Memory-safety fixes: uninitialized reads and a realloc leak

src/kmi/simple.c

@@ -192,12 +192,15 @@ int simple_parse_opts(void *opt_args)
 		const size_t dk_list_len = (priv.dk_list ? strlen((char *) priv.dk_list) + strlen("/") : 0)
 			+ strlen((char *) key[i].dk) + strlen(":") + strlen((char *) key[i].dki) + 1;
 
-		if (priv.dk_list)
+		unsigned char *previous = priv.dk_list;
+
+		if (priv.dk_list != NULL)
 			priv.dk_list = (unsigned char*)realloc(priv.dk_list, dk_list_len);
 		else
 			priv.dk_list = (unsigned char*)calloc(dk_list_len, sizeof(unsigned char));
 		if (priv.dk_list == NULL) {
 			ltfsmsg(LTFS_ERR, 10001E, __FUNCTION__);
+			free(previous);
 			return -LTFS_NO_MEMORY;
 		}
 		*(priv.dk_list + original_dk_list_len) = '\0';

src/libltfs/ltfs.c

@@ -4404,7 +4404,7 @@ void ltfs_enable_livelink_mode(struct ltfs_volume *vol)
  */
 int ltfs_profiler_set(uint64_t source, struct ltfs_volume *vol)
 {
-	int ret, ret_save = 0;
+	int ret = 0, ret_save = 0;
 
 	if (vol->iosched_handle) {
 		if (source & PROF_IOSCHED) {

src/libltfs/pathname.c

@@ -197,10 +197,12 @@ int pathname_prepare_caseless(const char *name, UChar **new_name, bool use_nfc)
 	/* Convert to NFD if needed, then case fold the name. */
 	if (need_initial_nfd) {
 		ret = _pathname_normalize_nfd_icu(icu_name, &icu_nfd);
-		if (icu_name != icu_nfd)
+		if (ret < 0) {
 			free(icu_name);
-		if (ret < 0)
 			return ret;
+		}
+		if (icu_name != icu_nfd)
+			free(icu_name);
 		ret = _pathname_foldcase_icu(icu_nfd, &icu_fold);
 		free(icu_nfd);
 		if (ret < 0)
@@ -217,10 +219,12 @@ int pathname_prepare_caseless(const char *name, UChar **new_name, bool use_nfc)
 		ret = _pathname_normalize_nfc_icu(icu_fold, new_name);
 	else
 		ret = _pathname_normalize_nfd_icu(icu_fold, new_name);
-	if (icu_fold != *new_name)
+	if (ret < 0) {
 		free(icu_fold);
-	if (ret < 0)
 		return ret;
+	}
+	if (icu_fold != *new_name)
+		free(icu_fold);
 
 	return 0;
 }
@@ -475,10 +479,12 @@ int _pathname_format_icu(const char *src, char **dest, bool validate, bool allow
 
 	/* normalize */
 	ret = _pathname_normalize_nfc_icu(utf16_name, &utf16_name_norm);
-	if (utf16_name != utf16_name_norm)
+	if (ret < 0) {
 		free(utf16_name);
-	if (ret < 0)
 		return ret;
+	}
+	if (utf16_name != utf16_name_norm)
+		free(utf16_name);
 
 	/* convert to UTF-8 */
 	ret = _pathname_utf16_to_utf8_icu(utf16_name_norm, dest);
@@ -534,10 +540,12 @@ int _pathname_normalize_utf8_nfd_icu(const char *src, char **dest)
 		return ret;
 
 	ret = _pathname_normalize_nfd_icu(icu_str, &icu_str_norm);
-	if (icu_str != icu_str_norm)
+	if (ret < 0) {
 		free(icu_str);
-	if (ret < 0)
 		return ret;
+	}
+	if (icu_str != icu_str_norm)
+		free(icu_str);
 
 	ret = _pathname_utf16_to_utf8_icu(icu_str_norm, dest);
 	free(icu_str_norm);
@@ -602,10 +610,12 @@ int _pathname_normalize_utf8_icu(const char *src, char **dest)
 		return ret;
 
 	ret = _pathname_normalize_nfc_icu(icu_str, &icu_str_norm);
-	if (icu_str != icu_str_norm)
+	if (ret < 0) {
 		free(icu_str);
-	if (ret < 0)
 		return ret;
+	}
+	if (icu_str != icu_str_norm)
+		free(icu_str);
 
 	ret = _pathname_utf16_to_utf8_icu(icu_str_norm, dest);
 	free(icu_str_norm);

src/libltfs/tape.c

@@ -373,7 +373,7 @@ int tape_load_tape(struct device_data *dev, void * const kmi_handle, bool force)
 	int ret;
 	struct tc_drive_param param;
 	struct tc_remaining_cap cap;
-	uint16_t pews;
+	uint16_t pews = 0;
 
 	CHECK_ARG_NULL(dev, -LTFS_NULL_ARG);
 	CHECK_ARG_NULL(dev->backend, -LTFS_NULL_ARG);

src/tape_drivers/linux/sg/sg_tape.c

@@ -311,7 +311,11 @@ static int _get_dump(struct sg_data *priv, char *fname)
 	}
 
 	/* Get buffer capacity */
-	_cdb_read_buffer(priv, buf_id, cap_buf, 0, sizeof(cap_buf), 0x03);
+	ret = _cdb_read_buffer(priv, buf_id, cap_buf, 0, sizeof(cap_buf), 0x03);
+	if (ret < 0) {
+		free(dump_buf);
+		return ret;
+	}
 	data_length = (cap_buf[1] << 16) + (cap_buf[2] << 8) + (int)cap_buf[3];
 
 	/* Open dump file for write only*/