coverity: Dereference after null check

8 files changed, 73 insertions, 62 deletions

diff --git a/sesman/chansrv/chansrv_fuse.c b/sesman/chansrv/chansrv_fuse.c
index 5bef552d..e80f93a9 100644
--- a/sesman/chansrv/chansrv_fuse.c
+++ b/sesman/chansrv/chansrv_fuse.c
@@ -1781,12 +1781,15 @@ void xfuse_devredir_cb_rename_file(void *vp, tui32 IoStatus)
         new_xinode = xfuse_get_inode_from_pinode_name(fip->new_inode,
                                                       fip->new_name);
 
-        if (new_xinode->mode & S_IFREG)
-            xfuse_delete_file_with_xinode(new_xinode);
-        else
-            xfuse_delete_dir_with_xinode(new_xinode);
+        if (new_xinode)
+        {
+            if (new_xinode->mode & S_IFREG)
+                xfuse_delete_file_with_xinode(new_xinode);
+            else
+                xfuse_delete_dir_with_xinode(new_xinode);
 
-        new_xinode = NULL;
+            new_xinode = NULL;
+        }
     }
 
     old_xinode = xfuse_get_inode_from_pinode_name(fip->inode, fip->name);
diff --git a/sesman/chansrv/devredir.c b/sesman/chansrv/devredir.c
index 9b746a98..121c1190 100644
--- a/sesman/chansrv/devredir.c
+++ b/sesman/chansrv/devredir.c
@@ -790,10 +790,14 @@ dev_redir_proc_device_iocompletion(struct stream *s)
         fuse_data = devredir_fuse_data_dequeue(irp);
 
         if (fuse_data == NULL)
+        {
             log_error("fuse_data is NULL");
-
-        xfuse_devredir_cb_read_file(fuse_data->data_ptr, s->p, Length);
-        devredir_irp_delete(irp);
+        }
+        else
+        {
+            xfuse_devredir_cb_read_file(fuse_data->data_ptr, s->p, Length);
+            devredir_irp_delete(irp);
+        }
         break;
 
     case CID_WRITE:
@@ -802,10 +806,14 @@ dev_redir_proc_device_iocompletion(struct stream *s)
         fuse_data = devredir_fuse_data_dequeue(irp);
 
         if (fuse_data == NULL)
+        {
             log_error("fuse_data is NULL");
-
-        xfuse_devredir_cb_write_file(fuse_data->data_ptr, s->p, Length);
-        devredir_irp_delete(irp);
+        }
+        else
+        {
+            xfuse_devredir_cb_write_file(fuse_data->data_ptr, s->p, Length);
+            devredir_irp_delete(irp);
+        }
         break;
 
     case CID_CLOSE:
diff --git a/sesman/chansrv/rail.c b/sesman/chansrv/rail.c
index 4d620c00..f3777970 100644
--- a/sesman/chansrv/rail.c
+++ b/sesman/chansrv/rail.c
@@ -739,7 +739,7 @@ rail_win_get_state(Window win)
                       (unsigned char **)&data,
                       &nitems);
 
-    if (data || nitems > 0)
+    if (data && nitems > 0)
     {
         rv = *(unsigned long *)data;
         XFree(data);
diff --git a/xrdp/xrdp_bitmap.c b/xrdp/xrdp_bitmap.c
index 6438f0e7..3bbebfd9 100644
--- a/xrdp/xrdp_bitmap.c
+++ b/xrdp/xrdp_bitmap.c
@@ -1764,42 +1764,6 @@ xrdp_bitmap_def_proc(struct xrdp_bitmap *self, int msg,
                 if (self->child_list != 0)
                 {
                     i = list_index_of(self->child_list, (long)self->focused_control);
-                }
-
-                if (shift)
-                {
-                    i--;
-
-                    if (i < 0)
-                    {
-                        i = self->child_list->count - 1;
-                    }
-                }
-                else
-                {
-                    i++;
-
-                    if (i >= self->child_list->count)
-                    {
-                        i = 0;
-                    }
-                }
-
-                n = self->child_list->count;
-                b = (struct xrdp_bitmap *)list_get_item(self->child_list, i);
-
-                while (b != self->focused_control && b != 0 && n > 0)
-                {
-                    n--;
-
-                    if (b->tab_stop)
-                    {
-                        focus_out_control = self->focused_control;
-                        self->focused_control = b;
-                        xrdp_bitmap_invalidate(focus_out_control, 0);
-                        xrdp_bitmap_invalidate(b, 0);
-                        break;
-                    }
 
                     if (shift)
                     {
@@ -1820,7 +1784,43 @@ xrdp_bitmap_def_proc(struct xrdp_bitmap *self, int msg,
                         }
                     }
 
+                    n = self->child_list->count;
                     b = (struct xrdp_bitmap *)list_get_item(self->child_list, i);
+
+                    while (b != self->focused_control && b != 0 && n > 0)
+                    {
+                        n--;
+
+                        if (b->tab_stop)
+                        {
+                            focus_out_control = self->focused_control;
+                            self->focused_control = b;
+                            xrdp_bitmap_invalidate(focus_out_control, 0);
+                            xrdp_bitmap_invalidate(b, 0);
+                            break;
+                        }
+
+                        if (shift)
+                        {
+                            i--;
+
+                            if (i < 0)
+                            {
+                                i = self->child_list->count - 1;
+                            }
+                        }
+                        else
+                        {
+                            i++;
+
+                            if (i >= self->child_list->count)
+                            {
+                                i = 0;
+                            }
+                        }
+
+                        b = (struct xrdp_bitmap *)list_get_item(self->child_list, i);
+                    }
                 }
             }
             else if (scan_code == 28) /* enter */
diff --git a/xrdp/xrdp_encoder.c b/xrdp/xrdp_encoder.c
index 13843ae4..78d1b52e 100644
--- a/xrdp/xrdp_encoder.c
+++ b/xrdp/xrdp_encoder.c
@@ -60,13 +60,13 @@ init_xrdp_encoder(struct xrdp_mm *self)
     char buf[1024];
     int pid;
 
-    LLOGLN(0, ("init_xrdp_encoder: initing encoder codec_id %d", self->codec_id));
-
     if (self == 0)
     {
         return -1;
     }
 
+    LLOGLN(0, ("init_xrdp_encoder: initing encoder codec_id %d", self->codec_id));
+
     /* setup required FIFOs */
     self->fifo_to_proc = fifo_create();
     self->fifo_processed = fifo_create();
@@ -100,7 +100,7 @@ init_xrdp_encoder(struct xrdp_mm *self)
             LLOGLN(0, ("init_xrdp_encoder: unknown codec_id %d",
                    self->codec_id));
             break;
-            
+
     }
 
     /* create thread to process messages */
diff --git a/xrdp/xrdp_listen.c b/xrdp/xrdp_listen.c
index 7f6ab281..fb4d9aec 100644
--- a/xrdp/xrdp_listen.c
+++ b/xrdp/xrdp_listen.c
@@ -449,7 +449,7 @@ xrdp_listen_main_loop(struct xrdp_listen *self)
             robjs[robjs_count++] = done_obj;
             timeout = -1;
 
-            if (self->listen_trans != 0)
+            /* if (self->listen_trans != 0) */
             {
                 if (trans_get_wait_objs(self->listen_trans, robjs,
                                         &robjs_count) != 0)
diff --git a/xrdp/xrdp_process.c b/xrdp/xrdp_process.c
index c60c40dc..b9cac32b 100644
--- a/xrdp/xrdp_process.c
+++ b/xrdp/xrdp_process.c
@@ -70,15 +70,15 @@ xrdp_process_loop(struct xrdp_process *self, struct stream *s)
     if (self->session != 0)
     {
         rv = libxrdp_process_data(self->session, s);
-    }
 
-    if ((self->wm == 0) && (self->session->up_and_running) && (rv == 0))
-    {
-        DEBUG(("calling xrdp_wm_init and creating wm"));
-        self->wm = xrdp_wm_create(self, self->session->client_info);
-        /* at this point the wm(window manager) is create and wm::login_mode is
-           zero and login_mode_event is set so xrdp_wm_init should be called by
-           xrdp_wm_check_wait_objs */
+        if ((self->wm == 0) && (self->session->up_and_running) && (rv == 0))
+        {
+            DEBUG(("calling xrdp_wm_init and creating wm"));
+            self->wm = xrdp_wm_create(self, self->session->client_info);
+            /* at this point the wm(window manager) is create and wm::login_mode is
+               zero and login_mode_event is set so xrdp_wm_init should be called by
+               xrdp_wm_check_wait_objs */
+        }
     }
 
     return rv;
diff --git a/xrdp/xrdp_wm.c b/xrdp/xrdp_wm.c
index 8f1016bd..6179d2e8 100644
--- a/xrdp/xrdp_wm.c
+++ b/xrdp/xrdp_wm.c
@@ -1745,13 +1745,13 @@ callback(long id, int msg, long param1, long param2, long param3, long param4)
 static int APP_CC
 xrdp_wm_login_mode_changed(struct xrdp_wm *self)
 {
-    g_writeln("xrdp_wm_login_mode_changed: login_mode is %d", self->login_mode);
-
     if (self == 0)
     {
         return 0;
     }
 
+    g_writeln("xrdp_wm_login_mode_changed: login_mode is %d", self->login_mode);
+
     if (self->login_mode == 0)
     {
         /* this is the inital state of the login window */