lxcfs/0009-set-null-after-free.patch

diff --git a/bindings.c b/bindings.c
index 9b9f180..b921d7e 100644
--- a/bindings.c
+++ b/bindings.c
@@ -192,6 +192,7 @@ static void remove_initpid(struct pidns_init_store *e)
 	if (pidns_hash_table[h] == e) {
 		pidns_hash_table[h] = e->next;
 		free(e);
+		e = NULL;
 		return;
 	}
 
@@ -200,6 +201,7 @@ static void remove_initpid(struct pidns_init_store *e)
 		if (tmp->next == e) {
 			tmp->next = e->next;
 			free(e);
+			e = NULL;
 			return;
 		}
 		tmp = tmp->next;
@@ -241,6 +243,7 @@ static void prune_initpid_store(void)
 					pidns_hash_table[i] = e->next;
 				e = e->next;
 				free(delme);
+				delme = NULL;
 			} else {
 				prev = e;
 				e = e->next;
@@ -337,7 +340,7 @@ char * dorealloc(char *mem, size_t oldlen, size_t newlen)
 	int oldbatches = (oldlen / BATCH_SIZE) + 1;
 
 	if (!mem || newbatches > oldbatches) {
-		char *tmp;
+		char *tmp = NULL;
 		do {
 			tmp = realloc(mem, newbatches * BATCH_SIZE);
 		} while (!tmp);
@@ -347,7 +350,7 @@ char * dorealloc(char *mem, size_t oldlen, size_t newlen)
 }
 char * append_line(char *contents, size_t *len, char *line, ssize_t linelen)
 {
-	char *tmp;
+	char *tmp = NULL;
 	size_t newlen = *len + linelen;
 	tmp = dorealloc(contents, *len, newlen + 1);
 	memcpy(tmp + *len, line, linelen+1);
@@ -490,7 +493,7 @@ bool cgfs_set_value(const char *controller, const char *cgroup, const char *file
 	int ret, fd, cfd;
 	bool ret_bool;
 	size_t len;
-	char *fnam, *tmpc;
+	char *fnam = NULL, *tmpc = NULL;
 
 	tmpc = find_mounted_controller(controller, &cfd);
 	if (!tmpc)
@@ -507,17 +510,20 @@ bool cgfs_set_value(const char *controller, const char *cgroup, const char *file
 	ret = snprintf(fnam, len, "%s%s/%s", *cgroup == '/' ? "." : "", cgroup, file);
 	if (ret < 0 || (size_t)ret >= len) {
 		free(fnam);
+		fnam = NULL;
 		return false;
 	}
 
 	fd = openat(cfd, fnam, O_WRONLY);
 	if (fd < 0) {
 		free(fnam);
+		fnam = NULL;
 		return false;
 	}
 
 	ret_bool = write_string(fnam, value, fd);
 	free(fnam);
+	fnam = NULL;
 	return ret_bool;
 }
 
@@ -565,7 +571,7 @@ int cgfs_create(const char *controller, const char *cg, uid_t uid, gid_t gid)
 {
 	int cfd;
 	size_t len;
-	char *dirnam, *tmpc;
+	char *dirnam = NULL, *tmpc = NULL;
 
 	tmpc = find_mounted_controller(controller, &cfd);
 	if (!tmpc)
@@ -655,7 +661,7 @@ bool cgfs_remove(const char *controller, const char *cg)
 {
 	int fd, cfd;
 	size_t len;
-	char *dirnam, *tmpc;
+	char *dirnam = NULL, *tmpc = NULL;
 	bool bret;
 
 	tmpc = find_mounted_controller(controller, &cfd);
@@ -682,7 +688,7 @@ bool cgfs_chmod_file(const char *controller, const char *file, mode_t mode)
 {
 	int cfd;
 	size_t len;
-	char *pathname, *tmpc;
+	char *pathname = NULL, *tmpc = NULL;
 
 	tmpc = find_mounted_controller(controller, &cfd);
 	if (!tmpc)
@@ -702,7 +708,7 @@ bool cgfs_chmod_file(const char *controller, const char *file, mode_t mode)
 static int chown_tasks_files(const char *dirname, uid_t uid, gid_t gid, int fd)
 {
 	size_t len;
-	char *fname;
+	char *fname = NULL;
 
 	len = strlen(dirname) + strlen("/cgroup.procs") + 1;
 	fname = alloca(len);
@@ -719,7 +725,7 @@ int cgfs_chown_file(const char *controller, const char *file, uid_t uid, gid_t g
 {
 	int cfd;
 	size_t len;
-	char *pathname, *tmpc;
+	char *pathname = NULL, *tmpc = NULL;
 
 	tmpc = find_mounted_controller(controller, &cfd);
 	if (!tmpc)
@@ -745,7 +751,7 @@ FILE *open_pids_file(const char *controller, const char *cgroup)
 {
 	int fd, cfd;
 	size_t len;
-	char *pathname, *tmpc;
+	char *pathname = NULL, *tmpc = NULL;
 
 	tmpc = find_mounted_controller(controller, &cfd);
 	if (!tmpc)
@@ -771,7 +777,7 @@ static bool cgfs_iterate_cgroup(const char *controller, const char *cgroup, bool
 {
 	int cfd, fd, ret;
 	size_t len;
-	char *cg, *tmpc;
+	char *cg = NULL, *tmpc = NULL;
 	char pathname[MAXPATHLEN];
 	size_t sz = 0, asz = 0;
 	struct dirent *dirent;
@@ -842,7 +848,7 @@ static bool cgfs_iterate_cgroup(const char *controller, const char *cgroup, bool
 
 static void *make_children_list_entry(const char *controller, const char *cgroup, const char *dir_entry)
 {
-	char *dup;
+	char *dup = NULL;
 	do {
 		dup = strdup(dir_entry);
 	} while (!dup);
@@ -859,7 +865,9 @@ void free_key(struct cgfs_files *k)
 	if (!k)
 		return;
 	free(k->name);
+	k->name = NULL;
 	free(k);
+	k = NULL;
 }
 
 void free_keys(struct cgfs_files **keys)
@@ -872,13 +880,14 @@ void free_keys(struct cgfs_files **keys)
 		free_key(keys[i]);
 	}
 	free(keys);
+	keys = NULL;
 }
 
 char * cgfs_get_value(const char *controller, const char *cgroup, const char *file)
 {
 	int ret, fd, cfd;
 	size_t len;
-	char *fnam, *tmpc, *value;
+	char *fnam = NULL, *tmpc = NULL, *value = NULL;
 
 	tmpc = find_mounted_controller(controller, &cfd);
 	if (!tmpc)
@@ -895,16 +904,19 @@ char * cgfs_get_value(const char *controller, const char *cgroup, const char *fi
 	ret = snprintf(fnam, len, "%s%s/%s", *cgroup == '/' ? "." : "", cgroup, file);
 	if (ret < 0 || (size_t)ret >= len) {
 		free(fnam);
+		fnam = NULL;
 		return NULL;
 	}
 
 	fd = openat(cfd, fnam, O_RDONLY);
 	if (fd < 0) {
 		free(fnam);
+		fnam = NULL;
 		return NULL;
 	}
 
 	free(fnam);
+	fnam = NULL;
 	lock_mutex(&slurp_file_mutex);
 	value = slurp_file(fd);
 	unlock_mutex(&slurp_file_mutex);
@@ -915,7 +927,7 @@ struct cgfs_files *cgfs_get_key(const char *controller, const char *cgroup, cons
 {
 	int ret, cfd;
 	size_t len;
-	char *fnam, *tmpc;
+	char *fnam = NULL, *tmpc = NULL;
 	struct stat sb;
 	struct cgfs_files *newkey;
 
@@ -978,7 +990,7 @@ bool is_child_cgroup(const char *controller, const char *cgroup, const char *f)
 {
 	int cfd;
 	size_t len;
-	char *fnam, *tmpc;
+	char *fnam = NULL, *tmpc = NULL;
 	int ret;
 	struct stat sb;
 
@@ -1165,7 +1177,7 @@ static void must_strcat_pid(char **src, size_t *sz, size_t *asz, pid_t pid)
 	int tmplen = sprintf(tmp, "%d\n", (int)pid);
 
 	if (!*src || tmplen + *sz + 1 >= *asz) {
-		char *tmp;
+		char *tmp = NULL;
 		do {
 			tmp = realloc(*src, *asz + BUF_RESERVE_SIZE);
 		} while (!tmp);
@@ -1304,7 +1316,7 @@ static bool perms_include(int fmode, mode_t req_mode)
  */
 static char *get_next_cgroup_dir(const char *taskcg, const char *querycg)
 {
-	char *start, *end;
+	char *start = NULL, *end = NULL;
 
 	if (strlen(taskcg) <= strlen(querycg)) {
 		lxcfs_error("%s\n", "I was fed bad input.");
@@ -1374,6 +1386,7 @@ static char *get_pid_cgroup(pid_t pid, const char *contrl)
 out:
 	fclose(f);
 	free(line);
+	line = NULL;
 	return answer;
 }
 
@@ -1419,7 +1432,7 @@ out:
 #define INITSCOPE "/init.scope"
 static void prune_init_slice(char *cg)
 {
-	char *point;
+	char *point = NULL;
 	size_t cg_len = strlen(cg), initscope_len = strlen(INITSCOPE);
 
 	if (cg_len < initscope_len)
@@ -1445,7 +1458,7 @@ static bool caller_is_in_ancestor(pid_t pid, const char *contrl, const char *cg,
 {
 	bool answer = false;
 	char *c2 = get_pid_cgroup(pid, contrl);
-	char *linecmp;
+	char *linecmp = NULL;
 
 	if (!c2)
 		return false;
@@ -1474,6 +1487,7 @@ static bool caller_is_in_ancestor(pid_t pid, const char *contrl, const char *cg,
 
 out:
 	free(c2);
+	c2 = NULL;
 	return answer;
 }
 
@@ -1483,7 +1497,7 @@ out:
 static bool caller_may_see_dir(pid_t pid, const char *contrl, const char *cg)
 {
 	bool answer = false;
-	char *c2, *task_cg;
+	char *c2 = NULL, *task_cg = NULL;
 	size_t target_len, task_len;
 
 	if (strcmp(cg, "/") == 0 || strcmp(cg, "./") == 0)
@@ -1525,6 +1539,7 @@ static bool caller_may_see_dir(pid_t pid, const char *contrl, const char *cg)
 
 out:
 	free(c2);
+	c2 = NULL;
 	return answer;
 }
 
@@ -1535,7 +1550,7 @@ out:
 static char *pick_controller_from_path(struct fuse_context *fc, const char *path)
 {
 	const char *p1;
-	char *contr, *slash;
+	char *contr = NULL, *slash = NULL;
 
 	if (strlen(path) < 9) {
 		errno = EACCES;
@@ -1570,7 +1585,7 @@ static char *pick_controller_from_path(struct fuse_context *fc, const char *path
  */
 static const char *find_cgroup_in_path(const char *path)
 {
-	const char *p1;
+	const char *p1 = NULL;
 
 	if (strlen(path) < 9) {
 		errno = EACCES;
@@ -1591,7 +1606,7 @@ static const char *find_cgroup_in_path(const char *path)
 */
 static void get_cgdir_and_path(const char *cg, char **dir, char **last)
 {
-	char *p;
+	char *p = NULL;
 
 	do {
 		*dir = strdup(cg);
@@ -1614,9 +1629,9 @@ int cg_getattr(const char *path, struct stat *sb)
 	struct timespec now;
 	struct fuse_context *fc = fuse_get_context();
 	char * cgdir = NULL;
-	char *last = NULL, *path1, *path2;
+	char *last = NULL, *path1 = NULL, *path2 = NULL;
 	struct cgfs_files *k = NULL;
-	const char *cgroup;
+	const char *cgroup = NULL;
 	const char *controller = NULL;
 	int ret = -ENOENT;
 
@@ -1716,14 +1731,15 @@ int cg_getattr(const char *path, struct stat *sb)
 
 out:
 	free(cgdir);
+	cgdir = NULL;
 	return ret;
 }
 
 int cg_opendir(const char *path, struct fuse_file_info *fi)
 {
 	struct fuse_context *fc = fuse_get_context();
-	const char *cgroup;
-	struct file_info *dir_info;
+	const char *cgroup = NULL;
+	struct file_info *dir_info = NULL;
 	char *controller = NULL;
 
 	if (!fc)
@@ -1847,9 +1863,12 @@ int cg_readdir(const char *path, void *buf, fuse_fill_dir_t filler, off_t offset
 out:
 	free_keys(list);
 	if (clist) {
-		for (i = 0; clist[i]; i++)
+		for (i = 0; clist[i]; i++) {
 			free(clist[i]);
+			clist[i] = NULL;
+		}
 		free(clist);
+		clist = NULL;
 	}
 	return ret;
 }
@@ -1858,7 +1877,7 @@ static void do_release_file_info(struct fuse_file_info *fi)
 {
 	struct file_info *f = (struct file_info *)fi->fh;
 
-	if (!f)
+	if (!f || !f->buf)
 		return;
 
 	fi->fh = 0;
@@ -1946,6 +1965,7 @@ int cg_open(const char *path, struct fuse_file_info *fi)
 
 out:
 	free(cgdir);
+	cgdir = NULL;
 	return ret;
 }
 
@@ -2010,6 +2030,7 @@ int cg_access(const char *path, int mode)
 
 out:
 	free(cgdir);
+	cgdir = NULL;
 	return ret;
 }
 
@@ -2304,6 +2325,7 @@ bool do_read_pids(pid_t tpid, const char *contrl, const char *cg, const char *fi
 	if (socketpair(AF_UNIX, SOCK_DGRAM, 0, sock) < 0) {
 		perror("socketpair");
 		free(tmpdata);
+		tmpdata = NULL;
 		return false;
 	}
 
@@ -2355,6 +2377,7 @@ next:
 
 out:
 	free(tmpdata);
+	tmpdata = NULL;
 	if (cpid != -1)
 		wait_for_pid(cpid);
 	if (sock[0] != -1) {
@@ -2430,6 +2453,7 @@ int cg_read(const char *path, char *buf, size_t size, off_t offset,
 
 out:
 	free(data);
+	data = NULL;
 	return ret;
 }
 
@@ -2517,7 +2541,7 @@ static void pid_from_ns_wrapper(int sock, pid_t tpid)
  */
 bool hostuid_to_ns(uid_t uid, pid_t pid, uid_t *answer)
 {
-	FILE *f;
+	FILE *f = NULL;
 	char line[400];
 
 	sprintf(line, "/proc/%d/uid_map", pid);
@@ -2790,6 +2814,7 @@ int cg_chown(const char *path, uid_t uid, gid_t gid)
 out:
 	free_key(k);
 	free(cgdir);
+	cgdir = NULL;
 
 	return ret;
 }
@@ -2860,6 +2885,7 @@ int cg_chmod(const char *path, mode_t mode)
 out:
 	free_key(k);
 	free(cgdir);
+	cgdir = NULL;
 	return ret;
 }
 
@@ -2913,7 +2939,9 @@ int cg_mkdir(const char *path, mode_t mode)
 
 out:
 	free(cgdir);
+	cgdir = NULL;
 	free(next);
+	next = NULL;
 	return ret;
 }
 
@@ -2974,7 +3002,9 @@ int cg_rmdir(const char *path)
 
 out:
 	free(cgdir);
+	cgdir = NULL;
 	free(next);
+	next = NULL;
 	return ret;
 }
 
@@ -2990,7 +3020,7 @@ static void parse_memstat(char *memstat, unsigned long *cached,
 		unsigned long *active_file, unsigned long *inactive_file,
 		unsigned long *unevictable, unsigned long *shmem)
 {
-	char *eol;
+	char *eol = NULL;
 
 	while (*memstat) {
 		if (startswith(memstat, "total_cache")) {
@@ -3024,7 +3054,7 @@ static void parse_memstat(char *memstat, unsigned long *cached,
 
 static void get_blkio_io_value(char *str, unsigned major, unsigned minor, char *iotype, unsigned long *v)
 {
-	char *eol;
+	char *eol = NULL;
 	char key[32];
 
 	memset(key, 0, 32);
@@ -3083,6 +3113,7 @@ static int read_file(const char *path, char *buf, size_t size,
   err:
 	fclose(f);
 	free(line);
+	line = NULL;
 	return rv;
 }
 
@@ -3099,6 +3130,7 @@ static unsigned long get_memlimit(const char *cgroup, const char *file)
 		memlimit = strtoul(memlimit_str, NULL, 10);
 
 	free(memlimit_str);
+	memlimit_str = NULL;
 
 	return memlimit;
 }
@@ -3128,7 +3160,7 @@ static int proc_meminfo_read(char *buf, size_t size, off_t offset,
 {
 	struct fuse_context *fc = fuse_get_context();
 	struct file_info *d = (struct file_info *)fi->fh;
-	char *cg;
+	char *cg = NULL;
 	char *memusage_str = NULL, *memstat_str = NULL, *memswusage_str = NULL;
 	unsigned long memlimit = 0, memusage = 0, memswlimit = 0, memswusage = 0,
 		cached = 0, hosttotal = 0, active_anon = 0, inactive_anon = 0,
@@ -3190,7 +3222,7 @@ static int proc_meminfo_read(char *buf, size_t size, off_t offset,
 	if (!f)
 		goto err;
 
-	char *printme, lbuf[100];
+	char *printme = NULL, lbuf[100];
 	while (getline(&line, &linelen, f) != -1) {
 		ssize_t l;
 
@@ -3300,10 +3332,15 @@ err:
 	if (f)
 		fclose(f);
 	free(line);
+	line = NULL;
 	free(cg);
+	cg = NULL;
 	free(memusage_str);
+	memusage_str = NULL;
 	free(memswusage_str);
+	memswusage_str = NULL;
 	free(memstat_str);
+	memstat_str = NULL;
 	return rv;
 }
 
@@ -3348,7 +3385,7 @@ static int proc_cpuinfo_read(char *buf, size_t size, off_t offset,
 {
 	struct fuse_context *fc = fuse_get_context();
 	struct file_info *d = (struct file_info *)fi->fh;
-	char *cg;
+	char *cg = NULL;
 	char *cpuset = NULL;
 	char *line = NULL;
 	size_t linelen = 0, total_len = 0, rv = 0;
@@ -3418,7 +3455,7 @@ static int proc_cpuinfo_read(char *buf, size_t size, off_t offset,
 			}
 			continue;
 		} else if (is_s390x && sscanf(line, "processor %d:", &cpu) == 1) {
-			char *p;
+			char *p = NULL;
 			if (!cpu_in_cpuset(cpu, cpuset))
 				continue;
 			curcpu ++;
@@ -3483,6 +3520,7 @@ static int proc_cpuinfo_read(char *buf, size_t size, off_t offset,
 		l = snprintf(cache, cache_size, "vendor_id       : IBM/S390\n");
 		if (l < 0 || l >= cache_size) {
 			free(origcache);
+			origcache = NULL;
 			goto err;
 		}
 		cache_size -= l;
@@ -3491,6 +3529,7 @@ static int proc_cpuinfo_read(char *buf, size_t size, off_t offset,
 		l = snprintf(cache, cache_size, "# processors    : %d\n", curcpu + 1);
 		if (l < 0 || l >= cache_size) {
 			free(origcache);
+			origcache = NULL;
 			goto err;
 		}
 		cache_size -= l;
@@ -3498,6 +3537,7 @@ static int proc_cpuinfo_read(char *buf, size_t size, off_t offset,
 		total_len += l;
 		l = snprintf(cache, cache_size, "%s", origcache);
 		free(origcache);
+		origcache = NULL;
 		if (l < 0 || l >= cache_size)
 			goto err;
 		total_len += l;
@@ -3514,8 +3554,11 @@ err:
 	if (f)
 		fclose(f);
 	free(line);
+	line = NULL;
 	free(cpuset);
+	cpuset = NULL;
 	free(cg);
+	cg = NULL;
 	return rv;
 }
 
@@ -3655,7 +3698,7 @@ static int proc_stat_read(char *buf, size_t size, off_t offset,
 {
 	struct fuse_context *fc = fuse_get_context();
 	struct file_info *d = (struct file_info *)fi->fh;
-	char *cg;
+	char *cg = NULL;
 	char *cpuset = NULL;
 	char *line = NULL;
 	size_t linelen = 0, total_len = 0, rv = 0;
@@ -3706,7 +3749,7 @@ static int proc_stat_read(char *buf, size_t size, off_t offset,
 		ssize_t l;
 		int cpu;
 		char cpu_char[10]; /* That's a lot of cores */
-		char *c;
+		char *c = NULL;
 
 		if (strlen(line) == 0)
 			continue;
@@ -3815,8 +3858,11 @@ err:
 	if (f)
 		fclose(f);
 	free(line);
+	line = NULL;
 	free(cpuset);
+	cpuset = NULL;
 	free(cg);
+	cg = NULL;
 	return rv;
 }
 
@@ -3847,7 +3893,9 @@ static unsigned long get_reaper_busy(pid_t task)
 
 out:
 	free(cgroup);
+	cgroup = NULL;
 	free(usage_str);
+	usage_str = NULL;
 	return usage;
 }
 
@@ -3939,7 +3987,7 @@ struct devinfo* container_dev_read(pid_t pid) {
 	pid_t child_pid;
 	int mypipe[2];
 	int dev_num;
-	FILE *stream;
+	FILE *stream[2];
 
 	if (pipe(mypipe) < 0) {
 		perror("Error creating pipe");
@@ -3955,8 +4003,8 @@ struct devinfo* container_dev_read(pid_t pid) {
 	}
 	if (child_pid == 0) {
 		close(mypipe[0]);
-		stream = fdopen(mypipe[1], "w");
-		if (stream == NULL) {
+		stream[1] = fdopen(mypipe[1], "w");
+		if (stream[1] == NULL) {
 			lxcfs_error("Error opening pipe for writing: %s\n", strerror(errno));
 			goto child_out;
 		}
@@ -3981,26 +4029,26 @@ struct devinfo* container_dev_read(pid_t pid) {
 			memset(fpath, 0, sizeof(fpath));
 			snprintf(fpath, 99, "/dev/%s", ptr->d_name);
 			stat(fpath, &dev_stat);
-			fprintf(stream, "%s %d ", ptr->d_name, dev_stat.st_rdev);
-			fflush(stream);
+			fprintf(stream[1], "%s %d ", ptr->d_name, dev_stat.st_rdev);
+			fflush(stream[1]);
 		}
 		closedir(dir);
 		stat("/", &dev_stat);
 		dev_num = dev_stat.st_dev & (~0xf);
-		fprintf(stream, "sda %d end 0 ", dev_num);
-		fflush(stream);
-		fclose(stream);
+		fprintf(stream[1], "sda %d end 0 ", dev_num);
+		fflush(stream[1]);
+child_out:
+		fclose(stream[1]);
 		exit(0);
 	}
 
-child_out:
 	close(mypipe[1]);
-	stream = fdopen(mypipe[0], "r");
-	if (stream == NULL) {
+	stream[0] = fdopen(mypipe[0], "r");
+	if (stream[0] == NULL) {
 		lxcfs_error("Error opening pipe for reading: %s\n", strerror(errno));
 		goto err;
 	}
-	while (fscanf(stream, "%100s%d", dev_name, &dev_num) == 2) {
+	while (fscanf(stream[0], "%100s%d", dev_name, &dev_num) == 2) {
 			if (dev_num == 0) {
 				break;
 			}
@@ -4021,8 +4069,8 @@ child_out:
 			end->minor = dev_num & 0x00ff;
 	}
 err:
-	if (stream)
-		fclose(stream);
+	if (stream[0])
+		fclose(stream[0]);
 	if (child_pid > 0)
 		wait_for_pid(child_pid);
 	return head;
@@ -4035,7 +4083,9 @@ void free_devinfo_list(struct devinfo *ptr)
 		tmp = ptr;
 		ptr = ptr->next;
 		free(tmp->name);
+		tmp->name = NULL;
 		free(tmp);
+		tmp = NULL;
 	}
 }
 
@@ -4046,7 +4096,7 @@ static int proc_diskstats_read(char *buf, size_t size, off_t offset,
 	struct fuse_context *fc = fuse_get_context();
 	struct file_info *d = (struct file_info *)fi->fh;
 	struct devinfo *container_devinfo = NULL, *ptr;
-	char *cg;
+	char *cg = NULL;
 	char *io_serviced_str = NULL, *io_merged_str = NULL, *io_service_bytes_str = NULL,
 			*io_wait_time_str = NULL, *io_service_time_str = NULL;
 	unsigned long read = 0, write = 0;
@@ -4174,11 +4224,17 @@ err:
 	if (f)
 		fclose(f);
 	free(line);
+	line = NULL;
 	free(io_serviced_str);
+	io_serviced_str = NULL;
 	free(io_merged_str);
+	io_merged_str = NULL;
 	free(io_service_bytes_str);
+	io_service_bytes_str = NULL;
 	free(io_wait_time_str);
+	io_wait_time_str = NULL;
 	free(io_service_time_str);
+	io_service_time_str = NULL;
 	free_devinfo_list(container_devinfo);
 	return rv;
 }
@@ -4256,6 +4312,7 @@ static int proc_swaps_read(char *buf, size_t size, off_t offset,
 		}
 
 		free(line);
+		line = NULL;
 		fclose(f);
 	}
 
@@ -4281,8 +4338,11 @@ static int proc_swaps_read(char *buf, size_t size, off_t offset,
 
 err:
 	free(cg);
+	cg = NULL;
 	free(memusage_str);
+	memusage_str = NULL;
 	free(memswusage_str);
+	memswusage_str = NULL;
 	return rv;
 }
 
@@ -4299,6 +4359,7 @@ static off_t get_procfile_size(const char *which)
 		answer += sz;
 	fclose (f);
 	free(line);
+	line = NULL;
 
 	return answer;
 }
@@ -4352,6 +4413,8 @@ int proc_open(const char *path, struct fuse_file_info *fi)
 	int type = -1;
 	struct file_info *info;
 
+	fi->fh = 0;
+
 	if (strcmp(path, "/proc/meminfo") == 0)
 		type = LXC_TYPE_PROC_MEMINFO;
 	else if (strcmp(path, "/proc/cpuinfo") == 0)
@@ -4437,7 +4500,7 @@ static bool mkdir_p(const char *dir, mode_t mode)
 {
 	const char *tmp = dir;
 	const char *orig = dir;
-	char *makeme;
+	char *makeme = NULL;
 
 	do {
 		dir = tmp + strspn(tmp, "/");
@@ -4452,6 +4515,7 @@ static bool mkdir_p(const char *dir, mode_t mode)
 			return false;
 		}
 		free(makeme);
+		makeme = NULL;
 	} while(tmp != dir);
 
 	return true;
@@ -4482,8 +4546,8 @@ static bool has_fs_type(const struct statfs *fs, fs_type_magic magic_val)
  */
 static bool is_on_ramfs(void)
 {
-	FILE *f;
-	char *p, *p2;
+	FILE *f = NULL;
+	char *p = NULL, *p2 = NULL;
 	char *line = NULL;
 	size_t len = 0;
 	int i;
@@ -4506,12 +4570,14 @@ static bool is_on_ramfs(void)
 			p = strchr(p2 + 1, '-');
 			if (p && strncmp(p, "- rootfs rootfs ", 16) == 0) {
 				free(line);
+				line = NULL;
 				fclose(f);
 				return true;
 			}
 		}
 	}
 	free(line);
+	line = NULL;
 	fclose(f);
 	return false;
 }
@@ -4709,7 +4775,7 @@ static bool cgfs_prepare_mounts(void)
 
 static bool cgfs_mount_hierarchies(void)
 {
-	char *target;
+	char *target = NULL;
 	size_t clen, len;
 	int i, ret;
 
@@ -4725,10 +4791,12 @@ static bool cgfs_mount_hierarchies(void)
 		ret = snprintf(target, len, "%s/%s", BASEDIR, controller);
 		if (ret < 0 || ret >= len) {
 			free(target);
+			target = NULL;
 			return false;
 		}
 		if (mkdir(target, 0755) < 0 && errno != EEXIST) {
 			free(target);
+			target = NULL;
 			return false;
 		}
 		if (!strcmp(controller, "unified"))
@@ -4738,15 +4806,18 @@ static bool cgfs_mount_hierarchies(void)
 		if (ret < 0) {
 			lxcfs_error("Failed mounting cgroup %s: %s\n", controller, strerror(errno));
 			free(target);
+			target = NULL;
 			return false;
 		}
 
 		fd_hierarchies[i] = open(target, O_DIRECTORY);
 		if (fd_hierarchies[i] < 0) {
 			free(target);
+			target = NULL;
 			return false;
 		}
 		free(target);
+		target = NULL;
 	}
 	return true;
 }
@@ -4770,7 +4841,7 @@ static bool cgfs_setup_controllers(void)
 static void __attribute__((constructor)) collect_and_mount_subsystems(void)
 {
 	FILE *f;
-	char *cret, *line = NULL;
+	char *cret = NULL, *line = NULL;
 	char cwd[MAXPATHLEN];
 	size_t len = 0;
 	int i, init_ns = -1;
@@ -4782,7 +4853,7 @@ static void __attribute__((constructor)) collect_and_mount_subsystems(void)
 	}
 
 	while (getline(&line, &len, f) != -1) {
-		char *idx, *p, *p2;
+		char *idx = NULL, *p = NULL, *p2 = NULL;
 
 		p = strchr(line, ':');
 		if (!p)
@@ -4848,6 +4919,7 @@ static void __attribute__((constructor)) collect_and_mount_subsystems(void)
 
 out:
 	free(line);
+	line = NULL;
 	fclose(f);
 	if (init_ns >= 0)
 		close(init_ns);
@@ -4860,13 +4932,17 @@ static void __attribute__((destructor)) free_subsystems(void)
 	lxcfs_debug("%s\n", "Running destructor for liblxcfs.");
 
 	for (i = 0; i < num_hierarchies; i++) {
-		if (hierarchies[i])
+		if (hierarchies[i]) {
 			free(hierarchies[i]);
+			hierarchies[i] = NULL;
+		}
 		if (fd_hierarchies && fd_hierarchies[i] >= 0)
 			close(fd_hierarchies[i]);
 	}
 	free(hierarchies);
+	hierarchies = NULL;
 	free(fd_hierarchies);
+	fd_hierarchies = NULL;
 
 	if (cgroup_mount_ns_fd >= 0)
 		close(cgroup_mount_ns_fd);