9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
1464 if(read(file,buf,length)!=length) {CID 349724: Error handling issues (NEGATIVE_RETURNS)
"length" is passed to a parameter that cannot be negative. [Note: The source code implementation of the function has been overridden by a builtin model.]
Hi,
Please find the latest report on new defect(s) introduced to Synchronet found with Coverity Scan.
so is this something DM setup or just something someone else decided to do.
Deuce and I set it up, years ago now.
Re: New Defects reported by Coverity Scan for Synchronet
By: MRO to scan-admin@coverity.com on Thu Feb 24 2022 09:23 am
so is this something DM setup or just something someone else decided to do.
Deuce and I set it up, years ago now.
Re: New Defects reported by Coverity Scan for Synchronet
By: Digital Man to MRO on Thu Feb 24 2022 01:13 pm
Re: New Defects reported by Coverity Scan for Synchronet
By: MRO to scan-admin@coverity.com on Thu Feb 24 2022 09:23 am
so is this something DM setup or just something someone else decided to do.
Deuce and I set it up, years ago now.
okay but is it actually accurate most of the time, considering that synchronet is a bit obscure compared to what it normally checks?
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
3959 JS_SetReservedSlot(cx, obj, key, JSVAL_VOID);Calling "JS_SetReservedSlot" without checking return value (as is done elsewhere 38 out of 43 times).
3965 JS_SetReservedSlot(cx, obj, JSRESERVED_GLOBAL_EVAL_ALLOWED, JSVAL_VOID);CID 349947: (CHECKED_RETURN)
Calling "JS_SetReservedSlot" without checking return value (as is done elsewhere 38 out of 43 times).
3973 JS_SetReservedSlot(cx, obj, JSRESERVED_GLOBAL_FLAGS, Jsvalify(Int32Value(flags)));CID 349947: (CHECKED_RETURN)
Calling "JS_SetReservedSlot" without checking return value (as is done elsewhere 38 out of 43 times).
259 JS_SetReservedSlot(cx, obj, SLOT_LIBRARY, PRIVATE_TO_JSVAL(NULL)); 260CID 349946: Error handling issues (CHECKED_RETURN)
Calling "JS_SetReservedSlot" without checking return value (as is done elsewhere 38 out of 43 times).
4834 if (!JS_GetElement(cx, arrayObj, i, &argTypes[i]))CID 349945: Null pointer dereferences (FORWARD_NULL)
Passing null pointer "arrayObj" to "JS_GetElement", which dereferences it.
226 int fd = mkstemp (name);CID 43174: Security best practices violations (SECURE_TEMP)
Calling "mkstemp" without securely setting umask first.
436 return start;CID 43169: Resource leaks (RESOURCE_LEAK)
Variable "ptr" going out of scope leaks the storage it points to.
148 case FFI_TYPE_POINTER:CID 43149: Control flow issues (MISSING_BREAK)
The case for value "14" is not terminated by a "break" statement.
4350 }CID 43148: Program hangs (LOCK)
Returning without unlocking "_gm_.mutex".
4246 return mem;CID 43147: Program hangs (LOCK)
Returning without unlocking "_gm_.mutex".
501 int ret = munmap (code, length);CID 43140: Memory - corruptions (BAD_FREE)
"munmap" frees incorrect pointer "code".
194 SAFECAT(buf,crlf);CID 350349: Memory - illegal accesses (STRING_NULL)
Passing unterminated string "buf" to "strlen", which expects a null-terminated string.
1376 return JS_LIKELY(!!p2) ? p2 : onOutOfMemory(p, newBytes, cx); 1377 }CID 350348: Resource leaks (RESOURCE_LEAK)
Variable "p2" going out of scope leaks the storage it points to.
2517 return false;CID 350347: (UNINIT)
Using uninitialized value "rdata.session.frame_.regs_.fp" when calling "~ReplaceData".
2517 return false;CID 350347: (UNINIT)
Using uninitialized value "rdata.singleShot.prevInvokeArgEnd" when calling "~ReplaceData".
2443 return false;CID 350347: (UNINIT)
Using uninitialized value "rdata.singleShot.prevInvokeArgEnd" when calling "~ReplaceData".
2443 return false;CID 350347: (UNINIT)
Using uninitialized value "rdata.session.frame_.regs_.fp" when calling "~ReplaceData".
2165 return expression(pn->pn_left, &expr) &&CID 350346: (UNINIT)
Using uninitialized value "stmt" when calling "whileStatement".
2166 statement(pn->pn_right, &stmt) &&CID 350346: (UNINIT)
Using uninitialized value "stmt.data" when calling "whileStatement". 2165 return expression(pn->pn_left, &expr) &&
1130 bn_correct_top(rr);CID 350345: Memory - corruptions (OVERRUN)
Overrunning callee's array of size 72 by passing argument "rr->top" (which evaluates to 272) in call to "BN_normalise".
3355 pics.append(pic);CID 350344: Uninitialized variables (UNINIT)
Using uninitialized value "pic". Field "pic.vr" is uninitialized when calling "append".
1922 JS_SET_RVAL(cx, arglist, BOOLEAN_TO_JSVAL(check_name(sys->cfg,str)));CID 350343: Uninitialized variables (UNINIT)
Using uninitialized value "*str" when calling "check_name".
3160 strlwr(str);CID 350342: Uninitialized variables (UNINIT)
Using uninitialized value "*str" when calling "strlwr".
1369 return JS_LIKELY(!!p) ? p : onOutOfMemory(reinterpret_cast<void *>(1), bytes, cx);CID 350341: Resource leaks (RESOURCE_LEAK)
Variable "p" going out of scope leaks the storage it points to.
5408 oplen = cs->length;CID 350340: Memory - illegal accesses (OVERRUN)
Overrunning array of 1952 bytes at byte offset 2040 by dereferencing pointer "cs".
3528 pics.append(pic);CID 350339: Uninitialized variables (UNINIT)
Using uninitialized value "pic". Field "pic.pc" is uninitialized when calling "append".
506 j1 = cmp(b, s);CID 350338: (USE_AFTER_FREE)
Calling "cmp" dereferences freed pointer "s".
481 delta = diff(PASS_STATE s, mhi);CID 350338: (USE_AFTER_FREE)
Calling "diff" dereferences freed pointer "s".
481 delta = diff(PASS_STATE s, mhi);CID 350338: (USE_AFTER_FREE)
Calling "diff" dereferences freed pointer "s".
1359 return JS_LIKELY(!!p) ? p : onOutOfMemory(NULL, bytes, cx); 1360 }CID 350337: Resource leaks (RESOURCE_LEAK)
Variable "p" going out of scope leaks the storage it points to.
2755 remove(bat_list);CID 350336: Uninitialized variables (UNINIT)
Using uninitialized value "*bat_list" when calling "remove".
716 _allocator.retire(ins->getReg()); // free any register associated with entryCID 350335: Memory - corruptions (OVERRUN)
Overrunning callee's array of size 32 by passing argument "ins->getReg()" (which evaluates to 127) in call to "retire".
3108 delta = diff(PASS_STATE S, mhi);CID 350334: (USE_AFTER_FREE)
Calling "diff" dereferences freed pointer "mhi".
3108 delta = diff(PASS_STATE S, mhi);CID 350334: (USE_AFTER_FREE)
Calling "diff" dereferences freed pointer "mhi".
3095 mlo = mhi;CID 350334: (USE_AFTER_FREE)
Using freed pointer "mhi".
1818 JS_RESUMEREQUEST(cx, rc);CID 350333: Uninitialized variables (UNINIT)
Using uninitialized value "*cstr" when calling "getSocketOptionByName". 1817 if((opt = getSocketOptionByName(cstr, &level)) == -1) {
542 _allocator.retire(r);CID 350332: (OVERRUN)
Overrunning callee's array of size 32 by passing argument "r" (which evaluates to 127) in call to "retire".
511 _allocator.useActive(r);CID 350332: (OVERRUN)
Overrunning callee's array of size 32 by passing argument "r" (which evaluates to 127) in call to "useActive".
255 _allocator.addActive(r, ins);CID 350331: Memory - corruptions (OVERRUN)
Overrunning callee's array of size 32 by passing argument "r" (which evaluates to 127) in call to "addActive".
2114 if (!(JS_UNLIKELY(atom == cx->runtime->atomState.protoAtom) 2115 ? js_SetPropertyHelper(cx, obj, id, defineHow, &rval, false)CID 350330: Error handling issues (CHECKED_RETURN)
Calling "js_SetPropertyHelper" without checking return value (as is done elsewhere 4 out of 5 times).
3629 (void)fseeko(stream,pos,SEEK_SET);CID 350353: Error handling issues (NEGATIVE_RETURNS)
"pos" is passed to a parameter that cannot be negative.
1208 fseeko(tmp_sdt, offset, SEEK_SET);CID 350413: Error handling issues (CHECKED_RETURN)
Calling "fseeko(tmp_sdt, offset, 0)" without checking return value. This library function may fail and return an error code.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
373 JS_ValueToECMAUint32(cx, *vp, (uint32_t*)&sys->cfg->sys_misc);CID 350813: Error handling issues (CHECKED_RETURN)
Calling "JS_ValueToECMAUint32" without checking return value (as is done elsewhere 68 out of 71 times).
1198 JS_ValueToECMAUint32(cx,argv[0],&t);CID 350812: Error handling issues (CHECKED_RETURN)
Calling "JS_ValueToECMAUint32" without checking return value (as is done elsewhere 68 out of 71 times).
1171 JS_ValueToECMAUint32(cx,argv[0],(uint32_t*)&t);CID 350811: Error handling issues (CHECKED_RETURN)
Calling "JS_ValueToECMAUint32" without checking return value (as is done elsewhere 68 out of 71 times).
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
319 if(p != NULL) {CID 351271: Null pointer dereferences (REVERSE_INULL)
Null-checking "p" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
582 localguru(gurubuf,i);CID 351999: Insecure data handling (TAINTED_SCALAR)
Passing tainted expression "*gurubuf" to "localguru", which uses it as a loop boundary.
1396 SAFEPRINTF2(str, "%s bytes, keep %lu"CID 351998: API usage errors (PRINTF_ARGS)
Argument "cfg.max_logs_kept" to format specifier "%lu" was expected to have type "unsigned long" but has type "unsigned short".
1397 ,byte_count_to_str(cfg.max_log_size, tmp, sizeof(tmp))CID 351997: API usage errors (PW.PRINTF_ARG_MISMATCH)
argument is incompatible with corresponding format string conversion 1396 SAFEPRINTF2(str, "%s bytes, keep %lu"
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
670 cfg.event[i]->months|=(1<<(atoi(p)-1));CID 174496: Integer handling issues (BAD_SHIFT)
In expression "1 << atoi(p) - 1", shifting by a negative amount has undefined behavior. The shift amount, "atoi(p) - 1", is -1.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
Just curious, should we avoid updating on days where coverity scan finds errors.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
253 str[rsp + 1] = 0;CID 319174: Memory - corruptions (OVERRUN)
Overrunning array "str" of 128 bytes at byte offset 128 using index "rsp + 1UL" (which evaluates to 128).
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319807: Memory - illegal accesses (UNINIT)
Using uninitialized value "res" when calling "uname".
9243 (void)uname(res); if (res != 0) { domain = res->domainname; }CID 319786: Null pointer dereferences (REVERSE_INULL)
Null-checking "res" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
674 beep();CID 376409: (SLEEP)
Call to "ciolib_beep" might sleep while holding lock "sdl_keylock".
682 beep();CID 376409: (SLEEP)
Call to "ciolib_beep" might sleep while holding lock "sdl_keylock".
1141 bputs(unixtodstr(&cfg,(time32_t)now,tmp1)); 1142 break;CID 376408: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "this->now" is cast to "time32_t".
841 return(::timestr(&cfg,(time32_t)intime,timestr_output));CID 376407: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "intime" is cast to "time32_t".
1606 session->user.logontime = (time32_t)session->logon_time;CID 376406: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "session->logon_time" is cast to "time32_t".
827 JS_SET_RVAL(cx, arglist,UINT_TO_JSVAL((uint32_t)time(NULL))); 828 return(JS_TRUE);CID 376405: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "time(NULL)" is cast to "uint32_t".
638 client.time = time(NULL);CID 376404: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "time(NULL)" is cast to "time32_t".
414 const SES_CHECKATTRIBUTE_FUNCTION checkAttributeFunction = \CID 376403: Control flow issues (DEADCODE)
Execution cannot reach the expression "sessionInfoPtr->checkAttributeFunction.fnPtr" inside this statement: "checkAttributeFunction = (S...".
235 YIELD();CID 376402: Program hangs (SLEEP)
Call to "nanosleep" might sleep while holding lock "sdl_ufunc_mtx".
4811 if (!CallAddPropertyHook(cx, clasp, obj, shape, &valueCopy)) { 4812 obj->removeProperty(cx, id);CID 376401: (OVERRUN)
Calling "CallAddPropertyHook" with "obj->slots" and "shape->slot" is suspicious because of the very large index, 4294967295. The index may be due to a negative parameter being interpreted as unsigned.
4808 obj->nativeSetSlot(shape->slot, valueCopy);CID 376401: (OVERRUN)
Calling "nativeSetSlot" with "obj->slots" and "shape->slot" is suspicious because of the very large index, 4294967295. The index may be due to a negative parameter being interpreted as unsigned.
332 const SES_CHECKATTRIBUTE_FUNCTION checkAttributeFunction = \CID 376400: Control flow issues (DEADCODE)
Execution cannot reach the expression "sessionInfoPtr->checkAttributeFunction.fnPtr" inside this statement: "checkAttributeFunction = (S...".
246 msg.hdr.when_written.time=(uint32_t)time(NULL);CID 376399: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "time(NULL)" is cast to "uint32_t".
1944 bb = bb1;CID 376398: Memory - illegal accesses (USE_AFTER_FREE)
Using freed pointer "bb1".
193 ,unixtodstr(&cfg,(time32_t)qwknode[i].time,str),qwknode[i].id,qwknode[i].path);A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "this->qwknode[i].time" is cast to "time32_t".
230 (void)read(file,gurubuf,(size_t)filelength(file));CID 376396: Memory - corruptions (OVERRUN)
Calling "read" with "gurubuf" and "(size_t)filelength(file)" is suspicious because of the very large index, 18446744073709551615. The index may be due to a negative parameter being interpreted as unsigned. [Note: The source code implementation of the function has been overridden by a builtin model.]
566 *dt=(time32_t)tmptime;CID 376395: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "tmptime" is cast to "time32_t".
1046 msg.hdr.when_written.time=(uint32_t)xpDateTime_to_localtime(dt);CID 376394: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "xpDateTime_to_localtime(dt)" is cast to "uint32_t".
367 strListCombine(list, metadata, size - 1, "\r\n");CID 376393: Memory - corruptions (OVERRUN)
Calling "strListCombine" with "metadata" and "size - 1UL" is suspicious because of the very large index, 18446744073709551615. The index may be due to a negative parameter being interpreted as unsigned.
298 memset(brute_buf+1,'_',l-1);CID 376392: Memory - corruptions (OVERRUN)
Calling "memset" with "brute_buf + 1" and "l - 1UL" is suspicious because of the very large index, 18446744073709551615. The index may be due to a negative parameter being interpreted as unsigned. [Note: The source code implementation of the function has been overridden by a builtin model.]
1128 JS_SET_RVAL(cx, arglist, UINT_TO_JSVAL((uint32)getfiletime(scfg, &file)));CID 376391: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "getfiletime(scfg, &file)" is cast to "uint32".
1565 user->pwmod=time(NULL);CID 376390: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "time(NULL)" is cast to "time32_t".
89 new defect(s) introduced to Synchronet found with Coverity Scan.
1082 pthread_mutex_lock(&vstatlock);CID 432266: Program hangs (ORDER_REVERSAL)
Calling "pthread_mutex_lock" acquires lock "vstatlock" while holding lock "win_mutex" (count: 1 / 4).
1039 ch=(char)getstr(str,LEN_PASS,K_UPPER);CID 433272: Code maintainability issues (UNUSED_VALUE)
Assigning value from "(char)this->getstr(str, 40UL, 1L, NULL)" to "ch" here, but that stored value is overwritten before it can be used.
659 str_list_t section = iniGetParsedSection(sections, name, /* cut: */TRUE);CID 433271: (RESOURCE_LEAK)
Variable "sections" going out of scope leaks the storage it points to. 658 return allocerr(error, maxerrlen, fname, "guru", sizeof(guru_t));
760 str_list_t section = iniGetParsedSection(sections, name, /* cut: */TRUE);CID 433271: (RESOURCE_LEAK)
Variable "sections" going out of scope leaks the storage it points to. 759 return allocerr(error, maxerrlen, fname, "page", sizeof(page_t));
680 } elseCID 433271: (RESOURCE_LEAK)
Variable "sections" going out of scope leaks the storage it points to. 679 return allocerr(error, maxerrlen, fname, "actsets", sizeof(actset_t *)*cfg->total_actsets);
688 str_list_t section = iniGetParsedSection(sections, name, /* cut: */TRUE);CID 433271: (RESOURCE_LEAK)
Variable "sections" going out of scope leaks the storage it points to. 687 return allocerr(error, maxerrlen, fname, "actset", sizeof(actset_t));
652 } elseCID 433271: (RESOURCE_LEAK)
Variable "sections" going out of scope leaks the storage it points to. 651 return allocerr(error, maxerrlen, fname, "gurus", sizeof(guru_t *)*cfg->total_gurus);
719 } elseCID 433271: (RESOURCE_LEAK)
Variable "sections" going out of scope leaks the storage it points to. 718 return allocerr(error, maxerrlen, fname, "chans", sizeof(chan_t *)*cfg->total_chans);
753 } elseCID 433271: (RESOURCE_LEAK)
Variable "sections" going out of scope leaks the storage it points to. 752 return allocerr(error, maxerrlen, fname, "pages", sizeof(page_t *)*cfg->total_pages);
726 str_list_t section = iniGetParsedSection(sections, name, /* cut: */TRUE);CID 433271: (RESOURCE_LEAK)
Variable "sections" going out of scope leaks the storage it points to. 725 return allocerr(error, maxerrlen, fname, "chan", sizeof(chan_t));
420 if((cfg->sub[i]=(sub_t *)malloc(sizeof(sub_t)))==NULL) 421 return allocerr(error, maxerrlen, fname, "sub", sizeof(sub_t));CID 433270: Null pointer dereferences (FORWARD_NULL)
Dereferencing null pointer "cfg->sub".
117 return allocerr(error, maxerrlen, fname, "fcomp", sizeof(fcomp_t));CID 433269: Resource leaks (RESOURCE_LEAK)
Variable "fcomp_list" going out of scope leaks the storage it points to.
194 return allocerr(error, maxerrlen, fname, "dlevent", sizeof(dlevent_t));CID 433268: Resource leaks (RESOURCE_LEAK)
Variable "dlevent_list" going out of scope leaks the storage it points to.
41 return MQTT_FAILURE;CID 433267: Control flow issues (DEADCODE)
Execution cannot reach this statement: "return 100;".
524 section = iniGetParsedSection(sections, name, /* cut: */TRUE);CID 433266: (RESOURCE_LEAK)
Variable "sections" going out of scope leaks the storage it points to. 523 return allocerr(error, maxerrlen, fname, "qhub", sizeof(qhub_t));
382 section = iniGetParsedSection(sections, name, /* cut: */TRUE);Variable "sections" going out of scope leaks the storage it points to. 381 return allocerr(error, maxerrlen, fname, "group", sizeof(grp_t));
374 } elseCID 433266: (RESOURCE_LEAK)
Variable "sections" going out of scope leaks the storage it points to. 373 return allocerr(error, maxerrlen, fname, "groups", sizeof(grp_t *)*cfg->total_grps);
382 section = iniGetParsedSection(sections, name, /* cut: */TRUE);Variable "grp_list" going out of scope leaks the storage it points to. 381 return allocerr(error, maxerrlen, fname, "group", sizeof(grp_t));
374 } elseCID 433265: (RESOURCE_LEAK)
Variable "grp_list" going out of scope leaks the storage it points to. 373 return allocerr(error, maxerrlen, fname, "groups", sizeof(grp_t *)*cfg->total_grps);
2347 while (sbbs->client_socket != INVALID_SOCKET && !terminate_server && !sbbs->terminate_output_thread) {CID 433264: Memory - corruptions (REVERSE_NEGATIVE)
You might be using variable "sbbs->client_socket" before verifying that it is >= 0.
549 }CID 433263: (RESOURCE_LEAK)
Variable "qhub_list" going out of scope leaks the storage it points to. 548 return allocerr(error, maxerrlen, fname, "qhub mode", sizeof(uchar)*k);
524 section = iniGetParsedSection(sections, name, /* cut: */TRUE);CID 433263: (RESOURCE_LEAK)
Variable "qhub_list" going out of scope leaks the storage it points to. 523 return allocerr(error, maxerrlen, fname, "qhub", sizeof(qhub_t));
516 } elseCID 433263: (RESOURCE_LEAK)
Variable "qhub_list" going out of scope leaks the storage it points to. 515 return allocerr(error, maxerrlen, fname, "qhubs", sizeof(qhub_t*)*cfg->total_qhubs);
547 if((cfg->qhub[i]->mode=(char *)malloc(sizeof(char)*k))==NULL)CID 433263: (RESOURCE_LEAK)
Variable "qhub_list" going out of scope leaks the storage it points to. 546 return allocerr(error, maxerrlen, fname, "qhub conf", sizeof(ushort)*k);
1036 msg.hdr.when_written.time=(uint32_t)xpDateTime_to_localtime(dt);CID 433262: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "xpDateTime_to_localtime(dt)" is cast to "uint32_t".
246 } elseCID 433261: (RESOURCE_LEAK)
Variable "lib_list" going out of scope leaks the storage it points to. 245 return allocerr(error, maxerrlen, fname, "libs", sizeof(lib_t *)*cfg->total_libs);
253 str_list_t section = iniGetParsedSection(sections, name, /* cut: */TRUE);Variable "lib_list" going out of scope leaks the storage it points to. 252 return allocerr(error, maxerrlen, fname, "lib", sizeof(lib_t));
547 if((cfg->qhub[i]->mode=(char *)malloc(sizeof(char)*k))==NULL)CID 433260: (RESOURCE_LEAK)
Variable "qsub_list" going out of scope leaks the storage it points to. 546 return allocerr(error, maxerrlen, fname, "qhub conf", sizeof(ushort)*k);
549 }CID 433260: (RESOURCE_LEAK)
Variable "qsub_list" going out of scope leaks the storage it points to. 548 return allocerr(error, maxerrlen, fname, "qhub mode", sizeof(uchar)*k);
545 if((cfg->qhub[i]->conf=(ushort *)malloc(sizeof(ushort)*k))==NULL)CID 433260: (RESOURCE_LEAK)
Variable "qsub_list" going out of scope leaks the storage it points to. 544 return allocerr(error, maxerrlen, fname, "qhub sub", sizeof(sub_t)*k);
463 return false;CID 433259: Resource leaks (RESOURCE_LEAK)
Variable "out" going out of scope leaks the storage it points to.
481 return allocerr(error, maxerrlen, fname, "xtrns", sizeof(xtrn_t *)*cfg->total_xtrns);CID 433258: (RESOURCE_LEAK)
Variable "list" going out of scope leaks the storage it points to.
500 return allocerr(error, maxerrlen, fname, "xtrn", sizeof(xtrn_t));CID 433258: (RESOURCE_LEAK)
Variable "list" going out of scope leaks the storage it points to.
462 return allocerr(error, maxerrlen, fname, "xtrnsec", sizeof(xtrnsec_t));CID 433258: (RESOURCE_LEAK)
Variable "list" going out of scope leaks the storage it points to.
428 return allocerr(error, maxerrlen, fname, "xedit", sizeof(xedit_t));CID 433258: (RESOURCE_LEAK)
Variable "list" going out of scope leaks the storage it points to.
541 return allocerr(error, maxerrlen, fname, "event", sizeof(event_t));CID 433258: (RESOURCE_LEAK)
Variable "list" going out of scope leaks the storage it points to.
594 return allocerr(error, maxerrlen, fname, "hotkeys", sizeof(hotkey_t *)*cfg->total_hotkeys);CID 433258: (RESOURCE_LEAK)
Variable "list" going out of scope leaks the storage it points to.
534 return allocerr(error, maxerrlen, fname, "events", sizeof(event_t *)*cfg->total_events);CID 433258: (RESOURCE_LEAK)
Variable "list" going out of scope leaks the storage it points to.
579 return allocerr(error, maxerrlen, fname, "natvpgm", sizeof(natvpgm_t));CID 433258: (RESOURCE_LEAK)
Variable "list" going out of scope leaks the storage it points to.
455 return allocerr(error, maxerrlen, fname, "xtrnsecs", sizeof(xtrnsec_t *)*cfg->total_xtrnsecs);CID 433258: (RESOURCE_LEAK)
Variable "list" going out of scope leaks the storage it points to.
601 return allocerr(error, maxerrlen, fname, "hotkey", sizeof(hotkey_t));CID 433258: (RESOURCE_LEAK)
Variable "list" going out of scope leaks the storage it points to.
421 return allocerr(error, maxerrlen, fname, "xedits", sizeof(xedit_t *)*cfg->total_xedits);CID 433258: (RESOURCE_LEAK)
Variable "list" going out of scope leaks the storage it points to.
572 return allocerr(error, maxerrlen, fname, "natvpgms", sizeof(natvpgm_t *)*cfg->total_natvpgms);CID 433258: (RESOURCE_LEAK)
Variable "list" going out of scope leaks the storage it points to.
314 if((cfg->dir[i]=(dir_t *)malloc(sizeof(dir_t)))==NULL) 315 return allocerr(error, maxerrlen, fname, "dir", sizeof(dir_t));CID 433257: Null pointer dereferences (FORWARD_NULL)
Dereferencing null pointer "cfg->dir".
6401 while(session->socket!=INVALID_SOCKET) {CID 433256: Memory - corruptions (REVERSE_NEGATIVE)
You might be using variable "session->socket" before verifying that it is >= 0.
297 } elseCID 433255: (RESOURCE_LEAK)
Variable "dir_list" going out of scope leaks the storage it points to. 296 return allocerr(error, maxerrlen, fname, "dirs", sizeof(dir_t *)*(cfg->total_dirs+1));
316 str_list_t section = iniGetParsedSection(sections, name, /* cut: */TRUE);Variable "dir_list" going out of scope leaks the storage it points to. 315 return allocerr(error, maxerrlen, fname, "dir", sizeof(dir_t));
167 return allocerr(error, maxerrlen, fname, "ftest", sizeof(ftest_t));CID 433254: Resource leaks (RESOURCE_LEAK)
Variable "ftest_list" going out of scope leaks the storage it points to.
85 int result = ::putuserdatetime(&cfg, usernumber, fnum, (time32_t)t);CID 433253: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "t" is cast to "time32_t".
720 SAFECOPY(client.user, cstr);CID 434885: Null pointer dereferences (FORWARD_NULL)
Passing null pointer "cstr" to "strncpy", which dereferences it.
666 SAFECOPY(client.user, cstr);CID 434884: Null pointer dereferences (FORWARD_NULL)
Passing null pointer "cstr" to "strncpy", which dereferences it.
1370 if(*gamedir == 0) {CID 434888: Uninitialized variables (UNINIT)
Using uninitialized value "*gamedir".
46 ,timestr(cfg, (time32_t)now, tstr)CID 435652: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "now" is cast to "time32_t".
102 ,timestr(cfg, (time32_t)now, tstr)CID 435651: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "now" is cast to "time32_t".
2266 load_msgs_cfg(&cfg, error, sizeof(error));CID 436064: Error handling issues (CHECKED_RETURN)
Calling "load_msgs_cfg" without checking return value (as is done elsewhere 4 out of 5 times).
679 l=length>(cfg.level_linespermsg[useron_level]*MAX_LINE_LEN)-1CID 436320: (SIGN_EXTENSION)
Suspicious implicit sign extension: "this->cfg.level_linespermsg[useron_level]" with type "uint16_t" (16 bits, unsigned) is promoted in "this->cfg.level_linespermsg[useron_level] * (this->cols - 1) - 1" to type "int" (32 bits, signed), then sign-extended to type "long" (64 bits, signed). If "this->cfg.level_linespermsg[useron_level] * (this->cols - 1) - 1" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
680 ? (cfg.level_linespermsg[useron_level]*MAX_LINE_LEN)-1 : length;CID 436320: (SIGN_EXTENSION)
Suspicious implicit sign extension: "this->cfg.level_linespermsg[useron_level]" with type "uint16_t" (16 bits, unsigned) is promoted in "this->cfg.level_linespermsg[useron_level] * (this->cols - 1) - 1" to type "int" (32 bits, signed), then sign-extended to type "long" (64 bits, signed). If "this->cfg.level_linespermsg[useron_level] * (this->cols - 1) - 1" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
657 length=(cfg.level_linespermsg[useron_level]*MAX_LINE_LEN)-(l+1);CID 436320: (SIGN_EXTENSION)
Suspicious implicit sign extension: "this->cfg.level_linespermsg[useron_level]" with type "uint16_t" (16 bits, unsigned) is promoted in "this->cfg.level_linespermsg[useron_level] * (this->cols - 1)" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "this->cfg.level_linespermsg[useron_level] * (this->cols - 1)" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
294 if((buf=(char*)malloc((cfg.level_linespermsg[useron_level]*MAX_LINE_LEN) + 1))CID 436320: (SIGN_EXTENSION)
Suspicious implicit sign extension: "this->cfg.level_linespermsg[useron_level]" with type "uint16_t" (16 bits, unsigned) is promoted in "this->cfg.level_linespermsg[useron_level] * (this->cols - 1) + 1" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "this->cfg.level_linespermsg[useron_level] * (this->cols - 1) + 1" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
656 if(length>(long)((cfg.level_linespermsg[useron_level]*MAX_LINE_LEN)-(l+1))) {CID 436320: (SIGN_EXTENSION)
Suspicious implicit sign extension: "this->cfg.level_linespermsg[useron_level]" with type "uint16_t" (16 bits, unsigned) is promoted in "this->cfg.level_linespermsg[useron_level] * (this->cols - 1)" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "this->cfg.level_linespermsg[useron_level] * (this->cols - 1)" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
49 msg->hdr.when_written.time=(uint32_t)xpDateTime_to_localtime(dt);CID 436319: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "xpDateTime_to_localtime(dt)" is cast to "uint32_t".
88 remove(str);CID 436318: Error handling issues (CHECKED_RETURN)
Calling "remove(str)" without checking return value. This library function may fail and return an error code.
198 msg->hdr.when_written.time=(uint32_t)sane_mktime(&tm); 199 }CID 436317: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "sane_mktime(&tm)" is cast to "uint32_t".
1382 fseeko(smb.sdt_fp,offset,SEEK_SET);CID 436316: Error handling issues (CHECKED_RETURN)
Calling "fseeko(this->smb.sdt_fp, offset, 0)" without checking return value. This library function may fail and return an error code.
406 min=min*10+(buf[++m]&0xf);CID 436315: Code maintainability issues (UNUSED_VALUE)
Assigning value from "min * 10 + (buf[++m] & 0xf)" to "min" here, but that stored value is overwritten before it can be used.
1692 }CID 436314: (RESOURCE_LEAK)
Handle variable "fd" going out of scope leaks the handle.
1692 }CID 436314: (RESOURCE_LEAK)
Handle variable "fd" going out of scope leaks the handle.
4383 if(sbbs->exec(&sbbs->main_csi))CID 436313: (OVERRUN)
Calling "exec" with "sbbs->main_csi.cs" and "sbbs->main_csi.length" is suspicious because of the very large index, 18446744073709551615. The index may be due to a negative parameter being interpreted as unsigned.
4367 if(lread(file,sbbs->main_csi.cs,sbbs->main_csi.length)CID 436313: (OVERRUN)
Calling "read" with "sbbs->main_csi.cs" and "sbbs->main_csi.length" is suspicious because of the very large index, 18446744073709551615. The index may be due to a negative parameter being interpreted as unsigned. [Note: The source code implementation of the function has been overridden by a builtin model.]
1750 poll(fds, 1, 1);CID 436312: Error handling issues (CHECKED_RETURN)
Calling "poll(fds, 1UL, 1)" without checking return value. This library function may fail and return an error code. [Note: The source code implementation of the function has been overridden by a builtin model.]
812 if(lread(file,bin.cs,bin.length)!=(ssize_t)bin.length) {CID 436311: (OVERRUN)
Calling "read" with "bin.cs" and "bin.length" is suspicious because of the very large index, 18446744073709551615. The index may be due to a negative parameter being interpreted as unsigned. [Note: The source code implementation of the function has been overridden by a builtin model.]
825 while(exec(&bin)==0)CID 436311: (OVERRUN)
Calling "exec" with "bin.cs" and "bin.length" is suspicious because of the very large index, 18446744073709551615. The index may be due to a negative parameter being interpreted as unsigned.
1114 useron.expire=(time32_t)juliantounix(i);CID 436310: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "juliantounix(i)" is cast to "time32_t".
294 remove(str);CID 436309: Error handling issues (CHECKED_RETURN)
Calling "remove(str)" without checking return value. This library function may fail and return an error code.
619 remove(str);CID 436308: (CHECKED_RETURN)
Calling "remove(str)" without checking return value. This library function may fail and return an error code.
745 remove(packet);CID 436308: (CHECKED_RETURN)
Calling "remove(packet)" without checking return value. This library function may fail and return an error code.
733 remove(packet);CID 436308: (CHECKED_RETURN)
Calling "remove(packet)" without checking return value. This library function may fail and return an error code.
4407 fprintf(fp, "done=%u\n", (uint)now);CID 436307: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "now" is cast to "uint".
1235 return(unixtodstr(&cfg,(time32_t)ns_time,str));CID 436306: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "this->ns_time" is cast to "time32_t".
128 errormsg(WHERE, ERR_CHK, "time", (uint)now); 129 return(false);CID 436305: (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "this->now" is cast to "uint".
598 ,(uint)elapsedCID 436305: (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "elapsed" is cast to "uint".
603 ,(uint)elapsedCID 436305: (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "elapsed" is cast to "uint".
242 fread(buf,len,sizeof(char),fp);CID 436304: Error handling issues (CHECKED_RETURN)
"fread(void * restrict, size_t, size_t, FILE * restrict)" returns the number of bytes read, but it is ignored.
218 if(!smb_getmsghdr(&smb,&msg)) {CID 436303: Uninitialized variables (UNINIT)
Using uninitialized value "msg.idx_offset" when calling "smb_getmsghdr".
194 SAFECAT(buf,crlf);CID 436302: Memory - illegal accesses (STRING_NULL)
Passing unterminated string "buf" to "strlen", which expects a null-terminated string.
752 cp437_to_utf8_str(str, buf, sizeof(buf) - 1, /* minval: */'\x02');CID 436301: Insecure data handling (TAINTED_SCALAR)
Passing tainted expression "str" to "cp437_to_utf8_str", which uses it as an offset.
2033 fprintf(fp, "Created = 0x%x\n", (int)time(NULL));CID 436563: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "time(NULL)" is cast to "int".
118 remove(protlog); /* Deletes the protocol log */CID 446269: Error handling issues (CHECKED_RETURN)
Calling "remove(protlog)" without checking return value. This library function may fail and return an error code.
75 SAFEPRINTF2(str,"Estimated Time: %s Transfer Time: %s"CID 446268: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "elapsed" is cast to "uint".
131 }Variable "stream" going out of scope leaks the storage it points to. 130 return(false);
3435 pthread_mutex_unlock(&nodefile_mutex);CID 451019: (NEGATIVE_RETURNS)
"this->client_socket" is passed to a parameter that cannot be negative. 3434 errormsg(WHERE, ERR_OPEN, str, cfg.node_num);
3445 }CID 451019: (NEGATIVE_RETURNS)
"this->client_socket" is passed to a parameter that cannot be negative. 3443 errormsg(WHERE,ERR_WRITE,str,sizeof(node_t)); 3444 break;
1437 external(cmdstr(cfg.xtrn[xtrnnum]->clean, drop_file, startup_dir, NULL, mode)CID 451018: (LOCK)
"external" locks "this->input_thread_mutex" while it is locked.
1438 ,mode&~(EX_STDIN|EX_CONIO), cfg.xtrn[xtrnnum]->path);CID 451018: (LOCK)
"external" unlocks "this->input_thread_mutex" while it is unlocked. 1437 external(cmdstr(cfg.xtrn[xtrnnum]->clean, drop_file, startup_dir, NULL, mode)
218 if((*cur)>=opts)CID 451057: Uninitialized variables (UNINIT)
Using uninitialized value "*cur".
872 chdir(bbs_startup.ctrl_dir);CID 451056: Error handling issues (CHECKED_RETURN)
Calling "chdir" without checking return value (as is done elsewhere 18 out of 21 times).
2498 sbbs_write_ini(CID 451084: Error handling issues (CHECKED_RETURN)
Calling "sbbs_write_ini" without checking return value (as is done elsewhere 6 out of 7 times).
50 iniWriteFile(fp, ini);CID 451182: Null pointer dereferences (NULL_RETURNS)
Dereferencing a pointer that might be "NULL" "fp" when calling "iniWriteFile".
936 errormsg(WHERE,ERR_ALLOC,"msgeditor",sizeof(char *)*(maxlines+1));CID 452331: Incorrect expression (SIZEOF_MISMATCH)
Passing argument "getfname("writemsg.cpp")" of type "char *" and argument "8UL /* sizeof (char *) */ * (maxlines + 1)" to function "errormsg" is suspicious.
966 if(line < 0)CID 452330: Control flow issues (NO_EFFECT)
This less-than-zero comparison of an unsigned value is never true. "line < 0U".
636 vs->winwidth = idealw;CID 452566: Concurrent data access violations (MISSING_LOCK)
Accessing "vs->winwidth" without holding lock "vstatlock". Elsewhere, "video_stats.winwidth" is accessed with "vstatlock" held 6 out of 9 times (1 of these accesses strongly imply that it is necessary).
288 release_vmem(vmem_ptr);CID 452578: Concurrent data access violations (ATOMICITY)
Using an unreliable value of "vmem_ptr" inside the second locked section. If the data that "vmem_ptr" depends on was changed by another thread, this use might be incorrect.
850 release_vmem(vmem_ptr);CID 452577: Concurrent data access violations (ATOMICITY)
Using an unreliable value of "vmem_ptr" inside the second locked section. If the data that "vmem_ptr" depends on was changed by another thread, this use might be incorrect.
1239 release_vmem(vmem_ptr);CID 452576: Concurrent data access violations (ATOMICITY)
Using an unreliable value of "vmem_ptr" inside the second locked section. If the data that "vmem_ptr" depends on was changed by another thread, this use might be incorrect.
1264 release_vmem(vmem_ptr);CID 452575: Concurrent data access violations (ATOMICITY)
Using an unreliable value of "vmem_ptr" inside the second locked section. If the data that "vmem_ptr" depends on was changed by another thread, this use might be incorrect.
1289 release_vmem(vmem_ptr);CID 452574: Concurrent data access violations (ATOMICITY)
Using an unreliable value of "vmem_ptr" inside the second locked section. If the data that "vmem_ptr" depends on was changed by another thread, this use might be incorrect.
882 release_vmem(vmem_ptr);CID 452573: Concurrent data access violations (ATOMICITY)
Using an unreliable value of "vmem_ptr" inside the second locked section. If the data that "vmem_ptr" depends on was changed by another thread, this use might be incorrect.
931 release_vmem(vmem_ptr);CID 452572: Concurrent data access violations (ATOMICITY)
Using an unreliable value of "vmem_ptr" inside the second locked section. If the data that "vmem_ptr" depends on was changed by another thread, this use might be incorrect.
562 release_vmem(vmem_ptr);Using an unreliable value of "vmem_ptr" inside the second locked section. If the data that "vmem_ptr" depends on was changed by another thread, this use might be incorrect.
647 release_vmem(vmem_ptr);CID 452582: (ATOMICITY)
Using an unreliable value of "vmem_ptr" inside the second locked section. If the data that "vmem_ptr" depends on was changed by another thread, this use might be incorrect.
584 release_vmem(vmem_ptr);CID 452582: (ATOMICITY)
Using an unreliable value of "vmem_ptr" inside the second locked section. If the data that "vmem_ptr" depends on was changed by another thread, this use might be incorrect.
1608 request_redraw();CID 452581: Program hangs (ORDER_REVERSAL)
Calling "request_redraw" acquires lock "vstatlock" while holding lock "screenlock" (count: 1 / 2).
89 fwrite(y2r, 4, 1 << 24, y);CID 453600: (NULL_RETURNS)
Dereferencing a pointer that might be "NULL" "r" when calling "fwrite". 88 fwrite(r2y, 4, 1 << 24, r);
90 fclose(s);CID 453600: (NULL_RETURNS)
Dereferencing a pointer that might be "NULL" "y" when calling "fwrite". 89 fwrite(y2r, 4, 1 << 24, y);
69 fprintf(s,CID 453600: (NULL_RETURNS)
Dereferencing a pointer that might be "NULL" "s" when calling "fprintf". [Note: The source code implementation of the function has been overridden by a builtin model.]
78 fprintf(h,CID 453600: (NULL_RETURNS)
Dereferencing a pointer that might be "NULL" "h" when calling "fprintf". [Note: The source code implementation of the function has been overridden by a builtin model.]
2135 sbbs->translate_input(wrbuf, wr);CID 453850: Memory - corruptions (OVERRUN)
Overrunning buffer pointed to by "wrbuf" of 4000 bytes by passing it to a function which accesses it at byte offset 4000 using argument "wr" (which evaluates to 4001).
72 sprintf(path, "%s/r2y.bin", argv[2]);CID 453849: (STRING_SIZE)
Passing string "argv[2]" of unknown size to "sprintf".
74 sprintf(path, "%s/y2r.bin", argv[2]);CID 453849: (STRING_SIZE)
Passing string "argv[2]" of unknown size to "sprintf".
68 sprintf(path, "%s/rgbmap.s", argv[2]);CID 453849: (STRING_SIZE)
Passing string "argv[2]" of unknown size to "sprintf".
70 sprintf(path, "%s/rgbmap.h", argv[2]);CID 453849: (STRING_SIZE)
Passing string "argv[2]" of unknown size to "sprintf".
562 x_cvstat = vstat;CID 453848: Concurrent data access violations (MISSING_LOCK)
Accessing "x_cvstat" without holding lock "vstatlock". Elsewhere, "x_cvstat" is accessed with "vstatlock" held 3 out of 4 times (1 of these accesses strongly imply that it is necessary).
336 if (x_cvstat.aspect_width != 0 && x_cvstat.aspect_height != 0) {CID 454698: Incorrect expression (IDENTICAL_BRANCHES)
The same code is executed regardless of whether "x_cvstat.aspect_width != 0 && x_cvstat.aspect_height != 0" is true, because the 'then' and 'else' branches are identical. Should one of the branches be modified, or the entire 'if' statement replaced?
565 return(-1);CID 454697: Program hangs (LOCK)
Returning without unlocking "vstatlock".
return true;".CID 454696: Control flow issues (UNREACHABLE)
This code cannot be reached: "if (fval == 0.)
904 x11.XPutImage(dpy, win, gc, xim, 0, 0, xoff, yoff, source->w, source->h);CID 462165: Null pointer dereferences (FORWARD_NULL)
Dereferencing null pointer "source".
448 vstat.scaling = sdl_getscaling();CID 462164: Concurrent data access violations (MISSING_LOCK)
Accessing "vstat.scaling" without holding lock "vstatlock". Elsewhere, "video_stats.scaling" is accessed with "vstatlock" held 13 out of 18 times (1 of these accesses strongly imply that it is necessary).
408 vstat.scaling = sdl_getscaling();CID 462163: Concurrent data access violations (MISSING_LOCK)
Accessing "vstat.scaling" without holding lock "vstatlock". Elsewhere, "video_stats.scaling" is accessed with "vstatlock" held 13 out of 18 times (1 of these accesses strongly imply that it is necessary).
657 vstat.scaling = sdl_getscaling();CID 462162: Concurrent data access violations (MISSING_LOCK)
Accessing "vstat.scaling" without holding lock "vstatlock". Elsewhere, "video_stats.scaling" is accessed with "vstatlock" held 13 out of 18 times (1 of these accesses strongly imply that it is necessary).
511 xp_dlclose(dl2);CID 462161: Null pointer dereferences (FORWARD_NULL)
Passing null pointer "dl2" to "dlclose", which dereferences it.
589 if(wmhints) {CID 462160: Null pointer dereferences (REVERSE_INULL)
Null-checking "wmhints" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.
591 return(-1);CID 462159: (RESOURCE_LEAK)
Variable "dl2" going out of scope leaks the storage it points to.
552 return(-1);CID 462159: (RESOURCE_LEAK)
Variable "dl2" going out of scope leaks the storage it points to.
552 return(-1);CID 462159: (RESOURCE_LEAK)
Variable "dl2" going out of scope leaks the storage it points to.
557 return(-1);CID 462159: (RESOURCE_LEAK)
Variable "dl2" going out of scope leaks the storage it points to.
552 return(-1);CID 462159: (RESOURCE_LEAK)
Variable "dl2" going out of scope leaks the storage it points to.
563 return(-1);CID 462159: (RESOURCE_LEAK)
Variable "dl2" going out of scope leaks the storage it points to.
570 return(-1);CID 462159: (RESOURCE_LEAK)
Variable "dl2" going out of scope leaks the storage it points to.
1167 fwrite(&ch,1,1,tmp_shd);CID 462184: (RESOURCE_LEAK)
Variable "datoffset" going out of scope leaks the storage it points to. 1166 return;
1162 fwrite(&hdr,1,sizeof(smbhdr_t),tmp_shd);CID 462184: (RESOURCE_LEAK)
Variable "datoffset" going out of scope leaks the storage it points to. 1161 return;
1250 if(!m && *(ushort *)buf!=XLAT_NONE && *(ushort *)buf!=XLAT_LZH) {CID 462184: (RESOURCE_LEAK)
Variable "datoffset" going out of scope leaks the storage it points to. 1249 return;
564 xp_dlclose(dl3);CID 462183: Null pointer dereferences (FORWARD_NULL)
Passing null pointer "dl3" to "dlclose", which dereferences it.
619 return(-1);CID 462182: (RESOURCE_LEAK)
Variable "dl4" going out of scope leaks the storage it points to.
608 return(-1);CID 462182: (RESOURCE_LEAK)
Variable "dl4" going out of scope leaks the storage it points to.
613 return(-1);CID 462182: (RESOURCE_LEAK)
Variable "dl4" going out of scope leaks the storage it points to.
626 return(-1);CID 462182: (RESOURCE_LEAK)
Variable "dl4" going out of scope leaks the storage it points to.
647 return(-1);CID 462182: (RESOURCE_LEAK)
Variable "dl4" going out of scope leaks the storage it points to.
608 return(-1);CID 462181: Resource leaks (RESOURCE_LEAK)
Variable "dl3" going out of scope leaks the storage it points to.
579 xp_dlclose(dl4);CID 462180: Null pointer dereferences (FORWARD_NULL)
Passing null pointer "dl4" to "dlclose", which dereferences it.
305 }CID 462179: Control flow issues (DEADCODE)
Execution cannot reach this statement: "x11.XRRFreeCrtcInfo(xrrci);". 304 x11.XRRFreeCrtcInfo(xrrci);
428 ftruncate (execfd, offset);CID 462239: (CHECKED_RETURN)
Calling "ftruncate" without checking return value (as is done elsewhere 45 out of 52 times).
416 ftruncate (execfd, offset);CID 462239: (CHECKED_RETURN)
Calling "ftruncate" without checking return value (as is done elsewhere 45 out of 52 times).
1732 }CID 462238: (RESOURCE_LEAK)
Variable "instream" going out of scope leaks the storage it points to. 1731 return false;
1718 }CID 462238: (RESOURCE_LEAK)
Variable "instream" going out of scope leaks the storage it points to. 1717 return false;
244 return -4;CID 462237: Resource leaks (RESOURCE_LEAK)
Variable "buf" going out of scope leaks the storage it points to.
588 if (xinerama_found && ((x11.XRRQueryVersion = xp_dlsym(dl4, XRRQueryVersion)) == NULL)) {CID 462236: Null pointer dereferences (FORWARD_NULL)
Passing null pointer "dl4" to "dlsym", which dereferences it.
114 return __COUNTER__;CID 462235: Resource leaks (RESOURCE_LEAK)
Variable "body" going out of scope leaks the storage it points to.
303 return false;CID 462234: Resource leaks (RESOURCE_LEAK)
Variable "buf" going out of scope leaks the storage it points to.
3525 case 'a': /* Character Position Forward */CID 462300: Control flow issues (MISSING_BREAK)
The case for value "'a'" is not terminated by a "break" statement.
3533 case 'j': /* Character Position Backward */CID 462299: Control flow issues (MISSING_BREAK)
The case for value "'j'" is not terminated by a "break" statement.
1893 return(0);CID 462298: (NEGATIVE_RETURNS)
"this->curdirnum" is passed to a parameter that cannot be negative. 1892 csi->logic=select_editor() ? LOGIC_TRUE:LOGIC_FALSE;
1881 && chk_ar(cfg.shell[i]->ar,&useron,&client))CID 462298: (NEGATIVE_RETURNS)
"this->curdirnum" is passed to a parameter that cannot be negative. 1880 if(!stricmp(csi->str,cfg.shell[i]->code)
1182CID 462298: (NEGATIVE_RETURNS)
"this->curdirnum" is passed to a parameter that cannot be negative. 1181 return(exec_function(csi));
1500 return(0);CID 462298: (NEGATIVE_RETURNS)
"this->curdirnum" is passed to a parameter that cannot be negative. 1499 user_event((user_event_t)*(csi->ip++));
1182CID 462298: (NEGATIVE_RETURNS)
"this->cursubnum" is passed to a parameter that cannot be negative. 1181 return(exec_function(csi));
1762 return(0);CID 462298: (NEGATIVE_RETURNS)
"this->curdirnum" is passed to a parameter that cannot be negative. 1761 logout();
1539 return(0);CID 462298: (NEGATIVE_RETURNS)
"this->curdirnum" is passed to a parameter that cannot be negative. 1538 multinodechat(*csi->ip++);
1876 return(0);CID 462298: (NEGATIVE_RETURNS)
"this->curdirnum" is passed to a parameter that cannot be negative. 1875 csi->logic=select_shell() ? LOGIC_TRUE:LOGIC_FALSE;
1898 && chk_ar(cfg.xedit[i]->ar,&useron,&client))CID 462298: (NEGATIVE_RETURNS)
"this->curdirnum" is passed to a parameter that cannot be negative. 1897 if(!stricmp(csi->str,cfg.xedit[i]->code)
218 if(!smb_getmsghdr(&smb,&msg)) {CID 462297: Uninitialized variables (UNINIT)
Using uninitialized value "msg.idx_offset" when calling "smb_getmsghdr".
296 if((buf=(char*)malloc((cfg.level_linespermsg[useron_level]*MAX_LINE_LEN) + 1))CID 462296: Integer handling issues (SIGN_EXTENSION)
Suspicious implicit sign extension: "this->cfg.level_linespermsg[useron_level]" with type "uint16_t" (16 bits, unsigned) is promoted in "this->cfg.level_linespermsg[useron_level] * (this->cols - 1 + 2) + 1" to type "int" (32 bits, signed), then sign-extended to type "unsigned long" (64 bits, unsigned). If "this->cfg.level_linespermsg[useron_level] * (this->cols - 1 + 2) + 1" is greater than 0x7FFFFFFF, the upper bits of the result will all be 1.
3509 case 'A': /* Cursor Up */CID 462295: Control flow issues (MISSING_BREAK)
The case for value "'A'" is not terminated by a "break" statement.
1038 if(!writemsg(msgpath,nulstr,title,WM_NETMAIL|mode,INVALID_SUB, to_list, /* from: */your_addr, &editor, &charset)) {CID 462294: Integer handling issues (NEGATIVE_RETURNS)
A negative constant "-1" is passed as an argument to a parameter that cannot be negative.
200 if(!writemsg(msgpath,nulstr,subj,WM_NETMAIL|mode,INVALID_SUB, to, from, &editor, &charset)) {CID 462293: Integer handling issues (NEGATIVE_RETURNS)
A negative constant "-1" is passed as an argument to a parameter that cannot be negative.
526 strcat(*pp1,*pp2);CID 462292: (NULL_RETURNS)
Dereferencing a pointer that might be "nullptr" "*pp1" when calling "strcat". [Note: The source code implementation of the function has been overridden by a builtin model.]
526 strcat(*pp1,*pp2);CID 462292: (NULL_RETURNS)
Dereferencing a pointer that might be "nullptr" "*pp1" when calling "strcat". [Note: The source code implementation of the function has been overridden by a builtin model.]
3517 case 'B': /* Cursor Down */CID 462291: Control flow issues (MISSING_BREAK)
The case for value "'B'" is not terminated by a "break" statement.
1316 if(!writemsg(msgpath,nulstr,title, (mode|WM_QWKNET|WM_NETMAIL) ,INVALID_SUB,to,/* from: */useron.alias, &editor, &charset)) {CID 462290: Integer handling issues (NEGATIVE_RETURNS)
A negative constant "-1" is passed as an argument to a parameter that cannot be negative.
53 if(!writemsg(msgpath,nulstr,title,wm_mode,INVALID_SUB,"Bulk Mailing"CID 462289: Integer handling issues (NEGATIVE_RETURNS)
A negative constant "-1" is passed as an argument to a parameter that cannot be negative.
351 SAFEPRINTF(str,"%s ",unixtodstr(&cfg,(time32_t)now,tmp));CID 462288: High impact quality (Y2K38_SAFETY)
A "time_t" value is stored in an integer with too few bits to accommodate it. The expression "this->now" is cast to "time32_t".
762 cp437_to_utf8_str(str, buf, sizeof(buf) - 1, /* minval: */'\x02');CID 462287: Insecure data handling (TAINTED_SCALAR)
Passing tainted expression "str" to "cp437_to_utf8_str", which uses it as an offset.
1796 remove(outpath); // expected to fail (file does not exist) much of the timeCID 462777: Error handling issues (CHECKED_RETURN)
Calling "remove(outpath)" without checking return value. This library function may fail and return an error code.
| Sysop: | Chris Anderson |
|---|---|
| Location: | Murfreesboro, TN |
| Users: | 2 |
| Nodes: | 4 (0 / 4) |
| Uptime: | 38:12:42 |
| Calls: | 58 |
| Files: | 3 |
| Messages: | 20,289 |