cleanup

3 files changed, 8 insertions, 2 deletions

diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index 8a402f692..1fd1fb675 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -494,6 +494,7 @@ void fs_whitelist(void) {
                                         printf("\"%s\" disabled by --private\n", entry->data);
 
                                 entry->data = EMPTY_STRING;
+                                free(fname);
                                 continue;
                         }
 
@@ -638,6 +639,7 @@ void fs_whitelist(void) {
                         }
                 }
                 else {
+                        free(fname);
                         goto errexit;
                 }
 
diff --git a/src/firejail/sbox.c b/src/firejail/sbox.c
index c11daad58..1c6f3c327 100644
--- a/src/firejail/sbox.c
+++ b/src/firejail/sbox.c
@@ -142,8 +142,10 @@ int sbox_run(unsigned filter, int num, ...) {
                 }
                 else if ((filter & SBOX_ALLOW_STDIN) == 0) {
                         int fd = open("/dev/null",O_RDWR, 0);
-                        if (fd != -1)
+                        if (fd != -1) {
                                 dup2(fd, STDIN_FILENO);
+                                close(fd);
+                        }
                         else // the user could run the sandbox without /dev/null
                                 close(STDIN_FILENO);
                 }
diff --git a/src/libpostexecseccomp/libpostexecseccomp.c b/src/libpostexecseccomp/libpostexecseccomp.c
index 6d2c8c695..de64d50c5 100644
--- a/src/libpostexecseccomp/libpostexecseccomp.c
+++ b/src/libpostexecseccomp/libpostexecseccomp.c
@@ -32,6 +32,8 @@ static void load_seccomp(void) {
                 return;
 
         off_t size = lseek(fd, 0, SEEK_END);
+        if (size <= 0)
+                return;
         unsigned short entries = (unsigned short) size / (unsigned short) sizeof(struct sock_filter);
         struct sock_filter *filter = MAP_FAILED;
         if (size != 0)
@@ -39,7 +41,7 @@ static void load_seccomp(void) {
 
         close(fd);
 
-        if (size == 0 || filter == MAP_FAILED)
+        if (filter == MAP_FAILED)
                 return;
 
         // install filter