fixing coverity found defects - invalid memory access / memory corrup…

…tions

flags.c

@@ -163,7 +163,7 @@ int get_flag_id_by_name(int flag_type, char *flag_name)
 		return -1;
 	}
 
-	if (flag_type < 0 || flag_type > FLAG_LIST_COUNT) {
+	if (flag_type < 0 || flag_type >= FLAG_LIST_COUNT) {
 		LM_ERR("Invalid flag list: %d\n", flag_type);
 		return -2;
 	}

ip_addr.h

@@ -546,7 +546,7 @@ static inline struct hostent* ip_addr2he(str* name, struct ip_addr* ip)
 	p_aliases[0]=0; /* no aliases*/
 	p_addr[1]=0; /* only one address*/
 	p_addr[0]=address;
-	len = (name->len < 256) ? name->len : 256;
+	len = (name->len < 255) ? name->len : 255;
 	strncpy(hostname, name->s, len);
 	hostname[len] = 0;
 	if (ip->len>16) return 0;

modules/acc/acc.c

@@ -1488,6 +1488,7 @@ int acc_evi_request( struct sip_msg *rq, struct sip_msg *rpl)
 	}
 	ret = 1;
 end:
+	if (backup_idx!=-1) /* can be -1, jumped to end: label*/
 	evi_params[backup_idx]->next = evi_params[backup_idx + 1];
 
 	return ret;

modules/call_center/call_center.c

@@ -669,7 +669,7 @@ static inline str* build_displayname(str *prefix, struct to_body *fh)
 	l --;
 
 	n = prefix->len;
-	if (n>l) n = l;
+	if (n>=l) n = l;
 
 	memcpy( p, prefix->s , n);
 	p += n;

modules/dialog/dlg_tophiding.c

@@ -132,7 +132,7 @@ int dlg_replace_contact(struct sip_msg* msg, struct dlg_cell* dlg)
 		goto error;
 	}
 
-	memcpy(prefix,"<sip:",prefix_len);
+	memcpy(prefix,"<sip:",5); /* copy only "<sip:", no prefix_len, modified above */
 	if (dlg->flags & DLG_FLAG_TOPH_KEEP_USER && ct_username_len > 0) {
 		memcpy(prefix+5,ct_username,ct_username_len);
 		prefix[prefix_len-1] = '@';

modules/mi_datagram/datagram_fnc.c

@@ -462,7 +462,7 @@ void mi_datagram_server(int rx_sock, int tx_sock)
 				continue;
 		}
 
-		LM_DBG("mi_buf is %s and we have received %i bytes\n",mi_buf, ret);
+		LM_DBG("mi_buf is %.*s and we have received %i bytes\n", ret, mi_buf, ret); /*mi_buff is not null terminated */
 		dtgram.start 	= mi_buf;
 		dtgram.len 		= ret;
 		dtgram.current 	= dtgram.start;

modules/mi_xmlrpc/xr_parser.c

@@ -218,6 +218,7 @@ struct mi_root * xr_parse_tree( xmlrpc_env * env, xmlrpc_value * paramArray ) {
 				goto error;
 			}
 			free(byteStringValue);
+			byteStringValue = NULL;
 
 			#endif
 

modules/presence/presentity.c

@@ -106,7 +106,7 @@ int publ_send200ok(struct sip_msg *msg, int lexpire, str etag)
 		LM_ERR("unsuccessful sprintf\n");
 		goto error;
 	}
-	if(hdr_append.len > buf_len)
+	if(hdr_append.len >= buf_len)
 	{
 		LM_ERR("buffer size overflown\n");
 		goto error;

modules/tm/t_reply.c

@@ -876,7 +876,7 @@ static inline int t_pick_branch( struct cell *t, int *res_code, int *do_cancel)
 		if ( t->uac[b].last_received<200 ) {
 			if (t->uac[b].br_flags & minor_branch_flag) {
 				*do_cancel = 1;
-				continue;
+				continue; /* if last branch, lowest_b remains -1 */
 			}
 			return -2;
 		}
@@ -888,7 +888,7 @@ static inline int t_pick_branch( struct cell *t, int *res_code, int *do_cancel)
 		}
 	} /* find lowest branch */
 	LM_DBG("picked branch %d, code %d (prio=%d)\n",
-		lowest_b,t->uac[lowest_b].last_received,lowest_s);
+		lowest_b,lowest_b==-1 ? -1 : t->uac[lowest_b].last_received,lowest_s);
 
 	*res_code=lowest_s;
 	return lowest_b;