From: Rahul Dadhich <r.dadhich@samsung.com>
Date: Mon, 3 Sep 2018 13:31:40 +0000 (+0530)
Subject: resolved SVACE issue
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=refs%2Fchanges%2F00%2F188300%2F3;p=sdk%2Femulator%2Fqemu.git

resolved SVACE issue

Change-Id: Iaed72b455946aaa6fb34914d045ca1e6eaf5b2e1
Signed-off-by: Rahul Dadhich <r.dadhich@samsung.com>
---

diff --git a/tizen/src/ecs/ecs.c b/tizen/src/ecs/ecs.c
index 209d557..477e973 100644
--- a/tizen/src/ecs/ecs.c
+++ b/tizen/src/ecs/ecs.c
@@ -712,7 +712,9 @@ static void epoll_init(ECS_State *cs)
 
     if (epoll_ctl(cs->epoll_fd, EPOLL_CTL_ADD, cs->listen_fd, &events) < 0) {
         close(cs->listen_fd);
-        close(cs->epoll_fd);
+        if (cs->epoll_fd >= 0) {
+            close(cs->epoll_fd);
+        }
     }
 }
 #endif
diff --git a/tizen/src/ecs/ecs_eventcast.c b/tizen/src/ecs/ecs_eventcast.c
index 6d97cbf..3f8042e 100644
--- a/tizen/src/ecs/ecs_eventcast.c
+++ b/tizen/src/ecs/ecs_eventcast.c
@@ -127,11 +127,15 @@ static void send_eventcast_connection_info(void)
 
         if (!ip) {
             LOG_SEVERE("invalid connected ip\n");
+            g_free(msg);
+            msg = NULL;
             return;
         }
 
         if (!port) {
             LOG_SEVERE("invalid connected port\n");
+            g_free(msg);
+            msg = NULL;
             return;
         }
         g_snprintf(data, sizeof(data) - 1, "%s:%d", ip, port);
diff --git a/tizen/src/ecs/ecs_mon.c b/tizen/src/ecs/ecs_mon.c
index 8a492ea..b264770 100644
--- a/tizen/src/ecs/ecs_mon.c
+++ b/tizen/src/ecs/ecs_mon.c
@@ -105,9 +105,7 @@ static void ecs_monitor_flush(ECS_Client *clii, Monitor *mon)
         ret = send_monitor_ntf((char *)mon->outbuf, mon->outbuf_index);
         memset(mon->outbuf, 0, sizeof(mon->outbuf));
         mon->outbuf_index = 0;
-        if (ret < -1) {
-            ecs_client_close(clii);
-        }
+        TRACE("ecs_monitor_flush return value of send_monitor_ntf : %d, \n", ret);
     }
 }
 
diff --git a/tizen/src/ecs/ecs_msg_device.c b/tizen/src/ecs/ecs_msg_device.c
index 4e7f5c1..bcab150 100644
--- a/tizen/src/ecs/ecs_msg_device.c
+++ b/tizen/src/ecs/ecs_msg_device.c
@@ -318,7 +318,7 @@ static void send_tuner_info(struct tune_info *info)
     char cmd[10] = "TUNER_DTV";
 
     if (strlen(info->map_table_path) < MAX_PATH_LEN) {
-        sprintf(data, "%d:%d:%d:%d:%d:%d:%s", info->is_streaming, info->frequency, info->modulation,
+        snprintf(data, sizeof(data), "%d:%d:%d:%d:%d:%d:%s", info->is_streaming, info->frequency, info->modulation,
                 info->system, info->country, info->playmode, info->map_table_path);
     }
 
@@ -364,8 +364,13 @@ static bool msgproc_device_req_tuner(ECS_Client* ccli, ECS__DeviceReq* msg, char
     } else if (action == TUNER_CHANGE_CONF) {
         //call change file function
         char *path = data;
-        marutuner_set_table_file(path);
-        LOG_TRACE("tuner : change configuration file : %s \n", data);
+        if (path != NULL) {
+            marutuner_set_table_file(path);
+            LOG_TRACE("tuner : change configuration file : %s \n", data);
+        } else {
+            LOG_TRACE("tuner : path is NULL");
+        }
+
     } else {
         char token[] = ":";
         char *section = strtok(data, token);
@@ -406,7 +411,11 @@ bool msgproc_device_req(ECS_Client *ccli, ECS__DeviceReq *msg)
 {
     char cmd[10];
     memset(cmd, 0, 10);
-    strcpy(cmd, msg->category);
+
+    if(strlen(msg->category) > 10) {
+        return false;
+    }
+    strncpy(cmd, msg->category, sizeof(cmd));
 
     LOG_TRACE(">> device_req: header = cmd = %s, length = %d, action=%d, group=%d\n",
             cmd, msg->length, msg->action, msg->group);
diff --git a/tizen/src/ecs/ecs_msg_injector.c b/tizen/src/ecs/ecs_msg_injector.c
index e5a0fdc..cba9f75 100644
--- a/tizen/src/ecs/ecs_msg_injector.c
+++ b/tizen/src/ecs/ecs_msg_injector.c
@@ -269,20 +269,20 @@ static bool injector_req_sensor(ECS_Client *ccli, ECS__InjectorReq *msg, char *c
     if (group == MSG_GROUP_STATUS) {
         switch (action) {
         case MSG_ACT_BATTERY_LEVEL:
-            sprintf(data, "%d", get_power_capacity());
+            snprintf(data, sizeof(data), "%d", get_power_capacity());
             break;
         case MSG_ACT_BATTERY_CHARGER:
-            sprintf(data, "%d", get_jack_charger());
+            snprintf(data, sizeof(data), "%d", get_jack_charger());
             break;
         case MSG_ACT_USB:
-            sprintf(data, "%d", get_jack_usb());
+            snprintf(data, sizeof(data), "%d", get_jack_usb());
             break;
         case MSG_ACT_EARJACK:
-            sprintf(data, "%d", get_jack_earjack());
+            snprintf(data, sizeof(data), "%d", get_jack_earjack());
             break;
         case MSG_ACT_LOCATION:
             qemu_mutex_lock(&mutex_location_data);
-            sprintf(data, "%s", location_data);
+            snprintf(data, sizeof(data), "%s", location_data);
             qemu_mutex_unlock(&mutex_location_data);
             break;
         default:
@@ -409,9 +409,9 @@ static bool push_package(const char *data)
 
     char *addon = strtok((char *)data, token);
 #ifndef CONFIG_WIN32
-        ret = sprintf(cmd, "\"%s%s\" -s emulator-%d push \"%s%s%s%s%s\" %s%s 2>&1",
+        ret = snprintf(cmd, sizeof(cmd), "\"%s%s\" -s emulator-%d push \"%s%s%s%s%s\" %s%s 2>&1",
 #else
-        ret = sprintf(cmd, "cmd /S /C \"\"%s%s\" -s emulator-%d push \"%s%s%s%s%s\" %s%s 2>&1\"",
+        ret = snprintf(cmd, sizeof(cmd), "cmd /S /C \"\"%s%s\" -s emulator-%d push \"%s%s%s%s%s\" %s%s 2>&1\"",
 #endif
             bin_dir, sdb_path, get_vm_device_serial_number(),
             bin_dir, platform_path, get_profile_name(), addon_path, addon,
@@ -473,9 +473,13 @@ static void show_error_popup(char *data)
     char *addon = strtok(data, token);
 
     memset(fail_msg, 0, sizeof(fail_msg));
-    strcpy(fail_msg, FAILED_TO_INSTALL_EXTRAPACKAGE_1);
-    strcat(fail_msg, addon);
-    strcat(fail_msg, FAILED_TO_INSTALL_EXTRAPACKAGE_2);
+    strncpy(fail_msg, FAILED_TO_INSTALL_EXTRAPACKAGE_1, sizeof(fail_msg));
+    if (addon != NULL && (strlen(addon)+strlen(fail_msg)) < MAX_PKGS_LIST) {
+        strncat(fail_msg, addon, strlen(addon));
+    }
+    if ((strlen(FAILED_TO_INSTALL_EXTRAPACKAGE_2)+strlen(fail_msg)) < MAX_PKGS_LIST) {
+        strncat(fail_msg, FAILED_TO_INSTALL_EXTRAPACKAGE_2, strlen(FAILED_TO_INSTALL_EXTRAPACKAGE_2));
+    }
 
     error_report("%s", fail_msg);
 }
@@ -493,9 +497,9 @@ static void set_read_write_mode(void)
 
     memset(cmd, 0, sizeof(cmd));
 #ifndef CONFIG_WIN32
-    ret = sprintf(cmd, "\"%s%s\" -s emulator-%d  root on",
+    ret = snprintf(cmd, sizeof(cmd), "\"%s%s\" -s emulator-%d  root on",
 #else
-    ret = sprintf(cmd, "cmd /S /C \"\"%s%s\" -s emulator-%d  root on\"",
+    ret = snprintf(cmd, sizeof(cmd), "cmd /S /C \"\"%s%s\" -s emulator-%d  root on\"",
 #endif
            bin_dir, sdb_path, get_vm_device_serial_number());
     if (ret < 0) {
@@ -509,9 +513,9 @@ static void set_read_write_mode(void)
 
     memset(cmd, 0, sizeof(cmd));
 #ifndef CONFIG_WIN32
-    ret = sprintf(cmd, "\"%s%s\" -s emulator-%d  shell \"mount -o remount,rw /\"",
+    ret = snprintf(cmd, sizeof(cmd), "\"%s%s\" -s emulator-%d  shell \"mount -o remount,rw /\"",
 #else
-    ret = sprintf(cmd, "cmd /S /C \"\"%s%s\" -s emulator-%d  shell \"mount -o remount,rw /\"\"",
+    ret = snprintf(cmd, sizeof(cmd), "cmd /S /C \"\"%s%s\" -s emulator-%d  shell \"mount -o remount,rw /\"\"",
 #endif
            bin_dir, sdb_path, get_vm_device_serial_number());
     if (ret < 0) {
@@ -537,9 +541,9 @@ static void *set_read_mode(void *args)
 
     memset(cmd, 0, sizeof(cmd));
 #ifndef CONFIG_WIN32
-    ret = sprintf(cmd, "\"%s%s\" -s emulator-%d  shell \"mount -o remount,ro /\"",
+    ret = snprintf(cmd, sizeof(cmd), "\"%s%s\" -s emulator-%d  shell \"mount -o remount,ro /\"",
 #else
-    ret = sprintf(cmd, "cmd /S /C \"\"%s%s\" -s emulator-%d  shell \"mount -o remount,ro /\"\"",
+    ret = snprintf(cmd, sizeof(cmd), "cmd /S /C \"\"%s%s\" -s emulator-%d  shell \"mount -o remount,ro /\"\"",
 #endif
             bin_dir, sdb_path, get_vm_device_serial_number());
     if (ret < 0) {
@@ -552,9 +556,9 @@ static void *set_read_mode(void *args)
     }
     memset(cmd, 0, sizeof(cmd));
 #ifndef CONFIG_WIN32
-    ret = sprintf(cmd, "\"%s%s\"  -s emulator-%d  root off",
+    ret = snprintf(cmd, sizeof(cmd), "\"%s%s\"  -s emulator-%d  root off",
 #else
-    ret = sprintf(cmd, "cmd /S /C \"\"%s%s\"  -s emulator-%d  root off\"",
+    ret = snprintf(cmd, sizeof(cmd), "cmd /S /C \"\"%s%s\"  -s emulator-%d  root off\"",
 #endif
            bin_dir, sdb_path, get_vm_device_serial_number());
     if (ret < 0) {
diff --git a/tizen/src/ecs/ecs_sdcard.c b/tizen/src/ecs/ecs_sdcard.c
index 7348bdb..284138d 100644
--- a/tizen/src/ecs/ecs_sdcard.c
+++ b/tizen/src/ecs/ecs_sdcard.c
@@ -118,7 +118,7 @@ static void send_sdcard_status(void)
                     image_info->actual_size);
         }
         get_human_readable_size(size_buf, sizeof(size_buf), image_info->virtual_size);
-        length += sprintf(data + length,
+        length += snprintf(data + length, (sizeof(data) - length),
                 "\nimage: %s\n"
                 "file format: %s\n"
                 "virtual size: %s (%" PRId64 " bytes)\n"
diff --git a/tizen/src/ecs/ecs_sensor.c b/tizen/src/ecs/ecs_sensor.c
index f05a60c..ae68467 100644
--- a/tizen/src/ecs/ecs_sensor.c
+++ b/tizen/src/ecs/ecs_sensor.c
@@ -168,7 +168,7 @@ static void _req_set_sensor_accel(int len, const char *data)
 
     memset(tmp, 0, sizeof(tmp));
 
-    sprintf(tmp, "%d,%d,%d", x, y, z);
+    snprintf(tmp, sizeof(tmp), "%d,%d,%d", x, y, z);
 
     set_sensor_accel(tmp, strlen(tmp));
 }
@@ -224,7 +224,7 @@ static void _req_set_sensor_pressure(int len, const char *data)
 
     memset(tmp, 0, sizeof(tmp));
 
-    sprintf(tmp, "%d, %d", pressure, temperature);
+    snprintf(tmp, sizeof(tmp), "%d, %d", pressure, temperature);
 
     set_sensor_pressure(tmp, strlen(tmp));
 }
@@ -269,13 +269,13 @@ static void _req_set_sensor_hrm(int len, const char *data)
     memset(tmp, 0, sizeof(tmp));
 
     if (index == 0) {
-        sprintf(tmp, "%d, %d", hrm, rri);
+        snprintf(tmp, sizeof(tmp), "%d, %d", hrm, rri);
         set_sensor_hrm(tmp, strlen(tmp));
     } else if (index == 1) {
-        sprintf(tmp, "%d", hrm);
+        snprintf(tmp, sizeof(tmp), "%d", hrm);
         set_sensor_hrm_heart(tmp, strlen(tmp));
     } else if (index == 2) {
-        sprintf(tmp, "%d", rri);
+        snprintf(tmp, sizeof(tmp), "%d", rri);
         set_sensor_hrm_rri(tmp, strlen(tmp));
     } else {
         LOG_SEVERE("unknown index with data '%s' & index '%d'\n", data, index);
@@ -304,7 +304,7 @@ static void _req_set_sensor_gyro(int len, const char *data)
 
     memset(tmp, 0, sizeof(tmp));
 
-    sprintf(tmp, "%d %d %d", x, y, z);
+    snprintf(tmp, sizeof(tmp), "%d %d %d", x, y, z);
 
     set_sensor_gyro(tmp, strlen(tmp));
 }
@@ -334,7 +334,7 @@ static void _req_set_sensor_geo(int len, const char *data)
 
     memset(tmp, 0, sizeof(tmp));
 
-    sprintf(tmp, "%d %d %d %d", x, y, z, accuracy);
+    snprintf(tmp, sizeof(tmp), "%d %d %d %d", x, y, z, accuracy);
 
     set_sensor_tilt(tmp, strlen(tmp));
 
@@ -379,7 +379,7 @@ static void _req_set_sensor_tilt(int len, const char *data)
 
     memset(tmp, 0, sizeof(tmp));
 
-    sprintf(tmp, "%d %d %d %d", x, y, z, accuracy);
+    snprintf(tmp, sizeof(tmp), "%d %d %d %d", x, y, z, accuracy);
 
     set_sensor_tilt(tmp, strlen(tmp));
 }
@@ -406,7 +406,7 @@ static void _req_set_sensor_mag(int len, const char *data)
 
     memset(tmp, 0, sizeof(tmp));
 
-    sprintf(tmp, "%d %d %d", x, y, z);
+    snprintf(tmp, sizeof(tmp), "%d %d %d", x, y, z);
 
     set_sensor_mag(tmp, strlen(tmp));
 }
diff --git a/tizen/src/emul_state.c b/tizen/src/emul_state.c
index 54e076b..b6b3033 100644
--- a/tizen/src/emul_state.c
+++ b/tizen/src/emul_state.c
@@ -197,7 +197,7 @@ const char *get_log_redirect_file(void)
     // should we compare stdout(fd/1) and stderr(fd/2) ??
 #if defined(CONFIG_LINUX)
     result = readlink("/proc/self/fd/1", log_filename, PATH_MAX);
-    if (result >= 0) {
+    if (result >= 0 && result < PATH_MAX) {
         log_filename[result] = '\0';
     }
 #elif defined(CONFIG_DARWIN)
diff --git a/tizen/src/emulator_options.c b/tizen/src/emulator_options.c
index 03ea020..89edc2e 100644
--- a/tizen/src/emulator_options.c
+++ b/tizen/src/emulator_options.c
@@ -80,8 +80,11 @@ void set_variable(const char * const arg1, const char * const arg2,
 
     QTAILQ_FOREACH(var, &variables, entry) {
         if (!g_strcmp0(name, var->name)) {
-            if(!override)
+            if(!override) {
+                g_free(value);
+                g_free(name);
                 return;
+            }
 
             g_free(name);
             g_free(var->value);
@@ -223,6 +226,7 @@ bool load_conf(const char * const conf)
     if(!g_file_test(filename, G_FILE_TEST_IS_REGULAR)) {
         fprintf(stderr,
             "Profile configuration file [%s] is invalid.\n", filename);
+        g_free(filename);
         return false;
     }
     file = g_fopen(filename, "r");
diff --git a/tizen/src/eventcast/sensor.c b/tizen/src/eventcast/sensor.c
index 8ceaafc..fbaa323 100644
--- a/tizen/src/eventcast/sensor.c
+++ b/tizen/src/eventcast/sensor.c
@@ -151,7 +151,7 @@ static void set_sensor_data(Eventcast__SensorData *data)
     {
         char tmp[255] = {0};
 
-        sprintf(tmp, "%d\n%d\n%lf\n%lf\n%lf\n",
+        snprintf(tmp, sizeof(tmp), "%d\n%d\n%lf\n%lf\n%lf\n",
                 level_accel, 3, (atof(data->x) * ACCEL_ADJUST),
                 (atof(data->y) * ACCEL_ADJUST), (atof(data->z) * ACCEL_ADJUST));
         send_eventcast_sensor_data(tmp, strlen(tmp));
diff --git a/tizen/src/hw/pci/maru_brillcodec_vaapi.c b/tizen/src/hw/pci/maru_brillcodec_vaapi.c
index cfb7fb9..08a4e61 100644
--- a/tizen/src/hw/pci/maru_brillcodec_vaapi.c
+++ b/tizen/src/hw/pci/maru_brillcodec_vaapi.c
@@ -367,7 +367,7 @@ static void *setup(AVCodecContext *ctx, int width, int height)
 
     int num_profiles = _vaMaxNumProfiles(va_ctx->display);
     VAProfile *profiles_list = g_malloc0_n(num_profiles, sizeof(VAProfile));
-    bool is_supported_profile;
+    bool is_supported_profile = false;
     int i;
 
     if (!profiles_list) {
@@ -408,7 +408,6 @@ static void *setup(AVCodecContext *ctx, int width, int height)
 
 error:
     cleanup(va_ctx);
-    g_free(va_ctx);
     return NULL;
 }
 
diff --git a/tizen/src/hw/pci/maru_tuner.c b/tizen/src/hw/pci/maru_tuner.c
index ad2845c..19cdd20 100644
--- a/tizen/src/hw/pci/maru_tuner.c
+++ b/tizen/src/hw/pci/maru_tuner.c
@@ -802,7 +802,7 @@ int marutuner_get_tuned_info(struct tune_info *info)
     info->system = g_current_tune.system;
     info->country = g_current_tune.country;
     info->playmode = g_current_tune.playmode;
-    strcpy(info->map_table_path, ts_mapping_table_path);
+    strncpy(info->map_table_path, ts_mapping_table_path, sizeof(info->map_table_path));
 
     return info->is_tuned? 0 : -1;
 }
@@ -1438,10 +1438,10 @@ static void marutuner_deliver_tuned_info(void *opaque)
     char data[TUNER_DATA_SIZE];
     char cmd[10] = {0};
 
-    strcpy(cmd, "TUNER_DTV");
+    strncpy(cmd, "TUNER_DTV", sizeof(cmd));
 
     if (strlen(g_current_tune.map_table_path) < MAX_PATH_LEN) {
-        sprintf(data, "%d:%d:%d:%d:%d:%d:%s",
+        snprintf(data, sizeof(data), "%d:%d:%d:%d:%d:%d:%s",
                 g_current_tune.is_streaming, g_current_tune.frequency,
                 g_current_tune.modulation, g_current_tune.system,
                 g_current_tune.country, g_current_tune. playmode,
diff --git a/tizen/src/hw/virtio/maru_virtio_esm.c b/tizen/src/hw/virtio/maru_virtio_esm.c
index 069be2c..0d8ae07 100644
--- a/tizen/src/hw/virtio/maru_virtio_esm.c
+++ b/tizen/src/hw/virtio/maru_virtio_esm.c
@@ -95,7 +95,9 @@ static void virtio_esm_handle(VirtIODevice *vdev, VirtQueue *vq)
     }
 
     // There is no data to copy into guest.
-    virtqueue_push(vesm->vq, elem, 0);
+    if(elem != NULL) {
+        virtqueue_push(vesm->vq, elem, 0);
+    }
     virtio_notify(&vesm->vdev, vesm->vq);
 }
 
diff --git a/tizen/src/hw/virtio/maru_virtio_nfc.c b/tizen/src/hw/virtio/maru_virtio_nfc.c
index 240c446..67fd50f 100644
--- a/tizen/src/hw/virtio/maru_virtio_nfc.c
+++ b/tizen/src/hw/virtio/maru_virtio_nfc.c
@@ -134,7 +134,7 @@ bool send_to_nfc(unsigned char id, unsigned char type, const char *data,
     _msg->info.client_type = type;
 
     qemu_mutex_lock(&recv_buf_mutex);
-    strcpy(nfc_data, data);
+    strncpy(nfc_data, data, sizeof(nfc_data));
     QTAILQ_INSERT_TAIL(&nfc_recv_msg_queue, _msg, next);
 
     qemu_mutex_unlock(&recv_buf_mutex);
diff --git a/tizen/src/hw/virtio/maru_virtio_sensor.c b/tizen/src/hw/virtio/maru_virtio_sensor.c
index 94d892d..a6870d5 100644
--- a/tizen/src/hw/virtio/maru_virtio_sensor.c
+++ b/tizen/src/hw/virtio/maru_virtio_sensor.c
@@ -202,7 +202,7 @@ static void __set_sensor_data(enum sensor_types type, char *data, int len)
     switch (type) {
     case sensor_type_accel:
         qemu_mutex_lock(&accel_mutex);
-        strcpy(accel_xyz, data);
+        strncpy(accel_xyz, data, sizeof(accel_xyz));
         qemu_mutex_unlock(&accel_mutex);
         break;
     case sensor_type_accel_enable:
@@ -283,7 +283,7 @@ static void __set_sensor_data(enum sensor_types type, char *data, int len)
         break;
     case sensor_type_rotation_vector:
         qemu_mutex_lock(&rot_mutex);
-        strcpy(rot_quad, data);
+        strncpy(rot_quad, data, sizeof(rot_quad));
         qemu_mutex_unlock(&rot_mutex);
         break;
     case sensor_type_rotation_vector_enable:
@@ -298,12 +298,12 @@ static void __set_sensor_data(enum sensor_types type, char *data, int len)
         break;
     case sensor_type_mag:
         qemu_mutex_lock(&geo_mutex);
-        strcpy(geo_tesla, data);
+        strncpy(geo_tesla, data, sizeof(geo_tesla));
         qemu_mutex_unlock(&geo_mutex);
         break;
     case sensor_type_tilt:
         qemu_mutex_lock(&geo_mutex);
-        strcpy(geo_raw, data);
+        strncpy(geo_raw, data, sizeof(geo_raw));
         qemu_mutex_unlock(&geo_mutex);
         break;
     case sensor_type_geo_enable:
@@ -318,7 +318,7 @@ static void __set_sensor_data(enum sensor_types type, char *data, int len)
         break;
     case sensor_type_pressure:
         qemu_mutex_lock(&pressure_mutex);
-        strcpy(pressure_data, data);
+        strncpy(pressure_data, data, sizeof(pressure_data));
         qemu_mutex_unlock(&pressure_mutex);
         break;
     case sensor_type_pressure_enable:
diff --git a/tizen/src/hw/virtio/maru_virtio_tablet.c b/tizen/src/hw/virtio/maru_virtio_tablet.c
index 5bab39c..41f1154 100644
--- a/tizen/src/hw/virtio/maru_virtio_tablet.c
+++ b/tizen/src/hw/virtio/maru_virtio_tablet.c
@@ -149,6 +149,9 @@ static void maru_tablet_bh(void *opaque)
 
     /* Get a queue buffer which is written by guest side. */
     elem = virtqueue_pop(vt->vq, sizeof(VirtQueueElement));
+    if (!elem) {
+        return;
+    }
 
     qemu_mutex_lock(&vt->mutex);
     while (!QTAILQ_EMPTY(&events_queue)) {
diff --git a/tizen/src/ui/displayglwidget.cpp b/tizen/src/ui/displayglwidget.cpp
index e49e516..9f9dc89 100644
--- a/tizen/src/ui/displayglwidget.cpp
+++ b/tizen/src/ui/displayglwidget.cpp
@@ -220,6 +220,11 @@ DisplayGLWidget::DisplayGLWidget(QWidget *parent,
 
     /* to be enable to drop events */
     setAcceptDrops(true);
+
+
+    mFuncs = NULL;
+    mVAO = NULL;
+    mVBO = NULL;
 }
 
 void DisplayGLWidget::changedTexture(struct dpy_item *item)
diff --git a/tizen/src/ui/input/mousehelper.cpp b/tizen/src/ui/input/mousehelper.cpp
index 61a22f9..8733741 100644
--- a/tizen/src/ui/input/mousehelper.cpp
+++ b/tizen/src/ui/input/mousehelper.cpp
@@ -51,6 +51,9 @@ MouseHelper::MouseHelper(void *parent, QSize resolution)
     this->prevY = 0;
     this->mouseStatus = MOUSE_LEAVE;
     this->lastMouseTime.tv_sec = 0;
+
+    this->tv.tv_sec = 0;
+    this->tv.tv_usec = 0;
 }
 
 void *MouseHelper::getParent()
diff --git a/tizen/src/ui/layout/controllerform.cpp b/tizen/src/ui/layout/controllerform.cpp
index 96e8712..80f4bd1 100644
--- a/tizen/src/ui/layout/controllerform.cpp
+++ b/tizen/src/ui/layout/controllerform.cpp
@@ -31,7 +31,7 @@
 
 ControllerForm::ControllerForm(const QString &name) : LayoutForm(name)
 {
-    /* do nothing */
+    rowCount = -1;
 }
 
 void ControllerForm::setCenteralRect(const QRect &rect)
diff --git a/tizen/src/ui/mainview.cpp b/tizen/src/ui/mainview.cpp
index 22ca25b..a54ba2c 100644
--- a/tizen/src/ui/mainview.cpp
+++ b/tizen/src/ui/mainview.cpp
@@ -40,6 +40,8 @@ MainView::MainView(QGraphicsScene *scene, QWidget *parent) :
     this->win = ((MainWindow *)parent);
     this->grabWinPos = SKINVIEW_NULLITY_POSITION;
     this->kbdHelper = new KeyboardHelper(this);
+
+    bezelItem = NULL;
 }
 
 /* override */
diff --git a/tizen/src/ui/mainwindow.cpp b/tizen/src/ui/mainwindow.cpp
index 0bb8446..d88f61b 100644
--- a/tizen/src/ui/mainwindow.cpp
+++ b/tizen/src/ui/mainwindow.cpp
@@ -273,7 +273,10 @@ void MainWindow::openController(int index, int dockPos)
 
         getFloatingCon()->show();
     } else {
-        getDockingCon()->show(); /* updateGeometry */
+        DockingController* dockingCon = getDockingCon();
+        if (dockingCon != NULL) {
+            dockingCon->show(); /* updateGeometry */
+        }
     }
 
     /* Some part of QGLWidget's surface might be lost on Windows when view changing.
diff --git a/tizen/src/ui/menu/menuitem.cpp b/tizen/src/ui/menu/menuitem.cpp
index 5b13dd7..f872b25 100644
--- a/tizen/src/ui/menu/menuitem.cpp
+++ b/tizen/src/ui/menu/menuitem.cpp
@@ -34,6 +34,8 @@ MenuItem::MenuItem(int type, const QString &name)
     this->type = type;
     this->name = name;
     this->action = NULL;
+
+    slot = NULL;
 }
 
 int MenuItem::getType()
diff --git a/tizen/src/ui/menu/sdbhelper.cpp b/tizen/src/ui/menu/sdbhelper.cpp
index 31d158f..d29e454 100644
--- a/tizen/src/ui/menu/sdbhelper.cpp
+++ b/tizen/src/ui/menu/sdbhelper.cpp
@@ -59,6 +59,9 @@ SdbHelper::SdbHelper(MainWindow *parent, DisplayBase *displaybase)
     this->progressing = false;
 
     connect(this, SIGNAL(geometryChanged(QRect)), this, SLOT(handleGeometryChanged(QRect)));
+
+    progressBar = NULL;
+    process = NULL;
 }
 
 bool SdbHelper::isSdbReady()
diff --git a/tizen/src/ui/menu/sdbhelperthread.cpp b/tizen/src/ui/menu/sdbhelperthread.cpp
index 2de9cc8..1d68109 100644
--- a/tizen/src/ui/menu/sdbhelperthread.cpp
+++ b/tizen/src/ui/menu/sdbhelperthread.cpp
@@ -41,6 +41,9 @@ SdbHelperThread::SdbHelperThread(SdbHelper *parent)
 {
     this->parent = parent;
     connect(this, SIGNAL(errorOccured(QString, int)), this, SLOT(handleErrorOccured(QString, int)));
+
+    process = NULL;
+    command = -1;
 }
 
 void SdbHelperThread::setArguments(int command, QString &program, QList<QStringList> &args)
diff --git a/tizen/src/ui/uiinformation.cpp b/tizen/src/ui/uiinformation.cpp
index f892762..e126022 100644
--- a/tizen/src/ui/uiinformation.cpp
+++ b/tizen/src/ui/uiinformation.cpp
@@ -37,6 +37,8 @@ UiInformation::UiInformation() :
     this->resolution = QSize(0, 0);
     this->vmDataPath = "./";
     this->skinPath = "./";
+
+    mainView = NULL;
 }
 
 void UiInformation::setVmName(QString name) { vmName = name; }
diff --git a/tizen/src/util/device_hotplug.c b/tizen/src/util/device_hotplug.c
index 56f926a..53335bd 100644
--- a/tizen/src/util/device_hotplug.c
+++ b/tizen/src/util/device_hotplug.c
@@ -117,7 +117,9 @@ static bool do_sdcard_attach(const char * const file)
             , file);
     opts = qemu_opts_parse_noisily(&qemu_drive_opts, cmdline, false);
     g_free(cmdline);
-
+    if (!opts) {
+        goto fail_attach;
+    }
     qdict = qemu_opts_to_qdict(opts, NULL);
     qemu_opts_del(opts);
 
diff --git a/tizen/src/util/extra_pkgs_install.c b/tizen/src/util/extra_pkgs_install.c
index 037101a..76694d0 100644
--- a/tizen/src/util/extra_pkgs_install.c
+++ b/tizen/src/util/extra_pkgs_install.c
@@ -97,7 +97,7 @@ static void send_to_emuld(char *addon, char *pkgs)
     char data[MAX_PKG_LIST + MAX_PATH_PKG_LIST];
 
     memset(data, 0, sizeof(data));
-    sprintf(data, "%s, %s", addon, pkgs);
+    snprintf(data, sizeof(data), "%s, %s", addon, pkgs);
 
     data_len = strlen(data) + 1;
     int sndlen = 14 + data_len;
@@ -115,9 +115,7 @@ static void send_to_emuld(char *addon, char *pkgs)
     LOG_TRACE("sndbuf data: %s\n", sndbuf + 14);
 
     ret = send_to_evdi(route_ij, sndbuf, sndlen);
-    if (ret < 0) {
-        LOG_SEVERE("Failed to send emuld message\n");
-    }
+    LOG_TRACE("send_to_evdi return value: %d\n", ret);
 }
 
 #ifdef CONFIG_WIN32
@@ -190,12 +188,12 @@ void epi_init(void)
             memset(addon, 0, sizeof(addon));
             memset(pkgs, 0, sizeof(pkgs));
 
-            strcpy(addon, dir_entry->d_name);
+            strncpy(addon, dir_entry->d_name, sizeof(addon));
 
 #ifndef CONFIG_WIN32
-            sprintf(sub_addon_path, "%s/%s", addon_path, dir_entry->d_name);
+            snprintf(sub_addon_path, sizeof(sub_addon_path), "%s/%s", addon_path, dir_entry->d_name);
 #else
-            sprintf(sub_addon_path, "%s\\%s", addon_path, dir_entry->d_name);
+            snprintf(sub_addon_path, sizeof(sub_addon_path), "%s\\%s", addon_path, dir_entry->d_name);
 #endif
             sub_dir = opendir(sub_addon_path);
             if (!sub_dir) {
diff --git a/tizen/src/util/hds.c b/tizen/src/util/hds.c
index fdb741f..1e4fd56 100644
--- a/tizen/src/util/hds.c
+++ b/tizen/src/util/hds.c
@@ -257,7 +257,7 @@ char *get_hds_lists(void)
     {
         LOG_INFO("list id: %s\n", list->id);
         if (list->attached) {
-            hds_size = sprintf(hds, "%s,%s,%s,%d,\n", list->id, list->host, list->guest, list->level);
+            hds_size = snprintf(hds, sizeof(hds), "%s,%s,%s,%d,\n", list->id, list->host, list->guest, list->level);
             if (strlen(list_hds) + hds_size > list_len) {
                 list_len *= 2;
                 list_hds = g_realloc(list_hds, list_len);
diff --git a/tizen/src/util/net_helper.c b/tizen/src/util/net_helper.c
index 9444a47..e8743ca 100644
--- a/tizen/src/util/net_helper.c
+++ b/tizen/src/util/net_helper.c
@@ -253,7 +253,7 @@ static void send_to_sdb_client(SDB_Client* client, int state)
     serial_len = strlen(client->serial);
 
     // send message "[4 digit message length]host:sync:emulator-26101:[0|1]"
-    sprintf(buf, "%04xhost:sync:%s:%01d", (serial_len + 12), client->serial, state);
+    snprintf(buf, sizeof(buf), "%04xhost:sync:%s:%01d", (serial_len + 12), client->serial, state);
 
     LOG_INFO("send %s to client %s\n", buf, inet_ntoa(client->addr.sin_addr));
 
@@ -314,7 +314,7 @@ static void add_sdb_client(struct sockaddr_in* addr, int port, const char* seria
 
     memcpy(&client->addr, addr, sizeof(struct sockaddr_in));
     client->port = port;
-    strcpy(client->serial, serial);
+    strncpy(client->serial, serial, sizeof(client->serial));
 
     qemu_mutex_lock(&mutex_clients);
 
@@ -421,6 +421,7 @@ static void *get_user_home_path(void *args)
     qemu_mutex_lock(&mutex_request);
 
     if (get_platform_default_home()) {
+        qemu_mutex_unlock(&mutex_request);
         return NULL;
     }
 #ifndef CONFIG_WIN32
@@ -454,9 +455,12 @@ static void *get_user_home_path(void *args)
         if (fp == NULL) {
             LOG_WARNING("Failed to run command\n");
             g_free(cmd_root_off);
+            cmd_root_off = NULL;
             break;
         }
-        g_free(cmd_root_off);
+        if (cmd_root_off != NULL) {
+            g_free(cmd_root_off);
+        }
         pclose(fp);
 
         fp = popen(cmd_get_home, "r");
@@ -665,6 +669,8 @@ static void start_sdb_noti_server(int server_port)
     if (ret < 0) {
         LOG_INFO("failed to create UDP server\n");
         close_server();
+        g_free(server);
+        server = NULL;
         return;
     }
 
diff --git a/tizen/src/util/tap_helper.c b/tizen/src/util/tap_helper.c
index be8564a..e0fee57 100644
--- a/tizen/src/util/tap_helper.c
+++ b/tizen/src/util/tap_helper.c
@@ -87,8 +87,9 @@ void tap_create(char *ifname)
     struct ifreq ifr;
     char dname[128];
     int cause;
-
-    ifname[0] = '\0';
+    if (ifname != NULL) {
+        ifname[0] = '\0';
+    }
 
     memset(&ifr, 0, sizeof(ifr));
     ifr.ifr_flags = IFF_TAP | IFF_NO_PI;