Error: GCC_ANALYZER_WARNING (CWE-688): [#def1] libarchive-3.8.4/libarchive/archive_read_support_filter_program.c:152:17: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL 'malloc(signature_len)' where non-null expected libarchive-3.8.4/libarchive/archive_read_support_filter_program.c:143:12: branch_false: following 'false' branch (when 'state' is non-NULL)... libarchive-3.8.4/libarchive/archive_read_support_filter_program.c:145:22: branch_false: ...to here libarchive-3.8.4/libarchive/archive_read_support_filter_program.c:146:12: branch_false: following 'false' branch... libarchive-3.8.4/libarchive/archive_read_support_filter_program.c:149:13: branch_false: ...to here libarchive-3.8.4/libarchive/archive_read_support_filter_program.c:149:12: branch_true: following 'true' branch... libarchive-3.8.4/libarchive/archive_read_support_filter_program.c:150:17: branch_true: ...to here libarchive-3.8.4/libarchive/archive_read_support_filter_program.c:151:36: acquire_memory: this call could return NULL libarchive-3.8.4/libarchive/archive_read_support_filter_program.c:152:17: danger: argument 1 ('malloc(signature_len)') from [(7)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/6) could be NULL where non-null expected # 150| state->signature_len = signature_len; # 151| state->signature = malloc(signature_len); # 152|-> memcpy(state->signature, signature, signature_len); # 153| } # 154| Error: CPPCHECK_WARNING (CWE-457): [#def2] libarchive-3.8.4/libarchive/archive_util.c:461: error[uninitvar]: Uninitialized variable: rgid # 459| if (getresgid(&ruid, &egid, &sgid) != 0) # 460| return (-1); # 461|-> if (rgid != egid || rgid != sgid) # 462| return (1); # 463| #elif HAVE_GETEUID Error: GCC_ANALYZER_WARNING (CWE-457): [#def3] libarchive-3.8.4/libarchive/archive_util.c:461:12: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value 'rgid' libarchive-3.8.4/libarchive/archive_util.c:455:12: branch_false: following 'false' branch... libarchive-3.8.4/libarchive/archive_util.c:457:13: branch_false: ...to here libarchive-3.8.4/libarchive/archive_util.c:457:12: branch_false: following 'false' branch... libarchive-3.8.4/libarchive/archive_util.c:459:12: branch_false: following 'false' branch... libarchive-3.8.4/libarchive/archive_util.c:461:13: branch_false: ...to here libarchive-3.8.4/libarchive/archive_util.c:461:12: danger: use of uninitialized value 'rgid' here # 459| if (getresgid(&ruid, &egid, &sgid) != 0) # 460| return (-1); # 461|-> if (rgid != egid || rgid != sgid) # 462| return (1); # 463| #elif HAVE_GETEUID Error: COMPILER_WARNING (CWE-457): [#def4] libarchive-3.8.4/libarchive/archive_util.c:461:12: warning[-Wmaybe-uninitialized]: 'rgid' may be used uninitialized # 461 | if (rgid != egid || rgid != sgid) # | ^ libarchive-3.8.4/libarchive/archive_util.c: scope_hint: In function '__archive_get_tempdir' libarchive-3.8.4/libarchive/archive_util.c:454:15: note: 'rgid' was declared here # 454 | gid_t rgid, egid, sgid; # | ^~~~ # 459| if (getresgid(&ruid, &egid, &sgid) != 0) # 460| return (-1); # 461|-> if (rgid != egid || rgid != sgid) # 462| return (1); # 463| #elif HAVE_GETEUID
| analyzer-version-clippy | 1.95.0 |
| analyzer-version-cppcheck | 2.20.0 |
| analyzer-version-gcc | 16.1.1 |
| analyzer-version-gcc-analyzer | 16.1.1 |
| analyzer-version-shellcheck | 0.11.0 |
| analyzer-version-unicontrol | 0.0.2 |
| diffbase-analyzer-version-clippy | 1.95.0 |
| diffbase-analyzer-version-cppcheck | 2.20.0 |
| diffbase-analyzer-version-gcc | 16.1.1 |
| diffbase-analyzer-version-gcc-analyzer | 16.1.1 |
| diffbase-analyzer-version-shellcheck | 0.11.0 |
| diffbase-analyzer-version-unicontrol | 0.0.2 |
| diffbase-enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol |
| diffbase-exit-code | 0 |
| diffbase-host | ip-172-16-1-61.us-west-2.compute.internal |
| diffbase-known-false-positives | /usr/share/csmock/known-false-positives.js |
| diffbase-known-false-positives-rpm | known-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch |
| diffbase-mock-config | fedora-rawhide-x86_64 |
| diffbase-project-name | libarchive-3.8.7-1.fc45 |
| diffbase-store-results-to | /tmp/tmp32lt0k09/libarchive-3.8.7-1.fc45.tar.xz |
| diffbase-time-created | 2026-06-01 14:10:44 |
| diffbase-time-finished | 2026-06-01 14:12:51 |
| diffbase-tool | csmock |
| diffbase-tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'shellcheck,cppcheck,clippy,unicontrol,gcc' '-o' '/tmp/tmp32lt0k09/libarchive-3.8.7-1.fc45.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmp32lt0k09/libarchive-3.8.7-1.fc45.src.rpm' |
| diffbase-tool-version | csmock-3.8.5.20260529.133039.g6f3b5c6-1.el9 |
| enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol |
| exit-code | 0 |
| host | ip-172-16-1-61.us-west-2.compute.internal |
| known-false-positives | /usr/share/csmock/known-false-positives.js |
| known-false-positives-rpm | known-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch |
| mock-config | fedora-rawhide-x86_64 |
| project-name | libarchive-3.8.4-2.fc44 |
| store-results-to | /tmp/tmpzjjwzwnh/libarchive-3.8.4-2.fc44.tar.xz |
| time-created | 2026-06-01 14:08:00 |
| time-finished | 2026-06-01 14:10:37 |
| title | Fixed findings |
| tool | csmock |
| tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'shellcheck,cppcheck,clippy,unicontrol,gcc' '-o' '/tmp/tmpzjjwzwnh/libarchive-3.8.4-2.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpzjjwzwnh/libarchive-3.8.4-2.fc44.src.rpm' |
| tool-version | csmock-3.8.5.20260529.133039.g6f3b5c6-1.el9 |