glob(int flags, const char *str, int slen, char ***wordsp)
 		    stat(words[0], &statb) < 0) ||
 		    words[0][0] == '\0') {
 			x_free_words(nwords, words);
+			words = NULL;
 			nwords = 0;
 		}
 	}
 	afree(toglob, ATEMP);
 
-	*wordsp = nwords ? words : (char **) 0;
+	if (nwords) {
+		*wordsp = words;
+	} else if (words) {
+		x_free_words(nwords, words);
+		*wordsp = NULL;
+	}
 
 	return nwords;
 }
diff --git a/bin/ksh/emacs.c b/bin/ksh/emacs.c
index 6d75da59621..5a6025a58e7 100644
--- a/bin/ksh/emacs.c
+++ b/bin/ksh/emacs.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: emacs.c,v 1.40 2006/07/10 17:12:41 beck Exp $	*/
+/*	$OpenBSD: emacs.c,v 1.41 2007/08/02 10:50:25 fgsch Exp $	*/
 
 /*
  *  Emacs-like command line editing and history
@@ -123,7 +123,7 @@ static int      x_search(char *, int, int);
 static int      x_match(char *, char *);
 static void	x_redraw(int);
 static void     x_push(int);
-static char *   x_mapin(const char *);
+static char *   x_mapin(const char *, Area *);
 static char *   x_mapout(int);
 static void     x_print(int, int);
 static void	x_adjust(void);
@@ -1244,11 +1244,11 @@ x_stuff(int c)
 }
 
 static char *
-x_mapin(const char *cp)
+x_mapin(const char *cp, Area *area)
 {
 	char *new, *op;
 
-	op = new = str_save(cp, ATEMP);
+	op = new = str_save(cp, area);
 	while (*cp) {
 		/* XXX -- should handle \^ escape? */
 		if (*cp == '^') {
@@ -1333,7 +1333,7 @@ x_bind( const char *a1, const char *a2,
 		return 0;
 	}
 
-	m1 = x_mapin(a1);
+	m2 = m1 = x_mapin(a1, ATEMP);
 	prefix = key = 0;
 	for (;; m1++) {
 		key = *m1 & CHARMASK;
@@ -1344,6 +1344,7 @@ x_bind( const char *a1, const char *a2,
 		else
 			break;
 	}
+	afree(m2, ATEMP);
 
 	if (a2 == NULL) {
 		x_print(prefix, key);
@@ -1369,8 +1370,7 @@ x_bind( const char *a1, const char *a2,
 #endif /* 0 */
 	} else {
 		f = XFUNC_ins_string;
-		m2 = x_mapin(a2);
-		sp = str_save(m2, AEDIT);
+		sp = x_mapin(a2, AEDIT);
 	}
 
 	if (x_tab[prefix][key] == XFUNC_ins_string && x_atab[prefix][key])
diff --git a/bin/ksh/eval.c b/bin/ksh/eval.c
index 33006dd0b63..1c8f60c2f37 100644
--- a/bin/ksh/eval.c
+++ b/bin/ksh/eval.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: eval.c,v 1.30 2006/04/10 14:38:59 jaredy Exp $	*/
+/*	$OpenBSD: eval.c,v 1.31 2007/08/02 10:50:25 fgsch Exp $	*/
 
 /*
  * Expansion - quoting, separation, substitution, globbing
@@ -840,6 +840,7 @@ comsub(Expand *xp, char *cp)
 	s->start = s->str = cp;
 	sold = source;
 	t = compile(s);
+	afree(s, ATEMP);
 	source = sold;
 
 	if (t == NULL)
diff --git a/bin/ksh/var.c b/bin/ksh/var.c
index b4915f0e677..02e0be434e8 100644
--- a/bin/ksh/var.c
+++ b/bin/ksh/var.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: var.c,v 1.30 2006/05/21 18:40:39 otto Exp $	*/
+/*	$OpenBSD: var.c,v 1.31 2007/08/02 10:50:25 fgsch Exp $	*/
 
 #include "sh.h"
 #include <time.h>
@@ -346,6 +346,7 @@ intval(struct tbl *vp)
 int
 setstr(struct tbl *vq, const char *s, int error_ok)
 {
+	const char *fs = NULL;
 	int no_ro_check = error_ok & 0x4;
 	error_ok &= ~0x4;
 	if ((vq->flag & RDONLY) && !no_ro_check) {
@@ -367,7 +368,7 @@ setstr(struct tbl *vq, const char *s, int error_ok)
 		vq->flag &= ~(ISSET|ALLOC);
 		vq->type = 0;
 		if (s && (vq->flag & (UCASEV_AL|LCASEV|LJUST|RJUST)))
-			s = formatstr(vq, s);
+			fs = s = formatstr(vq, s);
 		if ((vq->flag&EXPORT))
 			export(vq, s);
 		else {
@@ -381,6 +382,8 @@ setstr(struct tbl *vq, const char *s, int error_ok)
 	vq->flag |= ISSET;
 	if ((vq->flag&SPECIAL))
 		setspec(vq);
+	if (fs)
+		afree((char *)fs, ATEMP);
 	return 1;
 }