Windows: various fixes following Coverity analysis.

src/Common/BootEncryption.cpp

@@ -2137,6 +2137,7 @@ namespace VeraCrypt
 		ZeroMemory (&sdn, sizeof (sdn));
 		ZeroMemory (&partInfo, sizeof (partInfo));
 		m_bMounted = false;
+		bBootVolumePathSelected = false;
 	}
 
 	void EfiBoot::SelectBootVolumeESP() {
@@ -2161,14 +2162,14 @@ namespace VeraCrypt
 
 		PUNICODE_STRING pStr = (PUNICODE_STRING) tempBuf;
 		memcpy (BootVolumePath, pStr->Buffer, min (pStr->Length, (sizeof (BootVolumePath) - 2)));
-		bBootVolumePathSelected = TRUE;
+		bBootVolumePathSelected = true;
 	}
 
 	void EfiBoot::SelectBootVolume(WCHAR* bootVolumePath) {
 		wstring str;
 		str = bootVolumePath;
 		memcpy (BootVolumePath, &str[0], min (str.length() * 2, (sizeof (BootVolumePath) - 2)));
-		bBootVolumePathSelected = TRUE;
+		bBootVolumePathSelected = true;
 	}
 
 	void EfiBoot::MountBootPartition(WCHAR letter) {

src/Common/Dlgcode.c

@@ -547,6 +547,20 @@ size_t TrimWhiteSpace(wchar_t *str)
   return out_size;
 }
 
+BOOL IsNullTerminateString (const wchar_t* str, size_t cbSize)
+{
+	if (str && cbSize)
+	{
+		for (size_t i = 0; i < cbSize; i++)
+		{
+			if (str[i] == 0)
+				return TRUE;
+		}
+	}
+
+	return FALSE;
+}
+
 // check the validity of a file name
 BOOL IsValidFileName(const wchar_t* str)
 {
@@ -8212,9 +8226,14 @@ BOOL IsMountedVolumeID (BYTE volumeID[VOLUME_ID_SIZE])
 	int i;
 
 	memset (&mlist, 0, sizeof (mlist));
-	DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, &mlist,
+	if (	!DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, &mlist,
 				sizeof (mlist), &mlist, sizeof (mlist), &dwResult,
-		NULL);
+				NULL) 
+		|| (mlist.ulMountedDrives >= (1 << 26))
+		)
+	{
+		return FALSE; 
+	}
 
 	if (mlist.ulMountedDrives)
 	{
@@ -8256,19 +8275,29 @@ BOOL IsMountedVolume (const wchar_t *volname)
 			StringCbCopyW (volume, sizeof (volume), resolvedPath.c_str());
 
 		memset (&mlist, 0, sizeof (mlist));
-		DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, &mlist,
+		if (	!DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, &mlist,
 					sizeof (mlist), &mlist, sizeof (mlist), &dwResult,
-			NULL);
+					NULL) 
+			|| (mlist.ulMountedDrives >= (1 << 26))
+			)
+		{
+			return FALSE; 
+		}
 
 		if (mlist.ulMountedDrives)
 		{
 			for (i=0 ; i<26; i++)
 			{
-				if ((mlist.ulMountedDrives & (1 << i)) && (0 == _wcsicmp ((wchar_t *) mlist.wszVolume[i], volume)))
+				if ((mlist.ulMountedDrives & (1 << i)) 
+					&& IsNullTerminateString (mlist.wszVolume[i], TC_MAX_PATH) 
+					&& (0 == _wcsicmp ((wchar_t *) mlist.wszVolume[i], volume))
+					)
+				{
 					return TRUE;
 				}
 			}
 		}
+	}
 
 	return FALSE;
 }
@@ -8294,18 +8323,28 @@ int GetMountedVolumeDriveNo (wchar_t *volname)
 		StringCbCopyW (volume, sizeof (volume), resolvedPath.c_str());
 
 	memset (&mlist, 0, sizeof (mlist));
-	DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, &mlist,
+	if (	!DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, &mlist,
 				sizeof (mlist), &mlist, sizeof (mlist), &dwResult,
-		NULL);
+				NULL) 
+		|| (mlist.ulMountedDrives >= (1 << 26))
+		)
+	{
+		return -1; 
+	}
 
 	if (mlist.ulMountedDrives)
 	{
 		for (i=0 ; i<26; i++)
 		{
-			if ((mlist.ulMountedDrives & (1 << i)) && (0 == _wcsicmp ((wchar_t *) mlist.wszVolume[i], (WCHAR *)volume)))
+			if ((mlist.ulMountedDrives & (1 << i)) 
+				&& IsNullTerminateString (mlist.wszVolume[i], TC_MAX_PATH)
+				&& (0 == _wcsicmp ((wchar_t *) mlist.wszVolume[i], (WCHAR *)volume))
+				)
+			{
 				return i;
 			}
 		}
+	}
 
 	return -1;
 }
@@ -8425,7 +8464,7 @@ BOOL GetDriveGeometry (const wchar_t *deviceName, PDISK_GEOMETRY_EX diskGeometry
 
 	if (bResult && (dwResult == sizeof (dg)) && dg.diskGeometry.BytesPerSector)
 	{
-		ZeroMemory (diskGeometry, sizeof (PDISK_GEOMETRY_EX));
+		ZeroMemory (diskGeometry, sizeof (DISK_GEOMETRY_EX));
 		memcpy (&diskGeometry->Geometry, &dg.diskGeometry, sizeof (DISK_GEOMETRY));
 		diskGeometry->DiskSize.QuadPart = dg.DiskSize.QuadPart;
 		return TRUE;
@@ -9341,11 +9380,19 @@ LRESULT ListSubItemSet (HWND list, int index, int subIndex, const wchar_t *strin
 BOOL GetMountList (MOUNT_LIST_STRUCT *list)
 {
 	DWORD dwResult;
+	MOUNT_LIST_STRUCT localList = {0};
 
-	memset (list, 0, sizeof (*list));
+	if ( list && DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, &localList,
-	return DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, list,
+			sizeof (localList), &localList, sizeof (localList), &dwResult,
-		sizeof (*list), list, sizeof (*list), &dwResult,
+			NULL)
-		NULL);
+			&& (localList.ulMountedDrives < (1 << 26))
+		)
+	{
+		memcpy (list, &localList, sizeof (MOUNT_LIST_STRUCT));
+		return TRUE;
+	}
+	else
+		return FALSE;
 }
 
 
@@ -11853,6 +11900,8 @@ std::vector <HostDevice> GetHostRawDeviceList ()
 				NULL ) && ( ERROR_INSUFFICIENT_BUFFER == GetLastError()))
 			{
 				deviceInterfaceDetailData = ( PSP_DEVICE_INTERFACE_DETAIL_DATA ) malloc( requiredSize );
+				if (deviceInterfaceDetailData)
+				{
 					ZeroMemory( deviceInterfaceDetailData, requiredSize );
 					deviceInterfaceDetailData->cbSize = sizeof( SP_DEVICE_INTERFACE_DETAIL_DATA );
 					if (SetupDiGetDeviceInterfaceDetail( diskClassDevices,
@@ -11893,6 +11942,7 @@ std::vector <HostDevice> GetHostRawDeviceList ()
 					free (deviceInterfaceDetailData);
 				}
 			}
+		}
 
 		SetupDiDestroyDeviceInfoList( diskClassDevices );
 	}
@@ -12107,16 +12157,26 @@ wstring FindDeviceByVolumeID (const BYTE volumeID [VOLUME_ID_SIZE])
 	DWORD dwResult;
 
 	memset (&mlist, 0, sizeof (mlist));
-	DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, &mlist,
+	if (	!DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, &mlist,
 				sizeof (mlist), &mlist, sizeof (mlist), &dwResult,
-		NULL);
+				NULL) 
+		|| (mlist.ulMountedDrives >= (1 << 26))
+		)
+	{
+		return L""; 
+	}
 
 	if (mlist.ulMountedDrives)
 	{
 		for (int i=0 ; i < 26; i++)
 		{
 			if ((mlist.ulMountedDrives & (1 << i)) && (0 == memcmp (mlist.volumeID[i], volumeID, VOLUME_ID_SIZE)))
+			{
+				if (IsNullTerminateString (mlist.wszVolume[i], TC_MAX_PATH))
 					return mlist.wszVolume[i];
+				else
+					return L"";
+			}
 		}
 	}
 

src/Common/Dlgcode.h

@@ -241,6 +241,7 @@ typedef struct
 void cleanup ( void );
 void LowerCaseCopy ( wchar_t *lpszDest , const wchar_t *lpszSource );
 void UpperCaseCopy ( wchar_t *lpszDest , size_t cbDest, const wchar_t *lpszSource );
+BOOL IsNullTerminateString (const wchar_t* str, size_t cbSize);
 void CreateFullVolumePath ( wchar_t *lpszDiskFile , size_t cbDiskFile, const wchar_t *lpszFileName , BOOL *bDevice );
 int FakeDosNameForDevice ( const wchar_t *lpszDiskFile , wchar_t *lpszDosDevice , size_t cbDosDevice, wchar_t *lpszCFDevice , size_t cbCFDevice, BOOL bNameOnly );
 int RemoveFakeDosName ( wchar_t *lpszDiskFile , wchar_t *lpszDosDevice );

src/Common/Format.c

@@ -163,11 +163,12 @@ int TCFormatVolume (volatile FORMAT_VOL_PARAMETERS *volParams)
 					 FormatSectorSize,
 					 FALSE);
 
-	if (nStatus != 0)
+	/* cryptoInfo sanity check to make Coverity happy eventhough it can't be NULL if nStatus = 0 */
+	if ((nStatus != 0) || !cryptoInfo)
 	{
 		burn (header, sizeof (header));
 		VirtualUnlock (header, sizeof (header));
-		return nStatus;
+		return nStatus? nStatus : ERR_OUTOFMEMORY;
 	}
 
 begin_format:

src/Mount/Mount.c

@@ -159,7 +159,7 @@ BOOL bKeybLayoutAltKeyWarningShown = FALSE;	/* TRUE if the user has been informe
 
 static KeyFilesDlgParam				hidVolProtKeyFilesParam;
 
-static MOUNT_LIST_STRUCT	LastKnownMountList;
+static MOUNT_LIST_STRUCT	LastKnownMountList = {0};
 VOLUME_NOTIFICATIONS_LIST	VolumeNotificationsList;
 static DWORD				LastKnownLogicalDrives;
 
@@ -1603,7 +1603,7 @@ void LoadDriveLetters (HWND hwndDlg, HWND hTree, int drive)
 		NULL);
 	memcpy (&LastKnownMountList, &driver, sizeof (driver));
 
-	if (bResult == FALSE)
+	if ((bResult == FALSE) || (driver.ulMountedDrives >= (1 << 26)))
 	{
 		KillTimer (MainDlg, TIMER_ID_MAIN);
 		KillTimer (hwndDlg, TIMER_ID_UPDATE_DEVICE_LIST);
@@ -1740,7 +1740,7 @@ void LoadDriveLetters (HWND hwndDlg, HWND hTree, int drive)
 				curDrive = HIWORD(tmp.lParam);
 		}
 
-		if (driver.ulMountedDrives & (1 << i)
+		if (((driver.ulMountedDrives & (1 << i)) && (IsNullTerminateString (driver.wszVolume[i], TC_MAX_PATH)))
 			|| bSysEncPartition)
 		{
 			wchar_t szTmp[1024];
@@ -5059,12 +5059,12 @@ static BOOL DismountAll (HWND hwndDlg, BOOL forceUnmount, BOOL interact, int dis
 retry:
 	WaitCursor();
 
-	DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, &mountList, sizeof (mountList), &mountList, sizeof (mountList), &dwResult, NULL);
+	status = DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, &mountList, sizeof (mountList), &mountList, sizeof (mountList), &dwResult, NULL);
 
-	if (mountList.ulMountedDrives == 0)
+	if (!status || (mountList.ulMountedDrives == 0) || (mountList.ulMountedDrives >= (1 << 26)))
 	{
 		NormalCursor();
-		return TRUE;
+		return status && (mountList.ulMountedDrives == 0)? TRUE : FALSE;
 	}
 
 	BroadcastDeviceChange (DBT_DEVICEREMOVEPENDING, 0, mountList.ulMountedDrives);
@@ -5106,19 +5106,22 @@ retry:
 		return FALSE;
 
 	memset (&mountList, 0, sizeof (mountList));
-	DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, &mountList, sizeof (mountList), &mountList, sizeof (mountList), &dwResult, NULL);
+	if (	DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, &mountList, sizeof (mountList), &mountList, sizeof (mountList), &dwResult, NULL)
-
+		&& (mountList.ulMountedDrives < (1 << 26))
+		)
+	{
 		// remove any custom label from registry
 		if (prevMountList.ulMountedDrives)
 		{
 			for (i = 0; i < 26; i++)
 			{
-			if ((prevMountList.ulMountedDrives & (1 << i)) && (!(mountList.ulMountedDrives & (1 << i))) && wcslen (prevMountList.wszLabel[i]))
+				if ((prevMountList.ulMountedDrives & (1 << i)) && (!(mountList.ulMountedDrives & (1 << i))) && IsNullTerminateString (prevMountList.wszLabel[i], 33) && wcslen (prevMountList.wszLabel[i]))
 				{
 					UpdateDriveCustomLabel (i, prevMountList.wszLabel[i], FALSE);
 				}
 			}
 		}
+	}
 
 	BroadcastDeviceChange (DBT_DEVICEREMOVECOMPLETE, 0, prevMountList.ulMountedDrives & ~mountList.ulMountedDrives);
 
@@ -5145,9 +5148,10 @@ retry:
 			if (IsOSAtLeast (WIN_7))
 			{
 				// Undo SHCNE_DRIVEREMOVED
-				DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, NULL, 0, &mountList, sizeof (mountList), &dwResult, NULL);
+				if (	DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, NULL, 0, &mountList, sizeof (mountList), &dwResult, NULL)
-
+					&& mountList.ulMountedDrives
-				if (mountList.ulMountedDrives)
+					&& (mountList.ulMountedDrives < (1 << 26))
+					)
 				{
 					for (i = 0; i < 26; i++)
 					{
@@ -6203,12 +6207,15 @@ static void Benchmark (HWND hwndDlg)
 
 static BOOL CheckMountList (HWND hwndDlg, BOOL bForceTaskBarUpdate)
 {
-	MOUNT_LIST_STRUCT current;
+	MOUNT_LIST_STRUCT current = {0};
 	static BootEncryptionStatus newBootEncStatus;
 	static BOOL lastbUseDifferentTrayIconIfVolMounted = bUseDifferentTrayIconIfVolMounted;
 	static uint32 lastUlMountedDrives = 0;
 
-	GetMountList (&current);
+	if (!GetMountList (&current))
+	{
+		return bForceTaskBarUpdate;
+	}
 
 	if ((bForceTaskBarUpdate || current.ulMountedDrives != lastUlMountedDrives || bUseDifferentTrayIconIfVolMounted != lastbUseDifferentTrayIconIfVolMounted)
 		&& TaskBarIconMutex != NULL)
@@ -6857,7 +6864,9 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 				DWORD bytesReturned;
 
 				if (DeviceIoControl (hDriver, TC_IOCTL_GET_MOUNTED_VOLUMES, NULL, 0, &mountList, sizeof (mountList), &bytesReturned, NULL)
+					&& ((mountList.ulMountedDrives < (1 << 26))
 					&& (mountList.ulMountedDrives & (1 << cmdUnmountDrive)) == 0)
+					)
 				{
 					Error ("NO_VOLUME_MOUNTED_TO_DRIVE", hwndDlg);
 					exitCode = 1;
@@ -7332,7 +7341,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 					{
 						for (i = 0; i < 26; i++)
 						{
-							if (LastKnownMountList.ulMountedDrives & (1 << i))
+							if ((LastKnownMountList.ulMountedDrives & (1 << i)) && IsNullTerminateString (LastKnownMountList.wszVolume[i], TC_MAX_PATH))
 							{
 								wchar_t s[1024];
 								wchar_t *vol = (wchar_t *) LastKnownMountList.wszVolume[i];
@@ -7341,7 +7350,9 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 
 								// first check label used for mounting. If empty, look for it in favorites.
 								bool useInExplorer = false;
-								wstring label = (wchar_t *) LastKnownMountList.wszLabel[i];
+								wstring label;
+								if (IsNullTerminateString (LastKnownMountList.wszLabel[i], 33))
+									label = (wchar_t *) LastKnownMountList.wszLabel[i];
 								if (label.empty())
 									label = GetFavoriteVolumeLabel (vol, useInExplorer);
 
@@ -7451,8 +7462,8 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 			PDEV_BROADCAST_HDR hdr = (PDEV_BROADCAST_HDR) lParam;
 			int m;
 
-			GetMountList (&LastKnownMountList);
+			if (GetMountList (&LastKnownMountList))
-
+			{
 				if (wParam == DBT_DEVICEREMOVECOMPLETE && hdr->dbch_devicetype == DBT_DEVTYP_VOLUME)
 				{
 					// File-hosted volumes
@@ -7465,7 +7476,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 						{
 							for (m = 0; m < 26; m++)
 							{
-							if (LastKnownMountList.ulMountedDrives & (1 << m))
+								if ((LastKnownMountList.ulMountedDrives & (1 << m)) && IsNullTerminateString (LastKnownMountList.wszVolume[m], TC_MAX_PATH))
 								{
 									wchar_t *vol = (wchar_t *) LastKnownMountList.wszVolume[m];
 
@@ -7486,7 +7497,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 				// Device-hosted volumes
 				for (m = 0; m < 26; m++)
 				{
-				if (LastKnownMountList.ulMountedDrives & (1 << m))
+					if ((LastKnownMountList.ulMountedDrives & (1 << m)) && IsNullTerminateString (LastKnownMountList.wszVolume[m], TC_MAX_PATH))
 					{
 						wchar_t *vol = (wchar_t *) LastKnownMountList.wszVolume[m];
 
@@ -7505,6 +7516,7 @@ BOOL CALLBACK MainDialogProc (HWND hwndDlg, UINT uMsg, WPARAM wParam, LPARAM lPa
 						}
 					}
 				}
+			}
 
 			// Favorite volumes
 			UpdateDeviceHostedFavoriteVolumes();

src/Setup/Setup.c

@@ -1864,7 +1864,7 @@ BOOL DoShortcutsInstall (HWND hwndDlg, wchar_t *szDestDir, BOOL bProgGroup, BOOL
 		f = _wfopen (szTmp2, L"w");
 		if (f)
 		{
-			fprintf (f, "[InternetShortcut]\nURL=%S\n", TC_APPLINK);
+			fwprintf (f, L"[InternetShortcut]\nURL=%s\n", TC_APPLINK);
 
 			CheckFileStreamWriteErrors (hwndDlg, f, szTmp2);
 			fclose (f);