5 files changed, 77 insertions, 57 deletions

diff --git a/linden/indra/lscript/lscript_alloc.h b/linden/indra/lscript/lscript_alloc.h
index b195e3a..8179446 100644
--- a/linden/indra/lscript/lscript_alloc.h
+++ b/linden/indra/lscript/lscript_alloc.h
@@ -287,7 +287,9 @@ inline LLScriptLibData *lsa_bubble_sort(LLScriptLibData *src, S32 stride, S32 as
 
         src->mListp = NULL;
 
-        return sortarray[0];
+        temp = sortarray[0];
+        delete[] sortarray;
+        return temp;
 }
 
 
diff --git a/linden/indra/lscript/lscript_compile/lscript_tree.cpp b/linden/indra/lscript/lscript_compile/lscript_tree.cpp
index 1d7cc7b..df679ed 100644
--- a/linden/indra/lscript/lscript_compile/lscript_tree.cpp
+++ b/linden/indra/lscript/lscript_compile/lscript_tree.cpp
@@ -9936,6 +9936,8 @@ void LLScriptScript::recurse(FILE *fp, S32 tabs, S32 tabsize, LSCRIPTCompilePass
                         
                         code->build(fp, bcfp);
                         fclose(bcfp);
+                                                                           
+                        delete code;
                 }
                 break;
         case LSCP_EMIT_CIL_ASSEMBLY:
diff --git a/linden/indra/lscript/lscript_execute/lscript_execute.cpp b/linden/indra/lscript/lscript_execute/lscript_execute.cpp
index cc2c141..4d8389a 100644
--- a/linden/indra/lscript/lscript_execute/lscript_execute.cpp
+++ b/linden/indra/lscript/lscript_execute/lscript_execute.cpp
@@ -1,4 +1,4 @@
-/** 
+/**
  * @file lscript_execute.cpp
  * @brief classes to execute bytecode
  *
@@ -75,7 +75,7 @@ LLScriptExecute::LLScriptExecute(FILE *fp)
 
 LLScriptExecute::LLScriptExecute(U8 *buffer)
 {
-        mBuffer = buffer; 
+        mBuffer = buffer;
 
         init();
 }
@@ -1001,7 +1001,7 @@ BOOL run_loadgsp(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
         S32 address = lscript_global_get(buffer, arg);
         if (address)
                 lsa_decrease_ref_count(buffer, address);
-        
+
         lscript_global_store(buffer, arg, value);
         return FALSE;
 }
@@ -1019,7 +1019,7 @@ BOOL run_loadglp(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
         S32 address = lscript_global_get(buffer, arg);
         if (address)
                 lsa_decrease_ref_count(buffer, address);
-        
+
         lscript_global_store(buffer, arg, value);
         return FALSE;
 }
@@ -1386,14 +1386,31 @@ void integer_integer_operation(U8 *buffer, LSCRIPTOpCodesEnum opcode)
                 result = lside * rside;
                 break;
         case LOPC_DIV:
-                if (rside)
-                        result = lside / rside;
+                if (rside){
+                        if( ( rside == -1 ) || ( rside == 0xffffffff ) )//      division by -1 can have funny results: multiplication is OK: SL-31252
+                        {
+                                result = -1 * lside;
+                        }
+                        else
+                        {
+                                result = lside / rside;
+                        }
+                }
                 else
                         set_fault(buffer, LSRF_MATH);
                 break;
         case LOPC_MOD:
                 if (rside)
-                        result = lside % rside;
+                {
+                        if (rside == -1 || rside == 1 )  // mod(1) = mod(-1) = 0: SL-31252
+                        {
+                                result = 0;
+                        }
+                        else
+                        {
+                                result = lside % rside;
+                        }
+                }
                 else
                         set_fault(buffer, LSRF_MATH);
                 break;
@@ -2945,14 +2962,14 @@ BOOL run_return(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
         return FALSE;
 }
 
-S32 axtoi(char *hexStg) 
+S32 axtoi(char *hexStg)
 {
   S32 n = 0;         // position in string
   S32 m = 0;         // position in digit[] to shift
   S32 count;         // loop index
   S32 intValue = 0;  // integer value of hex string
   S32 digit[9];      // hold values to convert
-  while (n < 8) 
+  while (n < 8)
   {
      if (hexStg[n]=='\0')
         break;
@@ -2968,7 +2985,7 @@ S32 axtoi(char *hexStg)
   count = n;
   m = n - 1;
   n = 0;
-  while(n < count) 
+  while(n < count)
   {
      // digit[n] is value of hex digit at position n
      // (m << 2) is the number of positions to shift
@@ -3140,7 +3157,7 @@ BOOL run_cast(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
                                                         bytestream2char(arg, buffer, string);
                                                         F32 dest = (F32)atof(arg);
 
-                                                        
+
                                                         lscript_push(buffer, dest);
                                                         delete [] arg;
                                                 }
@@ -3338,7 +3355,7 @@ BOOL run_cast(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
                                         delete list_root;
                                         char *tmp = strdup(dest.str().c_str());
                                         LLScriptLibData *string = new LLScriptLibData(tmp);
-                                        free(tmp); 
+                                        free(tmp);
                                         tmp = NULL;
                                         S32 destaddress = lsa_heap_add_data(buffer, string, get_max_heap_size(buffer), TRUE);
                                         lscript_push(buffer, destaddress);
@@ -3393,7 +3410,7 @@ void lscript_stacktol_pop_variable(LLScriptLibData *data, U8 *buffer, char type)
                 break;
         case LST_KEY:
                 data->mType = LST_KEY;
-                
+
                 base_address = lscript_pop_int(buffer);
         // this bit of nastiness is to get around that code paths to local variables can result in lack of initialization
         // and function clean up of ref counts isn't based on scope (a mistake, I know)
@@ -3617,48 +3634,53 @@ BOOL run_print(U8 *buffer, S32 &offset, BOOL b_print, const LLUUID &id)
 void lscript_run(char *filename, BOOL b_debug)
 {
         LLTimer timer;
-        char *error;
-        BOOL b_state;
-        LLScriptExecute *execute = NULL;
         if (filename == NULL)
         {
-                llerrs << "filename is empty" << llendl;
+                llerrs << "filename is NULL" << llendl;
                 // Just reporting error is likely not enough. Need
                 // to check how to abort or error out gracefully
                 // from this function. XXXTBD
         }
-        FILE* file = LLFile::fopen(filename, "r");  /* Flawfinder: ignore */
-        if (file)
-        {
-                execute = new LLScriptExecute(file);
-                fclose(file);
-        }
-        file = LLFile::fopen(filename, "r");  /* Flawfinder: ignore */
-        if (file)
-        {
-                FILE* fp = LLFile::fopen("lscript.parse", "w");         /*Flawfinder: ignore*/
-                LLScriptLSOParse        *parse = new LLScriptLSOParse(file);
-                parse->printData(fp);
-                fclose(file);
-                fclose(fp);
-        }
-        file = LLFile::fopen(filename, "r");    /*Flawfinder: ignore*/
-        if (file && execute)
+        else
         {
-                timer.reset();
-                while (!execute->run(b_debug, LLUUID::null, &error, b_state))
-                        ;
-                F32 time = timer.getElapsedTimeF32();
-                F32 ips = execute->mInstructionCount / time;
-                llinfos << execute->mInstructionCount << " instructions in " << time << " seconds" << llendl;
-                llinfos << ips/1000 << "K instructions per second" << llendl;
-                printf("ip: 0x%X\n", get_register(execute->mBuffer, LREG_IP));
-                printf("sp: 0x%X\n", get_register(execute->mBuffer, LREG_SP));
-                printf("bp: 0x%X\n", get_register(execute->mBuffer, LREG_BP));
-                printf("hr: 0x%X\n", get_register(execute->mBuffer, LREG_HR));
-                printf("hp: 0x%X\n", get_register(execute->mBuffer, LREG_HP));
-                delete execute;
-                fclose(file);
+                char *error;
+                BOOL b_state;
+                LLScriptExecute *execute = NULL;
+
+                FILE* file = LLFile::fopen(filename, "r");
+                if (file)
+                {
+                        execute = new LLScriptExecute(file);
+                        // note: LLScriptExecute() closes file for us
+                }
+                file = LLFile::fopen(filename, "r");
+                if (file)
+                {
+                        FILE* fp = LLFile::fopen("lscript.parse", "w");         /*Flawfinder: ignore*/
+                        LLScriptLSOParse *parse = new LLScriptLSOParse(file);
+                        parse->printData(fp);
+                        delete parse;
+                        fclose(file);
+                        fclose(fp);
+                }
+                file = LLFile::fopen(filename, "r");
+                if (file && execute)
+                {
+                        timer.reset();
+                        while (!execute->run(b_debug, LLUUID::null, &error, b_state))
+                                ;
+                        F32 time = timer.getElapsedTimeF32();
+                        F32 ips = execute->mInstructionCount / time;
+                        llinfos << execute->mInstructionCount << " instructions in " << time << " seconds" << llendl;
+                        llinfos << ips/1000 << "K instructions per second" << llendl;
+                        printf("ip: 0x%X\n", get_register(execute->mBuffer, LREG_IP));
+                        printf("sp: 0x%X\n", get_register(execute->mBuffer, LREG_SP));
+                        printf("bp: 0x%X\n", get_register(execute->mBuffer, LREG_BP));
+                        printf("hr: 0x%X\n", get_register(execute->mBuffer, LREG_HR));
+                        printf("hp: 0x%X\n", get_register(execute->mBuffer, LREG_HP));
+                        delete execute;
+                        fclose(file);
+                }
         }
 }
 
@@ -3679,7 +3701,7 @@ void lscript_pop_variable(LLScriptLibData *data, U8 *buffer, char type)
                 break;
         case 'k':
                 data->mType = LST_KEY;
-                
+
                 base_address = lscript_pop_int(buffer);
         // this bit of nastiness is to get around that code paths to local variables can result in lack of initialization
         // and function clean up of ref counts isn't based on scope (a mistake, I know)
diff --git a/linden/indra/lscript/lscript_execute/lscript_readlso.cpp b/linden/indra/lscript/lscript_execute/lscript_readlso.cpp
index d750535..077e47c 100644
--- a/linden/indra/lscript/lscript_execute/lscript_readlso.cpp
+++ b/linden/indra/lscript/lscript_execute/lscript_readlso.cpp
@@ -42,7 +42,6 @@ LLScriptLSOParse::LLScriptLSOParse(FILE *fp)
         mRawData = new U8[filesize];
         fseek(fp, 0, SEEK_SET);
         fread(mRawData, 1, filesize, fp);
-        fclose(fp);
 
         initOpCodePrinting();
 }
diff --git a/linden/indra/lscript/lscript_library/lscript_library.cpp b/linden/indra/lscript/lscript_library/lscript_library.cpp
index ec1cc03..7d38621 100644
--- a/linden/indra/lscript/lscript_library/lscript_library.cpp
+++ b/linden/indra/lscript/lscript_library/lscript_library.cpp
@@ -401,7 +401,7 @@ void LLScriptLibrary::init()
         addFunction(new LLScriptLibraryFunction(10.f, 0.f, dummy_func, "llSetCameraParams",                      NULL, "l", "llSetCameraParams(list rules)\nSets multiple camera parameters at once.\nList format is [ rule1, data1, rule2, data2 . . . rulen, datan ]"));
         addFunction(new LLScriptLibraryFunction(10.f, 0.f, dummy_func, "llClearCameraParams",            NULL, NULL, "llClearCameraParams()\nResets all camera parameters to default values and turns off scripted camera control."));
         
-        addFunction(new LLScriptLibraryFunction(10.f, 0.f, dummy_func, "llListStatistics", "f", "il", "integer llListStatistics(integer operation, list l)\nPerform statistical aggregate functions on list l using LIST_STAT_* operations."));
+        addFunction(new LLScriptLibraryFunction(10.f, 0.f, dummy_func, "llListStatistics", "f", "il", "float llListStatistics(integer operation, list l)\nPerform statistical aggregate functions on list l using LIST_STAT_* operations."));
         addFunction(new LLScriptLibraryFunction(10.f, 0.f, dummy_func, "llGetUnixTime", "i", NULL, "integer llGetUnixTime()\nGet the number of seconds elapsed since 00:00 hours, Jan 1, 1970 UTC from the system clock."));
         addFunction(new LLScriptLibraryFunction(10.f, 0.f, dummy_func, "llGetParcelFlags", "i", "v", "integer llGetParcelFlags(vector pos)\nGet the parcel flags (PARCEL_FLAG_*) for the parcel including the point pos."));
         addFunction(new LLScriptLibraryFunction(10.f, 0.f, dummy_func, "llGetRegionFlags", "i", NULL, "integer llGetRegionFlags()\nGet the region flags (REGION_FLAG_*) for the region the object is in."));
@@ -548,12 +548,7 @@ void LLScriptLibData::print_separator(std::ostream& ostr, BOOL b_prepend_sep, ch
         }
         //print(ostr, FALSE);
         {
-                BOOL b_prepend_comma = FALSE;
                 char tmp[1024]; /* Flawfinder: ignore */
-                if (b_prepend_comma)
-                {
-                        ostr << ", ";
-                }
                 switch (mType)
                 {
                 case LST_INTEGER: