Major code cleanup:

- Initialized and zeroed out local variables
- Check for some null pointers
- Fixed some typos
- Other minor changes (beautify, etc.)

8 files changed, 180 insertions, 145 deletions

diff --git a/libxrdp/libxrdp.c b/libxrdp/libxrdp.c
index 0d7a86b1..05e67eb7 100644
--- a/libxrdp/libxrdp.c
+++ b/libxrdp/libxrdp.c
@@ -133,9 +133,9 @@ libxrdp_process_data(struct xrdp_session* session)
 int EXPORT_CC
 libxrdp_send_palette(struct xrdp_session* session, int* palette)
 {
-  int i;
-  int color;
-  struct stream* s;
+  int i = 0;
+  int color = 0;
+  struct stream* s = (struct stream *)NULL;
 
   if (session->client_info->bpp > 8)
   {
@@ -203,21 +203,21 @@ int EXPORT_CC
 libxrdp_send_bitmap(struct xrdp_session* session, int width, int height,
                     int bpp, char* data, int x, int y, int cx, int cy)
 {
-  int line_size;
-  int i;
-  int j;
-  int total_lines;
-  int lines_sending;
-  int Bpp;
-  int e;
-  int bufsize;
-  int total_bufsize;
-  int num_updates;
-  char* p_num_updates;
-  char* p;
-  char* q;
-  struct stream* s;
-  struct stream* temp_s;
+  int line_size = 0;
+  int i = 0;
+  int j = 0;
+  int total_lines = 0;
+  int lines_sending = 0;
+  int Bpp = 0;
+  int e = 0;
+  int bufsize = 0;
+  int total_bufsize = 0;
+  int num_updates = 0;
+  char* p_num_updates = (char *)NULL;
+  char* p = (char *)NULL;
+  char* q = (char *)NULL;
+  struct stream* s = (struct stream *)NULL;
+  struct stream* temp_s = (struct stream *)NULL;
 
   DEBUG(("libxrdp_send_bitmap sending bitmap"));
   Bpp = (bpp + 7) / 8;
@@ -651,10 +651,10 @@ int EXPORT_CC
 libxrdp_query_channel(struct xrdp_session* session, int index,
                       char* channel_name, int* channel_flags)
 {
-  int count;
-  struct xrdp_rdp* rdp;
-  struct xrdp_mcs* mcs;
-  struct mcs_channel_item* channel_item;
+  int count = 0;
+  struct xrdp_rdp* rdp = (struct xrdp_rdp *)NULL;
+  struct xrdp_mcs* mcs = (struct xrdp_mcs *)NULL;
+  struct mcs_channel_item* channel_item = (struct mcs_channel_item *)NULL;
 
   rdp = (struct xrdp_rdp*)session->rdp;
   mcs = rdp->sec_layer->mcs_layer;
@@ -687,11 +687,11 @@ libxrdp_query_channel(struct xrdp_session* session, int index,
 int EXPORT_CC
 libxrdp_get_channel_id(struct xrdp_session* session, char* name)
 {
-  int index;
-  int count;
-  struct xrdp_rdp* rdp;
-  struct xrdp_mcs* mcs;
-  struct mcs_channel_item* channel_item;
+  int index = 0;
+  int count = 0;
+  struct xrdp_rdp* rdp = NULL;
+  struct xrdp_mcs* mcs = NULL;
+  struct mcs_channel_item* channel_item = NULL;
 
   rdp = (struct xrdp_rdp*)session->rdp;
   mcs = rdp->sec_layer->mcs_layer;
@@ -717,10 +717,10 @@ libxrdp_send_to_channel(struct xrdp_session* session, int channel_id,
                         char* data, int data_len,
                         int total_data_len, int flags)
 {
-  struct xrdp_rdp* rdp;
-  struct xrdp_sec* sec;
-  struct xrdp_channel* chan;
-  struct stream* s;
+  struct xrdp_rdp* rdp = NULL;
+  struct xrdp_sec* sec = NULL;
+  struct xrdp_channel* chan = NULL;
+  struct stream* s = NULL;
 
   rdp = (struct xrdp_rdp*)session->rdp;
   sec = rdp->sec_layer;
diff --git a/libxrdp/libxrdpinc.h b/libxrdp/libxrdpinc.h
index 258fbb83..a8ee6640 100644
--- a/libxrdp/libxrdpinc.h
+++ b/libxrdp/libxrdpinc.h
@@ -20,7 +20,7 @@
 
 */
 
-#if !defined(LIBXRDPINC_H)
+#ifndef LIBXRDPINC_H
 #define LIBXRDPINC_H
 
 struct xrdp_client_info
diff --git a/libxrdp/xrdp_bitmap_compress.c b/libxrdp/xrdp_bitmap_compress.c
index ccf128f7..fcaab1f7 100644
--- a/libxrdp/xrdp_bitmap_compress.c
+++ b/libxrdp/xrdp_bitmap_compress.c
@@ -950,7 +950,7 @@ xrdp_bitmap_compress(char* in_data, int width, int height,
   }
   else if ((bpp == 15) || (bpp == 16))
   {
-    mix = 0xffff;
+    mix = (bpp == 15) ? 0xba1f : 0xffff;
     out_count = end * 2;
     line = in_data + width * start_line * 2;
     while (start_line >= 0 && out_count < 32768)
diff --git a/libxrdp/xrdp_channel.c b/libxrdp/xrdp_channel.c
index 15320ebd..00497c35 100644
--- a/libxrdp/xrdp_channel.c
+++ b/libxrdp/xrdp_channel.c
@@ -170,6 +170,7 @@ xrdp_channel_process(struct xrdp_channel* self, struct stream* s,
     g_writeln("xrdp_channel_process, channel not found");
     return 1;
   }
+  rv = 0;
   in_uint32_le(s, length);
   in_uint32_le(s, flags);
   rv = xrdp_channel_call_callback(self, s, channel_id, length, flags);
diff --git a/libxrdp/xrdp_orders.c b/libxrdp/xrdp_orders.c
index b12fa27d..ff2ed3d0 100644
--- a/libxrdp/xrdp_orders.c
+++ b/libxrdp/xrdp_orders.c
@@ -127,6 +127,10 @@ xrdp_orders_send(struct xrdp_orders* self)
 int APP_CC
 xrdp_orders_force_send(struct xrdp_orders* self)
 {
+  if (self == 0)
+  {
+    return 1;
+  }
   if ((self->order_level > 0) && (self->order_count > 0))
   {
     s_mark_end(self->out_s);
@@ -336,10 +340,10 @@ xrdp_order_pack_small_or_tiny(struct xrdp_orders* self,
                               char* present_ptr, int present,
                               int present_size)
 {
-  int move_up_count;
-  int index;
-  int size;
-  int keep_looking;
+  int move_up_count = 0;
+  int index = 0;
+  int size = 0;
+  int keep_looking = 1;
 
   move_up_count = 0;
   keep_looking = 1;
@@ -527,11 +531,11 @@ xrdp_orders_screen_blt(struct xrdp_orders* self, int x, int y,
                        int cx, int cy, int srcx, int srcy,
                        int rop, struct xrdp_rect* rect)
 {
-  int order_flags;
-  int vals[12];
-  int present;
-  char* present_ptr;
-  char* order_flags_ptr;
+  int order_flags = 0;
+  int vals[12] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+  int present = 0;
+  char* present_ptr = (char *)NULL;
+  char* order_flags_ptr = (char *)NULL;
 
   xrdp_orders_check(self, 25);
   self->order_count++;
@@ -996,13 +1000,15 @@ xrdp_orders_line(struct xrdp_orders* self, int mix_mode,
                  struct xrdp_pen* pen,
                  struct xrdp_rect* rect)
 {
-  int order_flags;
-  int vals[8];
-  int present;
-  char* present_ptr;
-  char* order_flags_ptr;
+  int order_flags = 0;
+  int vals[8] = {0, 0, 0, 0, 0, 0, 0, 0};
+  int present = 0;
+  char* present_ptr = (char *)NULL;
+  char* order_flags_ptr = (char *)NULL;
   struct xrdp_pen blank_pen;
 
+  g_memset(&blank_pen,0,sizeof(struct xrdp_pen));
+
   /* if mix mode or rop are out of range, mstsc build 6000+ will parse the orders
      wrong */
   if ((mix_mode < 1) || (mix_mode > 2)) /* TRANSPARENT(1) or OPAQUE(2) */
@@ -1176,11 +1182,11 @@ xrdp_orders_mem_blt(struct xrdp_orders* self, int cache_id,
                     int rop, int srcx, int srcy,
                     int cache_idx, struct xrdp_rect* rect)
 {
-  int order_flags;
-  int vals[12];
-  int present;
-  char* present_ptr;
-  char* order_flags_ptr;
+  int order_flags = 0;
+  int vals[12] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
+  int present = 0;
+  char* present_ptr = (char *)NULL;
+  char* order_flags_ptr = (char *)NULL;
 
   xrdp_orders_check(self, 30);
   self->order_count++;
@@ -1352,10 +1358,10 @@ xrdp_orders_text(struct xrdp_orders* self,
                  int x, int y, char* data, int data_len,
                  struct xrdp_rect* rect)
 {
-  int order_flags;
-  int present;
-  char* present_ptr;
-  char* order_flags_ptr;
+  int order_flags = 0;
+  int present = 0;
+  char* present_ptr = (char *)NULL;
+  char* order_flags_ptr = (char *)NULL;
 
   xrdp_orders_check(self, 100);
   self->order_count++;
@@ -1546,14 +1552,14 @@ xrdp_orders_send_raw_bitmap(struct xrdp_orders* self,
                             int width, int height, int bpp, char* data,
                             int cache_id, int cache_idx)
 {
-  int order_flags;
-  int len;
-  int bufsize;
-  int Bpp;
-  int i;
-  int j;
-  int pixel;
-  int e;
+  int order_flags = 0;
+  int len = 0;
+  int bufsize = 0;
+  int Bpp = 0;
+  int i = 0;
+  int j = 0;
+  int pixel = 0;
+  int e = 0;
 
   if (width > 64)
   {
@@ -1626,16 +1632,16 @@ xrdp_orders_send_bitmap(struct xrdp_orders* self,
                         int width, int height, int bpp, char* data,
                         int cache_id, int cache_idx)
 {
-  int order_flags;
-  int len;
-  int bufsize;
-  int Bpp;
-  int i;
-  int lines_sending;
-  int e;
-  struct stream* s;
-  struct stream* temp_s;
-  char* p;
+  int order_flags = 0;
+  int len = 0;
+  int bufsize = 0;
+  int Bpp = 0;
+  int i = 0;
+  int lines_sending = 0;
+  int e = 0;
+  struct stream* s = NULL;
+  struct stream* temp_s = NULL;
+  char* p = NULL;
 
   if (width > 64)
   {
@@ -1717,9 +1723,9 @@ xrdp_orders_send_font(struct xrdp_orders* self,
                       struct xrdp_font_char* font_char,
                       int font_index, int char_index)
 {
-  int order_flags;
-  int datasize;
-  int len;
+  int order_flags = 0;
+  int datasize = 0;
+  int len = 0;
 
   datasize = FONT_DATASIZE(font_char);
   xrdp_orders_check(self, datasize + 18);
@@ -1749,14 +1755,14 @@ xrdp_orders_send_raw_bitmap2(struct xrdp_orders* self,
                              int width, int height, int bpp, char* data,
                              int cache_id, int cache_idx)
 {
-  int order_flags;
-  int len;
-  int bufsize;
-  int Bpp;
-  int i;
-  int j;
-  int pixel;
-  int e;
+  int order_flags = 0;
+  int len = 0;
+  int bufsize = 0;
+  int Bpp = 0;
+  int i = 0;
+  int j = 0;
+  int pixel = 0;
+  int e = 0;
 
   if (width > 64)
   {
@@ -1830,16 +1836,16 @@ xrdp_orders_send_bitmap2(struct xrdp_orders* self,
                          int width, int height, int bpp, char* data,
                          int cache_id, int cache_idx)
 {
-  int order_flags;
-  int len;
-  int bufsize;
-  int Bpp;
-  int i;
-  int lines_sending;
-  int e;
-  struct stream* s;
-  struct stream* temp_s;
-  char* p;
+  int order_flags = 0;
+  int len = 0;
+  int bufsize = 0;
+  int Bpp = 0;
+  int i = 0;
+  int lines_sending = 0;
+  int e = 0;
+  struct stream* s = NULL;
+  struct stream* temp_s = NULL;
+  char* p = NULL;
 
   if (width > 64)
   {
@@ -1904,8 +1910,8 @@ int APP_CC
 xrdp_orders_send_brush(struct xrdp_orders* self, int width, int height,
                        int bpp, int type, int size, char* data, int cache_id)
 {
-  int order_flags;
-  int len;
+  int order_flags = 0;
+  int len = 0;
 
   xrdp_orders_check(self, size + 12);
   self->order_count++;
diff --git a/libxrdp/xrdp_rdp.c b/libxrdp/xrdp_rdp.c
index 63019b0d..686e567c 100644
--- a/libxrdp/xrdp_rdp.c
+++ b/libxrdp/xrdp_rdp.c
@@ -57,13 +57,16 @@ static tui8 g_unknown2[8] =
 static int APP_CC
 xrdp_rdp_read_config(struct xrdp_client_info* client_info)
 {
-  int index;
-  struct list* items;
-  struct list* values;
-  char* item;
-  char* value;
+  int index = 0;
+  struct list* items = (struct list *)NULL;
+  struct list* values = (struct list *)NULL;
+  char* item = (char *)NULL;
+  char* value = (char *)NULL;
   char cfg_file[256];
 
+  /* initialize (zero out) local variables: */
+  g_memset(cfg_file,0,sizeof(char) * 256);
+
   items = list_create();
   items->auto_free = 1;
   values = list_create();
@@ -124,7 +127,7 @@ xrdp_rdp_read_config(struct xrdp_client_info* client_info)
 struct xrdp_rdp* APP_CC
 xrdp_rdp_create(struct xrdp_session* session, struct trans* trans)
 {
-  struct xrdp_rdp* self;
+  struct xrdp_rdp* self = (struct xrdp_rdp *)NULL;
 
   DEBUG(("in xrdp_rdp_create"));
   self = (struct xrdp_rdp*)g_malloc(sizeof(struct xrdp_rdp), 1);
@@ -187,10 +190,10 @@ xrdp_rdp_init_data(struct xrdp_rdp* self, struct stream* s)
 int APP_CC
 xrdp_rdp_recv(struct xrdp_rdp* self, struct stream* s, int* code)
 {
-  int error;
-  int len;
-  int pdu_code;
-  int chan;
+  int error = 0;
+  int len = 0;
+  int pdu_code = 0;
+  int chan = 0;
 
   DEBUG(("in xrdp_rdp_recv"));
   if (s->next_packet == 0 || s->next_packet >= s->end)
@@ -248,7 +251,7 @@ xrdp_rdp_recv(struct xrdp_rdp* self, struct stream* s, int* code)
 int APP_CC
 xrdp_rdp_send(struct xrdp_rdp* self, struct stream* s, int pdu_type)
 {
-  int len;
+  int len = 0;
 
   DEBUG(("in xrdp_rdp_send"));
   s_pop_layer(s, rdp_hdr);
@@ -270,7 +273,7 @@ int APP_CC
 xrdp_rdp_send_data(struct xrdp_rdp* self, struct stream* s,
                    int data_pdu_type)
 {
-  int len;
+  int len = 0;
 
   DEBUG(("in xrdp_rdp_send_data"));
   s_pop_layer(s, rdp_hdr);
@@ -298,7 +301,7 @@ xrdp_rdp_send_data(struct xrdp_rdp* self, struct stream* s,
 int APP_CC
 xrdp_rdp_send_data_update_sync(struct xrdp_rdp* self)
 {
-  struct stream* s;
+  struct stream * s = (struct stream *)NULL;
 
   make_stream(s);
   init_stream(s, 8192);
@@ -327,8 +330,8 @@ xrdp_rdp_send_data_update_sync(struct xrdp_rdp* self)
 static int APP_CC
 xrdp_rdp_parse_client_mcs_data(struct xrdp_rdp* self)
 {
-  struct stream* p;
-  int i;
+  struct stream* p = (struct stream *)NULL;
+  int i = 0;
 
   p = &(self->sec_layer->client_mcs_data);
   p->p = p->data;
@@ -428,7 +431,8 @@ xrdp_rdp_send_demand_active(struct xrdp_rdp* self)
   out_uint16_le(s, 0x200); /* Protocol version */
   out_uint16_le(s, 0); /* pad */
   out_uint16_le(s, 0); /* Compression types */
-  out_uint16_le(s, 0); /* pad use 0x40d for rdp packets, 0 for not */
+  //out_uint16_le(s, 0); /* pad use 0x40d for rdp packets, 0 for not */
+  out_uint16_le(s, 0x40d); /* pad use 0x40d for rdp packets, 0 for not */
   out_uint16_le(s, 0); /* Update capability */
   out_uint16_le(s, 0); /* Remote unshare capability */
   out_uint16_le(s, 0); /* Compression level */
@@ -487,10 +491,10 @@ xrdp_rdp_send_demand_active(struct xrdp_rdp* self)
   out_uint8(s, 0); /* multi dest blt */
   out_uint8(s, 0); /* multi pat blt */
   out_uint8(s, 0); /* multi screen blt */
-  out_uint8(s, 0); /* multi rect */
+  out_uint8(s, 1); /* multi rect */
   out_uint8(s, 0); /* fast index */
-  out_uint8(s, 0); /* polygon */
-  out_uint8(s, 0); /* polygon */
+  out_uint8(s, 0); /* polygonSC ([MS-RDPEGDI], 2.2.2.2.1.1.2.16) */
+  out_uint8(s, 0); /* polygonCB ([MS-RDPEGDI], 2.2.2.2.1.1.2.17) */
   out_uint8(s, 0); /* polyline */
   out_uint8(s, 0); /* unused */
   out_uint8(s, 0); /* fast glyph */
@@ -644,8 +648,8 @@ static int APP_CC
 xrdp_process_capset_bmpcache2(struct xrdp_rdp* self, struct stream* s,
                               int len)
 {
-  int Bpp;
-  int i;
+  int Bpp = 0;
+  int i = 0;
 
   self->client_info.bitmap_cache_version = 2;
   Bpp = (self->client_info.bpp + 7) / 8;
diff --git a/libxrdp/xrdp_sec.c b/libxrdp/xrdp_sec.c
index 99067ba7..983be09f 100644
--- a/libxrdp/xrdp_sec.c
+++ b/libxrdp/xrdp_sec.c
@@ -303,17 +303,19 @@ unicode_in(struct stream* s, int uni_len, char* dst, int dst_len)
 static int APP_CC
 xrdp_sec_process_logon_info(struct xrdp_sec* self, struct stream* s)
 {
-  int flags;
-  int len_domain;
-  int len_user;
-  int len_password;
-  int len_program;
-  int len_directory;
-  int len_ip;
-  int len_dll;
-  int tzone;
+  int flags = 0;
+  int len_domain = 0;
+  int len_user = 0;
+  int len_password = 0;
+  int len_program = 0;
+  int len_directory = 0;
+  int len_ip = 0;
+  int len_dll = 0;
+  int tzone = 0;
   char tmpdata[256];
 
+  /* initialize (zero out) local variables */
+  g_memset(tmpdata,0,sizeof(char)*256);
   in_uint8s(s, 4);
   in_uint32_le(s, flags);
   DEBUG(("in xrdp_sec_process_logon_info flags $%x", flags));
@@ -340,12 +342,30 @@ xrdp_sec_process_logon_info(struct xrdp_sec* self, struct stream* s)
     DEBUG(("flag RDP_COMPRESSION found"));
   }
   in_uint16_le(s, len_domain);
+  if (len_domain > 511) {
+    DEBUG(("ERROR [xrdp_sec_process_logon_info()]: len_domain > 511"));
+    return 1;
+  }
   in_uint16_le(s, len_user);
+  if (len_user > 511) {
+    DEBUG(("ERROR [xrdp_sec_process_logon_info()]: len_user > 511"));
+    return 1;
+  }
   in_uint16_le(s, len_password);
+  if (len_password > 511) {
+    DEBUG(("ERROR [xrdp_sec_process_logon_info()]: len_password > 511"));
+    return 1;
+  }
   in_uint16_le(s, len_program);
+  if (len_program > 511) {
+    DEBUG(("ERROR [xrdp_sec_process_logon_info()]: len_program > 511"));
+    return 1;
+  }
   in_uint16_le(s, len_directory);
-  /* todo, we should error out in any of the above lengths are > 512 */
-  /* to avoid buffer overruns */
+  if (len_directory > 511) {
+    DEBUG(("ERROR [xrdp_sec_process_logon_info()]: len_directory > 511"));
+    return 1;
+  }
   unicode_in(s, len_domain, self->rdp_layer->client_info.domain, 255);
   DEBUG(("domain %s", self->rdp_layer->client_info.domain));
   unicode_in(s, len_user, self->rdp_layer->client_info.username, 255);
@@ -386,7 +406,7 @@ xrdp_sec_process_logon_info(struct xrdp_sec* self, struct stream* s)
 static int APP_CC
 xrdp_sec_send_lic_initial(struct xrdp_sec* self)
 {
-  struct stream* s;
+  struct stream* s = (struct stream *)NULL;
 
   make_stream(s);
   init_stream(s, 8192);
@@ -725,10 +745,10 @@ xrdp_sec_process_mcs_data_channels(struct xrdp_sec* self, struct stream* s)
 int APP_CC
 xrdp_sec_process_mcs_data(struct xrdp_sec* self)
 {
-  struct stream* s;
-  char* hold_p;
-  int tag;
-  int size;
+  struct stream* s = (struct stream *)NULL;
+  char* hold_p = (char *)NULL;
+  int tag = 0;
+  int size = 0;
 
   s = &self->client_mcs_data;
   /* set p to beginning */
@@ -861,13 +881,13 @@ xrdp_sec_out_mcs_data(struct xrdp_sec* self)
 static void APP_CC
 xrdp_sec_in_mcs_data(struct xrdp_sec* self)
 {
-  struct stream* s;
-  struct xrdp_client_info* client_info;
-  int index;
-  char c;
+  struct stream* s = (struct stream *)NULL;
+  struct xrdp_client_info* client_info = (struct xrdp_client_info *)NULL;
+  int index = 0;
+  char c = 0;
 
-  client_info = &self->rdp_layer->client_info;
-  s = &self->client_mcs_data;
+  client_info = &(self->rdp_layer->client_info);
+  s = &(self->client_mcs_data);
   /* get hostname, its unicode */
   s->p = s->data;
   in_uint8s(s, 47);
@@ -896,13 +916,15 @@ xrdp_sec_in_mcs_data(struct xrdp_sec* self)
 int APP_CC
 xrdp_sec_incoming(struct xrdp_sec* self)
 {
-  struct list* items;
-  struct list* values;
-  int index;
-  char* item;
-  char* value;
+  struct list* items = NULL;
+  struct list* values = NULL;
+  int index = 0;
+  char* item = NULL;
+  char* value = NULL;
   char key_file[256];
 
+  g_memset(key_file,0,sizeof(char)*256);
+
   DEBUG((" in xrdp_sec_incoming"));
   g_random(self->server_random, 32);
   items = list_create();
diff --git a/libxrdp/xrdp_tcp.c b/libxrdp/xrdp_tcp.c
index 86a79ea7..e4755ad6 100644
--- a/libxrdp/xrdp_tcp.c
+++ b/libxrdp/xrdp_tcp.c
@@ -74,6 +74,8 @@ xrdp_tcp_recv(struct xrdp_tcp* self, struct stream* s, int len)
 int APP_CC
 xrdp_tcp_send(struct xrdp_tcp* self, struct stream* s)
 {
+  int len;
+  len = s->end - s->data;
   DEBUG(("    in xrdp_tcp_send, gota send %d bytes", len));
   if (trans_force_write_s(self->trans, s) != 0)
   {