Fix a bunch of bugs reported by clang-analyzer

libr/anal/p/anal_arc.c

@@ -201,7 +201,7 @@ static int arcompact_genops_jmp(RAnalOp *op, ut64 addr, arc_fields *f, ut64 basi
 }
 
 static int arcompact_genops(RAnalOp *op, ut64 addr, ut32 words[2]) {
-	arc_fields fields;
+	arc_fields fields = {0};
 
 	fields.format = (words[0] & 0x00c00000) >> 22;
 	fields.subopcode = (words[0] & 0x003f0000) >> 16;

libr/asm/p/asm_lm32.c

@@ -264,7 +264,9 @@ static int write_reg_names_to_struct(RAsmLm32Instruction *instr) {
 }
 
 static int print_pseudo_instruction(RAsmLm32Instruction *instr, char *str) {
-	if (!instr->pseudoInstruction) return -1;
+	if (!instr->pseudoInstruction) {
+		return -1;
+	}
 	switch (instr->op) {
 	//ret == b ra
 	case lm32_op_b:
@@ -386,7 +388,7 @@ static int assemble(RAsm *a, RAsmOp *ao, const char *str) {
 #endif
 
 static int disassemble(RAsm *a, RAsmOp *op, const ut8 *buf, int len) {
-	RAsmLm32Instruction instr;
+	RAsmLm32Instruction instr = {0};
 	instr.value = buf[0] << 24 | buf[1] << 16 | buf[2] << 8 | buf[3];
 	instr.addr = a->pc;
 	if (r_asm_lm32_decode (&instr)) {
@@ -414,7 +416,7 @@ RAsmPlugin r_asm_plugin_lm32 = {
 };
 
 #ifndef CORELIB
-struct r_lib_struct_t radare_plugin = {
+RLibStruct radare_plugin = {
 	.type = R_LIB_TYPE_ASM,
 	.data = &r_asm_plugin_lm32,
 	.version = R2_VERSION

libr/bin/bin.c

@@ -809,8 +809,10 @@ R_API int r_bin_object_set_items(RBinFile *binfile, RBinObject *o) {
 
 // XXX - this is a rather hacky way to do things, there may need to be a better
 // way.
-R_API int r_bin_load(RBin *bin, const char *file, ut64 baseaddr, ut64 loadaddr,
-		      int xtr_idx, int fd, int rawstr) {
+R_API int r_bin_load(RBin *bin, const char *file, ut64 baseaddr, ut64 loadaddr, int xtr_idx, int fd, int rawstr) {
+	if (!bin) {
+		return false;
+	}
 	// ALIAS?	return r_bin_load_as (bin, file, baseaddr, loadaddr,
 	// xtr_idx, fd, rawstr, 0, file);
 	RIOBind *iob = &(bin->iob);
@@ -1498,7 +1500,7 @@ static RBinFile *r_bin_file_new_from_bytes(RBin *bin, const char *file,
 		bf = r_bin_file_create_append (bin, file, bytes, sz, file_sz,
 					       rawstr, fd, xtrname, steal_ptr);
 		if (!bf) {
-			if (steal_ptr) { // we own the ptr, free on error
+			if (!steal_ptr) { // we own the ptr, free on error
 				free ((void*) bytes);
 			}
 			return NULL;

libr/bin/pdb/pdb.c

@@ -460,6 +460,10 @@ static bool pdb7_parse(R_PDB *pdb) {
 		goto error;
 	}
 
+	if (page_size < 1 || num_root_index_pages < 1) {
+		eprintf ("invalid root index pages size\n");
+		goto error;
+	}
 	root_page_data = (int *)calloc (page_size, num_root_index_pages);
 	if (!root_page_data) {
 		eprintf ("error memory allocation of root_page_data\n");
@@ -702,7 +706,8 @@ static int build_format_flags(R_PDB *pdb, char *type, int pos, char *res_field,
 			//  w word (2 bytes unsigned short in hex)
 			if (res_field[pos] == 'p') {
 				return 1;
-			} else if (res_field[pos] == 'u') {
+			}
+			if (res_field[pos] == 'u') {
 				res_field[pos] = 'w';
 			} else {
 				res_field[pos] = 'w';
@@ -711,7 +716,8 @@ static int build_format_flags(R_PDB *pdb, char *type, int pos, char *res_field,
 		case eCharState:
 			if (res_field[pos] == 'p') {
 				return 1;
-			} else if (res_field[pos] == 'u') {
+			}
+			if (res_field[pos] == 'u') {
 				res_field[pos] = 'b';
 			} else {
 				res_field[pos] = 'c';
@@ -720,11 +726,8 @@ static int build_format_flags(R_PDB *pdb, char *type, int pos, char *res_field,
 		case eLongState:
 			if (res_field[pos] == 'p') {
 				return 1;
-			} else if (res_field[pos] == 'u') {
-				res_field[pos] = 'i';
-			} else {
-				res_field[pos] = 'i';
 			}
+			res_field[pos] = 'i';
 			return 1;
 		case eModifierState:
 			if (res_field[pos] == 'p') {
@@ -736,15 +739,16 @@ static int build_format_flags(R_PDB *pdb, char *type, int pos, char *res_field,
 			if (res_field[pos] == 'p') {
 				return 1;
 			}
-
 			res_field[pos] = 'E';
 			tmp = strtok(NULL, " ");
-			name = (char *) malloc(strlen(tmp) + strlen(*name_field) + 1 + 2);
-			strcpy(name, tmp);
-			sprintf(name, "(%s)%s", tmp, *name_field);
+			name = (char *) malloc (strlen (tmp) + strlen (*name_field) + 1 + 2);
+			if (!name) {
+				return 0;
+			}
+			strcpy (name, tmp);
+			sprintf (name, "(%s)%s", tmp, *name_field);
 			free(*name_field);
 			*name_field = name;
-
 			return 1;
 //		case eDoubleState:
 //			// TODO: what is the flag for double in pf??
@@ -1087,7 +1091,12 @@ static void print_gvars(R_PDB *pdb, ut64 img_base, int format) {
 	if ((omap != 0) && (sctns_orig != 0)) {
 		pe_stream = (SPEStream *) sctns_orig->stream;
 	} else {
-		pe_stream = (SPEStream *) sctns->stream;
+		if (sctns) {
+			pe_stream = (SPEStream *) sctns->stream;
+		}
+	}
+	if (!pe_stream) {
+		return;
 	}
 	it = r_list_iterator (gsym_data_stream->globals_list);
 	while (r_list_iter_next (it)) {

libr/bin/pdb/tpi.c

@@ -1027,14 +1027,14 @@ static void get_pointer_print_type(void *type, char **name) {
 static void get_modifier_print_type(void *type, char **name) {
 	STypeInfo *ti = (STypeInfo *) type;
 	SType *t = 0;
-	char *tmp_name = 0;
+	char *tmp_name = NULL;
 	int name_len = 0;
-	int need_to_free = 1;
+	bool need_to_free = true;
 	int base_type = 0;
 
 	base_type = ti->get_modified_type (ti, (void **)&t);
 	if (!t) {
-		need_to_free = 0;
+		need_to_free = false;
 		print_base_type (base_type, &tmp_name);
 	} else {
 		ti = &t->type_data;
@@ -1042,21 +1042,23 @@ static void get_modifier_print_type(void *type, char **name) {
 	}
 
 	name_len = strlen ("modifier ");
-	if (tmp_name)
+	if (tmp_name) {
 		name_len += strlen (tmp_name);
-	*name = (char *) malloc(name_len + 1);
+	}
+	*name = (char *) malloc (name_len + 1);
 	if (!(*name)) {
-		free (tmp_name);
+		if (need_to_free) {
+			free (tmp_name);
+		}
 		return;
 	}
 	// name[name_len] = '\0';
 	strcpy (*name, "modifier ");
-	if (tmp_name)
+	if (tmp_name) {
 		strcat (*name, tmp_name);
-
+	}
 	if (need_to_free) {
 		free (tmp_name);
-		tmp_name = 0;
 	}
 }
 

libr/core/cio.c

@@ -390,6 +390,9 @@ R_API int r_core_shift_block(RCore *core, ut64 addr, ut64 b_size, st64 dist) {
 	}
 
 	// XXX handling basic cases atm
+	if (b_size < 1) {
+		return false;
+	}
 	shift_buf = malloc (b_size);
 	memset (shift_buf, 0, b_size);
 

libr/core/cmd_anal.c

@@ -3515,12 +3515,7 @@ static void cmd_anal_aftertraps(RCore *core, const char *input) {
 				len = binfile->size - o;
 			} else {
 				if (binfile->size > core->offset) {
-					if (binfile->size > core->offset) {
-						len = binfile->size - core->offset;
-					} else {
-						eprintf ("Opps something went wrong aac\n");
-						return;
-					}
+					len = binfile->size - core->offset;
 				} else {
 					eprintf ("Oops invalid range\n");
 					len = 0;

libr/core/graph.c

@@ -1144,8 +1144,7 @@ static void adjust_directions(const RAGraph *g, int i, int from_up, Sdb *D, Sdb
 			for (k = wma->pos_in_layer + 1; k < wpa->pos_in_layer; ++k) {
 				const RGraphNode *w = g->layers[wma->layer].nodes[k];
 				const RANode *aw = get_anode (w);
-
-				if (aw->is_dummy) {
+				if (aw && aw->is_dummy) {
 					p &= hash_get_int (P, w);
 				}
 			}

shlr/sdb/src/fmt.c

@@ -53,7 +53,9 @@ SDB_API char *sdb_fmt(int n, const char *fmt, ...) {
 SDB_API char *sdb_fmt_tostr(void *p, const char *fmt) {
 	char buf[128], *e_str, *out = NULL;
 	int n, len = 0;
-
+	if (!p || !fmt) {
+		return NULL;
+	}
 	for (; *fmt; fmt++) {
 		n = 4;
 		switch (*fmt) {

shlr/sdb/src/ht.c

@@ -158,7 +158,7 @@ static void internal_ht_grow(SdbHash* ht) {
 #endif
 
 static bool internal_ht_insert_kv(SdbHash *ht, HtKv *kv, bool update) {
-	bool found;
+	bool found = false;
 	if (!ht || !kv) {
 		return false;
 	}