[OpenAFS-devel] [PATCH] flexelint: bugs found

Joe Buehler jbuehler@hekimian.com
Fri, 21 Nov 2003 16:10:05 -0500


This is a multi-part message in MIME format.
--------------090303000902090608080709
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit

This patch covers bugs found by running flexelint on
the CVS code on Windows NT.

- incorrect enum used in al_creds.cpp and various other files
- use of local after it goes out of scope in al_wizard.cpp
- uninitialized class members in afsclass/*
- cm_config.c looks like it has code commented out accidentally
- useless statement in alert.cpp
- no default case handling in problems.cpp
- strange use of & on booleans in set_clone.cpp
- fgets() and fclose() on closed stream in cellconfig.c
- memory leak in cellconfig.c
- *scanf into variables of unknown length in cellconfig.c
- incorrect pointer passed to getAFSServer() in cellconfig.c
- possible buffer overflows in userok.c
- address of array in bos.c
- too many arguments for printf() in commands.c
- return code not saved in bucoord/main.c
- bad types for argv arrays in bucoord/main.c
- probably incorrect initializer list in ol_verify.c
- extra argument to TLog() in lwps.c
- memory leak in cmd/cmd.c
- lack of typecast on malloc() in a couple files
- lower-case L for long constant in touch.c (is it a 1 or an l...)
- parentheses nesting error in util_cr.c
- apparently invalid case fall-through in util_cr.c
- various memory leaks in util_cr.c
- macro missing parens in crypt.c
- macro missing parens in quad_cksum.c
- null pointer deref in kpasswd.c (CVS work in progress?)
- Print_bos_ProcessState_p() code does not look correct
- extra argument to printf() in kas.c
- typo in vsprocs.c
- macro missing parens in iomgr.c
- address of array in threadname.c
- storing result of getch() in char type in waitkey.c (may not match EOF constant)
- storing pointer to local car in global in ptserver.c (benign -- it is in main())
- address of array in rx_lwp.c
- macro missing parens in rx_packet.h
- impossible == (signed vs. unsigned?) in rxdebug.c
- bogus constants in xdr.c and xdr_array.c (possible security implications?)
- incorrect test of fd for open file in update/server.c
- dangerous unparenthesized macro in get_krbrlm.c
- buffer overrun in regex.c
- missing comma causes string concat and bad array init in vlclient.c
- comparison of string < 0 in ntops.c
- default case has no code in vos.c
-- 
Joe Buehler


--------------090303000902090608080709
Content-Type: text/plain;
 name="temp.patch.bugs"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="temp.patch.bugs"

--- ./src/WINNT/afsapplib/al_creds.cpp.~1~	2000-11-04 05:01:19.000000000 -0500
+++ ./src/WINNT/afsapplib/al_creds.cpp	2003-11-20 13:57:01.000000000 -0500
@@ -954,7 +981,7 @@
                kas_principalEntry_t Entry;
                if (kas_PrincipalGet (hCell, NULL, &Identity, &Entry, &status))
                   {
-                  if (Entry.adminSetting == ADMIN)
+                  if (Entry.adminSetting == KAS_ADMIN)
                      rc = TRUE;
                   }
 
--- ./src/WINNT/afsapplib/al_wizard.cpp.~1~	2000-11-04 05:01:20.000000000 -0500
+++ ./src/WINNT/afsapplib/al_wizard.cpp	2003-11-20 13:57:55.000000000 -0500
@@ -168,6 +168,7 @@
 void WIZARD::SetGraphic (int idbGraphic16, int idbGraphic256)
 {
    LPRGBQUAD pargb = NULL;
+   RGBQUAD argb[256];
 
    m_idbGraphic16 = idbGraphic16;
    m_idbGraphic256 = idbGraphic256;
--- ./src/WINNT/afsapplib/al_wizard.cpp.~1~	2000-11-04 05:01:20.000000000 -0500
+++ ./src/WINNT/afsapplib/al_wizard.cpp	2003-11-20 13:57:55.000000000 -0500
@@ -202,7 +203,6 @@
          HDC hdc = CreateCompatibleDC (NULL);
          HBITMAP bmpOld = (HBITMAP)SelectObject (hdc, m_bmpGraphic256);
 
-         RGBQUAD argb[256];
          GetDIBColorTable (hdc, 0, 256, argb);
          pargb = argb;
 
--- ./src/WINNT/afsclass/c_grp.cpp.~1~	2000-11-04 05:01:31.000000000 -0500
+++ ./src/WINNT/afsclass/c_grp.cpp	2003-11-20 16:53:25.000000000 -0500
@@ -41,6 +41,7 @@
    m_mszMembers = NULL;
    m_mszMemberOf = NULL;
    m_mszOwnerOf = NULL;
+   memset(&m_gs, 0, sizeof(m_gs));
 }
 
 
--- ./src/WINNT/afsclass/c_svr.cpp.~1~	2000-11-04 05:01:33.000000000 -0500
+++ ./src/WINNT/afsclass/c_svr.cpp	2003-11-20 16:51:05.000000000 -0500
@@ -89,6 +89,7 @@
    m_fDelete = FALSE;
    m_lastStatus = 0;
 
+   m_fVLDBOutOfDate = FALSE; /* FIXME: added because it was missing */
    m_fStatusOutOfDate = TRUE;
    memset (&m_ss, 0x00, sizeof(SERVERSTATUS));
 }
--- ./src/WINNT/afsclass/c_usr.cpp.~1~	2000-11-04 05:01:33.000000000 -0500
+++ ./src/WINNT/afsclass/c_usr.cpp	2003-11-20 16:52:16.000000000 -0500
@@ -39,6 +39,7 @@
    m_fStatusOutOfDate = TRUE;
    m_mszOwnerOf = NULL;
    m_mszMemberOf = NULL;
+   memset(&m_us, 0, sizeof(m_us));
 }
 
 
--- ./src/WINNT/afsclass/c_usr.cpp.~1~	2000-11-04 05:01:33.000000000 -0500
+++ ./src/WINNT/afsclass/c_usr.cpp	2003-11-20 16:52:16.000000000 -0500
@@ -190,7 +191,7 @@
                CopyAnsiToString (szLastModPrincipal, wpGetKas.wpKasPrincipalGet.Data.lastModPrincipal.principal);
                CopyAnsiToString (szLastModInstance, wpGetKas.wpKasPrincipalGet.Data.lastModPrincipal.instance);
 
-               m_us.KASINFO.fIsAdmin = (wpGetKas.wpKasPrincipalGet.Data.adminSetting == ADMIN) ? TRUE : FALSE;
+               m_us.KASINFO.fIsAdmin = (wpGetKas.wpKasPrincipalGet.Data.adminSetting == KAS_ADMIN) ? TRUE : FALSE;
                m_us.KASINFO.fCanGetTickets = (wpGetKas.wpKasPrincipalGet.Data.tgsSetting == TGS) ? TRUE : FALSE;
                m_us.KASINFO.fEncrypt = (wpGetKas.wpKasPrincipalGet.Data.encSetting == ENCRYPT) ? TRUE : FALSE;
                m_us.KASINFO.fCanChangePassword = (wpGetKas.wpKasPrincipalGet.Data.cpwSetting == CHANGE_PASSWORD) ? TRUE : FALSE;
--- ./src/WINNT/afsd/cm_config.c.~1~	2002-11-04 15:43:50.000000000 -0500
+++ ./src/WINNT/afsd/cm_config.c	2003-11-20 10:36:26.000000000 -0500
@@ -66,6 +67,7 @@
 		/* comment or line end */
                 if (tc == '#' || tc == '\r' || tc == '\n') break;
 
+		/* FIXME: possible missing comment terminator at end of next line */
 		/* square bracket comment -- look for closing delim
 		if (tc == '[') {sawBracket = 1; continue;}
 
--- ./src/WINNT/afssvrmgr/alert.cpp.~1~	2000-11-04 05:02:02.000000000 -0500
+++ ./src/WINNT/afssvrmgr/alert.cpp	2003-11-19 15:12:58.000000000 -0500
@@ -357,7 +357,6 @@
             lpoa->nAlerts ++;
             lpoa->aAlerts[ iInsert ].alert = alertTIMEOUT;
             lpoa->aAlerts[ iInsert ].aiTIMEOUT.status = status;
-            lpoa->aAlerts[ iInsert ].aiTIMEOUT.stLastAttempt;
             GetSystemTime (&lpoa->aAlerts[ iInsert ].aiTIMEOUT.stLastAttempt);
 
             fChanged = TRUE;
--- ./src/WINNT/afssvrmgr/problems.cpp.~1~	2000-11-04 05:02:05.000000000 -0500
+++ ./src/WINNT/afssvrmgr/problems.cpp	2003-11-19 16:40:35.000000000 -0500
@@ -210,6 +221,8 @@
             GetString (szText, IDS_AGGREGATE_NO_PROBLEMS);
          else if (lpi->fIsFileset())
             GetString (szText, IDS_FILESET_NO_PROBLEMS);
+	 else
+	     wsprintf (szText, TEXT("UNEXPECTED CONDITION in problems.cpp"));
 
          SetDlgItemText (hDlg, IDC_PROBLEM_TEXT, szText);
          break;
--- ./src/WINNT/afssvrmgr/set_clone.cpp.~1~	2000-11-04 05:02:06.000000000 -0500
+++ ./src/WINNT/afssvrmgr/set_clone.cpp	2003-11-20 08:17:12.000000000 -0500
@@ -280,7 +296,7 @@
    if (!fEnable)
       CheckDlgButton (hDlg, IDC_CLONE_AGG_LIMIT, FALSE);
 
-   fEnable &= IsDlgButtonChecked (hDlg, IDC_CLONE_AGG_LIMIT) && pcsp->fEnumedAggregs;
+   fEnable = fEnable && IsDlgButtonChecked (hDlg, IDC_CLONE_AGG_LIMIT) && pcsp->fEnumedAggregs;
    EnableWindow (GetDlgItem (hDlg, IDC_CLONE_AGG), fEnable);
 
    fEnable = IsDlgButtonChecked (hDlg, IDC_CLONE_PREFIX_LIMIT);
--- ./src/auth/cellconfig.c.~1~	2003-07-15 19:14:41.000000000 -0400
+++ ./src/auth/cellconfig.c	2003-11-18 13:01:00.000000000 -0500
@@ -306,8 +306,6 @@
 			free(tdir);
 			UNLOCK_GLOBAL_MUTEX return (struct afsconf_dir *)0;
 		    }
-		    fgets(afs_confdir, 128, fp);
-		    fclose(fp);
 		}
 		fgets(afs_confdir, 128, fp);
 		fclose(fp);
--- ./src/auth/cellconfig.c.~1~	2003-07-15 19:14:41.000000000 -0400
+++ ./src/auth/cellconfig.c	2003-11-18 13:01:00.000000000 -0500
@@ -345,6 +343,7 @@
     strcompose(tbuffer, 256, adir->name, "/", AFSDIR_THISCELL_FILE, NULL);
     tf = fopen(tbuffer, "r");
     if (tf) {
+	/* FIXME: buffer overflow waiting to happen */
 	rc = fscanf(tf, "%s", tbuffer);
 	if (rc == 1) {
 	    adir->cellName = (char *)malloc(strlen(tbuffer) + 1);
--- ./src/auth/cellconfig.c.~1~	2003-07-15 19:14:41.000000000 -0400
+++ ./src/auth/cellconfig.c	2003-11-18 13:01:00.000000000 -0500
@@ -454,6 +453,7 @@
 	    if (code) {
 		afsconf_CloseInternal(adir);
 		fclose(tf);
+		free(curEntry);
 		return -1;
 	    }
 	    if (linkedcell[0] != '\0') {
--- ./src/auth/cellconfig.c.~1~	2003-07-15 19:14:41.000000000 -0400
+++ ./src/auth/cellconfig.c	2003-11-18 13:01:00.000000000 -0500
@@ -571,10 +571,12 @@
     if (*aline == '[') {
 	if (aclone)
 	    *aclone = 1;
+	/* FIXME: length of aname unknown here */
 	code = sscanf(aline, "[%d.%d.%d.%d] #%s", &c1, &c2, &c3, &c4, aname);
     } else {
 	if (aclone)
 	    *aclone = 0;
+	/* FIXME: length of aname unknown here */
 	code = sscanf(aline, "%d.%d.%d.%d #%s", &c1, &c2, &c3, &c4, aname);
     }
     if (code != 5)
--- ./src/auth/cellconfig.c.~1~	2003-07-15 19:14:41.000000000 -0400
+++ ./src/auth/cellconfig.c	2003-11-18 13:01:00.000000000 -0500
@@ -601,6 +603,7 @@
 	      register char *alname)
 {
     register int code;
+    /* FIXME: length of aname, alname unknown here */
     code = sscanf(aline, ">%s %s", aname, alname);
     if (code == 1)
 	*alname = '\0';
--- ./src/auth/cellconfig.c.~1~	2003-07-15 19:14:41.000000000 -0400
+++ ./src/auth/cellconfig.c	2003-11-18 13:01:00.000000000 -0500
@@ -785,16 +788,11 @@
 {
     register afs_int32 i;
     int tservice;
-    struct afsconf_entry DNSce;
-    char *DNStmpStrp;		/* a temp string pointer */
-    struct hostent *thp;
     afs_int32 cellHosts[AFSMAXCELLHOSTS];
     int numServers;
     int rc;
-    int *ttl;
+    int ttl;
 
-    DNSce.cellInfo.numServers = 0;
-    DNSce.next = NULL;
     rc = getAFSServer(acellName, cellHosts, &numServers, &ttl);
     /* ignore the ttl here since this code is only called by transitory programs
      * like klog, etc. */
--- ./src/auth/userok.c.~1~	2003-07-15 19:14:41.000000000 -0400
+++ ./src/auth/userok.c	2003-11-18 13:04:26.000000000 -0500
@@ -113,7 +116,7 @@
     register FILE *tf;
     register FILE *nf;
     register int flag;
-    char tname[64];
+    char tname[64 + 1];
     char *tp;
     int found;
     struct stat tstat;
--- ./src/auth/userok.c.~1~	2003-07-15 19:14:41.000000000 -0400
+++ ./src/auth/userok.c	2003-11-18 13:04:26.000000000 -0500
@@ -198,7 +202,7 @@
 {
     char tbuffer[256];
     register FILE *tf;
-    char tname[64];
+    char tname[64 + 1];
     register char *tp;
     register int flag;
     register afs_int32 code;
--- ./src/auth/userok.c.~1~	2003-07-15 19:14:41.000000000 -0400
+++ ./src/auth/userok.c	2003-11-18 13:04:26.000000000 -0500
@@ -228,14 +232,14 @@
 }
 
 /* returns true iff user is in the UserList file */
-static
+static int
 FindUser(adir, auser)
      struct afsconf_dir *adir;
      register char *auser;
 {
     char tbuffer[256];
     register bufio_p bp;
-    char tname[64];
+    char tname[64 + 1];
     register int flag;
     register afs_int32 code;
     int rc;
--- ./src/bozo/bos.c.~1~	2003-08-08 16:27:58.000000000 -0400
+++ ./src/bozo/bos.c	2003-11-20 14:34:53.000000000 -0500
@@ -1500,7 +1494,7 @@
 
     /* Find out whether fileserver is running MR-AFS (has a scanner instance) */
     /* XXX this should really be done some other way, potentially by RPC */
-    tp = &tname;
+    tp = &tname[0];
     if (code = BOZO_GetInstanceParm(tconn, "fs", 3, &tp) == 0)
 	mrafs = 1;
 
--- ./src/bucoord/commands.c.~1~	2003-07-15 19:14:47.000000000 -0400
+++ ./src/bucoord/commands.c	2003-11-20 14:34:18.000000000 -0500
@@ -3136,7 +3113,7 @@
 		printf("%10u %10u %-2d %16s %2d %5d %s", dumpPtr->id,
 		       dumpPtr->parent, dumpPtr->level, ds,
 		       dumpPtr->tapes.maxTapes - dumpPtr->tapes.b + 1,
-		       dumpPtr->nVolumes, dumpPtr->name, tapedumpid);
+		       dumpPtr->nVolumes, dumpPtr->name);
 	    if (dumpPtr->initialDumpID)	/* an appended dump */
 		printf(" (%u)", dumpPtr->initialDumpID);
 	    else if (dumpPtr->appendedDumpID)	/* has appended dumps */
--- ./src/bucoord/main.c.~1~	2003-07-15 19:14:47.000000000 -0400
+++ ./src/bucoord/main.c	2003-11-20 15:04:18.000000000 -0500
@@ -286,7 +283,7 @@
     rx_SetRxDeadTime(60);
 
     /* VLDB initialization */
-    vldbClientInit(0, localauth, tcell, &cstruct, &ttoken);
+    code = vldbClientInit(0, localauth, tcell, &cstruct, &ttoken);
     if (code)
 	return (code);
 
--- ./src/bucoord/main.c.~1~	2003-07-15 19:14:47.000000000 -0400
+++ ./src/bucoord/main.c	2003-11-20 15:04:18.000000000 -0500
@@ -391,11 +387,11 @@
 
 afs_int32
 doDispatch(targc, targv, dispatchCount)
-     char **targv[MAXV];
+     char *targv[MAXV];
      afs_int32 targc;
      afs_int32 dispatchCount;	/* to prevent infinite recursion */
 {
-    char **sargv[MAXV];
+    char *sargv[MAXV];
     afs_int32 sargc;
     afs_int32 code, c;
     FILE *fd;
--- ./src/bucoord/main.c.~1~	2003-07-15 19:14:47.000000000 -0400
+++ ./src/bucoord/main.c	2003-11-20 15:04:18.000000000 -0500
@@ -489,10 +485,9 @@
      int argc;
      char **argv;
 {				/*main */
-    char **targv[MAXV];		/*Ptr to parsed argv stuff */
+    char *targv[MAXV];		/*Ptr to parsed argv stuff */
     afs_int32 targc;		/*Num parsed arguments */
     afs_int32 code;		/*Return code */
-    char *tp;			/*Result of gets() */
     register struct cmd_syndesc *ts;	/*Ptr to parsed command line */
     int i;
 
--- ./src/budb/ol_verify.c.~1~	2003-07-15 19:14:48.000000000 -0400
+++ ./src/budb/ol_verify.c	2003-11-20 15:32:46.000000000 -0500
@@ -960,6 +962,7 @@
 
     static afs_int32(*checkEntry[NBLOCKTYPES]) ()
 	= {
+	/* FIXME: this list does not match typeName[] and may be incorrect */
 	0,			/* free block */
 	    verifyVolFragEntry, verifyVolInfoEntry, verifyTapeEntry, verifyDumpEntry, 0	/* text block */
     };
--- ./src/butc/lwps.c.~1~	2003-08-08 16:01:25.000000000 -0400
+++ ./src/butc/lwps.c	2003-11-20 13:13:18.000000000 -0500
@@ -741,8 +740,7 @@
 		com_err(whoami, errno,
 			"Error waiting for callout script to terminate.");
 		TLog(taskId,
-		     "Can't get exit status from callout script. will prompt\n",
-		     wcode);
+		     "Can't get exit status from callout script. will prompt\n");
 		CallOut = 0;
 		break;
 	    }
--- ./src/cmd/cmd.c.~1~	2003-07-15 19:14:50.000000000 -0400
+++ ./src/cmd/cmd.c	2003-11-18 12:53:28.000000000 -0500
@@ -594,6 +594,7 @@
     pinitopcode = (char *)malloc(sizeof(initcmd_opcode));
     if (!pinitopcode) {
 	fprintf(stderr, "%s: Can't malloc initial opcode space\n", aargv[0]);
+	free(newargv);
 	return (NULL);
     }
     strcpy(pinitopcode, initcmd_opcode);
--- ./src/comerr/compile_et.c.~1~	2003-07-15 19:14:53.000000000 -0400
+++ ./src/comerr/compile_et.c	2003-11-18 12:17:50.000000000 -0500
@@ -57,7 +57,7 @@
 char *
 xmalloc(unsigned int size)
 {
-    char *p = malloc(size);
+    char *p = (char *)malloc(size);
     if (!p) {
 	perror(whoami);
 	exit(1);
--- ./src/config/mkvers.c.~1~	2003-07-15 19:14:55.000000000 -0400
+++ ./src/config/mkvers.c	2003-11-18 13:44:57.000000000 -0500
@@ -205,7 +206,7 @@
 
     if (cml_prefix) {
 	cml_string =
-	    malloc(strlen("char ") + strlen(cml_prefix) + strlen(CML_STRING) +
+	    (char *)malloc(strlen("char ") + strlen(cml_prefix) + strlen(CML_STRING) +
 		   1);
 	if (!cml_string) {
 	    printf("No space to use prefix in cml string, ignoring it.\n");
--- ./src/config/touch.c.~1~	2003-07-15 19:14:56.000000000 -0400
+++ ./src/config/touch.c	2003-11-18 12:49:44.000000000 -0500
@@ -37,7 +37,8 @@
 	if ((finfo.attrib & ~_A_ARCH) != _A_NORMAL)
 	    continue;
 	fh = _open(finfo.name, _S_IWRITE | _O_BINARY | _S_IREAD | _O_RDWR);
-	pos = _lseek(fh, 0l, SEEK_END);
+	pos = _lseek(fh, 0L, SEEK_END);
+	buffer[0] = 0;
 	_write(fh, buffer, 1);
 	_chsize(fh, pos);
 	_close(fh);
--- ./src/config/util_cr.c.~1~	2003-07-15 19:14:56.000000000 -0400
+++ ./src/config/util_cr.c	2003-11-18 12:52:19.000000000 -0500
@@ -428,7 +428,7 @@
 	    break;
 	case 3:		//1.0.401 or 1.0.40a are the same; 
 	    if ((isdigit(*ptr) == 0)	// first 2 must be digit
-		|| (isdigit(*(ptr + 1) == 0))
+		|| (isdigit(*(ptr + 1)) == 0)
 		|| (*(ptr + 1) != '0' && isdigit(*(ptr + 2)) == 0)	// disallow 1.0.4b0  or 1.0.41a 
 		)
 		usuage();
--- ./src/config/util_cr.c.~1~	2003-07-15 19:14:56.000000000 -0400
+++ ./src/config/util_cr.c	2003-11-18 12:52:19.000000000 -0500
@@ -454,6 +455,7 @@
 		if (isdigit(*ptr) == 0 || isdigit(*(ptr + 1)) == 0)
 		    usuage();
 		pat2 = atoi(ptr);
+		break;
 	    default:
 		usuage();
 	    }
--- ./src/config/util_cr.c.~1~	2003-07-15 19:14:56.000000000 -0400
+++ ./src/config/util_cr.c	2003-11-18 12:52:19.000000000 -0500
@@ -462,7 +464,8 @@
 	if (file == NULL)
 	    usuage();
 	len = filelength(_fileno(file));
-	buf = (char *)malloc(len + 1);
+	save = (char *)malloc(len + 1);
+	buf = save;
 	len = fread(buf, sizeof(char), len, file);
 	buf[len] = 0;		//set eof
 	fclose(file);
--- ./src/config/util_cr.c.~1~	2003-07-15 19:14:56.000000000 -0400
+++ ./src/config/util_cr.c	2003-11-18 12:52:19.000000000 -0500
@@ -507,6 +510,7 @@
 	    buf = ptr + 1;
 	}
 	fclose(file);
+	free(save);
 	return 0;
     }
     if (strcmp(argv[1], "~") == 0) {	//check for file presence
--- ./src/config/util_cr.c.~1~	2003-07-15 19:14:56.000000000 -0400
+++ ./src/config/util_cr.c	2003-11-18 12:52:19.000000000 -0500
@@ -626,7 +630,8 @@
 	if (file == NULL)
 	    exit(0xc000);
 	len = filelength(_fileno(file));
-	ch = (char *)malloc(len + 2);
+	save = (char *)malloc(len + 2);
+	ch = save;
 	*ch++ = 0;		/* a small hack to allow matching /r/n if /n is first character */
 	len = fread(ch, sizeof(char), len, file);
 	file = freopen(fname, "wb", file);
--- ./src/config/util_cr.c.~1~	2003-07-15 19:14:56.000000000 -0400
+++ ./src/config/util_cr.c	2003-11-18 12:52:19.000000000 -0500
@@ -638,6 +643,7 @@
 	    ch++;
 	}
 	fclose(file);
+	free(save);
 	return 0;
     }
     if (strcmp(argv[1], "-") == 0) {
--- ./src/config/util_cr.c.~1~	2003-07-15 19:14:56.000000000 -0400
+++ ./src/config/util_cr.c	2003-11-18 12:52:19.000000000 -0500
@@ -646,7 +652,8 @@
 	if (file == NULL)
 	    exit(0xc000);
 	len = filelength(_fileno(file));
-	ch = (char *)malloc(len + 1);
+	save = (char *)malloc(len + 1);
+	ch = save;
 	len = fread(ch, sizeof(char), len, file);
 	file = freopen(fname, "wb", file);
 	while (len-- > 0) {
--- ./src/config/util_cr.c.~1~	2003-07-15 19:14:56.000000000 -0400
+++ ./src/config/util_cr.c	2003-11-18 12:52:19.000000000 -0500
@@ -655,6 +662,7 @@
 	    ch++;
 	}
 	fclose(file);
+	free(save);
 	return 0;
     }
     if (strstr(fname, ".et") == NULL)
--- ./src/config/util_cr.c.~1~	2003-07-15 19:14:56.000000000 -0400
+++ ./src/config/util_cr.c	2003-11-18 12:52:19.000000000 -0500
@@ -663,7 +671,8 @@
     if (file == NULL)
 	exit(0xc000);
     len = filelength(_fileno(file));
-    ch = (char *)malloc(len + 1);
+    save = (char *)malloc(len + 1);
+    ch = save;
     len = fread(ch, sizeof(char), len, file);
     file = freopen(fname, "wb", file);
     while (len-- > 0) {
--- ./src/config/util_cr.c.~1~	2003-07-15 19:14:56.000000000 -0400
+++ ./src/config/util_cr.c	2003-11-18 12:52:19.000000000 -0500
@@ -677,9 +686,9 @@
 	pvar[i] = argv[i + 1];
     pvar[argc - 1] = NULL;
     pvar[0] = argv[1];
-    l = _spawnvp(_P_WAIT, argv[1], pvar);
-    if (ch)
-	free(ch);
+    (void)_spawnvp(_P_WAIT, argv[1], pvar);
+    if (save)
+	free(save);
     if (pvar)
 	free(pvar);
     return 0;
--- ./src/des/crypt.c.~1~	2003-07-15 19:14:59.000000000 -0400
+++ ./src/des/crypt.c	2003-11-18 13:31:04.000000000 -0500
@@ -283,7 +283,7 @@
 #define	LOAD(d,d0,d1,bl)		d0 = (bl).b32.i0, d1 = (bl).b32.i1
 #define	LOADREG(d,d0,d1,s,s0,s1)	d0 = s0, d1 = s1
 #define	OR(d,d0,d1,bl)			d0 |= (bl).b32.i0, d1 |= (bl).b32.i1
-#define	STORE(s,s0,s1,bl)		(bl).b32.i0 = s0, (bl).b32.i1 = s1
+#define	STORE(s,s0,s1,bl)		(bl).b32.i0 = (s0), (bl).b32.i1 = (s1)
 #define	DCL_BLOCK(d,d0,d1)		long d0, d1
 
 #if defined(LARGEDATA)
--- ./src/des/quad_cksum.c.~1~	2003-07-15 19:15:00.000000000 -0400
+++ ./src/des/quad_cksum.c	2003-11-18 10:32:14.000000000 -0500
@@ -85,8 +85,8 @@
 /* Definitions for byte swapping */
 
 #ifdef LSBFIRST
-#define vaxtohl(x) *((afs_uint32 *)(x))
-#define vaxtohs(x) *((unsigned short *)(x))
+#define vaxtohl(x) (*((afs_uint32 *)(x)))
+#define vaxtohs(x) (*((unsigned short *)(x)))
 #else
 static afs_uint32 four_bytes_vax_to_nets();
 #define vaxtohl(x) four_bytes_vax_to_nets((char *)(x))
--- ./src/kauth/kpasswd.c.~1~	2003-07-15 19:15:16.000000000 -0400
+++ ./src/kauth/kpasswd.c	2003-11-20 13:09:51.000000000 -0500
@@ -185,6 +185,7 @@
 {
     if (insist == 0) {
 	/* see if it is reasonable, but don't get so obnoxious */
+	/* FIXME: null pointer derefence!!! */
 	(*insist)++;		/* so we don't get called again */
 	if (strlen(newpw) < 6)
 	    return 0;
--- ./src/libadmin/test/bos.c.~1~	2003-08-08 17:54:41.000000000 -0400
+++ ./src/libadmin/test/bos.c	2003-11-20 15:14:15.000000000 -0500
@@ -632,6 +632,7 @@
 Print_bos_ProcessState_p(bos_ProcessState_p state, const char *prefix)
 {
     printf("%sProcess state:\n", prefix);
+    /* FIXME: BOS_PROCESS_OK is 0, so this test is not right */
     if (*state & BOS_PROCESS_OK) {
 	printf("%s\tBOS_PROCESS_OK:\n", prefix);
     }
--- ./src/libadmin/test/kas.c.~1~	2003-08-08 17:54:41.000000000 -0400
+++ ./src/libadmin/test/kas.c	2003-11-20 13:33:37.000000000 -0500
@@ -150,7 +150,7 @@
     for (i = 0; i < KAS_ENCRYPTION_KEY_LEN; i++) {
 	printf("%d ", principal->key.key[i]);
     }
-    printf("\n", prefix);
+    printf("\n");
 
     printf("%sKey checksum %u\n", prefix, principal->keyCheckSum);
     printf("%sDays to password expire %d\n", prefix,
--- ./src/libadmin/vos/vsprocs.c.~1~	2003-07-15 19:15:36.000000000 -0400
+++ ./src/libadmin/vos/vsprocs.c	2003-11-20 15:12:14.000000000 -0500
@@ -4077,6 +4077,7 @@
 
     if (tid) {
 	etst = AFSVolEndTrans(server, tid, &rcode);
+	/* FIXME: this looks like a typo */
 	if (etst || etst) {
 	    if (!tst)
 		tst = (etst ? etst : rcode);
--- ./src/lwp/iomgr.c.~1~	2002-08-22 14:45:16.000000000 -0400
+++ ./src/lwp/iomgr.c	2003-11-18 11:03:35.000000000 -0500
@@ -88,7 +88,7 @@
 #define TRUE	1
 
 #ifndef MIN
-#define MIN(a,b) ((a)>(b)) ? b : a
+#define MIN(a,b) (((a)>(b)) ? (b) : (a))
 #endif
 
 #ifndef NSIG
--- ./src/lwp/threadname.c.~1~	2003-07-15 19:15:45.000000000 -0400
+++ ./src/lwp/threadname.c	2003-11-18 11:23:40.000000000 -0500
@@ -66,10 +66,10 @@
 #else /* AFS_PTHREAD_ENV */
     me = (PROCESS) LWP_ThreadId();
 #endif /* AFS_PTHREAD_ENV */
-    ptr = (char *)&MainThread;
+    ptr = &MainThread[0];
     for (i = 0; i < nThreads; i++) {
 	if (ThreadId[i] == me) {
-	    ptr = (char *)&ThreadName[i];
+	    ptr = &ThreadName[i][0];
 	    break;
 	}
     }
--- ./src/lwp/waitkey.c.~1~	2003-07-15 19:15:46.000000000 -0400
+++ ./src/lwp/waitkey.c	2003-11-18 10:28:43.000000000 -0500
@@ -113,7 +113,7 @@
 LWP_GetLine(char *linebuf, int len)
 {
     int cnt = 0;
-    char ch = '\0';
+    int ch = 0;
 
     fflush(stdin);
     /* loop until a new line has been entered */
--- ./src/ptserver/ptserver.c.~1~	2003-08-24 13:17:50.000000000 -0400
+++ ./src/ptserver/ptserver.c	2003-11-20 16:40:49.000000000 -0500
@@ -157,15 +157,14 @@
 extern afs_int32 depthsg;
 #endif
 
-extern afs_int32 ubik_lastYesTime;
-extern afs_int32 ubik_nBuffers;
-
 extern int afsconf_ServerAuth();
 extern int afsconf_CheckAuth();
 
 int pr_realmNameLen;
 char *pr_realmName;
 
+static struct afsconf_cell info;
+
 #include "AFS_component_version_number.c"
 
 /* check whether caller is authorized to manage RX statistics */
--- ./src/ptserver/ptserver.c.~1~	2003-08-24 13:17:50.000000000 -0400
+++ ./src/ptserver/ptserver.c	2003-11-20 16:40:49.000000000 -0500
@@ -190,7 +189,6 @@
 #if 0
     struct ktc_encryptionKey tkey;
 #endif
-    struct afsconf_cell info;
     int kerberosKeys;		/* set if found some keys */
     int lwps = 3;
     char clones[MAXHOSTSPERCELL];
--- ./src/rx/rx_lwp.c.~1~	2003-07-15 19:16:09.000000000 -0400
+++ ./src/rx/rx_lwp.c	2003-11-18 12:22:35.000000000 -0500
@@ -179,7 +179,7 @@
     }
     rx_listenerPid = pid;
     if (swapNameProgram)
-	(*swapNameProgram) (pid, "listener", &name);
+	(*swapNameProgram) (pid, "listener", &name[0]);
 
     for (;;) {
 	/* Grab a new packet only if necessary (otherwise re-use the old one) */
--- ./src/rx/rx_packet.h.~1~	2003-07-15 19:16:09.000000000 -0400
+++ ./src/rx/rx_packet.h	2003-11-18 13:33:45.000000000 -0500
@@ -320,8 +320,8 @@
 /* copy data from an RX packet */
 #define rx_packetread(p, off, len, out)               \
   ( (off) + (len) > (p)->wirevec[1].iov_len ?         \
-    rx_SlowReadPacket(p, off, len, (char*)out) :             \
-    ((memcpy((char *)(out), (char*)((p)->wirevec[1].iov_base)+(off), len)),0))
+    rx_SlowReadPacket(p, off, len, (char*)(out)) :             \
+    ((memcpy((char *)(out), (char*)((p)->wirevec[1].iov_base)+(off), (len))),0))
 
 #define rx_computelen(p,l) { register int i; \
    for (l=0, i=1; i < p->niovecs; i++ ) l += p->wirevec[i].iov_len; }
--- ./src/rx/rxdebug.c.~1~	2003-07-15 19:16:12.000000000 -0400
+++ ./src/rx/rxdebug.c	2003-11-20 14:27:44.000000000 -0500
@@ -335,7 +333,7 @@
 		printf("getconn call failed with code %d\n", code);
 		break;
 	    }
-	    if (tconn.cid == 0xffffffff) {
+	    if (tconn.cid == (afs_int32)0xffffffff) {
 		printf("Done.\n");
 		break;
 	    }
--- ./src/rx/xdr.c.~1~	2003-07-15 19:16:12.000000000 -0400
+++ ./src/rx/xdr.c	2003-11-18 13:15:32.000000000 -0500
@@ -522,6 +522,7 @@
     u_int size;
     u_int nodesize;
 
+    /* FIXME: this does not look correct: MSVC 6 computes -2 here */
     if (maxsize > ((~0) >> 1) - 1)
 	maxsize = ((~0) >> 1) - 1;
 
--- ./src/rx/xdr_array.c.~1~	2003-07-15 19:16:12.000000000 -0400
+++ ./src/rx/xdr_array.c	2003-11-18 13:13:30.000000000 -0500
@@ -86,6 +86,7 @@
     register bool_t stat = TRUE;
     register u_int nodesize;
 
+    /* FIXME: this does not look correct: MSVC 6 computes -1 / elsize here */
     i = ((~0) >> 1) / elsize;
     if (maxsize > i)
 	maxsize = i;
--- ./src/rxgen/rpc_main.c.~1~	2003-07-15 19:16:41.000000000 -0400
+++ ./src/rxgen/rpc_main.c	2003-11-18 10:51:17.000000000 -0500
@@ -785,7 +785,7 @@
     int i;
     int j;
     char c;
-    char flag[(1 << 8 * sizeof(char))];
+    char flag[(1 << (8 * sizeof(char)))];
     int nflags;
 
     cmdname = argv[0];
--- ./src/update/server.c.~1~	2003-07-15 19:17:07.000000000 -0400
+++ ./src/update/server.c	2003-11-20 15:02:31.000000000 -0500
@@ -354,7 +356,6 @@
      struct rx_call *call;
      char *name;
 {
-    int fd = -1;
     int error = 0;
     struct stat status;
     char *reqObject;
--- ./src/update/server.c.~1~	2003-07-15 19:17:07.000000000 -0400
+++ ./src/update/server.c	2003-11-20 15:02:31.000000000 -0500
@@ -375,13 +376,9 @@
 	}
 	if ((status.st_mode & S_IFMT) != S_IFDIR) {
 	    printf(" file %s is not a directory \n", reqObject);
-	    if (fd >= 0)
-		close(fd);
 	    error = -1;
 	}
 
-	if (fd >= 0)
-	    close(fd);
 	if (!error)
 	    error = update_SendDirInfo(reqObject, call, &status, name);
     }
--- ./src/update/server.c.~1~	2003-07-15 19:17:07.000000000 -0400
+++ ./src/update/server.c	2003-11-20 15:02:31.000000000 -0500
@@ -524,7 +521,7 @@
     }
     if (error == 0) {
 	fd = open(dirInfoFile, O_RDONLY, 0);
-	if (fd) {
+	if (fd >= 0) {
 	    fstat(fd, &tstatus);
 	    errcode = update_SendFile(fd, call, &tstatus);
 	    if (errcode)
--- ./src/util/get_krbrlm.c.~1~	2003-07-15 19:17:16.000000000 -0400
+++ ./src/util/get_krbrlm.c	2003-11-18 10:31:57.000000000 -0500
@@ -24,12 +24,12 @@
  *
  */
 #define	KSUCCESS	0
-#define	KFAILURE	-1
+#define	KFAILURE	(-1)
 
 int
 afs_krb_get_lrealm(char *r, int n)
 {
-    FILE *cnffile, *fopen();
+    FILE *cnffile/*, *fopen()*/;
 
     if (n > 1)
 	return (KFAILURE);	/* Temporary restriction */
--- ./src/util/regex.c.~1~	2003-07-15 19:17:16.000000000 -0400
+++ ./src/util/regex.c	2003-11-18 13:26:58.000000000 -0500
@@ -139,7 +139,7 @@
     } else
 	circf = 0;
     for (;;) {
-	if (ep >= &expbuf[ESIZE])
+	if (ep >= &expbuf[ESIZE - 10 /* fudge factor */])
 	    comperr(retoolong);
 	if ((c = *sp++) == '\0') {
 	    if (bracketp != bracket)
--- ./src/util/regex.c.~1~	2003-07-15 19:17:16.000000000 -0400
+++ ./src/util/regex.c	2003-11-18 13:26:58.000000000 -0500
@@ -189,13 +189,13 @@
 			*ep = ep[-1] + 1;
 			ep++;
 			cclcnt++;
-			if (ep >= &expbuf[ESIZE])
+			if (ep >= &expbuf[ESIZE - 10 /* fudge factor */])
 			    comperr(retoolong);
 		    }
 		}
 		*ep++ = c;
 		cclcnt++;
-		if (ep >= &expbuf[ESIZE])
+		if (ep >= &expbuf[ESIZE - 10 /* fudge factor */])
 		    comperr(retoolong);
 	    } while ((c = *sp++) != ']');
 	    lastep[1] = cclcnt;
--- ./src/vlserver/vlclient.c.~1~	2003-07-15 19:17:34.000000000 -0400
+++ ./src/vlserver/vlclient.c	2003-11-20 15:26:46.000000000 -0500
@@ -107,7 +106,8 @@
     "ListAttributesU",
     "LinkedListU",
     "RegisterAddr",
-    "GetAddrsU" "ListAttributesN2"
+    "GetAddrsU",
+    "ListAttributesN2"
 };
 
 struct Vlent {
--- ./src/vlserver/vlclient.c.~1~	2003-07-15 19:17:34.000000000 -0400
+++ ./src/vlserver/vlclient.c	2003-11-20 15:26:46.000000000 -0500
@@ -532,6 +534,7 @@
 		    ("Volumes not found in main hash tables in vldb will be fixed...\n");
 		memset(&updateentry, 0, sizeof(updateentry));
 		for (index = 0; 1; index = next_index) {
+		    /* FIXME: n2 is never changed for some reason */
 		    int n1 = 0, n2 = 0, n3 = 0, n4 = 0;
 		    memset(&entry, 0, sizeof(entry));
 		    code =
--- ./src/vol/ntops.c.~1~	2003-07-15 19:17:39.000000000 -0400
+++ ./src/vol/ntops.c	2003-11-20 14:53:51.000000000 -0500
@@ -1054,7 +1056,7 @@
 
     if (singleVolumeNumber) {
 	h.ih_vid = singleVolumeNumber;
-	if (nt_HandleToVolDir(name, &h) < 0)
+	if (!nt_HandleToVolDir(name, &h))
 	    return -1;
 	ninodes =
 	    nt_ListAFSSubDirs(&h, writeFun, fp, judgeFun, singleVolumeNumber);
--- ./src/volser/vos.c.~1~	2003-11-12 15:42:04.000000000 -0500
+++ ./src/volser/vos.c	2003-11-20 14:33:44.000000000 -0500
@@ -3477,6 +3462,10 @@
 	*part = rentry->serverPartition[index];
 	return 0;
     }
+    fprintf(STDERR,
+	    "unexpected volume type for volume %lu\n",
+	    (unsigned long)volid);
+    return -1;
 }
 
 static

--------------090303000902090608080709--