From a95da7966b293f26194015f170b0c124913ed0fd Mon Sep 17 00:00:00 2001
From: chme <christian.meffert@googlemail.com>
Date: Sun, 20 Nov 2016 06:27:45 +0100
Subject: [PATCH] Fixes issues found by scan-build in mpd.c and queue.c

---
 src/mpd.c   | 50 ++++++++++++++++++++++++++++++++------------------
 src/queue.c | 10 ++++++++--
 2 files changed, 40 insertions(+), 20 deletions(-)

diff --git a/src/mpd.c b/src/mpd.c
index 4b23ed2d..874d8ff0 100644
--- a/src/mpd.c
+++ b/src/mpd.c
@@ -437,18 +437,20 @@ mpd_add_mediainfo(struct evbuffer *evbuf, struct media_file_info *mfi, unsigned
     mfi->genre,
     mfi->disc);
 
-  if (pos_pl >= 0)
+  if (ret >= 0 && pos_pl >= 0)
     {
       ret = evbuffer_add_printf(evbuf,
 	"Pos: %d\n",
 	pos_pl);
 
-      ret = evbuffer_add_printf(evbuf,
-	"Id: %d\n",
-	item_id);
+      if (ret >= 0)
+	{
+	  ret = evbuffer_add_printf(evbuf,
+	    "Id: %d\n",
+	    item_id);
+	}
     }
 
-
   return ret;
 }
 
@@ -2039,12 +2041,16 @@ mpd_command_listplaylist(struct evbuffer *evbuf, int argc, char **argv, char **e
     }
 
   if (strncmp(argv[1], "/", 1) == 0)
-    {
-      ret = snprintf(path, sizeof(path), "%s", argv[1]);
-    }
+    ret = snprintf(path, sizeof(path), "%s", argv[1]);
   else
+    ret = snprintf(path, sizeof(path), "/%s", argv[1]);
+
+  if (ret >= sizeof(path))
     {
-      ret = snprintf(path, sizeof(path), "/%s", argv[1]);
+      ret = asprintf(errmsg, "Length of path exceeds the PATH_MAX value '%s'", argv[1]);
+      if (ret < 0)
+	DPRINTF(E_LOG, L_MPD, "Out of memory\n");
+      return ACK_ERROR_ARG;
     }
 
   pli = db_pl_fetch_byvirtualpath(path);
@@ -2111,12 +2117,16 @@ mpd_command_listplaylistinfo(struct evbuffer *evbuf, int argc, char **argv, char
     }
 
   if (strncmp(argv[1], "/", 1) == 0)
-    {
-      ret = snprintf(path, sizeof(path), "%s", argv[1]);
-    }
+    ret = snprintf(path, sizeof(path), "%s", argv[1]);
   else
+    ret = snprintf(path, sizeof(path), "/%s", argv[1]);
+
+  if (ret >= sizeof(path))
     {
-      ret = snprintf(path, sizeof(path), "/%s", argv[1]);
+      ret = asprintf(errmsg, "Length of path exceeds the PATH_MAX value '%s'", argv[1]);
+      if (ret < 0)
+	DPRINTF(E_LOG, L_MPD, "Out of memory\n");
+      return ACK_ERROR_ARG;
     }
 
   pli = db_pl_fetch_byvirtualpath(path);
@@ -2241,12 +2251,16 @@ mpd_command_load(struct evbuffer *evbuf, int argc, char **argv, char **errmsg)
     }
 
   if (strncmp(argv[1], "/", 1) == 0)
-    {
-      ret = snprintf(path, sizeof(path), "%s", argv[1]);
-    }
+    ret = snprintf(path, sizeof(path), "%s", argv[1]);
   else
+    ret = snprintf(path, sizeof(path), "/%s", argv[1]);
+
+  if (ret >= sizeof(path))
     {
-      ret = snprintf(path, sizeof(path), "/%s", argv[1]);
+      ret = asprintf(errmsg, "Length of path exceeds the PATH_MAX value '%s'", argv[1]);
+      if (ret < 0)
+	DPRINTF(E_LOG, L_MPD, "Out of memory\n");
+      return ACK_ERROR_ARG;
     }
 
   pli = db_pl_fetch_byvirtualpath(path);
@@ -4276,7 +4290,7 @@ mpd_read_cb(struct bufferevent *bev, void *ctx)
 
       // Split the read line into command name and arguments
       ret = mpd_parse_args(line, &argc, argv);
-      if (ret != 0)
+      if (ret != 0 || argc <= 0)
 	{
 	  // Error handling for argument parsing error
 	  DPRINTF(E_LOG, L_MPD, "Error parsing arguments for MPD message: %s\n", line);
diff --git a/src/queue.c b/src/queue.c
index b6b4ad8a..718eaa91 100644
--- a/src/queue.c
+++ b/src/queue.c
@@ -117,7 +117,7 @@ queue_new()
 }
 
 /*
- * Frees the given item and all linked items
+ * Frees the given item and all linked (next) items
  */
 static void
 queue_items_free(struct queue_item *item)
@@ -125,7 +125,12 @@ queue_items_free(struct queue_item *item)
   struct queue_item *temp;
   struct queue_item *next;
 
-  item->prev->next = NULL;
+  if (!item)
+    return;
+
+  // Make the queue non-circular
+  if (item->prev)
+    item->prev->next = NULL;
 
   next = item;
   while (next)
@@ -1194,6 +1199,7 @@ queueitem_make_byquery(struct query_params *qp)
   if (ret < 0)
     {
       DPRINTF(E_LOG, L_PLAYER, "Error fetching results\n");
+      queue_items_free(item_tail);
       return NULL;
     }