From e791cb2c00c3f50a04b027c9156eeea83ac97776 Mon Sep 17 00:00:00 2001
From: Riccardo Magliocchetti <riccardo.magliocchetti@gmail.com>
Date: Mon, 28 Oct 2013 19:02:29 +0100
Subject: [PATCH 1/4] core/utils: cleanup if condition

uwsgi.ksm_mappings_current_size cannot be 0 here.
A couple of lines above:

1219 if (uwsgi.ksm_mappings_current_size <= 0) {
1220     uwsgi_log("[uwsgi-KSM] unable to read /proc/self/maps data\n");
1221     return;
1222 }
---
 core/utils.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/utils.c b/core/utils.c
index 48071ba8..fdf431f4 100644
--- a/core/utils.c
+++ b/core/utils.c
@@ -1222,7 +1222,7 @@ void uwsgi_linux_ksm_map(void) {
 	}
 
 	// we now have areas
-	if (uwsgi.ksm_mappings_last_size == 0 || uwsgi.ksm_mappings_current_size == 0 || uwsgi.ksm_mappings_current_size != uwsgi.ksm_mappings_last_size) {
+	if (uwsgi.ksm_mappings_last_size == 0 || uwsgi.ksm_mappings_current_size != uwsgi.ksm_mappings_last_size) {
 		dirty = 1;
 	}
 	else {

From f58a9c6119ae0b46f483316e991c409ae732003a Mon Sep 17 00:00:00 2001
From: Riccardo Magliocchetti <riccardo.magliocchetti@gmail.com>
Date: Mon, 28 Oct 2013 19:14:55 +0100
Subject: [PATCH 2/4] plugins/router_hash: don't dereference a null pointer

In case this condition is true:

    if (urhc->items[i] == ';') {

but this is false:

    if (found == hashed_result)

for the latest loop iteration value would be set as NULL

This is a bit unfortunate because later we can:
- use it in arithmetics
- dereference it in uwsgi_req_append

To fix that update vallen only if value is not null.

Reported by Coverity sa CID #1100805.
---
 plugins/router_hash/router_hash.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/router_hash/router_hash.c b/plugins/router_hash/router_hash.c
index 7e980f8e..812a4992 100644
--- a/plugins/router_hash/router_hash.c
+++ b/plugins/router_hash/router_hash.c
@@ -81,7 +81,7 @@ static int uwsgi_routing_func_hash(struct wsgi_request *wsgi_req, struct uwsgi_r
 			vallen = urhc->items_len;
 		}
 		// last item
-		else {
+		else if (value != NULL) {
 			vallen = (urhc->items + urhc->items_len) - value;
 		}
 	}

From 1114c1a4293910e49668edfd9da96884d786f7cd Mon Sep 17 00:00:00 2001
From: Riccardo Magliocchetti <riccardo.magliocchetti@gmail.com>
Date: Mon, 28 Oct 2013 18:52:12 +0100
Subject: [PATCH 3/4] core/fifo: check array index read before dereferencing
 uwsgi_master_fifo_manage

Reported by Coverity as CID #1100821
---
 core/fifo.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/core/fifo.c b/core/fifo.c
index 1a92d9bc..c59adb55 100644
--- a/core/fifo.c
+++ b/core/fifo.c
@@ -114,6 +114,11 @@ int uwsgi_master_fifo_manage(int fd) {
 		return 0;
 	}
 
+	if ((int)cmd < 0) {
+		uwsgi_error("invalid cmd read in uwsgi_master_fifo_manage");
+		exit(1);
+	}
+
 	if (uwsgi_fifo_table[(int) cmd]) {
 		uwsgi_fifo_table[(int) cmd](0);
 	}

From d50596432158a7f738f4681cb1750f687600e3c6 Mon Sep 17 00:00:00 2001
From: Riccardo Magliocchetti <riccardo.magliocchetti@gmail.com>
Date: Mon, 28 Oct 2013 19:38:02 +0100
Subject: [PATCH 4/4] plugins/gevent: don't dereference null pointer

We should not pass a NULL pointer to Py_DECREF. This is possible
if wsgi_req->socket->edge_trigger is true.

Reported by Coverity as CID #970981.
---
 plugins/gevent/gevent.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/plugins/gevent/gevent.c b/plugins/gevent/gevent.c
index 1fbe14ff..fd44bbda 100644
--- a/plugins/gevent/gevent.c
+++ b/plugins/gevent/gevent.c
@@ -291,7 +291,8 @@ request:
 	}
 
 end:
-	Py_DECREF(greenlet_switch);
+	if (greenlet_switch)
+		Py_DECREF(greenlet_switch);
 end2:
 	Py_DECREF(current_greenlet);