[PATCH 0/5] MR4590: mciwave: Use matching memory allocator (Coverity).

[Zhiyi Zhang (＠zhiyi)]

*pszTmpFileName will be freed with free() but it's allocated with HeapAlloc().

[PATCH 1/5] mciwave: Use matching memory allocator (Coverity).

[Zhiyi Zhang]

From: Zhiyi Zhang

*pszTmpFileName will be freed with free() but it's allocated with HeapAlloc().
---
 dlls/mciwave/mciwave.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/dlls/mciwave/mciwave.c b/dlls/mciwave/mciwave.c
index b17c347258f..f2af38b8762 100644
--- a/dlls/mciwave/mciwave.c
+++ b/dlls/mciwave/mciwave.c
@@ -432,9 +432,7 @@ static DWORD create_tmp_file(HMMIO* hFile, LPWSTR* pszTmpFileName)
         return MCIERR_FILE_NOT_FOUND;
     }

-    *pszTmpFileName = HeapAlloc(GetProcessHeap(),
-                                HEAP_ZERO_MEMORY,
-                                MAX_PATH * sizeof(WCHAR));
+    *pszTmpFileName = calloc(1, MAX_PATH * sizeof(WCHAR));
     if (!GetTempFileNameW(szTmpPath, szPrefix, 0, *pszTmpFileName)) {
         WARN("can't retrieve temp file name!\n");
         free(*pszTmpFileName);

[PATCH 2/5] tasklist: Fix a possible buffer overrun (Coverity).

[Zhiyi Zhang]

From: Zhiyi Zhang

process_entry->szExeFile has length of MAX_PATH but info->image_name only has 32.
---
 programs/tasklist/tasklist.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/programs/tasklist/tasklist.c b/programs/tasklist/tasklist.c
index 4f866f6b727..28e50d119bb 100644
--- a/programs/tasklist/tasklist.c
+++ b/programs/tasklist/tasklist.c
@@ -176,7 +176,7 @@ static BOOL tasklist_get_process_info(const PROCESSENTRY32W *process_entry, stru
     info->pid_value = process_entry->th32ProcessID;
     info->memory_usage_value = memory_counters.WorkingSetSize / 1024;
     info->session_id_value = session_id;
-    wcscpy(info->image_name, process_entry->szExeFile);
+    wcscpy_s(info->image_name, ARRAY_SIZE(info->image_name), process_entry->szExeFile);
     swprintf(info->pid, ARRAY_SIZE(info->pid), L"%u", process_entry->th32ProcessID);
     wcscpy(info->session_name, session_id == 0 ? L"Services" : L"Console");
     swprintf(info->session_number, ARRAY_SIZE(info->session_number), L"%u", session_id);

[PATCH 3/5] wininet: Fix a use-after-free (Coverity).

[Zhiyi Zhang]

From: Zhiyi Zhang

pEntry could be freed after cache_container_unlock_index(pContainer, pHeader).
---
 dlls/wininet/urlcache.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dlls/wininet/urlcache.c b/dlls/wininet/urlcache.c
index 8e43eaae9f3..7975071ce91 100644
--- a/dlls/wininet/urlcache.c
+++ b/dlls/wininet/urlcache.c
@@ -2550,8 +2550,8 @@ BOOL WINAPI UnlockUrlCacheEntryFileA(LPCSTR lpszUrlName, DWORD dwReserved)
     pEntry = (entry_header*)((LPBYTE)pHeader + pHashEntry->offset);
     if (pEntry->signature != URL_SIGNATURE)
     {
-        cache_container_unlock_index(pContainer, pHeader);
         FIXME("Trying to retrieve entry of unknown format %s\n", debugstr_an((LPSTR)&pEntry->signature, sizeof(DWORD)));
+        cache_container_unlock_index(pContainer, pHeader);
         SetLastError(ERROR_FILE_NOT_FOUND);
         return FALSE;
     }

[PATCH 4/5] shell32: Fix a memory leak (Coverity).

[Zhiyi Zhang]

From: Zhiyi Zhang

---
 dlls/shell32/dde.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dlls/shell32/dde.c b/dlls/shell32/dde.c
index 976dc2e394a..eea8b8ec4ce 100644
--- a/dlls/shell32/dde.c
+++ b/dlls/shell32/dde.c
@@ -165,6 +165,7 @@ static inline HDDEDATA Dde_OnRequest(UINT uFmt, HCONV hconv, HSZ hszTopic,
                     {
                         free(groups_data);
                         free(programs);
+                        FindClose(hfind);
                         return NULL;
                     }
                     groups_data = new_groups_data;

[PATCH 5/5] ntdll: Fix a memory leak (Coverity).

[Zhiyi Zhang]

From: Zhiyi Zhang

---
 dlls/ntdll/unix/loader.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/dlls/ntdll/unix/loader.c b/dlls/ntdll/unix/loader.c
index aa120ae38ec..5673fdb38cb 100644
--- a/dlls/ntdll/unix/loader.c
+++ b/dlls/ntdll/unix/loader.c
@@ -438,7 +438,12 @@ static void init_paths( char *argv[] )
         data_dir = build_path( bin_dir, BIN_TO_DATADIR );
         wineloader = build_path( bin_dir, basename );
     }
-    else wineloader = build_path( build_path( build_dir, "loader" ), basename );
+    else
+    {
+        char *dirname = build_path( build_dir, "loader" );
+        wineloader = build_path( dirname, basename );
+        free(dirname);
+    }

asprintf( &env, "WINELOADER=%s", wineloader );
     putenv( env );

[Alexandre Julliard (＠julliard)]

Alexandre Julliard (@julliard) commented about programs/tasklist/tasklist.c:
>  info->pid_value = process_entry->th32ProcessID;
>  info->memory_usage_value = memory_counters.WorkingSetSize / 1024;
>  info->session_id_value = session_id;
> - wcscpy(info->image_name, process_entry->szExeFile);
> - wcscpy_s(info->image_name, ARRAY_SIZE(info->image_name), process_entry->szExeFile);

wcscpy_s doesn't seem appropriate here.