Assorted hardening issues flagged by kres (#42802)

src/shared/libfido2-util.c

@@ -622,6 +622,8 @@ static int fido2_use_hmac_hash_specific_token(
                 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to retrieve HMAC secret.");
 
         hmac_size = sym_fido_assert_hmac_secret_len(a, 0);
+        /* Should never be zero, sanity check */
+        assert(hmac_size > 0);
 
         hmac_copy = memdup(hmac, hmac_size);
         if (!hmac_copy)
@@ -1160,6 +1162,8 @@ int fido2_generate_hmac_hash(
                 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to retrieve HMAC secret.");
 
         secret_size = sym_fido_assert_hmac_secret_len(a, 0);
+        /* Should never be zero, sanity check */
+        assert(secret_size > 0);
 
         secret_copy = memdup(secret, secret_size);
         if (!secret_copy)

src/shared/ptyfwd.c

@@ -889,19 +889,16 @@ static int on_sigwinch_event(sd_event_source *e, const struct signalfd_siginfo *
 
 static int on_exit_event(sd_event_source *e, void *userdata) {
         PTYForward *f = ASSERT_PTR(userdata);
-        int r;
 
         assert(e);
         assert(e == f->exit_event_source);
 
-        if (!pty_forward_drain(f)) {
-                /* If not drained, try to drain the buffer. */
-                r = shovel_force(f);
-                if (r < 0)
-                        return r;
-        }
-
-        return pty_forward_done(f, 0);
+        /* The event loop is exiting while the forwarder is still active. Force a final synchronous drain of
+         * whatever is still buffered. shovel() may complete the drain and call pty_forward_done(), which
+         * can free f via the hangup handler, so we must not touch f afterwards, only propagate the return
+         * value, exactly like on_master_event() does. */
+        f->drain = true;
+        return shovel_force(f);
 }
 
 static int on_defer_event(sd_event_source *s, void *userdata) {