# dnsconfd-2.1.0-1

## List of Findings

    Error: SHELLCHECK_WARNING (CWE-457): [#def1]
    /usr/lib/dracut/modules.d/77dnsconfd/module-setup.sh:42:27: warning[SC2154]: initdir is referenced but not assigned.
    #   40|       inst_multiple -o /etc/pki/dns/extracted/pem/*
    #   41|
    #   42|->     $SYSTEMCTL -q --root "$initdir" enable dnsconfd.service
    #   43|   }

    Error: GCC_ANALYZER_WARNING (CWE-465): [#def2]
    dnsconfd-2.1.0/src/dns_managers/unbound_manager.c: scope_hint: In function ‘get_used_servers’
    dnsconfd-2.1.0/src/dns_managers/unbound_manager.c:25:18: warning[-Wanalyzer-deref-before-check]: check of ‘servers’ for NULL after already dereferencing it
    #   23|     unsigned char dnssec = cur_server->dnssec;
    #   24|
    #   25|->   for (; servers != NULL; servers = servers->next) {
    #   26|       cur_server = ((server_uri_t *)servers->data);
    #   27|       if (cur_server->priority < max_priority || cur_server->protocol < max_protocol ||

    Error: GCC_ANALYZER_WARNING (CWE-688): [#def3]
    dnsconfd-2.1.0/src/dns_managers/unbound_manager.c: scope_hint: In function ‘effective_ca_from_config’
    dnsconfd-2.1.0/src/dns_managers/unbound_manager.c:184:12: warning[-Wanalyzer-null-argument]: use of NULL ‘effective_ca’ where non-null expected
    /usr/include/glib-2.0/glib/galloca.h:35: included_from: Included from here.
    /usr/include/glib-2.0/glib.h:32: included_from: Included from here.
    dnsconfd-2.1.0/src/dns_managers/unbound_manager.h:1: included_from: Included from here.
    dnsconfd-2.1.0/src/dns_managers/unbound_manager.c:1: included_from: Included from here.
    /usr/include/string.h:202:14: note: argument 1 of ‘strdup’ must be non-null
    #  182|     }
    #  183|
    #  184|->   result = strdup(effective_ca);
    #  185|
    #  186|     free(backup_ca);

    Error: GCC_ANALYZER_WARNING (CWE-465): [#def4]
    dnsconfd-2.1.0/src/dns_managers/unbound_manager.c: scope_hint: In function ‘get_forward_add_command’
    dnsconfd-2.1.0/src/dns_managers/unbound_manager.c:340:18: warning[-Wanalyzer-deref-before-check]: check of ‘servers’ for NULL after already dereferencing it
    #  338|     g_ptr_array_add(argv_array, g_strdup(domain));
    #  339|
    #  340|->   for (; servers != NULL; servers = servers->next) {
    #  341|       cur_server = (server_uri_t *)servers->data;
    #  342|       ip_to_str(&cur_server->address, address_buffer);

    Error: GCC_ANALYZER_WARNING (CWE-775): [#def5]
    dnsconfd-2.1.0/src/dns_managers/unbound_manager.c: scope_hint: In function ‘write_resolv_conf’
    dnsconfd-2.1.0/src/dns_managers/unbound_manager.c:602:13: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(*config.resolv_conf_path, "w")’
    #  600|     g_hash_table_destroy(searches_table);
    #  601|
    #  602|->   if (config->resolver_options) {
    #  603|       fprintf(resolv_conf_file, "options %s\n", config->resolver_options);
    #  604|     }

    Error: GCC_ANALYZER_WARNING (CWE-401): [#def6]
    dnsconfd-2.1.0/src/dns_managers/unbound_manager.c:602:13: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(*config.resolv_conf_path, "w")’
    #  600|     g_hash_table_destroy(searches_table);
    #  601|
    #  602|->   if (config->resolver_options) {
    #  603|       fprintf(resolv_conf_file, "options %s\n", config->resolver_options);
    #  604|     }

    Error: GCC_ANALYZER_WARNING (CWE-775): [#def7]
    dnsconfd-2.1.0/src/fsm/fsm.c: scope_hint: In function ‘revert_resolv_conf’
    dnsconfd-2.1.0/src/fsm/fsm.c:260:63: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(*ctx_8(D)->config.resolv_conf_path, "w")’
    dnsconfd-2.1.0/src/fsm/fsm.c: scope_hint: In function ‘revert_resolv_conf’
    #  258|     FILE *resolv_conf_file = fopen(ctx->config->resolv_conf_path, "w");
    #  259|
    #  260|->   if (!resolv_conf_file || fprintf(resolv_conf_file, "%s", ctx->resolv_conf_backup->str) < 0) {
    #  261|       dnsconfd_log(LOG_ERR, "Failed to revert resolv.conf");
    #  262|       return EVENT_FAILURE;

    Error: GCC_ANALYZER_WARNING (CWE-401): [#def8]
    dnsconfd-2.1.0/src/fsm/fsm.c:260:63: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(*ctx_8(D)->config.resolv_conf_path, "w")’
    dnsconfd-2.1.0/src/fsm/fsm.c: scope_hint: In function ‘revert_resolv_conf’
    #  258|     FILE *resolv_conf_file = fopen(ctx->config->resolv_conf_path, "w");
    #  259|
    #  260|->   if (!resolv_conf_file || fprintf(resolv_conf_file, "%s", ctx->resolv_conf_backup->str) < 0) {
    #  261|       dnsconfd_log(LOG_ERR, "Failed to revert resolv.conf");
    #  262|       return EVENT_FAILURE;

    Error: CPPCHECK_WARNING (CWE-404): [#def9]
    dnsconfd-2.1.0/src/fsm/fsm.c:265: error[resourceLeak]: Resource leak: resolv_conf_file
    #  263|     }
    #  264|
    #  265|->   return EVENT_SUCCESS;
    #  266|   }
    #  267|

    Error: CPPCHECK_WARNING (CWE-476): [#def10]
    dnsconfd-2.1.0/unittests/test_server_uri.c:11: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: server
    #    9|   static server_uri_t *create_test_server(int priority, dns_protocol_t protocol, int dnssec) {
    #   10|     server_uri_t *server = calloc(1, sizeof(server_uri_t));
    #   11|->   server->priority = priority;
    #   12|     server->protocol = protocol;
    #   13|     server->dnssec = dnssec;

    Error: GCC_ANALYZER_WARNING (CWE-476): [#def11]
    dnsconfd-2.1.0/unittests/test_server_uri.c:11:20: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘server’
    dnsconfd-2.1.0/unittests/test_server_uri.c:3: included_from: Included from here.
    dnsconfd-2.1.0/unittests/test_server_uri.c: scope_hint: In function ‘test_server_list_to_hash_table_networks_fn’
    #    9|   static server_uri_t *create_test_server(int priority, dns_protocol_t protocol, int dnssec) {
    #   10|     server_uri_t *server = calloc(1, sizeof(server_uri_t));
    #   11|->   server->priority = priority;
    #   12|     server->protocol = protocol;
    #   13|     server->dnssec = dnssec;

    Error: CPPCHECK_WARNING (CWE-476): [#def12]
    dnsconfd-2.1.0/unittests/test_server_uri.c:12: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: server
    #   10|     server_uri_t *server = calloc(1, sizeof(server_uri_t));
    #   11|     server->priority = priority;
    #   12|->   server->protocol = protocol;
    #   13|     server->dnssec = dnssec;
    #   14|     return server;

    Error: CPPCHECK_WARNING (CWE-476): [#def13]
    dnsconfd-2.1.0/unittests/test_server_uri.c:13: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: server
    #   11|     server->priority = priority;
    #   12|     server->protocol = protocol;
    #   13|->   server->dnssec = dnssec;
    #   14|     return server;
    #   15|   }

    Error: CPPCHECK_WARNING (CWE-476): [#def14]
    dnsconfd-2.1.0/unittests/test_server_uri.c:50: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: uri
    #   48|     int ret = server_uri_t_init_from_string("dns+udp://127.0.0.1:53", uri);
    #   49|     ck_assert_int_eq(ret, 0);
    #   50|->   ck_assert_int_eq(uri->protocol, DNS_UDP);
    #   51|
    #   52|     struct sockaddr_in *s4 = (struct sockaddr_in *)&uri->address;

    Error: CPPCHECK_WARNING (CWE-476): [#def15]
    dnsconfd-2.1.0/unittests/test_unbound_manager.c:15: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: server
    #   13|                                      const char *interface) {
    #   14|     server_uri_t *server = calloc(1, sizeof(server_uri_t));
    #   15|->   server->priority = priority;
    #   16|     server->protocol = protocol;
    #   17|     server->dnssec = dnssec;

    Error: GCC_ANALYZER_WARNING (CWE-476): [#def16]
    dnsconfd-2.1.0/unittests/test_unbound_manager.c:15:20: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘server’
    dnsconfd-2.1.0/unittests/test_unbound_manager.c: scope_hint: In function ‘test_get_used_servers_mixed_fn’
    #   13|                                      const char *interface) {
    #   14|     server_uri_t *server = calloc(1, sizeof(server_uri_t));
    #   15|->   server->priority = priority;
    #   16|     server->protocol = protocol;
    #   17|     server->dnssec = dnssec;

    Error: CPPCHECK_WARNING (CWE-476): [#def17]
    dnsconfd-2.1.0/unittests/test_unbound_manager.c:16: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: server
    #   14|     server_uri_t *server = calloc(1, sizeof(server_uri_t));
    #   15|     server->priority = priority;
    #   16|->   server->protocol = protocol;
    #   17|     server->dnssec = dnssec;
    #   18|     if (interface) {

    Error: CPPCHECK_WARNING (CWE-476): [#def18]
    dnsconfd-2.1.0/unittests/test_unbound_manager.c:17: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: server
    #   15|     server->priority = priority;
    #   16|     server->protocol = protocol;
    #   17|->   server->dnssec = dnssec;
    #   18|     if (interface) {
    #   19|       strncpy(server->interface, interface, IFNAMSIZ - 1);

    Error: CPPCHECK_WARNING (CWE-476): [#def19]
    dnsconfd-2.1.0/unittests/test_unbound_manager.c:19: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: server
    #   17|     server->dnssec = dnssec;
    #   18|     if (interface) {
    #   19|->     strncpy(server->interface, interface, IFNAMSIZ - 1);
    #   20|     }
    #   21|     return server;

## Scan Properties

analyzer-version-clippy | 1.94.0
analyzer-version-cppcheck | 2.20.0
analyzer-version-gcc | 16.0.1
analyzer-version-gcc-analyzer | 16.0.1
analyzer-version-shellcheck | 0.11.0
analyzer-version-unicontrol | 0.0.2
enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol
exit-code | 0
host | ip-172-16-1-126.us-west-2.compute.internal
known-false-positives | /usr/share/csmock/known-false-positives.js
known-false-positives-rpm | known-false-positives-0.0.0.20260320.200800.gd35503f.main-1.el9.noarch
mock-config | fedora-rawhide-x86_64
project-name | dnsconfd-2.1.0-1
store-results-to | /tmp/tmpzfe5i2oz/dnsconfd-2.1.0-1.tar.xz
time-created | 2026-03-24 12:21:19
time-finished | 2026-03-24 12:22:25
tool | csmock
tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'cppcheck,gcc,shellcheck,clippy,unicontrol' '-o' '/tmp/tmpzfe5i2oz/dnsconfd-2.1.0-1.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '/tmp/tmpzfe5i2oz/dnsconfd-2.1.0-1.src.rpm'
tool-version | csmock-3.8.4.20260302.153719.g8203630-1.el9