Resolve FORWARD_NULL static analysis warnings

This resolves core findings from ASTERISK-19650 numbers 0-2, 6, 7, 9-11, 14-20,
22-24, 28, 30-32, 34-36, 42-56, 82-84, 87, 89-90, 93-102, 104, 105, 109-111,
and 115. Finding numbers 26, 33, and 29 were already resolved.  Those skipped
were either extended/deprecated or in areas of code that shouldn't be
disturbed.

(Closes issue ASTERISK-19650)
........

Merged revisions 366167 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 366168 from http://svn.asterisk.org/svn/asterisk/branches/10


git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@366169 65c4cc65-6c06-0410-ace0-fbb531ad65f3

apps/app_voicemail.c

@@ -11371,13 +11371,15 @@ static char *handle_voicemail_show_users(struct ast_cli_entry *e, int cmd, struc
 		AST_LIST_UNLOCK(&users);
 		return CLI_FAILURE;
 	}
-	if (a->argc == 3)
+	if (!context) {
 		ast_cli(a->fd, HVSU_OUTPUT_FORMAT, "Context", "Mbox", "User", "Zone", "NewMsg");
-	else {
+	} else {
 		int count = 0;
 		AST_LIST_TRAVERSE(&users, vmu, list) {
-			if (!strcmp(context, vmu->context))
+			if (!strcmp(context, vmu->context)) {
 				count++;
+				break;
+			}
 		}
 		if (count) {
 			ast_cli(a->fd, HVSU_OUTPUT_FORMAT, "Context", "Mbox", "User", "Zone", "NewMsg");
@@ -11391,7 +11393,7 @@ static char *handle_voicemail_show_users(struct ast_cli_entry *e, int cmd, struc
 		int newmsgs = 0, oldmsgs = 0;
 		char count[12], tmp[256] = "";
 
-		if ((a->argc == 3) || ((a->argc == 5) && !strcmp(context, vmu->context))) {
+		if (!context || !strcmp(context, vmu->context)) {
 			snprintf(tmp, sizeof(tmp), "%s@%s", vmu->mailbox, ast_strlen_zero(vmu->context) ? "default" : vmu->context);
 			inboxcount(tmp, &newmsgs, &oldmsgs);
 			snprintf(count, sizeof(count), "%d", newmsgs);

channels/chan_agent.c

@@ -668,7 +668,9 @@ static struct ast_frame *agent_read(struct ast_channel *ast)
 			break;
 		case AST_FRAME_DTMF_END:
 			if (!p->acknowledged && (f->subclass.integer == p->acceptdtmf)) {
-				ast_verb(3, "%s acknowledged\n", ast_channel_name(p->chan));
+				if (p->chan) {
+					ast_verb(3, "%s acknowledged\n", ast_channel_name(p->chan));
+				}
 				p->acknowledged = 1;
 				ast_frfree(f);
 				f = &answer_frame;

channels/chan_dahdi.c

@@ -8937,7 +8937,9 @@ static struct ast_frame *__dahdi_exception(struct ast_channel *ast)
 		ast_debug(1, "Exception on %d, channel %d\n", ast_channel_fd(ast, 0), p->channel);
 	/* If it's not us, return NULL immediately */
 	if (ast != p->owner) {
-		ast_log(LOG_WARNING, "We're %s, not %s\n", ast_channel_name(ast), ast_channel_name(p->owner));
+		if (p->owner) {
+			ast_log(LOG_WARNING, "We're %s, not %s\n", ast_channel_name(ast), ast_channel_name(p->owner));
+		}
 		f = &p->subs[idx].f;
 		return f;
 	}
@@ -11778,14 +11780,13 @@ static void *do_monitor(void *data)
 		count = 0;
 		for (i = iflist; i; i = i->next) {
 			ast_mutex_lock(&i->lock);
-			if ((i->subs[SUB_REAL].dfd > -1) && i->sig && (!i->radio) && !(i->sig & SIG_MFCR2)) {
+			if (pfds && (i->subs[SUB_REAL].dfd > -1) && i->sig && (!i->radio) && !(i->sig & SIG_MFCR2)) {
 				if (analog_lib_handles(i->sig, i->radio, i->oprmode)) {
 					struct analog_pvt *p = i->sig_pvt;
 
-					if (!p)
+					if (!p) {
 						ast_log(LOG_ERROR, "No sig_pvt?\n");
-
-					if (!p->owner && !p->subs[SUB_REAL].owner) {
+					} else if (!p->owner && !p->subs[SUB_REAL].owner) {
 						/* This needs to be watched, as it lacks an owner */
 						pfds[count].fd = i->subs[SUB_REAL].dfd;
 						pfds[count].events = POLLPRI;

channels/chan_iax2.c

@@ -5285,7 +5285,7 @@ static int wait_for_peercallno(struct chan_iax2_pvt *pvt)
 			DEADLOCK_AVOIDANCE(&iaxsl[callno]);
 			pvt = iaxs[callno];
 		}
-		if (!pvt->peercallno) {
+		if (!pvt || !pvt->peercallno) {
 			return -1;
 		}
 	}
@@ -8669,6 +8669,7 @@ static void reg_source_db(struct iax2_peer *p)
 	expiry = strrchr(data, ':');
 	if (!expiry) {
 		ast_log(LOG_NOTICE, "IAX/Registry astdb entry missing expiry: '%s'\n", data);
+		return;
 	}
 	*expiry++ = '\0';
 

channels/chan_sip.c

@@ -3188,7 +3188,7 @@ static int method_match(enum sipmethod id, const char *name)
 	int len = strlen(sip_methods[id].text);
 	int l_name = name ? strlen(name) : 0;
 	/* true if the string is long enough, and ends with whitespace, and matches */
-	return (l_name >= len && name[len] < 33 &&
+	return (l_name >= len && name && name[len] < 33 &&
 		!strncasecmp(sip_methods[id].text, name, len));
 }
 
@@ -3492,7 +3492,7 @@ static void ast_sip_ouraddrfor(const struct ast_sockaddr *them, struct ast_socka
 		}
 		ast_debug(1, "Target address %s is not local, substituting externaddr\n",
 			  ast_sockaddr_stringify(them));
-	} else if (p) {
+	} else {
 		/* no remapping, but we bind to a specific address, so use it. */
 		switch (p->socket.type) {
 		case SIP_TRANSPORT_TCP:
@@ -3523,8 +3523,6 @@ static void ast_sip_ouraddrfor(const struct ast_sockaddr *them, struct ast_socka
 				ast_sockaddr_set_port(us, ast_sockaddr_port(&bindaddr));
 			}
 		}
-	} else if (!ast_sockaddr_is_any(&bindaddr)) {
-		ast_sockaddr_copy(us, &bindaddr);
 	}
 	ast_debug(3, "Setting SIP_TRANSPORT_%s with address %s\n", sip_get_transport(p->socket.type), ast_sockaddr_stringify(us));
 }
@@ -3667,7 +3665,7 @@ static int retrans_pkt(const void *data)
 
 	pkt->retransid = -1; /* Kill this scheduler item */
 
-	if (pkt->owner && pkt->method != SIP_OPTIONS && xmitres == 0) {
+	if (pkt->method != SIP_OPTIONS && xmitres == 0) {
 		if (pkt->is_fatal || sipdebug) { /* Tell us if it's critical or if we're debugging */
 			ast_log(LOG_WARNING, "Retransmission timeout reached on transmission %s for seqno %u (%s %s) -- See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions\n"
 				"Packet timed out after %dms with no response\n",
@@ -7224,6 +7222,8 @@ static struct ast_channel *sip_new(struct sip_pvt *i, int state, const char *tit
 	if (i->rtp) {
 		ast_channel_set_fd(tmp, 0, ast_rtp_instance_fd(i->rtp, 0));
 		ast_channel_set_fd(tmp, 1, ast_rtp_instance_fd(i->rtp, 1));
+		ast_rtp_instance_set_write_format(i->rtp, &fmt);
+		ast_rtp_instance_set_read_format(i->rtp, &fmt);
 	}
 	if (needvideo && i->vrtp) {
 		ast_channel_set_fd(tmp, 2, ast_rtp_instance_fd(i->vrtp, 0));
@@ -7243,11 +7243,9 @@ static struct ast_channel *sip_new(struct sip_pvt *i, int state, const char *tit
 
 	ast_format_copy(ast_channel_writeformat(tmp), &fmt);
 	ast_format_copy(ast_channel_rawwriteformat(tmp), &fmt);
-	ast_rtp_instance_set_write_format(i->rtp, &fmt);
 
 	ast_format_copy(ast_channel_readformat(tmp), &fmt);
 	ast_format_copy(ast_channel_rawreadformat(tmp), &fmt);
-	ast_rtp_instance_set_read_format(i->rtp, &fmt);
 
 	ast_channel_tech_pvt_set(tmp, dialog_ref(i, "sip_new: set chan->tech_pvt to i"));
 
@@ -8511,7 +8509,7 @@ static int sip_subscribe_mwi(const char *value, int lineno)
 	int portnum = 0;
 	enum sip_transport transport = SIP_TRANSPORT_UDP;
 	char buf[256] = "";
-	char *username = NULL, *hostname = NULL, *secret = NULL, *authuser = NULL, *porta = NULL, *mailbox = NULL, *at = NULL;
+	char *username = NULL, *hostname = NULL, *secret = NULL, *authuser = NULL, *porta = NULL, *mailbox = NULL;
 
 	if (!value) {
 		return -1;
@@ -8519,13 +8517,12 @@ static int sip_subscribe_mwi(const char *value, int lineno)
 
 	ast_copy_string(buf, value, sizeof(buf));
 
-	if (!(at = strstr(buf, "@"))) {
-		return -1;
-	}
+	username = buf;
 
 	if ((hostname = strrchr(buf, '@'))) {
 		*hostname++ = '\0';
-		username = buf;
+	} else {
+		return -1;
 	}
 
 	if ((secret = strchr(username, ':'))) {
@@ -27283,8 +27280,12 @@ enum st_refresher st_get_refresher(struct sip_pvt *p)
 */
 enum st_mode st_get_mode(struct sip_pvt *p, int no_cached)
 {
-	if (!p->stimer)
+	if (!p->stimer) {
 		sip_st_alloc(p);
+		if (!p->stimer) {
+			return SESSION_TIMER_MODE_INVALID;
+		}
+	}
 
 	if (!no_cached && p->stimer->st_cached_mode != SESSION_TIMER_MODE_INVALID)
 		return p->stimer->st_cached_mode;

channels/iax2-parser.c

@@ -1192,7 +1192,7 @@ struct iax_frame *iax_frame_new(int direction, int datalen, unsigned int cacheab
 		AST_LIST_TRAVERSE_SAFE_END;
 	}
 	if (!fr) {
-		if (iax_frames->size >= FRAME_CACHE_MAX_SIZE && smallest) {
+		if (iax_frames && iax_frames->size >= FRAME_CACHE_MAX_SIZE && smallest) {
 			/* Make useless cache into something more useful */
 			AST_LIST_REMOVE(&iax_frames->list, smallest, list);
 			if (!(fr = ast_realloc(smallest, sizeof(*fr) + datalen))) {

channels/sip/reqresp_parser.c

@@ -217,7 +217,7 @@ int parse_uri_full(char *uri, const char *scheme, char **user, char **pass,
 }
 
 
-AST_TEST_DEFINE(sip_parse_uri_fully_test)
+AST_TEST_DEFINE(sip_parse_uri_full_test)
 {
 	int res = AST_TEST_PASS;
 	char uri[1024];
@@ -227,12 +227,6 @@ AST_TEST_DEFINE(sip_parse_uri_fully_test)
 	struct testdata {
 		char *desc;
 		char *uri;
-		char **userptr;
-		char **passptr;
-		char **hostportptr;
-		char **headersptr;
-		char **residueptr;
-		struct uriparams *paramsptr;
 		char *user;
 		char *pass;
 		char *hostport;
@@ -250,12 +244,6 @@ AST_TEST_DEFINE(sip_parse_uri_fully_test)
 	struct testdata td1 = {
 		.desc = "no headers",
 		.uri = "sip:user:secret@host:5060;param=discard;transport=tcp;param2=residue",
-		.userptr = &user,
-		.passptr = &pass,
-		.hostportptr = &hostport,
-		.headersptr = &headers,
-		.residueptr = &residue,
-		.paramsptr = &params,
 		.user = "user",
 		.pass = "secret",
 		.hostport = "host:5060",
@@ -269,12 +257,6 @@ AST_TEST_DEFINE(sip_parse_uri_fully_test)
 	struct testdata td2 = {
 		.desc = "with headers",
 		.uri = "sip:user:secret@host:5060;param=discard;transport=tcp;param2=discard2?header=blah&header2=blah2;param3=residue",
-		.userptr = &user,
-		.passptr = &pass,
-		.hostportptr = &hostport,
-		.headersptr = &headers,
-		.residueptr = &residue,
-		.paramsptr = &params,
 		.user = "user",
 		.pass = "secret",
 		.hostport = "host:5060",
@@ -288,12 +270,6 @@ AST_TEST_DEFINE(sip_parse_uri_fully_test)
 	struct testdata td3 = {
 		.desc = "difficult user",
 		.uri = "sip:-_.!~*'()&=+$,;?/:secret@host:5060;transport=tcp",
-		.userptr = &user,
-		.passptr = &pass,
-		.hostportptr = &hostport,
-		.headersptr = &headers,
-		.residueptr = &residue,
-		.paramsptr = &params,
 		.user = "-_.!~*'()&=+$,;?/",
 		.pass = "secret",
 		.hostport = "host:5060",
@@ -307,12 +283,6 @@ AST_TEST_DEFINE(sip_parse_uri_fully_test)
 	struct testdata td4 = {
 		.desc = "difficult pass",
 		.uri = "sip:user:-_.!~*'()&=+$,@host:5060;transport=tcp",
-		.userptr = &user,
-		.passptr = &pass,
-		.hostportptr = &hostport,
-		.headersptr = &headers,
-		.residueptr = &residue,
-		.paramsptr = &params,
 		.user = "user",
 		.pass = "-_.!~*'()&=+$,",
 		.hostport = "host:5060",
@@ -326,12 +296,6 @@ AST_TEST_DEFINE(sip_parse_uri_fully_test)
 	struct testdata td5 = {
 		.desc = "difficult host",
 		.uri = "sip:user:secret@1-1.a-1.:5060;transport=tcp",
-		.userptr = &user,
-		.passptr = &pass,
-		.hostportptr = &hostport,
-		.headersptr = &headers,
-		.residueptr = &residue,
-		.paramsptr = &params,
 		.user = "user",
 		.pass = "secret",
 		.hostport = "1-1.a-1.:5060",
@@ -345,12 +309,6 @@ AST_TEST_DEFINE(sip_parse_uri_fully_test)
 	struct testdata td6 = {
 		.desc = "difficult params near transport",
 		.uri = "sip:user:secret@host:5060;-_.!~*'()[]/:&+$=-_.!~*'()[]/:&+$;transport=tcp",
-		.userptr = &user,
-		.passptr = &pass,
-		.hostportptr = &hostport,
-		.headersptr = &headers,
-		.residueptr = &residue,
-		.paramsptr = &params,
 		.user = "user",
 		.pass = "secret",
 		.hostport = "host:5060",
@@ -364,12 +322,6 @@ AST_TEST_DEFINE(sip_parse_uri_fully_test)
 	struct testdata td7 = {
 		.desc = "difficult params near headers",
 		.uri = "sip:user:secret@host:5060;-_.!~*'()[]/:&+$=-_.!~*'()[]/:&+$?header=blah&header2=blah2;-_.!~*'()[]/:&+$=residue",
-		.userptr = &user,
-		.passptr = &pass,
-		.hostportptr = &hostport,
-		.headersptr = &headers,
-		.residueptr = &residue,
-		.paramsptr = &params,
 		.user = "user",
 		.pass = "secret",
 		.hostport = "host:5060",
@@ -383,12 +335,6 @@ AST_TEST_DEFINE(sip_parse_uri_fully_test)
 	struct testdata td8 = {
 		.desc = "lr parameter",
 		.uri = "sip:user:secret@host:5060;param=discard;lr?header=blah",
-		.userptr = &user,
-		.passptr = &pass,
-		.hostportptr = &hostport,
-		.headersptr = &headers,
-		.residueptr = &residue,
-		.paramsptr = &params,
 		.user = "user",
 		.pass = "secret",
 		.hostport = "host:5060",
@@ -402,12 +348,6 @@ AST_TEST_DEFINE(sip_parse_uri_fully_test)
 	struct testdata td9 = {
 		.desc = "alternative lr parameter",
 		.uri = "sip:user:secret@host:5060;param=discard;lr=yes?header=blah",
-		.userptr = &user,
-		.passptr = &pass,
-		.hostportptr = &hostport,
-		.headersptr = &headers,
-		.residueptr = &residue,
-		.paramsptr = &params,
 		.user = "user",
 		.pass = "secret",
 		.hostport = "host:5060",
@@ -421,12 +361,6 @@ AST_TEST_DEFINE(sip_parse_uri_fully_test)
 	struct testdata td10 = {
 		.desc = "no lr parameter",
 		.uri = "sip:user:secret@host:5060;paramlr=lr;lr=no;lr=off;lr=0;lr=;=lr;lrextra;lrparam2=lr?header=blah",
-		.userptr = &user,
-		.passptr = &pass,
-		.hostportptr = &hostport,
-		.headersptr = &headers,
-		.residueptr = &residue,
-		.paramsptr = &params,
 		.user = "user",
 		.pass = "secret",
 		.hostport = "host:5060",
@@ -469,19 +403,19 @@ AST_TEST_DEFINE(sip_parse_uri_fully_test)
 		params.lr = 0;
 
 		ast_copy_string(uri,testdataptr->uri,sizeof(uri));
-		if (parse_uri_full(uri, "sip:,sips:", testdataptr->userptr,
-				   testdataptr->passptr, testdataptr->hostportptr,
-				   testdataptr->paramsptr,
-				   testdataptr->headersptr,
-				   testdataptr->residueptr) ||
-			((testdataptr->userptr) && strcmp(testdataptr->user, user)) ||
-			((testdataptr->passptr) && strcmp(testdataptr->pass, pass)) ||
-			((testdataptr->hostportptr) && strcmp(testdataptr->hostport, hostport)) ||
-			((testdataptr->headersptr) && strcmp(testdataptr->headers, headers)) ||
-			((testdataptr->residueptr) && strcmp(testdataptr->residue, residue)) ||
-			((testdataptr->paramsptr) && strcmp(testdataptr->params.transport,params.transport)) ||
-			((testdataptr->paramsptr) && (testdataptr->params.lr != params.lr)) ||
-			((testdataptr->paramsptr) && strcmp(testdataptr->params.user,params.user))
+		if (parse_uri_full(uri, "sip:,sips:", &user,
+				   &pass, &hostport,
+				   &params,
+				   &headers,
+				   &residue) ||
+			(user && strcmp(testdataptr->user, user)) ||
+			(pass && strcmp(testdataptr->pass, pass)) ||
+			(hostport && strcmp(testdataptr->hostport, hostport)) ||
+			(headers && strcmp(testdataptr->headers, headers)) ||
+			(residue && strcmp(testdataptr->residue, residue)) ||
+			(strcmp(testdataptr->params.transport,params.transport)) ||
+			(testdataptr->params.lr != params.lr) ||
+			(strcmp(testdataptr->params.user,params.user))
 		) {
 				ast_test_status_update(test, "Sub-Test: %s, failed.\n", testdataptr->desc);
 				res = AST_TEST_FAIL;
@@ -1220,13 +1154,6 @@ AST_TEST_DEFINE(parse_name_andor_addr_test)
 	struct testdata {
 		char *desc;
 		char *uri;
-		char **nameptr;
-		char **userptr;
-		char **passptr;
-		char **hostportptr;
-		char **headersptr;
-		char **residueptr;
-		struct uriparams *paramsptr;
 		char *name;
 		char *user;
 		char *pass;
@@ -1244,13 +1171,6 @@ AST_TEST_DEFINE(parse_name_andor_addr_test)
 	struct testdata td1 = {
 		.desc = "quotes and brackets",
 		.uri = "\"name :@ \" <sip:user:secret@host:5060;param=discard;transport=tcp>;tag=tag",
-		.nameptr = &name,
-		.userptr = &user,
-		.passptr = &pass,
-		.hostportptr = &hostport,
-		.headersptr = &headers,
-		.residueptr = &residue,
-		.paramsptr = &params,
 		.name =  "name :@ ",
 		.user = "user",
 		.pass = "secret",
@@ -1265,13 +1185,6 @@ AST_TEST_DEFINE(parse_name_andor_addr_test)
 	struct testdata td2 = {
 		.desc = "no quotes",
 		.uri = "givenname familyname <sip:user:secret@host:5060;param=discard;transport=tcp>;expires=3600",
-		.nameptr = &name,
-		.userptr = &user,
-		.passptr = &pass,
-		.hostportptr = &hostport,
-		.headersptr = &headers,
-		.residueptr = &residue,
-		.paramsptr = &params,
 		.name = "givenname familyname",
 		.user = "user",
 		.pass = "secret",
@@ -1286,13 +1199,6 @@ AST_TEST_DEFINE(parse_name_andor_addr_test)
 	struct testdata td3 = {
 		.desc = "no brackets",
 		.uri = "sip:user:secret@host:5060;param=discard;transport=tcp;q=1",
-		.nameptr = &name,
-		.userptr = &user,
-		.passptr = &pass,
-		.hostportptr = &hostport,
-		.headersptr = &headers,
-		.residueptr = &residue,
-		.paramsptr = &params,
 		.name = "",
 		.user = "user",
 		.pass = "secret",
@@ -1307,13 +1213,6 @@ AST_TEST_DEFINE(parse_name_andor_addr_test)
 	struct testdata td4 = {
 		.desc = "just host",
 		.uri = "sips:host",
-		.nameptr = &name,
-		.userptr = &user,
-		.passptr = &pass,
-		.hostportptr = &hostport,
-		.headersptr = &headers,
-		.residueptr = &residue,
-		.paramsptr = &params,
 		.name = "",
 		.user = "",
 		.pass = "",
@@ -1351,21 +1250,21 @@ AST_TEST_DEFINE(parse_name_andor_addr_test)
 		params.lr = 0;
 		ast_copy_string(uri,testdataptr->uri,sizeof(uri));
 		if (parse_name_andor_addr(uri, "sip:,sips:",
-					  testdataptr->nameptr,
-					  testdataptr->userptr,
-					  testdataptr->passptr,
-					  testdataptr->hostportptr,
-					  testdataptr->paramsptr,
-					  testdataptr->headersptr,
-					  testdataptr->residueptr) ||
-			((testdataptr->nameptr) && strcmp(testdataptr->name, name)) ||
-			((testdataptr->userptr) && strcmp(testdataptr->user, user)) ||
-			((testdataptr->passptr) && strcmp(testdataptr->pass, pass)) ||
-			((testdataptr->hostportptr) && strcmp(testdataptr->hostport, hostport)) ||
-			((testdataptr->headersptr) && strcmp(testdataptr->headers, headers)) ||
-			((testdataptr->residueptr) && strcmp(testdataptr->residue, residue)) ||
-			((testdataptr->paramsptr) && strcmp(testdataptr->params.transport,params.transport)) ||
-			((testdataptr->paramsptr) && strcmp(testdataptr->params.user,params.user))
+					  &name,
+					  &user,
+					  &pass,
+					  &hostport,
+					  &params,
+					  &headers,
+					  &residue) ||
+			(name && strcmp(testdataptr->name, name)) ||
+			(user && strcmp(testdataptr->user, user)) ||
+			(pass && strcmp(testdataptr->pass, pass)) ||
+			(hostport && strcmp(testdataptr->hostport, hostport)) ||
+			(headers && strcmp(testdataptr->headers, headers)) ||
+			(residue && strcmp(testdataptr->residue, residue)) ||
+			(strcmp(testdataptr->params.transport,params.transport)) ||
+			(strcmp(testdataptr->params.user,params.user))
 			) {
 			ast_test_status_update(test, "Sub-Test: %s,failed.\n", testdataptr->desc);
 			res = AST_TEST_FAIL;
@@ -2579,7 +2478,7 @@ void sip_request_parser_register_tests(void)
 	AST_TEST_REGISTER(sip_parse_uri_test);
 	AST_TEST_REGISTER(get_in_brackets_test);
 	AST_TEST_REGISTER(get_name_and_number_test);
-	AST_TEST_REGISTER(sip_parse_uri_fully_test);
+	AST_TEST_REGISTER(sip_parse_uri_full_test);
 	AST_TEST_REGISTER(parse_name_andor_addr_test);
 	AST_TEST_REGISTER(parse_contact_header_test);
 	AST_TEST_REGISTER(sip_parse_options_test);
@@ -2592,7 +2491,7 @@ void sip_request_parser_unregister_tests(void)
 	AST_TEST_UNREGISTER(get_calleridname_test);
 	AST_TEST_UNREGISTER(get_in_brackets_test);
 	AST_TEST_UNREGISTER(get_name_and_number_test);
-	AST_TEST_UNREGISTER(sip_parse_uri_fully_test);
+	AST_TEST_UNREGISTER(sip_parse_uri_full_test);
 	AST_TEST_UNREGISTER(parse_name_andor_addr_test);
 	AST_TEST_UNREGISTER(parse_contact_header_test);
 	AST_TEST_UNREGISTER(sip_parse_options_test);

funcs/func_lock.c

@@ -373,10 +373,15 @@ static int get_lock(struct ast_channel *chan, char *lockname, int trylock)
 
 static int unlock_read(struct ast_channel *chan, const char *cmd, char *data, char *buf, size_t len)
 {
-	struct ast_datastore *lock_store = ast_channel_datastore_find(chan, &lock_info, NULL);
+	struct ast_datastore *lock_store;
 	struct channel_lock_frame *clframe;
 	AST_LIST_HEAD(, channel_lock_frame) *list;
 
+	if (!chan) {
+		return -1;
+	}
+
+	lock_store = ast_channel_datastore_find(chan, &lock_info, NULL);
 	if (!lock_store) {
 		ast_log(LOG_WARNING, "No datastore for dialplan locks.  Nothing was ever locked!\n");
 		ast_copy_string(buf, "0", len);
@@ -417,26 +422,24 @@ static int unlock_read(struct ast_channel *chan, const char *cmd, char *data, ch
 
 static int lock_read(struct ast_channel *chan, const char *cmd, char *data, char *buf, size_t len)
 {
-	if (chan)
-		ast_autoservice_start(chan);
-
+	if (!chan) {
+		return -1;
+	}
+	ast_autoservice_start(chan);
 	ast_copy_string(buf, get_lock(chan, data, 0) ? "0" : "1", len);
-
-	if (chan)
-		ast_autoservice_stop(chan);
+	ast_autoservice_stop(chan);
 
 	return 0;
 }
 
 static int trylock_read(struct ast_channel *chan, const char *cmd, char *data, char *buf, size_t len)
 {
-	if (chan)
-		ast_autoservice_start(chan);
-
+	if (!chan) {
+		return -1;
+	}
+	ast_autoservice_start(chan);
 	ast_copy_string(buf, get_lock(chan, data, 1) ? "0" : "1", len);
-
-	if (chan)
-		ast_autoservice_stop(chan);
+	ast_autoservice_stop(chan);
 
 	return 0;
 }

funcs/func_speex.c

@@ -202,6 +202,11 @@ static int speex_write(struct ast_channel *chan, const char *cmd, char *data, co
 	struct speex_direction_info **sdi = NULL;
 	int is_new = 0;
 
+	if (strcasecmp(data, "rx") && strcasecmp(data, "tx")) {
+		ast_log(LOG_ERROR, "Invalid argument provided to the %s function\n", cmd);
+		return -1;
+	}
+
 	ast_channel_lock(chan);
 	if (!(datastore = ast_channel_datastore_find(chan, &speex_datastore, NULL))) {
 		ast_channel_unlock(chan);
@@ -226,15 +231,8 @@ static int speex_write(struct ast_channel *chan, const char *cmd, char *data, co
 
 	if (!strcasecmp(data, "rx")) {
 		sdi = &si->rx;
-	} else if (!strcasecmp(data, "tx")) {
-		sdi = &si->tx;
 	} else {
-		ast_log(LOG_ERROR, "Invalid argument provided to the %s function\n", cmd);
-
-		if (is_new) {
-			ast_datastore_free(datastore);
-			return -1;
-		}
+		sdi = &si->tx;
 	}
 
 	if (!*sdi) {

main/app.c

@@ -721,6 +721,9 @@ int ast_control_streamfile(struct ast_channel *chan, const char *file,
 	long pause_restart_point = 0;
 	long offset = 0;
 
+	if (!file) {
+		return -1;
+	}
 	if (offsetms) {
 		offset = *offsetms * 8; /* XXX Assumes 8kHz */
 	}
@@ -752,12 +755,10 @@ int ast_control_streamfile(struct ast_channel *chan, const char *file,
 		res = ast_answer(chan);
 	}
 
-	if (file) {
-		if ((end = strchr(file, ':'))) {
-			if (!strcasecmp(end, ":end")) {
-				*end = '\0';
-				end++;
-			}
+	if ((end = strchr(file, ':'))) {
+		if (!strcasecmp(end, ":end")) {
+			*end = '\0';
+			end++;
 		}
 	}
 

main/cdr.c

@@ -581,7 +581,9 @@ void ast_cdr_merge(struct ast_cdr *to, struct ast_cdr *from)
 				lfrom = lfrom->next;
 			}
 			/* rip off the last entry and put a copy of the to at the end */
-			llfrom->next = to;
+			if (llfrom) {
+				llfrom->next = to;
+			}
 			from = lfrom;
 		} else {
 			/* save copy of the current *to cdr */
@@ -597,10 +599,11 @@ void ast_cdr_merge(struct ast_cdr *to, struct ast_cdr *from)
 			}
 			from->next = NULL;
 			/* rip off the last entry and put a copy of the to at the end */
-			if (llfrom == from)
+			if (llfrom == from) {
 				to = to->next = ast_cdr_dup(&tcdr);
-			else
+			} else if (llfrom) {
 				to = llfrom->next = ast_cdr_dup(&tcdr);
+			}
 			from = lfrom;
 		}
 	}

main/channel.c

@@ -2967,11 +2967,6 @@ struct ast_channel *ast_waitfor_nandfds(struct ast_channel **c, int n, int *fds,
 		int fdno;
 	} *fdmap = NULL;
 
-	if ((sz = n * AST_MAX_FDS + nfds)) {
-		pfds = alloca(sizeof(*pfds) * sz);
-		fdmap = alloca(sizeof(*fdmap) * sz);
-	}
-
 	if (outfd) {
 		*outfd = -99999;
 	}
@@ -2979,6 +2974,14 @@ struct ast_channel *ast_waitfor_nandfds(struct ast_channel **c, int n, int *fds,
 		*exception = 0;
 	}
 
+	if ((sz = n * AST_MAX_FDS + nfds)) {
+		pfds = alloca(sizeof(*pfds) * sz);
+		fdmap = alloca(sizeof(*fdmap) * sz);
+	} else {
+		/* nothing to allocate and no FDs to check */
+		return NULL;
+	}
+
 	/* Perform any pending masquerades */
 	for (x = 0; x < n; x++) {
 		if (ast_channel_masq(c[x]) && ast_do_masquerade(c[x])) {

main/config.c

@@ -562,7 +562,11 @@ struct ast_variable *ast_variable_browse(const struct ast_config *config, const
 {
 	struct ast_category *cat = NULL;
 
-	if (category && config->last_browse && (config->last_browse->name == category)) {
+	if (!category) {
+		return NULL;
+	}
+
+	if (config->last_browse && (config->last_browse->name == category)) {
 		cat = config->last_browse;
 	} else {
 		cat = ast_category_get(config, category);
@@ -1898,7 +1902,7 @@ int ast_config_text_file_save(const char *configfile, const struct ast_config *c
 			/* Dump section with any appropriate comment */
 			for (cmt = cat->precomments; cmt; cmt=cmt->next) {
 				char *cmtp = cmt->cmt;
-				while (*cmtp == ';' && *(cmtp+1) == '!') {
+				while (cmtp && *cmtp == ';' && *(cmtp+1) == '!') {
 					char *cmtp2 = strchr(cmtp+1, '\n');
 					if (cmtp2)
 						cmtp = cmtp2+1;

main/data.c

@@ -2496,18 +2496,20 @@ struct ast_data_iterator *ast_data_iterator_init(struct ast_data *tree,
 	struct ast_data *internal = tree;
 	char *path, *ptr = NULL;
 
+	if (!elements) {
+		return NULL;
+	}
+
 	/* tree is the node we want to use to iterate? or we are going
 	 * to iterate thow an internal node? */
-	if (elements) {
-		path = ast_strdupa(elements);
-
-		ptr = strrchr(path, '/');
-		if (ptr) {
-			*ptr = '\0';
-			internal = data_result_get_node(tree, path);
-			if (!internal) {
-				return NULL;
-			}
+	path = ast_strdupa(elements);
+
+	ptr = strrchr(path, '/');
+	if (ptr) {
+		*ptr = '\0';
+		internal = data_result_get_node(tree, path);
+		if (!internal) {
+			return NULL;
 		}
 	}
 

main/devicestate.c

@@ -330,9 +330,7 @@ static enum ast_device_state _ast_device_state(const char *device, int check_cac
 		/* We have a provider */
 		number = tech;
 		tech = NULL;
-	}
 
-	if (provider)  {
 		ast_debug(3, "Checking if I can find provider for \"%s\" - number: %s\n", provider, number);
 		return getproviderstate(provider, number);
 	}

main/event.c

@@ -1286,8 +1286,9 @@ struct ast_event *ast_event_new(enum ast_event_type type, ...)
 			break;
 		}
 
+		/* realloc inside one of the append functions failed */
 		if (!event) {
-			break;
+			return NULL;
 		}
 	}
 

main/features.c

@@ -2166,6 +2166,9 @@ static int builtin_automonitor(struct ast_channel *chan, struct ast_channel *pee
 	struct ast_channel *caller_chan, *callee_chan;
 	const char *automon_message_start = NULL;
 	const char *automon_message_stop = NULL;
+	const char *touch_format = NULL;
+	const char *touch_monitor = NULL;
+	const char *touch_monitor_prefix = NULL;
 
 	if (!monitor_ok) {
 		ast_log(LOG_ERROR,"Cannot record the call. The monitor application is disabled.\n");
@@ -2179,10 +2182,13 @@ static int builtin_automonitor(struct ast_channel *chan, struct ast_channel *pee
 	}
 
 	set_peers(&caller_chan, &callee_chan, peer, chan, sense);
-	if (caller_chan) {	/* Find extra messages */
-		automon_message_start = pbx_builtin_getvar_helper(caller_chan, "TOUCH_MONITOR_MESSAGE_START");
-		automon_message_stop = pbx_builtin_getvar_helper(caller_chan, "TOUCH_MONITOR_MESSAGE_STOP");
+	if (!caller_chan || !callee_chan) {
+		ast_log(LOG_NOTICE,"Cannot record the call. One or both channels have gone away.\n");	
+		return -1;
 	}
+	/* Find extra messages */
+	automon_message_start = pbx_builtin_getvar_helper(caller_chan, "TOUCH_MONITOR_MESSAGE_START");
+	automon_message_stop = pbx_builtin_getvar_helper(caller_chan, "TOUCH_MONITOR_MESSAGE_STOP");
 
 	if (!ast_strlen_zero(courtesytone)) {	/* Play courtesy tone if configured */
 		if(play_message_in_bridged_call(caller_chan, callee_chan, courtesytone) == -1) {
@@ -2199,58 +2205,53 @@ static int builtin_automonitor(struct ast_channel *chan, struct ast_channel *pee
 		return AST_FEATURE_RETURN_SUCCESS;
 	}
 
-	if (caller_chan && callee_chan) {
-		const char *touch_format = pbx_builtin_getvar_helper(caller_chan, "TOUCH_MONITOR_FORMAT");
-		const char *touch_monitor = pbx_builtin_getvar_helper(caller_chan, "TOUCH_MONITOR");
-		const char *touch_monitor_prefix = pbx_builtin_getvar_helper(caller_chan, "TOUCH_MONITOR_PREFIX");
+	touch_format = pbx_builtin_getvar_helper(caller_chan, "TOUCH_MONITOR_FORMAT");
+	touch_monitor = pbx_builtin_getvar_helper(caller_chan, "TOUCH_MONITOR");
+	touch_monitor_prefix = pbx_builtin_getvar_helper(caller_chan, "TOUCH_MONITOR_PREFIX");
 
-		if (!touch_format)
-			touch_format = pbx_builtin_getvar_helper(callee_chan, "TOUCH_MONITOR_FORMAT");
-
-		if (!touch_monitor)
-			touch_monitor = pbx_builtin_getvar_helper(callee_chan, "TOUCH_MONITOR");
+	if (!touch_format)
+		touch_format = pbx_builtin_getvar_helper(callee_chan, "TOUCH_MONITOR_FORMAT");
 
-		if (!touch_monitor_prefix)
-			touch_monitor_prefix = pbx_builtin_getvar_helper(callee_chan, "TOUCH_MONITOR_PREFIX");
+	if (!touch_monitor)
+		touch_monitor = pbx_builtin_getvar_helper(callee_chan, "TOUCH_MONITOR");
 
-		if (touch_monitor) {
-			len = strlen(touch_monitor) + 50;
-			args = alloca(len);
-			touch_filename = alloca(len);
-			snprintf(touch_filename, len, "%s-%ld-%s", S_OR(touch_monitor_prefix, "auto"), (long)time(NULL), touch_monitor);
-			snprintf(args, len, "%s,%s,m", S_OR(touch_format, "wav"), touch_filename);
-		} else {
-			caller_chan_id = ast_strdupa(S_COR(ast_channel_caller(caller_chan)->id.number.valid,
-				ast_channel_caller(caller_chan)->id.number.str, ast_channel_name(caller_chan)));
-			callee_chan_id = ast_strdupa(S_COR(ast_channel_caller(callee_chan)->id.number.valid,
-				ast_channel_caller(callee_chan)->id.number.str, ast_channel_name(callee_chan)));
-			len = strlen(caller_chan_id) + strlen(callee_chan_id) + 50;
-			args = alloca(len);
-			touch_filename = alloca(len);
-			snprintf(touch_filename, len, "%s-%ld-%s-%s", S_OR(touch_monitor_prefix, "auto"), (long)time(NULL), caller_chan_id, callee_chan_id);
-			snprintf(args, len, "%s,%s,m", S_OR(touch_format, "wav"), touch_filename);
-		}
+	if (!touch_monitor_prefix)
+		touch_monitor_prefix = pbx_builtin_getvar_helper(callee_chan, "TOUCH_MONITOR_PREFIX");
 
-		for(x = 0; x < strlen(args); x++) {
-			if (args[x] == '/')
-				args[x] = '-';
-		}
+	if (touch_monitor) {
+		len = strlen(touch_monitor) + 50;
+		args = alloca(len);
+		touch_filename = alloca(len);
+		snprintf(touch_filename, len, "%s-%ld-%s", S_OR(touch_monitor_prefix, "auto"), (long)time(NULL), touch_monitor);
+		snprintf(args, len, "%s,%s,m", S_OR(touch_format, "wav"), touch_filename);
+	} else {
+		caller_chan_id = ast_strdupa(S_COR(ast_channel_caller(caller_chan)->id.number.valid,
+			ast_channel_caller(caller_chan)->id.number.str, ast_channel_name(caller_chan)));
+		callee_chan_id = ast_strdupa(S_COR(ast_channel_caller(callee_chan)->id.number.valid,
+			ast_channel_caller(callee_chan)->id.number.str, ast_channel_name(callee_chan)));
+		len = strlen(caller_chan_id) + strlen(callee_chan_id) + 50;
+		args = alloca(len);
+		touch_filename = alloca(len);
+		snprintf(touch_filename, len, "%s-%ld-%s-%s", S_OR(touch_monitor_prefix, "auto"), (long)time(NULL), caller_chan_id, callee_chan_id);
+		snprintf(args, len, "%s,%s,m", S_OR(touch_format, "wav"), touch_filename);
+	}
 
-		ast_verb(4, "User hit '%s' to record call. filename: %s\n", code, args);
+	for(x = 0; x < strlen(args); x++) {
+		if (args[x] == '/')
+			args[x] = '-';
+	}
 
-		pbx_exec(callee_chan, monitor_app, args);
-		pbx_builtin_setvar_helper(callee_chan, "TOUCH_MONITOR_OUTPUT", touch_filename);
-		pbx_builtin_setvar_helper(caller_chan, "TOUCH_MONITOR_OUTPUT", touch_filename);
+	ast_verb(4, "User hit '%s' to record call. filename: %s\n", code, args);
 
-		if (!ast_strlen_zero(automon_message_start)) {	/* Play start message for both channels */
-			play_message_in_bridged_call(caller_chan, callee_chan, automon_message_start);
-		}
+	pbx_exec(callee_chan, monitor_app, args);
+	pbx_builtin_setvar_helper(callee_chan, "TOUCH_MONITOR_OUTPUT", touch_filename);
+	pbx_builtin_setvar_helper(caller_chan, "TOUCH_MONITOR_OUTPUT", touch_filename);
 
-		return AST_FEATURE_RETURN_SUCCESS;
+	if (!ast_strlen_zero(automon_message_start)) {	/* Play start message for both channels */
+		play_message_in_bridged_call(caller_chan, callee_chan, automon_message_start);
 	}
 
-	ast_log(LOG_NOTICE,"Cannot record the call. One or both channels have gone away.\n");
-	return -1;
+	return AST_FEATURE_RETURN_SUCCESS;
 }
 
 static int builtin_automixmonitor(struct ast_channel *chan, struct ast_channel *peer, struct ast_bridge_config *config, const char *code, int sense, void *data)
@@ -3415,12 +3416,10 @@ static int feature_exec_app(struct ast_channel *chan, struct ast_channel *peer,
 	ast_autoservice_start(idle);
 	ast_autoservice_ignore(idle, AST_FRAME_DTMF_END);
 
-	if(work && idle) {
-		pbx_builtin_setvar_helper(work, "DYNAMIC_PEERNAME", ast_channel_name(idle));
-		pbx_builtin_setvar_helper(idle, "DYNAMIC_PEERNAME", ast_channel_name(work));
-		pbx_builtin_setvar_helper(work, "DYNAMIC_FEATURENAME", feature->sname);
-		pbx_builtin_setvar_helper(idle, "DYNAMIC_FEATURENAME", feature->sname);
-	}
+	pbx_builtin_setvar_helper(work, "DYNAMIC_PEERNAME", ast_channel_name(idle));
+	pbx_builtin_setvar_helper(idle, "DYNAMIC_PEERNAME", ast_channel_name(work));
+	pbx_builtin_setvar_helper(work, "DYNAMIC_FEATURENAME", feature->sname);
+	pbx_builtin_setvar_helper(idle, "DYNAMIC_FEATURENAME", feature->sname);
 
 	if (!ast_strlen_zero(feature->moh_class))
 		ast_moh_start(idle, feature->moh_class, NULL);
@@ -3543,7 +3542,9 @@ static int feature_interpret_helper(struct ast_channel *chan, struct ast_channel
 					if (operation) {
 						res = fge->feature->operation(chan, peer, config, code, sense, fge->feature);
 					}
-					memcpy(feature, fge->feature, sizeof(*feature));
+					if (feature) {
+						memcpy(feature, fge->feature, sizeof(*feature));
+					}
 					if (res != AST_FEATURE_RETURN_KEEPTRYING) {
 						AST_RWLIST_UNLOCK(&feature_groups);
 						break;
@@ -5019,76 +5020,80 @@ static int manage_parked_call(struct parkeduser *pu, const struct pollfd *pfds,
 		/* And take them out of the parking lot */
 		parking_complete = 1;
 	} else {	/* still within parking time, process descriptors */
-		for (x = 0; x < AST_MAX_FDS; x++) {
-			struct ast_frame *f;
-			int y;
-
-			if (!ast_channel_fd_isset(chan, x)) {
-				continue;	/* nothing on this descriptor */
-			}
-
-			for (y = 0; y < nfds; y++) {
-				if (pfds[y].fd == ast_channel_fd(chan, x)) {
-					/* Found poll record! */
-					break;
+		x = 0;
+		if (pfds) {
+			for (; x < AST_MAX_FDS; x++) {
+				struct ast_frame *f;
+				int y;
+	
+				if (!ast_channel_fd_isset(chan, x)) {
+					continue;	/* nothing on this descriptor */
 				}
-			}
-			if (y == nfds) {
-				/* Not found */
-				continue;
-			}
-
-			if (!(pfds[y].revents & (POLLIN | POLLERR | POLLPRI))) {
-				/* Next x */
-				continue;
-			}
-
-			if (pfds[y].revents & POLLPRI) {
-				ast_set_flag(ast_channel_flags(chan), AST_FLAG_EXCEPTION);
-			} else {
-				ast_clear_flag(ast_channel_flags(chan), AST_FLAG_EXCEPTION);
-			}
-			ast_channel_fdno_set(chan, x);
-
-			/* See if they need servicing */
-			f = ast_read(pu->chan);
-			/* Hangup? */
-			if (!f || (f->frametype == AST_FRAME_CONTROL
-				&& f->subclass.integer == AST_CONTROL_HANGUP)) {
-				if (f) {
-					ast_frfree(f);
+	
+				for (y = 0; y < nfds; y++) {
+					if (pfds[y].fd == ast_channel_fd(chan, x)) {
+						/* Found poll record! */
+						break;
+					}
 				}
-				post_manager_event("ParkedCallGiveUp", pu);
-				ast_cel_report_event(pu->chan, AST_CEL_PARK_END, NULL, "ParkedCallGiveUp",
-					NULL);
-
-				/* There's a problem, hang them up */
-				ast_verb(2, "%s got tired of being parked\n", ast_channel_name(chan));
-				ast_hangup(chan);
-
-				/* And take them out of the parking lot */
-				parking_complete = 1;
-				break;
-			} else {
-				/* XXX Maybe we could do something with packets, like dial "0" for operator or something XXX */
-				ast_frfree(f);
-				if (pu->hold_method == AST_CONTROL_HOLD
-					&& pu->moh_trys < 3
-					&& !ast_channel_generatordata(chan)) {
-					ast_debug(1,
-						"MOH on parked call stopped by outside source.  Restarting on channel %s.\n",
-						ast_channel_name(chan));
-					ast_indicate_data(chan, AST_CONTROL_HOLD,
-						S_OR(pu->parkinglot->cfg.mohclass, NULL),
-						(!ast_strlen_zero(pu->parkinglot->cfg.mohclass)
-							? strlen(pu->parkinglot->cfg.mohclass) + 1 : 0));
-					pu->moh_trys++;
+				if (y == nfds) {
+					/* Not found */
+					continue;
 				}
-				goto std;	/* XXX Ick: jumping into an else statement??? XXX */
-			}
-		} /* End for */
+	
+				if (!(pfds[y].revents & (POLLIN | POLLERR | POLLPRI))) {
+					/* Next x */
+					continue;
+				}
+	
+				if (pfds[y].revents & POLLPRI) {
+					ast_set_flag(ast_channel_flags(chan), AST_FLAG_EXCEPTION);
+				} else {
+					ast_clear_flag(ast_channel_flags(chan), AST_FLAG_EXCEPTION);
+				}
+				ast_channel_fdno_set(chan, x);
+	
+				/* See if they need servicing */
+				f = ast_read(pu->chan);
+				/* Hangup? */
+				if (!f || (f->frametype == AST_FRAME_CONTROL
+					&& f->subclass.integer == AST_CONTROL_HANGUP)) {
+					if (f) {
+						ast_frfree(f);
+					}
+					post_manager_event("ParkedCallGiveUp", pu);
+					ast_cel_report_event(pu->chan, AST_CEL_PARK_END, NULL, "ParkedCallGiveUp",
+						NULL);
+	
+					/* There's a problem, hang them up */
+					ast_verb(2, "%s got tired of being parked\n", ast_channel_name(chan));
+					ast_hangup(chan);
+	
+					/* And take them out of the parking lot */
+					parking_complete = 1;
+					break;
+				} else {
+					/* XXX Maybe we could do something with packets, like dial "0" for operator or something XXX */
+					ast_frfree(f);
+					if (pu->hold_method == AST_CONTROL_HOLD
+						&& pu->moh_trys < 3
+						&& !ast_channel_generatordata(chan)) {
+						ast_debug(1,
+							"MOH on parked call stopped by outside source.  Restarting on channel %s.\n",
+							ast_channel_name(chan));
+						ast_indicate_data(chan, AST_CONTROL_HOLD,
+							S_OR(pu->parkinglot->cfg.mohclass, NULL),
+							(!ast_strlen_zero(pu->parkinglot->cfg.mohclass)
+								? strlen(pu->parkinglot->cfg.mohclass) + 1 : 0));
+						pu->moh_trys++;
+					}
+					goto std;	/* XXX Ick: jumping into an else statement??? XXX */
+				}
+			} /* End for */
+		}
 		if (x >= AST_MAX_FDS) {
-std:		for (x = 0; x < AST_MAX_FDS; x++) {	/* mark fds for next round */
+std:
+			for (x = 0; x < AST_MAX_FDS; x++) {	/* mark fds for next round */
 				if (ast_channel_fd_isset(chan, x)) {
 					void *tmp = ast_realloc(*new_pfds,
 						(*new_nfds + 1) * sizeof(struct pollfd));

main/manager.c

@@ -4690,10 +4690,22 @@ static int action_reload(struct mansession *s, const struct message *m)
 	const char *module = astman_get_header(m, "Module");
 	int res = ast_module_reload(S_OR(module, NULL));
 
-	if (res == 2) {
+	switch (res) {
+	case -1:
+		astman_send_error(s, m, "A reload is in progress");
+		break;
+	case 0:
+		astman_send_error(s, m, "No such module");
+		break;
+	case 1:
+		astman_send_error(s, m, "Module does not support reload");
+		break;
+	case 2:
 		astman_send_ack(s, m, "Module Reloaded");
-	} else {
-		astman_send_error(s, m, s == 0 ? "No such module" : "Module does not support reload");
+		break;
+	default:
+		astman_send_error(s, m, "An unknown error occurred");
+		break;
 	}
 	return 0;
 }
@@ -7054,7 +7066,7 @@ static int __init_manager(int reload)
 				if (user_writetimeout) {
 					int value = atoi(user_writetimeout);
 					if (value < 100) {
-						ast_log(LOG_WARNING, "Invalid writetimeout value '%s' at users.conf line %d\n", var->value, var->lineno);
+						ast_log(LOG_WARNING, "Invalid writetimeout value '%d' in users.conf\n", value);
 					} else {
 						user->writetimeout = value;
 					}

main/pbx.c

@@ -1733,8 +1733,9 @@ static void cli_match_char_tree(struct match_char *node, char *prefix, int fd)
 
 	extenstr[0] = '\0';
 
-	if (node && node->exten)
+	if (node->exten) {
 		snprintf(extenstr, sizeof(extenstr), "(%p)", node->exten);
+	}
 
 	if (strlen(node->x) > 1) {
 		ast_cli(fd, "%s[%s]:%c:%c:%d:%s%s%s\n", prefix, node->x, node->is_pattern ? 'Y' : 'N',
@@ -9705,6 +9706,11 @@ static int pbx_builtin_gotoiftime(struct ast_channel *chan, const char *data)
 	struct timeval tv = ast_tvnow();
 	long timesecs;
 
+	if (!chan) {
+		ast_log(LOG_WARNING, "GotoIfTime requires a channel on which to operate\n");
+		return -1;
+	}
+
 	if (ast_strlen_zero(data)) {
 		ast_log(LOG_WARNING, "GotoIfTime requires an argument:\n  <time range>,<days of week>,<days of month>,<months>[,<timezone>]?'labeliftrue':'labeliffalse'\n");
 		return -1;
@@ -9712,17 +9718,16 @@ static int pbx_builtin_gotoiftime(struct ast_channel *chan, const char *data)
 
 	ts = s = ast_strdupa(data);
 
-	if (chan) {
-		ast_channel_lock(chan);
-		if ((ctime = pbx_builtin_getvar_helper(chan, "TESTTIME")) && sscanf(ctime, "%ld", &timesecs) == 1) {
-			tv.tv_sec = timesecs;
-		} else if (ctime) {
-			ast_log(LOG_WARNING, "Using current time to evaluate\n");
-			/* Reset when unparseable */
-			pbx_builtin_setvar_helper(chan, "TESTTIME", NULL);
-		}
-		ast_channel_unlock(chan);
+	ast_channel_lock(chan);
+	if ((ctime = pbx_builtin_getvar_helper(chan, "TESTTIME")) && sscanf(ctime, "%ld", &timesecs) == 1) {
+		tv.tv_sec = timesecs;
+	} else if (ctime) {
+		ast_log(LOG_WARNING, "Using current time to evaluate\n");
+		/* Reset when unparseable */
+		pbx_builtin_setvar_helper(chan, "TESTTIME", NULL);
 	}
+	ast_channel_unlock(chan);
+
 	/* Separate the Goto path */
 	strsep(&ts, "?");
 	branch1 = strsep(&ts,":");

main/tcptls.c

@@ -421,8 +421,10 @@ struct ast_tcptls_session_instance *ast_tcptls_client_start(struct ast_tcptls_se
 	return handle_tcptls_connection(tcptls_session);
 
 client_start_error:
-	close(desc->accept_fd);
-	desc->accept_fd = -1;
+	if (desc) {
+		close(desc->accept_fd);
+		desc->accept_fd = -1;
+	}
 	if (tcptls_session) {
 		ao2_ref(tcptls_session, -1);
 	}

main/xmldoc.c

@@ -976,26 +976,28 @@ static char *xmldoc_get_syntax_cmd(struct ast_xml_node *fixnode, const char *nam
 			/* is this a recursive parameter. */
 			paramname = xmldoc_get_syntax_cmd(node, "", 0);
 			isenum = 1;
-		} else if (!xmldoc_has_inside(node, "enumlist")) {
-			/* this is a simple parameter. */
-			attrname = ast_xml_get_attribute(node, "name");
-			if (!attrname) {
-				/* ignore this bogus parameter and continue. */
-				continue;
-			}
-			paramname = ast_strdup(attrname);
-			ast_xml_free_attr(attrname);
-			isenum = 0;
 		} else {
-			/* parse enumlist (note that this is a special enumlist
-			that is used to describe a syntax like {<param1>|<param2>|...} */
 			for (tmpnode = ast_xml_node_get_children(node); tmpnode; tmpnode = ast_xml_node_get_next(tmpnode)) {
 				if (!strcasecmp(ast_xml_node_get_name(tmpnode), "enumlist")) {
 					break;
 				}
 			}
-			paramname = xmldoc_parse_cmd_enumlist(tmpnode);
-			isenum = 1;
+			if (tmpnode) {
+				/* parse enumlist (note that this is a special enumlist
+				that is used to describe a syntax like {<param1>|<param2>|...} */
+				paramname = xmldoc_parse_cmd_enumlist(tmpnode);
+				isenum = 1;
+			} else {
+				/* this is a simple parameter. */
+				attrname = ast_xml_get_attribute(node, "name");
+				if (!attrname) {
+					/* ignore this bogus parameter and continue. */
+					continue;
+				}
+				paramname = ast_strdup(attrname);
+				ast_xml_free_attr(attrname);
+				isenum = 0;
+			}
 		}
 
 		/* Is this parameter required? */

pbx/dundi-parser.c

@@ -512,8 +512,10 @@ int dundi_ie_append_cause(struct dundi_ie_data *ied, unsigned char ie, unsigned
 	ied->buf[ied->pos++] = ie;
 	ied->buf[ied->pos++] = datalen;
 	ied->buf[ied->pos++] = cause;
-	memcpy(ied->buf + ied->pos, data, datalen-1);
-	ied->pos += datalen-1;
+	if (data) {
+		memcpy(ied->buf + ied->pos, data, datalen-1);
+		ied->pos += datalen-1;
+	}
 	return 0;
 }
 
@@ -531,8 +533,10 @@ int dundi_ie_append_hint(struct dundi_ie_data *ied, unsigned char ie, unsigned s
 	flags = htons(flags);
 	memcpy(ied->buf + ied->pos, &flags, sizeof(flags));
 	ied->pos += 2;
-	memcpy(ied->buf + ied->pos, data, datalen-1);
-	ied->pos += datalen-2;
+	if (data) {
+		memcpy(ied->buf + ied->pos, data, datalen-2);
+		ied->pos += datalen-2;
+	}
 	return 0;
 }
 

pbx/pbx_dundi.c

@@ -1021,7 +1021,7 @@ static int dundi_prop_precache(struct dundi_transaction *trans, struct dundi_ies
 	totallen += (ies->eidcount - skipfirst) * sizeof(dundi_eid);
 	st = ast_calloc(1, totallen);
 	if (st) {
-		ast_copy_string(st->called_context, ies->called_context, sizeof(st->called_context));
+		ast_copy_string(st->called_context, dr.dcontext, sizeof(st->called_context));
 		ast_copy_string(st->called_number, ies->called_number, sizeof(st->called_number));
 		st->trans = trans;
 		st->ttl = ies->ttl - 1;

res/ael/pval.c

@@ -1160,7 +1160,11 @@ static pval *get_goto_target(pval *item)
 	pval *curr_ext = get_extension_or_contxt(item); /* containing exten, or macro */
 	pval *curr_cont;
 	
-	if (item->u1.list && !item->u1.list->next && !strstr((item->u1.list)->u1.str,"${")) {
+	if (!item->u1.list) {
+		return NULL;
+	}
+
+	if (!item->u1.list->next && !strstr((item->u1.list)->u1.str,"${")) {
 		struct pval *x = find_label_in_current_extension((char*)((item->u1.list)->u1.str), curr_ext);
 			return x;
 	}
@@ -5882,7 +5886,7 @@ pval* pvalGlobalsWalkStatements( pval *p, pval **next_statement )
 {
 	if (!pvalCheckType(p, "pvalGlobalsWalkStatements", PV_GLOBALS))
 		return 0;
-	if (!next_statement) {
+	if (!*next_statement) {
 		*next_statement = p;
 		return p;
 	} else {
@@ -5903,7 +5907,7 @@ void pvalTopLevAddObject( pval *p, pval *contextOrObj )
 
 pval *pvalTopLevWalkObjects(pval *p, pval **next_obj )
 {
-	if (!next_obj) {
+	if (!*next_obj) {
 		*next_obj = p;
 		return p;
 	} else {

res/res_calendar_icalendar.c

@@ -133,6 +133,7 @@ static icalcomponent *fetch_icalendar(struct icalendar_pvt *pvt)
 
 	if (!pvt) {
 		ast_log(LOG_ERROR, "There is no private!\n");
+		return NULL;
 	}
 
 	if (!(response = ast_str_create(512))) {

res/res_monitor.c

@@ -378,7 +378,9 @@ int AST_OPTIONAL_API_NAME(ast_monitor_start)(struct ast_channel *chan, const cha
 							O_CREAT|O_TRUNC|O_WRONLY, 0, AST_FILE_MODE))) {
 				ast_log(LOG_WARNING, "Could not create file %s\n",
 							monitor->write_filename);
-				ast_closestream(monitor->read_stream);
+				if (monitor->read_stream) {
+					ast_closestream(monitor->read_stream);
+				}
 				ast_free(monitor);
 				UNLOCK_IF_NEEDED(chan, need_lock);
 				return -1;

res/res_odbc.c

@@ -365,6 +365,10 @@ static int mark_transaction_active(struct ast_channel *chan, struct odbc_txn_fra
 		chan = tx->owner;
 	}
 
+	if (!chan) {
+		return -1;
+	}
+
 	ast_channel_lock(chan);
 	if (!(txn_store = ast_channel_datastore_find(chan, &txn_info, NULL))) {
 		ast_channel_unlock(chan);