Fixed findings

List of Findings

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1]
glibc-2.43-8-g48f5a05a7a/io/ftw.c:263:1: warning[-Wanalyzer-malloc-leak]: leak of ‘newp’
glibc-2.43-8-g48f5a05a7a/io/ftw.c:836:1: enter_function: entry to ‘__new_nftw’
glibc-2.43-8-g48f5a05a7a/io/ftw.c:838:6: branch_false: following ‘false’ branch...
glibc-2.43-8-g48f5a05a7a/io/ftw.c:844:10: branch_false: ...to here
glibc-2.43-8-g48f5a05a7a/io/ftw.c:844:10: call_function: calling ‘ftw_startup’ from ‘__new_nftw’
#  261|     newp->ino = st->st_ino;
#  262|     return __tsearch (newp, &data->known_objects, object_compare) ? 0 : -1;
#  263|-> }
#  264|   
#  265|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def2]
glibc-2.43-8-g48f5a05a7a/io/ftw.c:272:10: warning[-Wanalyzer-malloc-leak]: leak of ‘newp’
glibc-2.43-8-g48f5a05a7a/io/ftw.c:836:1: enter_function: entry to ‘__new_nftw’
glibc-2.43-8-g48f5a05a7a/io/ftw.c:838:6: branch_false: following ‘false’ branch...
glibc-2.43-8-g48f5a05a7a/io/ftw.c:844:10: branch_false: ...to here
glibc-2.43-8-g48f5a05a7a/io/ftw.c:844:10: call_function: calling ‘ftw_startup’ from ‘__new_nftw’
#  270|     obj.dev = st->st_dev;
#  271|     obj.ino = st->st_ino;
#  272|->   return __tfind (&obj, &data->known_objects, object_compare) != NULL;
#  273|   }
#  274|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def3]
glibc-2.43-8-g48f5a05a7a/string/bits/string_fortified.h:29:10: warning[-Wanalyzer-null-argument]: use of NULL ‘address’ where non-null expected
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:291:1: enter_function: entry to ‘__check_pf’
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:315:10: branch_true: following ‘true’ branch...
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:318:11: call_function: inlined call to ‘memset’ from ‘__check_pf’
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:323:14: branch_true: following ‘true’ branch...
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:324:18: branch_true: ...to here
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:323:15: branch_true: following ‘true’ branch...
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:326:38: branch_true: ...to here
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:326:20: call_function: calling ‘make_request’ from ‘__check_pf’
#argument 2 of ‘__builtin___memcpy_chk’ must be non-null
#   27|   	       size_t __len))
#   28|   {
#   29|->   return __builtin___memcpy_chk (__dest, __src, __len,
#   30|   				 __glibc_objsize0 (__dest));
#   31|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def4]
glibc-2.43-8-g48f5a05a7a/support/resolv_test.c:1135:8: warning[-Wanalyzer-malloc-leak]: leak of ‘xmalloc(192)’
glibc-2.43-8-g48f5a05a7a/support/resolv_test.c:1169:6: branch_false: following ‘false’ branch...
glibc-2.43-8-g48f5a05a7a/support/resolv_test.c:1172:6: branch_false: ...to here
glibc-2.43-8-g48f5a05a7a/support/resolv_test.c:1172:6: branch_false: following ‘false’ branch...
glibc-2.43-8-g48f5a05a7a/support/resolv_test.c:1178:3: branch_false: ...to here
glibc-2.43-8-g48f5a05a7a/support/resolv_test.c:1135:8: danger: ‘xmalloc(192)’ leaks here; was allocated at [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
# 1133|     };
# 1134|   
# 1135|->   if (!config.disable_redirect)
# 1136|       resolv_test_init ();
# 1137|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def5]
glibc-2.43-8-g48f5a05a7a/support/resolv_test.c:1135:8: warning[-Wanalyzer-malloc-leak]: leak of ‘xmalloc(288)’
glibc-2.43-8-g48f5a05a7a/support/resolv_test.c:1169:6: branch_false: following ‘false’ branch...
glibc-2.43-8-g48f5a05a7a/support/resolv_test.c:1172:6: branch_false: ...to here
glibc-2.43-8-g48f5a05a7a/support/resolv_test.c:1172:6: branch_false: following ‘false’ branch...
glibc-2.43-8-g48f5a05a7a/support/resolv_test.c:1178:3: branch_false: ...to here
glibc-2.43-8-g48f5a05a7a/support/resolv_test.c:1135:8: danger: ‘xmalloc(288)’ leaks here; was allocated at [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
# 1133|     };
# 1134|   
# 1135|->   if (!config.disable_redirect)
# 1136|       resolv_test_init ();
# 1137|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def6]
glibc-2.43-8-g48f5a05a7a/support/timespec.c:88:13: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘norm.<Uc1e0>’
glibc-2.43-8-g48f5a05a7a/support/timespec.c:84:6: branch_true: following ‘true’ branch...
glibc-2.43-8-g48f5a05a7a/support/timespec.c:86:20: branch_true: ...to here
glibc-2.43-8-g48f5a05a7a/support/timespec.c:88:13: danger: use of uninitialized value ‘norm.<Uc1e0>’ here
#   86|        norm.tv_sec = (time.tv_nsec < 0) ? TYPE_MINIMUM (time_t): TYPE_MAXIMUM (time_t);
#   87|        norm.tv_nsec = (time.tv_nsec < 0) ? -1 * (TIMESPEC_HZ - 1) : TIMESPEC_HZ - 1;
#   88|->      return norm;
#   89|      }
#   90|     norm.tv_nsec = time.tv_nsec % TIMESPEC_HZ;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def7]
glibc-2.43-8-g48f5a05a7a/support/timespec.c:91:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘norm.<Uc1e0>’
glibc-2.43-8-g48f5a05a7a/support/timespec.c:84:6: branch_false: following ‘false’ branch...
glibc-2.43-8-g48f5a05a7a/support/timespec.c:90:18: branch_false: ...to here
glibc-2.43-8-g48f5a05a7a/support/timespec.c:91:10: danger: use of uninitialized value ‘norm.<Uc1e0>’ here
#   89|      }
#   90|     norm.tv_nsec = time.tv_nsec % TIMESPEC_HZ;
#   91|->   return norm;
#   92|   }
#   93|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def8]
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:242:35: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘address’
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:291:1: enter_function: entry to ‘__check_pf’
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:315:10: branch_true: following ‘true’ branch...
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:318:11: call_function: inlined call to ‘memset’ from ‘__check_pf’
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:323:14: branch_true: following ‘true’ branch...
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:324:18: branch_true: ...to here
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:323:15: branch_true: following ‘true’ branch...
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:326:38: branch_true: ...to here
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:326:20: call_function: calling ‘make_request’ from ‘__check_pf’
#  240|   		  info->addr[1] = 0;
#  241|   		  info->addr[2] = htonl (0xffff);
#  242|-> 		  info->addr[3] = *(const in_addr_t *) address;
#  243|   		}
#  244|   	      else

Error: GCC_ANALYZER_WARNING (CWE-416): [#def9]
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:242:35: warning[-Wanalyzer-use-after-free]: use after ‘free’ of ‘address’
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:291:1: enter_function: entry to ‘__check_pf’
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:315:10: branch_true: following ‘true’ branch...
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:318:11: call_function: inlined call to ‘memset’ from ‘__check_pf’
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:323:14: branch_true: following ‘true’ branch...
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:324:18: branch_true: ...to here
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:323:15: branch_true: following ‘true’ branch...
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:326:38: branch_true: ...to here
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/check_pf.c:326:20: call_function: calling ‘make_request’ from ‘__check_pf’
#  240|   		  info->addr[1] = 0;
#  241|   		  info->addr[2] = htonl (0xffff);
#  242|-> 		  info->addr[3] = *(const in_addr_t *) address;
#  243|   		}
#  244|   	      else

Error: COMPILER_WARNING: [#def10]
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/include/sys/mount.h:22: included_from: Included from here.
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/umount2.c:19: included_from: Included from here.
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/sys/mount.h:268:9: warning: ‘OPEN_TREE_CLONE’ redefined
#  268 | #define OPEN_TREE_CLONE    1         /* Clone the target tree and attach the clone */
#      |         ^~~~~~~~~~~~~~~
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/sys/mount.h:32: included_from: Included from here.
/usr/include/linux/mount.h:64:9: note: this is the location of the previous definition
#   64 | #define OPEN_TREE_CLONE         (1 << 0)        /* Clone the target tree and attach the clone */
#      |         ^~~~~~~~~~~~~~~
#  266|   
#  267|   /* open_tree flags.  */
#  268|-> #define OPEN_TREE_CLONE    1         /* Clone the target tree and attach the clone */
#  269|   #define OPEN_TREE_CLOEXEC  O_CLOEXEC /* Close the file on execve() */
#  270|   

Error: COMPILER_WARNING: [#def11]
glibc-2.43-8-g48f5a05a7a/sysdeps/unix/sysv/linux/sys/mount.h:268:9: warning[warning]: ‘OPEN_TREE_CLONE’ redefined
#  266|   
#  267|   /* open_tree flags.  */
#  268|-> #define OPEN_TREE_CLONE    1         /* Clone the target tree and attach the clone */
#  269|   #define OPEN_TREE_CLOEXEC  O_CLOEXEC /* Close the file on execve() */
#  270|

Scan Properties

analyzer-version-clippy1.95.0
analyzer-version-cppcheck2.20.0
analyzer-version-gcc16.0.1
analyzer-version-gcc-analyzer16.0.1
analyzer-version-shellcheck0.11.0
analyzer-version-unicontrol0.0.2
diffbase-analyzer-version-clippy1.95.0
diffbase-analyzer-version-cppcheck2.20.0
diffbase-analyzer-version-gcc16.0.1
diffbase-analyzer-version-gcc-analyzer16.0.1
diffbase-analyzer-version-shellcheck0.11.0
diffbase-analyzer-version-unicontrol0.0.2
diffbase-enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
diffbase-exit-code0
diffbase-hostip-172-16-1-205.us-west-2.compute.internal
diffbase-known-false-positives/usr/share/csmock/known-false-positives.js
diffbase-known-false-positives-rpmknown-false-positives-0.0.0.20260420.180315.gd39a405.main-1.el9.noarch
diffbase-mock-configfedora-rawhide-x86_64
diffbase-project-nameglibc-2.43.9000-12.fc45
diffbase-store-results-to/tmp/tmpcn1lvhuj/glibc-2.43.9000-12.fc45.tar.xz
diffbase-time-created2026-04-28 17:04:37
diffbase-time-finished2026-04-28 18:42:07
diffbase-toolcsmock
diffbase-tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'cppcheck,shellcheck,clippy,unicontrol,gcc' '-o' '/tmp/tmpcn1lvhuj/glibc-2.43.9000-12.fc45.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpcn1lvhuj/glibc-2.43.9000-12.fc45.src.rpm'
diffbase-tool-versioncsmock-3.8.5-1.el9
enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
exit-code0
hostip-172-16-1-205.us-west-2.compute.internal
known-false-positives/usr/share/csmock/known-false-positives.js
known-false-positives-rpmknown-false-positives-0.0.0.20260420.180315.gd39a405.main-1.el9.noarch
mock-configfedora-rawhide-x86_64
project-nameglibc-2.43-2.fc44
store-results-to/tmp/tmpbskuja6g/glibc-2.43-2.fc44.tar.xz
time-created2026-04-28 15:30:48
time-finished2026-04-28 17:03:23
titleFixed findings
toolcsmock
tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'cppcheck,shellcheck,clippy,unicontrol,gcc' '-o' '/tmp/tmpbskuja6g/glibc-2.43-2.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpbskuja6g/glibc-2.43-2.fc44.src.rpm'
tool-versioncsmock-3.8.5-1.el9