Newly introduced findings

List of Findings

Error: CPPCHECK_WARNING (CWE-190): [#def1]
pipewire-1.6.4/spa/plugins/alsa/alsa-seq-bridge.c:460: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  458|   
#  459|   	if (info == NULL) {
#  460|-> 		spa_log_debug(state->log, "free port %d.%d %p", addr->client, addr->port, port);
#  461|   		if (port)
#  462|   			free_port(state, stream, port);

Error: CPPCHECK_WARNING (CWE-190): [#def2]
pipewire-1.6.4/spa/plugins/alsa/alsa-seq-bridge.c:472: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  470|   		} else if (port != NULL) {
#  471|   			if ((caps & stream->caps) != stream->caps) {
#  472|-> 				spa_log_debug(state->log, "free port %d.%d %p", addr->client, addr->port, port);
#  473|   				free_port(state, stream, port);
#  474|   			}

Error: CPPCHECK_WARNING (CWE-190): [#def3]
pipewire-1.6.4/spa/plugins/alsa/alsa-seq-bridge.c:839: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  837|   	info.size = size;
#  838|   
#  839|-> 	spa_log_debug(this->log, "%p: %p: io %d.%d %d %p %zd", this, port,
#  840|   			direction, port_id, id, data, size);
#  841|   

Error: CPPCHECK_WARNING (CWE-190): [#def4]
pipewire-1.6.4/spa/plugins/bluez5/bt-latency.h:73: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#   71|   	res = setsockopt(transport->fd, SOL_SOCKET, SO_TIMESTAMPING, &so_timestamping, sizeof(so_timestamping));
#   72|   	if (res < 0) {
#   73|-> 		spa_log_info(log, "setsockopt(SO_TIMESTAMPING) failed (kernel feature not enabled?): %d (%m)", errno);
#   74|   		return;
#   75|   	}

Error: CPPCHECK_WARNING (CWE-190): [#def5]
pipewire-1.6.4/spa/plugins/bluez5/bt-latency.h:202: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  200|   
#  201|   		if (serr.ee_data % UINT16_MAX != lat->impl.pending[tx_pos].pos) {
#  202|-> 			spa_log_debug(log, "fd:%d latency[%u] bad value %u", fd, tx_pos, serr.ee_data);
#  203|   			continue;
#  204|   		}

Error: CPPCHECK_WARNING (CWE-190): [#def6]
pipewire-1.6.4/spa/plugins/bluez5/decode-buffer.h:515: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  513|   
#  514|   	if (getsockopt(fd, SOL_SOCKET, SO_TIMESTAMPING, &flags, &len) < 0)
#  515|-> 		spa_log_info(log, "failed to get SO_TIMESTAMPING");
#  516|   
#  517|   	flags |= SOF_TIMESTAMPING_SOFTWARE | SOF_TIMESTAMPING_RX_SOFTWARE;

Error: CPPCHECK_WARNING (CWE-190): [#def7]
pipewire-1.6.4/spa/plugins/bluez5/decode-buffer.h:519: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  517|   	flags |= SOF_TIMESTAMPING_SOFTWARE | SOF_TIMESTAMPING_RX_SOFTWARE;
#  518|   	if (setsockopt(fd, SOL_SOCKET, SO_TIMESTAMPING, &flags, sizeof(flags)) < 0)
#  519|-> 		spa_log_info(log, "failed to set SO_TIMESTAMPING");
#  520|   
#  521|   	opt = 1;

Error: CPPCHECK_WARNING (CWE-190): [#def8]
pipewire-1.6.4/spa/plugins/bluez5/decode-buffer.h:523: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  521|   	opt = 1;
#  522|   	if (setsockopt(fd, SOL_BLUETOOTH, BT_PKT_SEQNUM, &opt, sizeof(opt)) < 0)
#  523|-> 		spa_log_info(log, "failed to set BT_PKT_SEQNUM");
#  524|   }
#  525|   

Error: CPPCHECK_WARNING (CWE-190): [#def9]
pipewire-1.6.4/spa/plugins/control/mixer.c:478: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  476|   			port->have_format = true;
#  477|   			port->types = types == 0 ? this->control_types : types;
#  478|-> 			spa_log_debug(this->log, "%p: set format on port %d:%d types:%08x %08x",
#  479|   					this, direction, port_id, port->types, this->control_types);
#  480|   		}

Scan Properties

analyzer-version-clippy1.95.0
analyzer-version-cppcheck2.20.0
analyzer-version-gcc16.0.1
analyzer-version-gcc-analyzer16.0.1
analyzer-version-shellcheck0.11.0
analyzer-version-unicontrol0.0.2
diffbase-analyzer-version-clippy1.95.0
diffbase-analyzer-version-cppcheck2.20.0
diffbase-analyzer-version-gcc16.0.1
diffbase-analyzer-version-gcc-analyzer16.0.1
diffbase-analyzer-version-shellcheck0.11.0
diffbase-analyzer-version-unicontrol0.0.2
diffbase-enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
diffbase-exit-code0
diffbase-hostip-172-16-1-19.us-west-2.compute.internal
diffbase-known-false-positives/usr/share/csmock/known-false-positives.js
diffbase-known-false-positives-rpmknown-false-positives-0.0.0.20260420.180315.gd39a405.main-1.el9.noarch
diffbase-mock-configfedora-rawhide-x86_64
diffbase-project-namepipewire-1.6.2-1.fc44
diffbase-store-results-to/tmp/tmpo0shbn7e/pipewire-1.6.2-1.fc44.tar.xz
diffbase-time-created2026-04-28 18:54:21
diffbase-time-finished2026-04-28 19:08:15
diffbase-toolcsmock
diffbase-tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'cppcheck,shellcheck,clippy,unicontrol,gcc' '-o' '/tmp/tmpo0shbn7e/pipewire-1.6.2-1.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpo0shbn7e/pipewire-1.6.2-1.fc44.src.rpm'
diffbase-tool-versioncsmock-3.8.5-1.el9
enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
exit-code0
hostip-172-16-1-19.us-west-2.compute.internal
known-false-positives/usr/share/csmock/known-false-positives.js
known-false-positives-rpmknown-false-positives-0.0.0.20260420.180315.gd39a405.main-1.el9.noarch
mock-configfedora-rawhide-x86_64
project-namepipewire-1.6.4-1.fc45
store-results-to/tmp/tmp_py_r693/pipewire-1.6.4-1.fc45.tar.xz
time-created2026-04-28 19:08:45
time-finished2026-04-28 19:21:55
titleNewly introduced findings
toolcsmock
tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'cppcheck,shellcheck,clippy,unicontrol,gcc' '-o' '/tmp/tmp_py_r693/pipewire-1.6.4-1.fc45.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmp_py_r693/pipewire-1.6.4-1.fc45.src.rpm'
tool-versioncsmock-3.8.5-1.el9