tidying: coverity issues

7 files changed, 15 insertions, 10 deletions

diff --git a/src/exim_monitor/em_menu.c b/src/exim_monitor/em_menu.c
index 9d3ca1c14..af9ef3701 100644
--- a/src/exim_monitor/em_menu.c
+++ b/src/exim_monitor/em_menu.c
@@ -373,7 +373,7 @@ if ((pid = fork()) == 0)
 
 /* Main process - set up an item for the main ticker to watch. */
 
-if (pid < 0) text_showf(text, "Failed to fork: %s\n", strerror(pid)); else
+if (pid < 0) text_showf(text, "Failed to fork: %s\n", strerror(errno)); else
   {
   pipe_item *p = (pipe_item *)store_malloc(sizeof(pipe_item));
 
diff --git a/src/exim_monitor/em_xs.c b/src/exim_monitor/em_xs.c
index 87371b50c..c91b7dea9 100644
--- a/src/exim_monitor/em_xs.c
+++ b/src/exim_monitor/em_xs.c
@@ -37,6 +37,7 @@ for (i = 0; i < num_args; i++)
   aa[i].name = va_arg(ap, String);
   aa[i].value = va_arg(ap, XtArgVal);
   }
+va_end(ap);
 XtSetValues(w, aa, num_args);
 if (num_args > 15) free(aa);
 }
diff --git a/src/src/auths/dovecot.c b/src/src/auths/dovecot.c
index 9641beff4..612aed39a 100644
--- a/src/src/auths/dovecot.c
+++ b/src/src/auths/dovecot.c
@@ -240,7 +240,7 @@ uschar *auth_command;
 uschar *auth_extra_data = US"";
 uschar *p;
 int nargs, tmp;
-int crequid = 1, cont = 1, fd, ret = DEFER;
+int crequid = 1, cont = 1, fd = -1, ret = DEFER;
 BOOL found = FALSE, have_mech_line = FALSE;
 
 HDEBUG(D_auth) debug_printf("dovecot authentication\n");
diff --git a/src/src/deliver.c b/src/src/deliver.c
index 9066a14be..d5a9c1bac 100644
--- a/src/src/deliver.c
+++ b/src/src/deliver.c
@@ -4243,7 +4243,7 @@ for (delivery_count = 0; addr_remote; delivery_count++)
         addr_fallback = addr;
         }
 
-      else
+      else if (next)
 	{
 	while (next->next) next = next->next;
 	next->next = addr_defer;
diff --git a/src/src/expand.c b/src/src/expand.c
index 5bb9df1b6..cc22e65fb 100644
--- a/src/src/expand.c
+++ b/src/src/expand.c
@@ -3407,8 +3407,8 @@ if (Ustrlen(key) > 64)
   return NULL;
 
 hash_source = string_cat(NULL,&size,&offset,key_num,1);
-string_cat(hash_source,&size,&offset,daystamp,3);
-string_cat(hash_source,&size,&offset,address,Ustrlen(address));
+hash_source = string_cat(hash_source,&size,&offset,daystamp,3);
+hash_source = string_cat(hash_source,&size,&offset,address,Ustrlen(address));
 hash_source[offset] = '\0';
 
 DEBUG(D_expand) debug_printf("prvs: hash source is '%s'\n", hash_source);
diff --git a/src/src/readconf.c b/src/src/readconf.c
index 3a4a4c3bf..9ffd41cc4 100644
--- a/src/src/readconf.c
+++ b/src/src/readconf.c
@@ -2708,13 +2708,14 @@ if (type == NULL)
     {
     if (environ)
       {
-      uschar **p;
+      uschar ** p;
       for (p = USS environ; *p; p++) ;
       qsort(environ, p - USS environ, sizeof(*p), string_compare_by_pointer);
 
       for (p = USS environ; *p; p++)
         {
-        if (no_labels) *(Ustrchr(*p, '=')) = '\0';
+	uschar * q;
+        if (no_labels && (q = Ustrchr(*p, '='))) *q  = '\0';
         puts(CS *p);
         }
       }
diff --git a/src/src/spam.c b/src/src/spam.c
index 1159d3687..8898c591e 100644
--- a/src/src/spam.c
+++ b/src/src/spam.c
@@ -500,8 +500,9 @@ offset = 0;
 while ((i = ip_recv(spamd_sock,
 		   spamd_buffer + offset,
 		   sizeof(spamd_buffer) - offset - 1,
-		   sd->timeout - time(NULL) + start)) > 0 )
+		   sd->timeout - time(NULL) + start)) > 0)
   offset += i;
+spamd_buffer[offset] = '\0';	/* guard byte */
 
 /* error handling */
 if (i <= 0 && errno != 0)
@@ -518,10 +519,12 @@ if (i <= 0 && errno != 0)
 if (sd->is_rspamd)
   {				/* rspamd variant of reply */
   int r;
-  if ((r = sscanf(CS spamd_buffer,
+  if (  (r = sscanf(CS spamd_buffer,
 	  "RSPAMD/%7s 0 EX_OK\r\nMetric: default; %7s %lf / %lf / %lf\r\n%n",
 	  spamd_version, spamd_short_result, &spamd_score, &spamd_threshold,
-	  &spamd_reject_score, &spamd_report_offset)) != 5)
+	  &spamd_reject_score, &spamd_report_offset)) != 5
+     || spamd_report_offset >= offset		/* verify within buffer */
+     )
     {
     log_write(0, LOG_MAIN|LOG_PANIC,
 	      "%s cannot parse spamd %s, output: %d", loglabel, callout_address, r);