Task #119239 - added.err
back to task #119239download
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c: scope_hint: In function ‘amd_cp_print_packet_gfx11’
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:1900:19: warning[-Wunused-variable]: unused variable ‘dw2’
# 1900 | uint32_t dw2 = ac_ib_get(ib);
# | ^~~
# 1898| if (pkt_count_field == 1) break;
# 1899|
# 1900|-> uint32_t dw2 = ac_ib_get(ib);
# 1901| assert(!dw2 && "reserved packet fields should be 0 for COND_EXEC, word 2");
# 1902| if (pkt_count_field == 2) break;
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:3069:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 3069 | uint32_t dw0 = ac_ib_get(ib);
# | ^~~
# 3067| assert(0 && "packet PFP_SYNC_ME is not supported by MEC");
# 3068| } else {
# 3069|-> uint32_t dw0 = ac_ib_get(ib);
# 3070| assert(!dw0 && "reserved packet fields should be 0 for PFP_SYNC_ME, word 0");
# 3071| }
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:4603:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 4603 | uint32_t dw0 = ac_ib_get(ib);
# | ^~~
# 4601| case 0x95: { /* PKT3_HDP_FLUSH */
# 4602| if (ib->ip_type == AMD_IP_COMPUTE) {
# 4603|-> uint32_t dw0 = ac_ib_get(ib);
# 4604| assert(!dw0 && "reserved packet fields should be 0 for HDP_FLUSH, word 0");
# 4605| } else {
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:4606:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 4606 | uint32_t dw0 = ac_ib_get(ib);
# | ^~~
# 4604| assert(!dw0 && "reserved packet fields should be 0 for HDP_FLUSH, word 0");
# 4605| } else {
# 4606|-> uint32_t dw0 = ac_ib_get(ib);
# 4607| assert(!dw0 && "reserved packet fields should be 0 for HDP_FLUSH, word 0");
# 4608| }
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:5335:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5335 | uint32_t dw0 = ac_ib_get(ib);
# | ^~~
# 5333| case 0xD0: { /* PKT3_PROTECTED_FENCE_SIGNAL */
# 5334| if (ib->ip_type == AMD_IP_COMPUTE) {
# 5335|-> uint32_t dw0 = ac_ib_get(ib);
# 5336| assert(!dw0 && "reserved packet fields should be 0 for PROTECTED_FENCE_SIGNAL, word 0");
# 5337| } else {
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:5338:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5338 | uint32_t dw0 = ac_ib_get(ib);
# | ^~~
# 5336| assert(!dw0 && "reserved packet fields should be 0 for PROTECTED_FENCE_SIGNAL, word 0");
# 5337| } else {
# 5338|-> uint32_t dw0 = ac_ib_get(ib);
# 5339| assert(!dw0 && "reserved packet fields should be 0 for PROTECTED_FENCE_SIGNAL, word 0");
# 5340| }
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:5350:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5350 | uint32_t dw0 = ac_ib_get(ib);
# | ^~~
# 5348| case 0xD2: { /* PKT3_CLEANER_SHADER */
# 5349| if (ib->ip_type == AMD_IP_COMPUTE) {
# 5350|-> uint32_t dw0 = ac_ib_get(ib);
# 5351| assert(!dw0 && "reserved packet fields should be 0 for CLEANER_SHADER, word 0");
# 5352| } else {
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:5353:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5353 | uint32_t dw0 = ac_ib_get(ib);
# | ^~~
# 5351| assert(!dw0 && "reserved packet fields should be 0 for CLEANER_SHADER, word 0");
# 5352| } else {
# 5353|-> uint32_t dw0 = ac_ib_get(ib);
# 5354| assert(!dw0 && "reserved packet fields should be 0 for CLEANER_SHADER, word 0");
# 5355| }
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c: scope_hint: In function ‘amd_cp_print_packet_gfx12’
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:1757:19: warning[-Wunused-variable]: unused variable ‘dw2’
# 1757 | uint32_t dw2 = ac_ib_get(ib);
# | ^~~
# 1755| if (pkt_count_field == 1) break;
# 1756|
# 1757|-> uint32_t dw2 = ac_ib_get(ib);
# 1758| assert(!dw2 && "reserved packet fields should be 0 for COND_EXEC, word 2");
# 1759| if (pkt_count_field == 2) break;
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:2923:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 2923 | uint32_t dw0 = ac_ib_get(ib);
# | ^~~
# 2921| assert(0 && "packet PFP_SYNC_ME is not supported by MEC");
# 2922| } else {
# 2923|-> uint32_t dw0 = ac_ib_get(ib);
# 2924| assert(!dw0 && "reserved packet fields should be 0 for PFP_SYNC_ME, word 0");
# 2925| }
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:4453:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 4453 | uint32_t dw0 = ac_ib_get(ib);
# | ^~~
# 4451| case 0x95: { /* PKT3_HDP_FLUSH */
# 4452| if (ib->ip_type == AMD_IP_COMPUTE) {
# 4453|-> uint32_t dw0 = ac_ib_get(ib);
# 4454| assert(!dw0 && "reserved packet fields should be 0 for HDP_FLUSH, word 0");
# 4455| } else {
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:4456:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 4456 | uint32_t dw0 = ac_ib_get(ib);
# | ^~~
# 4454| assert(!dw0 && "reserved packet fields should be 0 for HDP_FLUSH, word 0");
# 4455| } else {
# 4456|-> uint32_t dw0 = ac_ib_get(ib);
# 4457| assert(!dw0 && "reserved packet fields should be 0 for HDP_FLUSH, word 0");
# 4458| }
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:5491:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5491 | uint32_t dw0 = ac_ib_get(ib);
# | ^~~
# 5489| case 0xD0: { /* PKT3_PROTECTED_FENCE_SIGNAL */
# 5490| if (ib->ip_type == AMD_IP_COMPUTE) {
# 5491|-> uint32_t dw0 = ac_ib_get(ib);
# 5492| assert(!dw0 && "reserved packet fields should be 0 for PROTECTED_FENCE_SIGNAL, word 0");
# 5493| } else {
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:5494:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5494 | uint32_t dw0 = ac_ib_get(ib);
# | ^~~
# 5492| assert(!dw0 && "reserved packet fields should be 0 for PROTECTED_FENCE_SIGNAL, word 0");
# 5493| } else {
# 5494|-> uint32_t dw0 = ac_ib_get(ib);
# 5495| assert(!dw0 && "reserved packet fields should be 0 for PROTECTED_FENCE_SIGNAL, word 0");
# 5496| }
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:5506:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5506 | uint32_t dw0 = ac_ib_get(ib);
# | ^~~
# 5504| case 0xD2: { /* PKT3_CLEANER_SHADER */
# 5505| if (ib->ip_type == AMD_IP_COMPUTE) {
# 5506|-> uint32_t dw0 = ac_ib_get(ib);
# 5507| assert(!dw0 && "reserved packet fields should be 0 for CLEANER_SHADER, word 0");
# 5508| } else {
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:5509:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5509 | uint32_t dw0 = ac_ib_get(ib);
# | ^~~
# 5507| assert(!dw0 && "reserved packet fields should be 0 for CLEANER_SHADER, word 0");
# 5508| } else {
# 5509|-> uint32_t dw0 = ac_ib_get(ib);
# 5510| assert(!dw0 && "reserved packet fields should be 0 for CLEANER_SHADER, word 0");
# 5511| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:2161:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘rt’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:623:1: enter_function: entry to ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: calling ‘pan_nir_tile_default_coverage’ from ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: return_function: returning to ‘bi_lower_load_output’ from ‘pan_nir_tile_default_coverage’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: inlined call to ‘nir_imm_int’ from ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: inlined call to ‘nir_imm_int’ from ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: calling ‘pan_nir_tile_location_sample’ from ‘bi_lower_load_output’
# 2159| nir_u2u8(nir_builder *build, nir_def *src0)
# 2160| {
# 2161|-> if (src0->bit_size == 8)
# 2162| return src0;
# 2163| return nir_build_alu1(build, nir_op_u2u8, src0);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:2161:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘sample’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:623:1: enter_function: entry to ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: calling ‘pan_nir_tile_default_coverage’ from ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: return_function: returning to ‘bi_lower_load_output’ from ‘pan_nir_tile_default_coverage’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: inlined call to ‘nir_imm_int’ from ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: inlined call to ‘nir_imm_int’ from ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: calling ‘pan_nir_tile_location_sample’ from ‘bi_lower_load_output’
# 2159| nir_u2u8(nir_builder *build, nir_def *src0)
# 2160| {
# 2161|-> if (src0->bit_size == 8)
# 2162| return src0;
# 2163| return nir_build_alu1(build, nir_op_u2u8, src0);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:14102:58: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:108:1: enter_function: entry to ‘pan_nir_lower_fs_inputs’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:117:11: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘pan_nir_lower_fs_inputs’
#14100| indices.io_semantics.num_slots = 1;
#14101| if (!indices.src_type)
#14102|-> indices.src_type = (nir_alu_type)(nir_type_float | src0->bit_size);
#14103| nir_intrinsic_set_src_type(intrin, indices.src_type);
#14104| nir_intrinsic_set_io_semantics(intrin, indices.io_semantics);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:821:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:6969:28: enter_function: entry to ‘vk_enqueue_cmd_bind_descriptor_buffer_embedded_samplers_ext’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:6976:7: branch_false: following ‘false’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:6978:4: branch_false: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:6981:4: call_function: calling ‘enqueue_pipeline_layout’ from ‘vk_enqueue_cmd_bind_descriptor_buffer_embedded_samplers_ext’
# 819| VK_FROM_HANDLE(vk_pipeline_layout, vklayout, layout);
# 820| vk_pipeline_layout_ref(vklayout);
# 821|-> util_dynarray_append(&queue->pipeline_layouts, vklayout);
# 822| }
# 823|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:829:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7868:28: enter_function: entry to ‘vk_enqueue_cmd_bind_descriptor_buffer_embedded_samplers2_ext’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7873:7: branch_false: following ‘false’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7875:4: branch_false: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7876:7: branch_true: following ‘true’ branch (when ‘pBindDescriptorBufferEmbeddedSamplersInfo’ is non-NULL)...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7877:108: branch_true: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7878:10: branch_false: following ‘false’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7879:7: branch_false: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7880:7: call_function: calling ‘enqueue_pipeline_layout’ from ‘vk_enqueue_cmd_bind_descriptor_buffer_embedded_samplers2_ext’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7880:7: return_function: returning to ‘vk_enqueue_cmd_bind_descriptor_buffer_embedded_samplers2_ext’ from ‘enqueue_pipeline_layout’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7885:14: branch_true: following ‘true’ branch (when ‘pnext’ is non-NULL)...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7886:27: branch_true: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7889:16: branch_false: following ‘false’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7890:13: branch_false: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7895:19: branch_false: following ‘false’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7896:114: branch_false: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7897:38: branch_true: following ‘true’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7898:52: branch_true: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7898:19: call_function: calling ‘enqueue_descriptor_layout’ from ‘vk_enqueue_cmd_bind_descriptor_buffer_embedded_samplers2_ext’
# 827| VK_FROM_HANDLE(vk_descriptor_set_layout, vklayout, layout);
# 828| vk_descriptor_set_layout_ref(vklayout);
# 829|-> util_dynarray_append(&queue->set_layouts, vklayout);
# 830| }
# 831|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:837:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7754:28: enter_function: entry to ‘vk_enqueue_cmd_push_descriptor_set_with_template2’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7759:7: branch_false: following ‘false’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7761:4: branch_false: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7762:7: branch_true: following ‘true’ branch (when ‘pPushDescriptorSetWithTemplateInfo’ is non-NULL)...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7763:90: branch_true: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7764:10: branch_false: following ‘false’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7765:7: branch_false: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7766:7: call_function: calling ‘enqueue_descriptor_template’ from ‘vk_enqueue_cmd_push_descriptor_set_with_template2’
# 835| VK_FROM_HANDLE(vk_descriptor_update_template, vktempl, templ);
# 836| vk_descriptor_update_template_ref(vktempl);
# 837|-> util_dynarray_append(&queue->update_templates, vktempl);
# 838| }
# 839|
Error: GCC_ANALYZER_WARNING (CWE-401):
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:731:11: warning[-Wanalyzer-malloc-leak]: leak of ‘dec’
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:672:1: enter_function: entry to ‘ac_uvd_create_video_decoder’
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:674:33: acquire_memory: allocated here
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:675:7: branch_false: following ‘false’ branch (when ‘dec’ is non-NULL)...
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:678:18: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:722:29: call_function: calling ‘get_session_size’ from ‘ac_uvd_create_video_decoder’
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:722:29: return_function: returning to ‘ac_uvd_create_video_decoder’ from ‘get_session_size’
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:723:30: call_function: calling ‘get_embedded_size’ from ‘ac_uvd_create_video_decoder’
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:723:30: return_function: returning to ‘ac_uvd_create_video_decoder’ from ‘get_embedded_size’
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:727:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:729:4: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:731:11: danger: ‘dec’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
# 729| dec->base.build_decode_cmd = uvd_build_decode_cmd;
# 730|
# 731|-> return &dec->base;
# 732| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1003:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1060:1: enter_function: entry to ‘vcn_build_create_cmd’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1093:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1098:4: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1098:4: call_function: calling ‘send_cmd’ from ‘vcn_build_create_cmd’
# 1001| case RDECODE_CMD_SESSION_CONTEXT_BUFFER:
# 1002| cmd_buf->decode_buffer_flags |= RDECODE_CMDBUF_FLAGS_SESSION_CONTEXT_BUFFER;
# 1003|-> cmd_buf->decode_buffer->session_contex_buffer_address_hi = va >> 32;
# 1004| cmd_buf->decode_buffer->session_contex_buffer_address_lo = va;
# 1005| break;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1885:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index_drm’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1826:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1842:42: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1845:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1869:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1884:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1885:7: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1885:7: danger: dereference of NULL ‘index_drm’
# 1883|
# 1884| if (cmd->protected_content.mode) {
# 1885|-> index_drm->message_id = RDECODE_MESSAGE_DRM;
# 1886| index_drm->offset = offset_drm;
# 1887| index_drm->size = sizeof(rvcn_dec_message_drm_t);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1899:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index_dynamic_dpb’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1826:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1842:42: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1845:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1869:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1884:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1899:7: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1899:7: danger: dereference of NULL ‘index_dynamic_dpb’
# 1897|
# 1898| if (cmd->tier == AC_VIDEO_DEC_TIER1 || cmd->tier == AC_VIDEO_DEC_TIER2) {
# 1899|-> index_dynamic_dpb->message_id = RDECODE_MESSAGE_DYNAMIC_DPB;
# 1900| index_dynamic_dpb->offset = offset_dynamic_dpb;
# 1901| if (cmd->tier == AC_VIDEO_DEC_TIER1)
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2020:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dynamic_dpb’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1826:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1842:42: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1845:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1869:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1884:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1908:26: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1922:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1925:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1958:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1965:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2012:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2015:14: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2015:14: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2016:7: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2020:7: danger: dereference of NULL ‘dynamic_dpb’
# 2018| decode_flags |= RDECODE_FLAGS_DPB_RESIZE_MASK;
# 2019|
# 2020|-> dynamic_dpb->dpbArraySize = decoder->param.max_num_ref;
# 2021| dynamic_dpb->dpbLumaPitch = cmd->ref_surfaces[0].planes[0].surf->u.gfx9.surf_pitch;
# 2022| dynamic_dpb->dpbLumaAlignedHeight = cmd->ref_surfaces[0].planes[0].surf->u.gfx9.surf_height;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2054:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dynamic_dpb_t2’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1826:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1842:42: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1845:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1869:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1884:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1908:26: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1922:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1925:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1958:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1965:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2012:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2015:14: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2015:14: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2028:14: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2028:14: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2028:14: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2031:28: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2048:10: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2048:10: branch_true: following ‘true’ branch (when ‘cur’ is NULL)...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2049:10: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2054:7: danger: dereference of NULL ‘dynamic_dpb_t2’
# 2052| decode->db_swizzle_mode = cur->planes[0].surf->u.gfx9.swizzle_mode;
# 2053|
# 2054|-> dynamic_dpb_t2->dpbArraySize = ref_id_size;
# 2055| dynamic_dpb_t2->dpbCurrLo = cur->planes[0].va;
# 2056| dynamic_dpb_t2->dpbCurrHi = cur->planes[0].va >> 32;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2107:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘drm’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1826:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1842:42: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1845:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1869:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1884:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1908:26: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1922:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1925:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1958:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1965:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2013:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2097:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2097:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2104:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2104:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2105:27: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2107:7: danger: dereference of NULL ‘drm’
# 2105| DECRYPT_PARAMETERS *decrypt = cmd->protected_content.key;
# 2106|
# 2107|-> drm->drm_cntl = 1 << DRM_CNTL_BYPASS_SHIFT;
# 2108| if (decrypt->u.s.cbc || decrypt->u.s.ctr) {
# 2109| uint32_t drm_cmd = 0;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2133:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘drm’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1826:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1842:42: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1845:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1869:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1884:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1908:26: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1922:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1925:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1958:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1965:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2013:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2097:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2097:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2104:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2104:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2129:14: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2129:14: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2130:33: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2133:7: danger: dereference of NULL ‘drm’
# 2131| uint32_t drm_cmd = 0;
# 2132|
# 2133|-> memcpy(drm->drm_wrapped_key, secure_buf->key_blob.wrapped_key, 16);
# 2134| memcpy(drm->drm_key, secure_buf->key_blob.wrapped_key_iv, 16);
# 2135| memcpy(drm->drm_counter, secure_buf->desc.iv, 16);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2148:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘drm_keyblob’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1826:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1827:7: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1842:42: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1845:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1847:39: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1869:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1884:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1908:26: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1922:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1925:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1958:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1965:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2013:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2097:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2097:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2104:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2104:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2129:14: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2129:14: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2130:33: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2148:7: danger: dereference of NULL ‘drm_keyblob’
# 2146| drm->drm_cmd = drm_cmd;
# 2147|
# 2148|-> memcpy(drm_keyblob->contentKey, secure_buf->key_blob.local_policy.wrapped_key, 16);
# 2149| memcpy(drm_keyblob->signature, secure_buf->key_blob.local_policy.signature, 16);
# 2150| memcpy(&drm_keyblob->policyIndex, secure_buf->key_blob.local_policy.native_policy.enabled_policy_index, 4);
Error: GCC_ANALYZER_WARNING (CWE-401):
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2386:11: warning[-Wanalyzer-malloc-leak]: leak of ‘dec’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2291:1: enter_function: entry to ‘ac_vcn_create_video_decoder’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2293:33: acquire_memory: allocated here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2294:7: branch_false: following ‘false’ branch (when ‘dec’ is non-NULL)...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2297:23: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2375:29: call_function: calling ‘get_session_size’ from ‘ac_vcn_create_video_decoder’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2375:29: return_function: returning to ‘ac_vcn_create_video_decoder’ from ‘get_session_size’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2376:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2378:30: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2378:30: call_function: calling ‘get_embedded_size’ from ‘ac_vcn_create_video_decoder’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2378:30: return_function: returning to ‘ac_vcn_create_video_decoder’ from ‘get_embedded_size’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2381:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2383:4: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2386:11: danger: ‘dec’ leaks here; was allocated at [(2)](sarif:/runs/0/results/8/codeFlows/0/threadFlows/0/locations/1)
# 2384| dec->base.build_decode_cmd = vcn_build_decode_cmd;
# 2385|
# 2386|-> return &dec->base;
# 2387| }
# 2388|
Error: GCC_ANALYZER_WARNING (CWE-401):
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2819:11: warning[-Wanalyzer-malloc-leak]: leak of ‘dec’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2730:38: acquire_memory: allocated here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2731:7: branch_false: following ‘false’ branch (when ‘dec’ is non-NULL)...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2734:21: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2745:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2746:7: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2819:11: danger: ‘dec’ leaks here; was allocated at [(1)](sarif:/runs/0/results/9/codeFlows/0/threadFlows/0/locations/0)
# 2817| dec->base.build_decode_cmd = vcn_jpeg_build_decode_cmd;
# 2818|
# 2819|-> return &dec->base;
# 2820| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:151:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:196:1: enter_function: entry to ‘ac_nir_opt_flip_if_for_mem_loads’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:199:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘ac_nir_opt_flip_if_for_mem_loads’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:199:4: return_function: returning to ‘ac_nir_opt_flip_if_for_mem_loads’ from ‘nir_foreach_function_with_impl_first’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:199:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:200:19: call_function: calling ‘opt_flip_if_for_mem_loads_impl’ from ‘ac_nir_opt_flip_if_for_mem_loads’
# 149| continue;
# 150|
# 151|-> uint32_t then_first = nir_if_first_then_block(nif)->index;
# 152| uint32_t then_last = nir_if_last_then_block(nif)->index;
# 153| uint32_t else_first = nir_if_first_else_block(nif)->index;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:153:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:196:1: enter_function: entry to ‘ac_nir_opt_flip_if_for_mem_loads’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:199:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘ac_nir_opt_flip_if_for_mem_loads’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:199:4: return_function: returning to ‘ac_nir_opt_flip_if_for_mem_loads’ from ‘nir_foreach_function_with_impl_first’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:199:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:200:19: call_function: calling ‘opt_flip_if_for_mem_loads_impl’ from ‘ac_nir_opt_flip_if_for_mem_loads’
# 151| uint32_t then_first = nir_if_first_then_block(nif)->index;
# 152| uint32_t then_last = nir_if_last_then_block(nif)->index;
# 153|-> uint32_t else_first = nir_if_first_else_block(nif)->index;
# 154| uint32_t else_last = nir_if_last_else_block(nif)->index;
# 155|
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_copy.c: scope_hint: In function ‘radv_CmdCopyMemoryToImageIndirectKHR’
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_copy.c:930:37: warning[-Wunused-variable]: unused variable ‘format_layout’
# 930 | const enum util_format_layout format_layout = radv_format_description(dst_image->vk.format)->layout;
# | ^~~~~~~~~~~~~
# 928| VK_ACCESS_TRANSFER_READ_BIT, 0, dst_image, NULL);
# 929|
# 930|-> const enum util_format_layout format_layout = radv_format_description(dst_image->vk.format)->layout;
# 931| assert(format_layout == UTIL_FORMAT_LAYOUT_ETC);
# 932|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:293:55: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dst_iview’
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:245:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:249:4: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:276:7: branch_true: following ‘true’ branch (when ‘has_ds_resolve != 0’)...
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:277:40: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:287:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:290:43: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:291:43: branch_false: following ‘false’ branch (when ‘d_res_iview’ is NULL)...
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:291:43: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:293:55: danger: dereference of NULL ‘dst_iview’
# 291| struct radv_image_view *dst_iview = d_res_iview ? d_res_iview : s_res_iview;
# 292|
# 293|-> const enum radv_resolve_method resolve_method = radv_get_resolve_method(src_iview->image, dst_iview->image);
# 294|
# 295| VkImageResolve2 region = {
Error: COMPILER_WARNING:
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c: scope_hint: In function ‘get_sampler_desc’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:248:9: warning[-Wunused-but-set-variable=]: variable ‘indirect’ set but not used
# 248 | bool indirect = false;
# | ^~~~~~~~
# 246| nir_def *desc_ptr = NULL;
# 247| uint32_t offset = 0;
# 248|-> bool indirect = false;
# 249| uint32_t plane_offset;
# 250|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:266:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:679:1: enter_function: entry to ‘radv_nir_lower_descriptors’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:699:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘radv_nir_lower_descriptors’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:699:4: return_function: returning to ‘radv_nir_lower_descriptors’ from ‘nir_foreach_function_with_impl_first’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:699:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:707:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:708:10: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:708:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:708:10: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:709:16: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:710:33: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:710:33: call_function: calling ‘lower_descriptors_tex’ from ‘radv_nir_lower_descriptors’
# 264| }
# 265|
# 266|-> while (deref->deref_type != nir_deref_type_var) {
# 267| assert(deref->deref_type == nir_deref_type_array);
# 268| unsigned array_size = MAX2(glsl_get_aoa_size(deref->type), 1);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:463:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:458:1: enter_function: entry to ‘radv_nir_lower_rt_abi_monolithic’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:462:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘radv_nir_lower_rt_abi_monolithic’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:462:30: return_function: returning to ‘radv_nir_lower_rt_abi_monolithic’ from ‘nir_shader_get_entrypoint’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:463:4: danger: dereference of NULL ‘nir_shader_get_entrypoint(shader)’
# 461| const bool uses_descriptor_heap = pipeline->base.base.create_flags & VK_PIPELINE_CREATE_2_DESCRIPTOR_HEAP_BIT_EXT;
# 462| nir_function_impl *impl = nir_shader_get_entrypoint(shader);
# 463|-> radv_nir_init_rt_function_params(impl->function, MESA_SHADER_RAYGEN, 0, 0, uses_descriptor_heap);
# 464|
# 465| nir_builder b = nir_builder_at(nir_before_impl(impl));
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:131:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:98:1: enter_function: entry to ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:103:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:106:30: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:108:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:111:28: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:116:20: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:116:20: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:118:21: acquire_memory: this call could return NULL
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:121:22: call_function: inlined call to ‘nir_imm_true’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:121:22: call_function: inlined call to ‘nir_imm_true’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:124:25: branch_true: following ‘true’ branch (when ‘i < argc’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:125:29: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:128:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:131:11: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:131:7: danger: ‘args + (long unsigned int)i * 8’ could be NULL: unchecked value from [(21)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/20)
# 129| arg = nir_b2i32(b, arg);
# 130|
# 131|-> args[i] = arg;
# 132|
# 133| uint32_t arg_size = arg->bit_size == 1 ? 32 : arg->bit_size / 8;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:137:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘strides’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:98:1: enter_function: entry to ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:103:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:106:30: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:108:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:111:28: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:116:20: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:116:20: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:119:24: acquire_memory: this call could return NULL
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:121:22: call_function: inlined call to ‘nir_imm_true’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:121:22: call_function: inlined call to ‘nir_imm_true’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:124:25: branch_true: following ‘true’ branch (when ‘i < argc’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:125:29: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:128:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:129:16: call_function: inlined call to ‘nir_b2i32’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:133:27: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:133:27: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:136:10: branch_true: following ‘true’ branch (when ‘divergent != 0’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:137:23: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:137:23: call_function: inlined call to ‘nir_imul_imm’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:137:23: call_function: inlined call to ‘nir_imul_imm’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:137:10: danger: ‘strides + (long unsigned int)i * 8’ could be NULL: unchecked value from [(21)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/20)
# 135|
# 136| if (divergent) {
# 137|-> strides[i] = nir_imul_imm(b, active_invocation_count, arg_size);
# 138| format.divergence_mask |= BITFIELD_BIT(i);
# 139| } else {
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:140:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘strides’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:98:1: enter_function: entry to ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:103:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:106:30: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:108:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:111:28: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:116:20: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:116:20: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:119:24: acquire_memory: this call could return NULL
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:121:22: call_function: inlined call to ‘nir_imm_true’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:121:22: call_function: inlined call to ‘nir_imm_true’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:124:25: branch_true: following ‘true’ branch (when ‘i < argc’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:125:29: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:136:10: branch_false: following ‘false’ branch (when ‘divergent == 0’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:140:17: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:140:23: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:140:23: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:140:10: danger: ‘strides + (long unsigned int)i * 8’ could be NULL: unchecked value from [(21)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/20)
# 138| format.divergence_mask |= BITFIELD_BIT(i);
# 139| } else {
# 140|-> strides[i] = nir_imm_int(b, arg_size);
# 141| }
# 142|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:241:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fields’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:200:1: enter_function: entry to ‘radv_build_printf’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:212:25: branch_true: following ‘true’ branch (when ‘num_args > i’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:213:11: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:235:7: branch_true: following ‘true’ branch (when ‘num_args != 0’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:236:16: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:236:16: acquire_memory: this call could return NULL
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:238:28: branch_true: following ‘true’ branch (when ‘num_args > i’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:239:29: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:241:27: call_function: calling ‘glsl_intN_t_type’ from ‘radv_build_printf’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:241:27: return_function: returning to ‘radv_build_printf’ from ‘glsl_intN_t_type’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:241:10: danger: ‘fields + (long unsigned int)i * 48’ could be NULL: unchecked value from [(6)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/5)
# 239| nir_def *arg = args[i];
# 240|
# 241|-> fields[i].type = glsl_intN_t_type(arg->bit_size);
# 242| fields[i].name = "";
# 243|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/vulkan/radv_pipeline.c:855:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/radv_pipeline.c:833:1: enter_function: entry to ‘radv_GetPipelineExecutableStatisticsKHR’
mesa-26.1.1/src/amd/vulkan/radv_pipeline.c:840:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableStatisticsKHR’
mesa-26.1.1/src/amd/vulkan/radv_pipeline.c:840:7: return_function: returning to ‘radv_GetPipelineExecutableStatisticsKHR’ from ‘radv_get_shader_from_executable_index’
mesa-26.1.1/src/amd/vulkan/radv_pipeline.c:855:21: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’
# 853| stats.spillsgprs = shader->config.spilled_sgprs;
# 854| stats.spillvgprs = shader->config.spilled_vgprs;
# 855|-> stats.codesize = shader->exec_size;
# 856| stats.lds = align(shader->config.lds_size, ac_shader_get_lds_alloc_granularity(gfx_level));
# 857| stats.scratch = shader->config.scratch_bytes_per_wave;
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/amd/vulkan/radv_pipeline_compute.c:157:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘cs_dbg.spirv’ where non-null expected
mesa-26.1.1/src/amd/vulkan/radv_pipeline_compute.c:324:1: enter_function: entry to ‘radv_create_compute_pipelines’
mesa-26.1.1/src/amd/vulkan/radv_pipeline_compute.c:331:11: branch_true: following ‘true’ branch (when ‘i < count’)...
mesa-26.1.1/src/amd/vulkan/radv_pipeline_compute.c:333:105: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_pipeline_compute.c:333:11: call_function: calling ‘radv_compute_pipeline_create’ from ‘radv_create_compute_pipelines’
# 155| if (keep_executable_info && cs_stage->spirv.size) {
# 156| dbg->spirv = malloc(cs_stage->spirv.size);
# 157|-> memcpy(dbg->spirv, cs_stage->spirv.data, cs_stage->spirv.size);
# 158| dbg->spirv_size = cs_stage->spirv.size;
# 159| }
Error: GCC_ANALYZER_WARNING (CWE-775):
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1345:7: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(os_get_option_secure("RADV_BVH_STATS_FILE"), "w")’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1401:1: enter_function: entry to ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1408:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1414:57: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1417:7: branch_false: following ‘false’ branch (when ‘hash_entries’ is non-NULL)...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1417:7: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1436:13: call_function: calling ‘rra_copy_context_init’ from ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1436:13: return_function: returning to ‘radv_dump_bvh_stats’ from ‘rra_copy_context_init’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1437:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1440:15: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1442:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: call_function: calling ‘rra_map_accel_struct_data’ from ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: return_function: returning to ‘radv_dump_bvh_stats’ from ‘rra_map_accel_struct_data’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1444:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1447:72: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1447:7: call_function: calling ‘dump_bvh_stats’ from ‘radv_dump_bvh_stats’
# 1343| if (!device->rra_trace.stats_file) {
# 1344| device->rra_trace.stats_file = fopen(radv_bvh_stats_file(), "w");
# 1345|-> fprintf(device->rra_trace.stats_file, "app,name,type,allocated_size,compacted_size");
# 1346| if (radv_use_bvh8(pdev)) {
# 1347| fprintf(device->rra_trace.stats_file, ",max_depth,box_node_count,primitive_node_count,instance_node_count");
Error: GCC_ANALYZER_WARNING (CWE-401):
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1345:7: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(os_get_option_secure("RADV_BVH_STATS_FILE"), "w")’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1401:1: enter_function: entry to ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1408:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1414:57: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1417:7: branch_false: following ‘false’ branch (when ‘hash_entries’ is non-NULL)...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1417:7: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1436:13: call_function: calling ‘rra_copy_context_init’ from ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1436:13: return_function: returning to ‘radv_dump_bvh_stats’ from ‘rra_copy_context_init’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1437:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1440:15: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1442:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: call_function: calling ‘rra_map_accel_struct_data’ from ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: return_function: returning to ‘radv_dump_bvh_stats’ from ‘rra_map_accel_struct_data’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1444:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1447:72: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1447:7: call_function: calling ‘dump_bvh_stats’ from ‘radv_dump_bvh_stats’
# 1343| if (!device->rra_trace.stats_file) {
# 1344| device->rra_trace.stats_file = fopen(radv_bvh_stats_file(), "w");
# 1345|-> fprintf(device->rra_trace.stats_file, "app,name,type,allocated_size,compacted_size");
# 1346| if (radv_use_bvh8(pdev)) {
# 1347| fprintf(device->rra_trace.stats_file, ",max_depth,box_node_count,primitive_node_count,instance_node_count");
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1345:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*device.rra_trace.stats_file’ where non-null expected
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1310:1: enter_function: entry to ‘dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1320:7: branch_false: following ‘false’ branch (when ‘is_tlas == tlas_pass’)...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1326:8: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1326:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1329:8: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1330:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1343:9: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1343:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1344:44: call_function: inlined call to ‘radv_bvh_stats_file’ from ‘dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1344:38: acquire_memory: this call could return NULL
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1345:7: danger: argument 4 (‘fopen(os_get_option_secure("RADV_BVH_STATS_FILE"), "w")’) from [(11)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/10) could be NULL where non-null expected
#argument 4 of ‘__builtin_fwrite’ must be non-null
# 1343| if (!device->rra_trace.stats_file) {
# 1344| device->rra_trace.stats_file = fopen(radv_bvh_stats_file(), "w");
# 1345|-> fprintf(device->rra_trace.stats_file, "app,name,type,allocated_size,compacted_size");
# 1346| if (radv_use_bvh8(pdev)) {
# 1347| fprintf(device->rra_trace.stats_file, ",max_depth,box_node_count,primitive_node_count,instance_node_count");
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1345:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘fopen(os_get_option_secure("RADV_BVH_STATS_FILE"), "w")’ where non-null expected
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1401:1: enter_function: entry to ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1408:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1414:57: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1417:7: branch_false: following ‘false’ branch (when ‘hash_entries’ is non-NULL)...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1417:7: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1436:13: call_function: calling ‘rra_copy_context_init’ from ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1436:13: return_function: returning to ‘radv_dump_bvh_stats’ from ‘rra_copy_context_init’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1437:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1440:15: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1442:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: call_function: calling ‘rra_map_accel_struct_data’ from ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: return_function: returning to ‘radv_dump_bvh_stats’ from ‘rra_map_accel_struct_data’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1444:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1447:72: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1447:7: call_function: calling ‘dump_bvh_stats’ from ‘radv_dump_bvh_stats’
#argument 4 of ‘__builtin_fwrite’ must be non-null
# 1343| if (!device->rra_trace.stats_file) {
# 1344| device->rra_trace.stats_file = fopen(radv_bvh_stats_file(), "w");
# 1345|-> fprintf(device->rra_trace.stats_file, "app,name,type,allocated_size,compacted_size");
# 1346| if (radv_use_bvh8(pdev)) {
# 1347| fprintf(device->rra_trace.stats_file, ",max_depth,box_node_count,primitive_node_count,instance_node_count");
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/amd/vulkan/radv_shader.c:2944:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘malloc(disasm_size + 1)’ where non-null expected
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3520:1: enter_function: entry to ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3529:4: call_function: calling ‘radv_fill_nir_compiler_options’ from ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3529:4: return_function: returning to ‘radv_compile_rt_prolog’ from ‘radv_fill_nir_compiler_options’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3555:4: call_function: calling ‘radv_shader_create_uncached’ from ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3555:4: return_function: returning to ‘radv_compile_rt_prolog’ from ‘radv_shader_create_uncached’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3556:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3556:19: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3556:19: call_function: calling ‘radv_parse_binary_debug_info’ from ‘radv_compile_rt_prolog’
# 2942| dbg->ir_string = bin->llvm_ir_size ? strdup((const char *)(bin->data + bin->elf_size)) : NULL;
# 2943| dbg->disasm_string = malloc(disasm_size + 1);
# 2944|-> memcpy(dbg->disasm_string, disasm_data, disasm_size);
# 2945| dbg->disasm_string[disasm_size] = 0;
# 2946|
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/amd/vulkan/radv_shader.c:2958:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘malloc((long unsigned int)*(struct radv_shader_binary_legacy *)binary.debug_info_size)’ where non-null expected
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3520:1: enter_function: entry to ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3529:4: call_function: calling ‘radv_fill_nir_compiler_options’ from ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3529:4: return_function: returning to ‘radv_compile_rt_prolog’ from ‘radv_fill_nir_compiler_options’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3555:4: call_function: calling ‘radv_shader_create_uncached’ from ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3555:4: return_function: returning to ‘radv_compile_rt_prolog’ from ‘radv_shader_create_uncached’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3556:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3556:19: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3556:19: call_function: calling ‘radv_parse_binary_debug_info’ from ‘radv_compile_rt_prolog’
# 2956| if (bin->debug_info_size) {
# 2957| dbg->debug_info = malloc(bin->debug_info_size);
# 2958|-> memcpy(dbg->debug_info, layout.debug_info, bin->debug_info_size);
# 2959| dbg->debug_info_count = bin->debug_info_size / sizeof(struct ac_shader_debug_info);
# 2960| }
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3011:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘calloc((long unsigned int)*(struct radv_shader_binary_legacy *)binary.stats_size, 1)’ where non-null expected
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3520:1: enter_function: entry to ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3529:4: call_function: calling ‘radv_fill_nir_compiler_options’ from ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3529:4: return_function: returning to ‘radv_compile_rt_prolog’ from ‘radv_fill_nir_compiler_options’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3555:4: call_function: calling ‘radv_shader_create_uncached’ from ‘radv_compile_rt_prolog’
# 3009| if (bin->stats_size) {
# 3010| shader->dbg.statistics = calloc(bin->stats_size, 1);
# 3011|-> memcpy(shader->dbg.statistics, layout.stats, bin->stats_size);
# 3012| }
# 3013| }
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/amd/vulkan/radv_video.c: scope_hint: In function ‘radv_CmdControlVideoCodingKHR’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1335:8: warning[-Wunused-variable]: unused variable ‘ret’
# 1335 | int ret = vid->dec->build_create_cmd(vid->dec, &cmd);
# | ^~~
# 1333| }
# 1334|
# 1335|-> int ret = vid->dec->build_create_cmd(vid->dec, &cmd);
# 1336| cs->b->cdw += cmd.out.cmd_dw;
# 1337| assert(ret == 0);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/vulkan/radv_video.c:1357:25: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1346:1: enter_function: entry to ‘get_h264_param’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1351:7: call_function: inlined call to ‘__vk_find_struct’ from ‘get_h264_param’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1355:33: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1357:25: danger: dereference of NULL ‘<unknown>’
# 1355| vk_video_get_h264_parameters(&vid->vk, params, frame_info, h264_pic_info, &sps, &pps);
# 1356|
# 1357|-> cmd->bitstream_va += h264_pic_info->pSliceOffsets[0];
# 1358|
# 1359| avc->sps_flags.direct_8x8_inference_flag = sps->flags.direct_8x8_inference_flag;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/vulkan/radv_video.c:1481:36: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1436:1: enter_function: entry to ‘get_h265_param’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1441:7: call_function: inlined call to ‘__vk_find_struct’ from ‘get_h265_param’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1445:33: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1481:36: danger: dereference of NULL ‘<unknown>’
# 1479| hevc->pps_flags.slice_segment_header_extension_present_flag = pps->flags.slice_segment_header_extension_present_flag;
# 1480|
# 1481|-> hevc->pic_flags.irap_pic_flag = h265_pic_info->pStdPictureInfo->flags.IrapPicFlag;
# 1482| hevc->pic_flags.idr_pic_flag = h265_pic_info->pStdPictureInfo->flags.IdrPicFlag;
# 1483| hevc->pic_flags.is_ref_pic_flag = frame_info->pSetupReferenceSlot != NULL;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/vulkan/radv_video.c:1867:40: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1861:1: enter_function: entry to ‘get_vp9_param’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1866:7: call_function: inlined call to ‘__vk_find_struct’ from ‘get_vp9_param’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1867:40: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1867:40: danger: dereference of NULL ‘<unknown>’
# 1865| const struct VkVideoDecodeVP9PictureInfoKHR *vp9_pic_info =
# 1866| vk_find_struct_const(frame_info->pNext, VIDEO_DECODE_VP9_PICTURE_INFO_KHR);
# 1867|-> const StdVideoDecodeVP9PictureInfo *std_pic_info = vp9_pic_info->pStdPictureInfo;
# 1868|
# 1869| vp9->pic_flags.error_resilient_mode = std_pic_info->flags.error_resilient_mode;
Error: GCC_ANALYZER_WARNING (CWE-121):
mesa-26.1.1/src/amd/vulkan/radv_video.c:1991:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-26.1.1/src/amd/vulkan/radv_video.c:1987:7: branch_true: following ‘true’ branch (when ‘interleaved_planes != 0’)...
mesa-26.1.1/src/amd/vulkan/radv_video.c:1989:16: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1990:28: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_video.c:1991:39: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1990:28: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_video.c:1991:39: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1990:28: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_video.c:1991:39: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1990:28: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_video.c:1991:39: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1991:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘plane_sizes’ ends at byte 16
# 1989| uint32_t plane_sizes[4] = {0};
# 1990| for (uint32_t i = 1; i <= surf->num_planes; i++)
# 1991|-> plane_sizes[i] = plane_sizes[i - 1] + img->planes[i - 1].surface.u.gfx9.surf_slice_size;
# 1992|
# 1993| for (uint32_t i = 0; i < surf->num_planes; i++) {
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/amd/vulkan/radv_video.c: scope_hint: In function ‘radv_CmdDecodeVideoKHR’
mesa-26.1.1/src/amd/vulkan/radv_video.c:2153:8: warning[-Wunused-variable]: unused variable ‘ret’
# 2153 | int ret = vid->dec->build_decode_cmd(vid->dec, &cmd);
# | ^~~
# 2151| }
# 2152|
# 2153|-> int ret = vid->dec->build_decode_cmd(vid->dec, &cmd);
# 2154| cs->b->cdw += cmd.out.cmd_dw;
# 2155| assert(ret == 0);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:528:46: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:3317:1: enter_function: entry to ‘radv_CmdEncodeVideoKHR’
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:3320:4: call_function: calling ‘radv_vcn_encode_video’ from ‘radv_CmdEncodeVideoKHR’
# 526| const struct VkVideoEncodeH264PictureInfoKHR *h264_picture_info =
# 527| vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_H264_PICTURE_INFO_KHR);
# 528|-> if (sps->seq_parameter_set_id != h264_picture_info->pStdPictureInfo->seq_parameter_set_id)
# 529| continue;
# 530| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:541:50: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:3317:1: enter_function: entry to ‘radv_CmdEncodeVideoKHR’
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:3320:4: call_function: calling ‘radv_vcn_encode_video’ from ‘radv_CmdEncodeVideoKHR’
# 539| const struct VkVideoEncodeH265PictureInfoKHR *h265_picture_info =
# 540| vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_H265_PICTURE_INFO_KHR);
# 541|-> if (sps->sps_seq_parameter_set_id != h265_picture_info->pStdPictureInfo->pps_seq_parameter_set_id)
# 542| continue;
# 543| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:555:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:3317:1: enter_function: entry to ‘radv_CmdEncodeVideoKHR’
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:3320:4: call_function: calling ‘radv_vcn_encode_video’ from ‘radv_CmdEncodeVideoKHR’
# 553| const struct VkVideoEncodeAV1PictureInfoKHR *av1_picture_info =
# 554| vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_AV1_PICTURE_INFO_KHR);
# 555|-> if (av1_picture_info->pStdPictureInfo->flags.frame_size_override_flag)
# 556| extent = enc_info->srcPictureResource.codedExtent;
# 557| }
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/asahi/vulkan/hk_cmd_dispatch.c:88:1: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘grid.<U4500>.count[2]’
mesa-26.1.1/src/asahi/vulkan/hk_cmd_dispatch.c:154:1: enter_function: entry to ‘hk_CmdDispatchIndirect’
mesa-26.1.1/src/asahi/vulkan/hk_cmd_dispatch.c:171:4: call_function: calling ‘dispatch’ from ‘hk_CmdDispatchIndirect’
# 86|
# 87| static void
# 88|-> dispatch(struct hk_cmd_buffer *cmd, struct agx_grid grid)
# 89| {
# 90| struct hk_shader *s = hk_only_variant(cmd->state.cs.shader);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/broadcom/vulkan/v3dv_cmd_buffer.h:762:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘job’
mesa-26.1.1/src/broadcom/vulkan/v3dv_cmd_buffer.c:1987:1: enter_function: entry to ‘v3dv_job_clone_in_cmd_buffer’
mesa-26.1.1/src/broadcom/vulkan/v3dv_cmd_buffer.c:1992:7: call_function: inlined call to ‘v3dv_flag_oom’ from ‘v3dv_job_clone_in_cmd_buffer’
# 760| } else {
# 761| assert(job);
# 762|-> if (job->cmd_buffer)
# 763| job->cmd_buffer->state.oom = true;
# 764| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:657:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘syncs’
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1278:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1292:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1293:7: branch_true: ...to here
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1352:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1358:14: branch_true: ...to here
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1358:14: call_function: calling ‘queue_submit_noop_job’ from ‘v3dv_queue_driver_submit’
# 655| struct v3dv_query *query = &info->pool->queries[info->first + i];
# 656|
# 657|-> syncs[i] = vk_sync_as_drm_syncobj(query->perf.last_job_sync)->syncobj;
# 658| kperfmon_ids[i] = (uintptr_t)(void *)query->perf.kperfmon_ids;
# 659|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:657:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1278:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1292:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1293:7: branch_true: ...to here
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1352:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1358:14: branch_true: ...to here
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1358:14: call_function: calling ‘queue_submit_noop_job’ from ‘v3dv_queue_driver_submit’
# 655| struct v3dv_query *query = &info->pool->queries[info->first + i];
# 656|
# 657|-> syncs[i] = vk_sync_as_drm_syncobj(query->perf.last_job_sync)->syncobj;
# 658| kperfmon_ids[i] = (uintptr_t)(void *)query->perf.kperfmon_ids;
# 659|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:658:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘kperfmon_ids’
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1278:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1292:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1293:7: branch_true: ...to here
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1352:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1358:14: branch_true: ...to here
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1358:14: call_function: calling ‘queue_submit_noop_job’ from ‘v3dv_queue_driver_submit’
# 656|
# 657| syncs[i] = vk_sync_as_drm_syncobj(query->perf.last_job_sync)->syncobj;
# 658|-> kperfmon_ids[i] = (uintptr_t)(void *)query->perf.kperfmon_ids;
# 659|
# 660| if (info->flags & VK_QUERY_RESULT_WAIT_BIT) {
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/compiler/nir/nir.h:3424:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/compiler/nir/nir_control_flow.c:49:1: enter_function: entry to ‘link_blocks’
mesa-26.1.1/src/compiler/nir/nir_control_flow.c:57:7: call_function: inlined call to ‘nir_block_add_pred’ from ‘link_blocks’
mesa-26.1.1/src/compiler/nir/nir_control_flow.c:57:7: call_function: inlined call to ‘nir_block_add_pred’ from ‘link_blocks’
# 3422| nir_block_add_pred(nir_block *block, nir_block *pred)
# 3423| {
# 3424|-> util_dynarray_append(&block->predecessors, pred);
# 3425| }
# 3426|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/compiler/nir/nir_builder.h:1587:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src’
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:291:1: enter_function: entry to ‘jay_process_nir’
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:321:7: branch_false: following ‘false’ branch (when ‘stage != 0’)...
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:365:14: branch_false: ...to here
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:365:14: branch_true: following ‘true’ branch (when ‘stage == 4’)...
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:368:7: branch_true: ...to here
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:377:7: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘jay_process_nir’
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:377:7: return_function: returning to ‘jay_process_nir’ from ‘nir_shader_intrinsics_pass’
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:381:7: call_function: calling ‘nir_shader_get_entrypoint’ from ‘jay_process_nir’
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:381:7: return_function: returning to ‘jay_process_nir’ from ‘nir_shader_get_entrypoint’
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:381:7: call_function: calling ‘lower_fragment_outputs’ from ‘jay_process_nir’
# 1585| {
# 1586| assert(src->num_components <= num_components);
# 1587|-> if (src->num_components == num_components)
# 1588| return src;
# 1589|
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/compiler/nir/nir_lower_non_uniform_access.c: scope_hint: In function ‘nu_handle_init’
mesa-26.1.1/src/compiler/nir/nir_lower_non_uniform_access.c:75:24: warning[-Wunused-variable]: unused variable ‘parent’
# 75 | nir_deref_instr *parent = nir_deref_instr_parent(deref);
# | ^~~~~~
# 73| return false;
# 74|
# 75|-> nir_deref_instr *parent = nir_deref_instr_parent(deref);
# 76| assert(parent->deref_type == nir_deref_type_var);
# 77|
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/compiler/nir/nir_search.c:252:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘&new_swizzle’
mesa-26.1.1/src/compiler/nir/nir_search.c:833:1: enter_function: entry to ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:9: call_function: calling ‘util_dynarray_resize_bytes’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:9: return_function: returning to ‘nir_algebraic_impl’ from ‘util_dynarray_resize_bytes’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:849:27: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:874:4: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_true: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:877:13: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:878:13: call_function: inlined call to ‘nir_instr_worklist_push_tail’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:874:4: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:886:20: call_function: inlined call to ‘nir_instr_worklist_pop_head’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:886:11: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:891:11: branch_true: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:891:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:894:19: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:894:19: call_function: calling ‘nir_algebraic_instr’ from ‘nir_algebraic_impl’
# 250| dst->src = instr->src[src].src;
# 251|
# 252|-> memcpy(dst->swizzle, new_swizzle, num_components);
# 253| memset(dst->swizzle + num_components, 0, NIR_MAX_VEC_COMPONENTS - num_components);
# 254|
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/compiler/nir/nir_search.c:279:48: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘new_swizzle[i]’
mesa-26.1.1/src/compiler/nir/nir_search.c:833:1: enter_function: entry to ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:9: call_function: calling ‘util_dynarray_resize_bytes’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:9: return_function: returning to ‘nir_algebraic_impl’ from ‘util_dynarray_resize_bytes’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:849:27: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:874:4: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_true: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:877:13: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:878:13: call_function: inlined call to ‘nir_instr_worklist_push_tail’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:874:4: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:886:20: call_function: inlined call to ‘nir_instr_worklist_pop_head’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:886:11: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:891:11: branch_true: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:891:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:894:19: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:894:19: call_function: calling ‘nir_algebraic_instr’ from ‘nir_algebraic_impl’
# 277| for (unsigned i = 0; i < num_components; ++i) {
# 278| double val = nir_src_comp_as_float(instr->src[src].src,
# 279|-> new_swizzle[i]);
# 280| if (val != const_val->data.d)
# 281| return false;
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/compiler/nir/nir_search.c:299:49: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘new_swizzle[i]’
mesa-26.1.1/src/compiler/nir/nir_search.c:833:1: enter_function: entry to ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:9: call_function: calling ‘util_dynarray_resize_bytes’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:9: return_function: returning to ‘nir_algebraic_impl’ from ‘util_dynarray_resize_bytes’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:849:27: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:874:4: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_true: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:877:13: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:878:13: call_function: inlined call to ‘nir_instr_worklist_push_tail’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:874:4: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:886:20: call_function: inlined call to ‘nir_instr_worklist_pop_head’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:886:11: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:891:11: branch_true: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:891:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:894:19: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:894:19: call_function: calling ‘nir_algebraic_instr’ from ‘nir_algebraic_impl’
# 297| for (unsigned i = 0; i < num_components; ++i) {
# 298| uint64_t val = nir_src_comp_as_uint(instr->src[src].src,
# 299|-> new_swizzle[i]);
# 300| if ((val & mask) != (const_val->data.u & mask))
# 301| return false;
Error: GCC_ANALYZER_WARNING (CWE-787):
mesa-26.1.1/src/compiler/spirv/vtn_subgroup.c:236:4: warning[-Wanalyzer-out-of-bounds]: buffer over-read
mesa-26.1.1/src/compiler/spirv/vtn_subgroup.c:53:1: enter_function: entry to ‘vtn_handle_subgroup’
mesa-26.1.1/src/compiler/spirv/vtn_subgroup.c:56:33: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_subgroup’
mesa-26.1.1/src/compiler/spirv/vtn_subgroup.c:56:33: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_subgroup’
mesa-26.1.1/src/compiler/spirv/vtn_subgroup.c:236:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/spirv/vtn_subgroup.c:236:4: branch_true: ...to here
mesa-26.1.1/src/compiler/spirv/vtn_subgroup.c:236:4: danger: read of 4 bytes at offset ‘opcode * 4 + 17179867800’ exceeds ‘CSWTCH’
# 234| }
# 235|
# 236|-> case SpvOpGroupNonUniformShuffle:
# 237| case SpvOpGroupNonUniformShuffleXor:
# 238| case SpvOpGroupNonUniformShuffleUp:
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:175:8: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*prim_info.linear’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:452:1: enter_function: entry to ‘fetch_pipeline_linear_run_elts’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:477:4: call_function: calling ‘fetch_pipeline_generic’ from ‘fetch_pipeline_linear_run_elts’
# 173| const struct draw_prim_info *prim_info)
# 174| {
# 175|-> if (prim_info->linear)
# 176| draw_pipeline_run_linear(fpme->draw, vert_info, prim_info);
# 177| else
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:187:8: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*prim_info.linear’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:452:1: enter_function: entry to ‘fetch_pipeline_linear_run_elts’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:477:4: call_function: calling ‘fetch_pipeline_generic’ from ‘fetch_pipeline_linear_run_elts’
# 185| const struct draw_prim_info *prim_info)
# 186| {
# 187|-> if (prim_info->linear) {
# 188| draw_pt_emit_linear(emit, vert_info, prim_info);
# 189| }
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:372:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘gs_vert_info[i].verts’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:452:1: enter_function: entry to ‘fetch_pipeline_linear_run_elts’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:477:4: call_function: calling ‘fetch_pipeline_generic’ from ‘fetch_pipeline_linear_run_elts’
# 370| if ((fpme->opt & PT_SHADE) && gshader) {
# 371| for (unsigned i = 0; i < gshader->num_vertex_streams; i++)
# 372|-> FREE(gs_vert_info[i].verts);
# 373| } else {
# 374| FREE(vert_info->verts);
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:374:7: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*vert_info.verts’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:452:1: enter_function: entry to ‘fetch_pipeline_linear_run_elts’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:477:4: call_function: calling ‘fetch_pipeline_generic’ from ‘fetch_pipeline_linear_run_elts’
# 372| FREE(gs_vert_info[i].verts);
# 373| } else {
# 374|-> FREE(vert_info->verts);
# 375| }
# 376| if (free_prim_info) {
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:161:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘operation.kernel.scales’ where non-null expected
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:442:1: enter_function: entry to ‘ethosu_lower_graph’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:448:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:449:31: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:455:53: call_function: calling ‘ethosu_find_first_producer’ from ‘ethosu_lower_graph’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:455:53: return_function: returning to ‘ethosu_lower_graph’ from ‘ethosu_find_first_producer’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:456:30: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:462:10: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:462:10: call_function: calling ‘ethosu_lower_convolution’ from ‘ethosu_lower_graph’
# 159| if (weight->scales != NULL) {
# 160| operation->kernel.scales = malloc(num_channels * sizeof(float));
# 161|-> memcpy(operation->kernel.scales, weight->scales, num_channels * sizeof(float));
# 162| } else {
# 163| operation->kernel.scales = NULL;
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:168:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘operation.kernel.zero_points’ where non-null expected
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:442:1: enter_function: entry to ‘ethosu_lower_graph’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:448:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:449:31: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:455:53: call_function: calling ‘ethosu_find_first_producer’ from ‘ethosu_lower_graph’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:455:53: return_function: returning to ‘ethosu_lower_graph’ from ‘ethosu_find_first_producer’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:456:30: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:462:10: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:462:10: call_function: calling ‘ethosu_lower_convolution’ from ‘ethosu_lower_graph’
# 166| if (weight->zero_points != NULL) {
# 167| operation->kernel.zero_points = malloc(num_channels * sizeof(int));
# 168|-> memcpy(operation->kernel.zero_points, weight->zero_points, num_channels * sizeof(int));
# 169| } else {
# 170| operation->kernel.zero_points = NULL;
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c: scope_hint: In function ‘prepare_for_submission’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:270:8: warning[-Wunused-variable]: unused variable ‘ret’
# 270 | int ret = drmIoctl(screen->fd, DRM_IOCTL_ETHOSU_CMDSTREAM_BO_CREATE,
# | ^~~
# 268| };
# 269|
# 270|-> int ret = drmIoctl(screen->fd, DRM_IOCTL_ETHOSU_CMDSTREAM_BO_CREATE,
# 271| &cmd_bo_create);
# 272| assert(ret == 0);
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:344:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:307:1: enter_function: entry to ‘ethosu_ml_subgraph_deserialize’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:313:7: branch_false: following ‘false’ branch (when ‘size > 31’)...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:316:15: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:317:7: branch_false: following ‘false’ branch (when ‘subgraph’ is non-NULL)...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:320:28: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:332:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:332:7: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:338:9: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:341:22: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:344:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘ethosu_ml_subgraph_deserialize’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:344:7: return_function: returning to ‘ethosu_ml_subgraph_deserialize’ from ‘util_dynarray_grow_bytes’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:344:7: danger: argument 1 (‘util_dynarray_grow_bytes(&*subgraph.tensors, 1, 32)’) NULL where non-null expected
# 342| tensor.offset = tdata[1];
# 343| tensor.size = tdata[2];
# 344|-> util_dynarray_append(&subgraph->tensors, tensor);
# 345| data += NUM_TENSOR_FIELDS * sizeof(uint32_t);
# 346| }
Error: GCC_ANALYZER_WARNING (CWE-401):
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:373:11: warning[-Wanalyzer-malloc-leak]: leak of ‘subgraph’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:313:7: branch_false: following ‘false’ branch (when ‘size > 31’)...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:316:15: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:316:15: acquire_memory: allocated here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:317:7: branch_false: following ‘false’ branch (when ‘subgraph’ is non-NULL)...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:320:28: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:332:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:332:7: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:338:9: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:348:31: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:350:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:355:4: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:360:7: branch_false: following ‘false’ branch (when ‘coefs_size == 0’)...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:371:4: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:373:11: danger: ‘subgraph’ leaks here; was allocated at [(3)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/2)
# 371| subgraph->io_used = io_size;
# 372|
# 373|-> return &subgraph->base;
# 374| }
# 375|
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_sched_u85.c: scope_hint: In function ‘find_depthwise_config_u85’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_sched_u85.c:402:14: warning[-Wunused-variable]: unused variable ‘acc_elements’
# 402 | const int acc_elements = (acc_ram_size * 8) / common.acc_bits;
# | ^~~~~~~~~~~~
# 400| ofm_block_limit.depth = MIN2(ofm_shape.depth, common.ofm_block_max.depth);
# 401|
# 402|-> const int acc_elements = (acc_ram_size * 8) / common.acc_bits;
# 403| const int ib_elements = ifm_ram_size;
# 404|
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/ml_ethosu_encode.cpp:21: included_from: Included from here.
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/ml_bit_buffer.hpp: scope_hint: In constructor ‘bitbuf_t::bitbuf_t(bitbuf_t&, int, int)’
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/ml_bit_buffer.hpp:64:13: warning[-Wunused-variable]: unused variable ‘required’
# 64 | int required = (_substream_end + 7 ) / 8;
# | ^~~~~~~~
# 62| bitlen = (bitlen <= 0) ? (_limit * 8) - bitpos : bitlen; // Default to rest of buffer
# 63| _substream_end = bitpos + bitlen;
# 64|-> int required = (_substream_end + 7 ) / 8;
# 65| assert( required <= _limit );
# 66| _enabled = dest._enabled;
Error: CPPCHECK_WARNING (CWE-190):
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/ml_bit_buffer.hpp:74: error[integerOverflow]: Signed integer overflow for expression '1<<len'.
# 72| {
# 73| assert( _buf == reinterpret_cast<uint32_t *>(_buffer->begin()) && "Buffer resized externally" );
# 74|-> assert( (data & ((1 << len)-1)) == data && "Data must be pre-masked" );
# 75| assert( ((_substream_end == 0) || (_pos + len <= _substream_end)) && "Write past end of substream section" );
# 76| if ( len > 0 && _enabled )
Error: CPPCHECK_WARNING (CWE-758):
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/ml_bit_buffer.hpp:74: error[shiftTooManyBits]: Shifting 32-bit value by 32 bits is undefined behaviour
# 72| {
# 73| assert( _buf == reinterpret_cast<uint32_t *>(_buffer->begin()) && "Buffer resized externally" );
# 74|-> assert( (data & ((1 << len)-1)) == data && "Data must be pre-masked" );
# 75| assert( ((_substream_end == 0) || (_pos + len <= _substream_end)) && "Write past end of substream section" );
# 76| if ( len > 0 && _enabled )
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp: scope_hint: In function ‘int ml_decode_internal(raw_buffer_t<short int>&, bitbuf_t&, palette_t&, int, bool, int)’
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp:77:17: warning[-Wunused-variable]: unused variable ‘ones’
# 77 | int ones = bb.get(bits_avail);
# | ^~~~
# 75| {
# 76| z_grc_div = ZDIV_EOS;
# 77|-> int ones = bb.get(bits_avail);
# 78| assert( ones == (1 << bits_avail) - 1 );
# 79| }
Error: COMPILER_WARNING (CWE-457):
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp:133:13: warning[-Wmaybe-uninitialized]: ‘palette.palette_t::palsize’ may be used uninitialized
# 133 | if ( palette.palsize > 0 )
# | ^~
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp: scope_hint: In function ‘void ml_decode_ethosu_stream(ml_decode_result_t*, const uint8_t*, int)’
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp:334:15: note: ‘palette.palette_t::palsize’ was declared here
# 334 | palette_t palette;
# | ^~~~~~~
# 131| w_uncompressed = 1;
# 132| int uncompressed_bits;
# 133|-> if ( palette.palsize > 0 )
# 134| {
# 135| // Uncompressed bits is given by palette size.
Error: COMPILER_WARNING (CWE-457):
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp:205:63: warning[-Wmaybe-uninitialized]: ‘w_grc_div’ may be used uninitialized
# 205 | int max_symbols = w_uncompressed && w_grc_div > 5 ? 8 : 12;
# | ~~~~~~~~~~^~~
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp: scope_hint: In function ‘void ml_decode_ethosu_stream(ml_decode_result_t*, const uint8_t*, int)’
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp:57:9: note: ‘w_grc_div’ was declared here
# 57 | int w_grc_div;
# | ^~~~~~~~~
# 203| {
# 204| w_unary1_len = 0;
# 205|-> int max_symbols = w_uncompressed && w_grc_div > 5 ? 8 : 12;
# 206| if ( w_unary0 != 0 )
# 207| {
Error: COMPILER_WARNING (CWE-457):
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp:292:21: warning[-Wmaybe-uninitialized]: ‘palette.palette_t::direct_offset’ may be used uninitialized
# 292 | val = w_value[i] - palette.palsize + palette.direct_offset;
# | ~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp: scope_hint: In function ‘void ml_decode_ethosu_stream(ml_decode_result_t*, const uint8_t*, int)’
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp:334:15: note: ‘palette.palette_t::direct_offset’ was declared here
# 334 | palette_t palette;
# | ^~~~~~~
# 290| else
# 291| {
# 292|-> val = w_value[i] - palette.palsize + palette.direct_offset;
# 293| }
# 294| int sign = val & 1;
Error: COMPILER_WARNING:
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_encode.cpp: scope_hint: In function ‘void update_palette(mle_context_t*, palette_t*, const int16_t*, int, bool, bool, bool)’
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_encode.cpp:224:9: warning[-Wunused-but-set-variable=]: variable ‘common_val’ set but not used
# 224 | int common_val = 0;
# | ^~~~~~~~~~
# 222| }
# 223|
# 224|-> int common_val = 0;
# 225| int common_freq = 0;
# 226| for ( int i = 0; i < 512; i++ )
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml.c:763:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘subgraph’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml.c:752:7: branch_false: following ‘false’ branch (when ‘nn_core_count != 0’)...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml.c:757:15: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml.c:757:15: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml.c:763:4: danger: ‘subgraph’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/7/codeFlows/0/threadFlows/0/locations/2)
# 761|
# 762| subgraph->base.device = pdevice;
# 763|-> subgraph->screen = screen;
# 764| subgraph->operations = UTIL_DYNARRAY_INIT;
# 765|
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:257:27: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>[w][h][ic]’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:551:1: enter_function: entry to ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:609:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: call_function: calling ‘pointwise_to_2x2’ from ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: return_function: returning to ‘etna_ml_lower_convolution’ from ‘pointwise_to_2x2’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:612:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:613:10: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:619:17: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:620:10: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:620:10: call_function: calling ‘reorder_for_hw_depthwise’ from ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:620:10: return_function: returning to ‘etna_ml_lower_convolution’ from ‘reorder_for_hw_depthwise’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:626:12: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:629:39: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:637:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:643:7: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:643:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:648:7: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:651:7: call_function: calling ‘requantize_weights’ from ‘etna_ml_lower_convolution’
# 255| map_out[oc][w][h][ic] = requantized + operation->weight_zero_point - 0x80;
# 256| } else {
# 257|-> uint8_t val = map_in[oc][w][h][ic];
# 258| double dequantized = weight_tensor->scales[oc] * (val - weight_tensor->zero_points[oc]);
# 259| uint8_t requantized = round(dequantized / operation->weight_scale);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:307:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘map_out’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:551:1: enter_function: entry to ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:609:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: call_function: calling ‘pointwise_to_2x2’ from ‘etna_ml_lower_convolution’
# 305| uint8_t *map_out = output + channel * 2 * 2 * operation->input_channels;
# 306|
# 307|-> map_out[0] = map_in[0];
# 308| if (operation->weight_signed) {
# 309| map_out[1] = operation->weight_zero_point - 128;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:344:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘output’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:551:1: enter_function: entry to ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:609:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: call_function: calling ‘pointwise_to_2x2’ from ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: return_function: returning to ‘etna_ml_lower_convolution’ from ‘pointwise_to_2x2’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:612:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:613:10: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:613:10: branch_true: following ‘true’ branch (when ‘nn_core_version <= 7’)...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:614:14: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:615:16: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:617:13: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:617:13: call_function: calling ‘expand_depthwise’ from ‘etna_ml_lower_convolution’
# 342| for (unsigned i = 0; i < operation->weight_width * operation->weight_height * operation->input_channels; i++) {
# 343| if (i % operation->input_channels == in_depth)
# 344|-> map_out[i] = map_in[i];
# 345| else if (operation->weight_signed)
# 346| map_out[i] = operation->weight_zero_point - 128;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:368:61: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘input’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:551:1: enter_function: entry to ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:609:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: call_function: calling ‘pointwise_to_2x2’ from ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: return_function: returning to ‘etna_ml_lower_convolution’ from ‘pointwise_to_2x2’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:612:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:613:10: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:613:10: branch_false: following ‘false’ branch (when ‘nn_core_version > 7’)...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:619:18: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:619:17: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:620:10: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:620:10: call_function: calling ‘reorder_for_hw_depthwise’ from ‘etna_ml_lower_convolution’
# 366| unsigned out_channel = i % operation->output_channels;
# 367|
# 368|-> output[out_channel][i / operation->output_channels] = input[i];
# 369| }
# 370|
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:368:61: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:551:1: enter_function: entry to ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:609:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: call_function: calling ‘pointwise_to_2x2’ from ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: return_function: returning to ‘etna_ml_lower_convolution’ from ‘pointwise_to_2x2’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:612:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:613:10: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:613:10: branch_false: following ‘false’ branch (when ‘nn_core_version > 7’)...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:619:18: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:619:17: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:620:10: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:620:10: call_function: calling ‘reorder_for_hw_depthwise’ from ‘etna_ml_lower_convolution’
# 366| unsigned out_channel = i % operation->output_channels;
# 367|
# 368|-> output[out_channel][i / operation->output_channels] = input[i];
# 369| }
# 370|
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:592:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*operation.weight_tensor’ where non-null expected
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:591:31: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:592:4: danger: argument 1 (‘malloc((long unsigned int)weight_size)’) from [(1)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
# 590| poperation->conv.weight_tensor->dims[3];
# 591| operation->weight_tensor = malloc(weight_size);
# 592|-> memcpy(operation->weight_tensor, poperation->conv.weight_tensor->data, weight_size);
# 593| operation->weight_tensor_size = weight_size;
# 594| operation->weight_width = poperation->conv.weight_tensor->dims[1];
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:606:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*operation.bias_tensor’ where non-null expected
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:605:29: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:606:4: danger: argument 1 (‘malloc((long unsigned int)bias_size)’) from [(1)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
# 604| sizeof(int32_t);
# 605| operation->bias_tensor = malloc(bias_size);
# 606|-> memcpy(operation->bias_tensor, poperation->conv.bias_tensor->data, bias_size);
# 607| operation->bias_tensor_size = bias_size;
# 608|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:747:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*operation.weight_tensor’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:737:31: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:747:4: danger: ‘calloc(1, 8)’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/7/codeFlows/0/threadFlows/0/locations/0)
# 745|
# 746| uint8_t *weight_map = operation->weight_tensor;
# 747|-> weight_map[0] = compute_weight_add(poperation->input_tensors[1]->scale, poperation->input_tensors[0]->scale, operation->weight_scale);
# 748|
# 749| operation->bias_tensor = calloc(1, 4);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:752:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*operation.bias_tensor’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:749:29: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:752:4: danger: ‘calloc(1, 4)’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/8/codeFlows/0/threadFlows/0/locations/0)
# 750| operation->bias_tensor_size = 4;
# 751| int32_t *bias_map = (int32_t *)operation->bias_tensor;
# 752|-> bias_map[0] = compute_bias_add(poperation->input_tensors[1]->scale, poperation->input_tensors[0]->scale,
# 753| poperation->input_tensors[1]->zero_point, poperation->input_tensors[0]->zero_point,
# 754| operation->weight_scale);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:856:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*operation.weight_tensor’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:848:31: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:854:24: branch_true: following ‘true’ branch (when ‘i < kernel_size’)...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:855:16: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:855:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:856:20: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:856:10: danger: ‘calloc(1, (long unsigned int)kernel_size) + (sizetype)i’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/10/codeFlows/0/threadFlows/0/locations/0)
# 854| for(unsigned i = 0; i < kernel_size; i++) {
# 855| if (i % (operation->weight_width * operation->weight_height * operation->input_channels + 1) == 0)
# 856|-> weight_map[i] = first_weight;
# 857| else if (i % (operation->weight_width * operation->weight_height * operation->input_channels + 1) == operation->output_channels)
# 858| weight_map[i] = second_weight;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:877:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*operation.bias_tensor’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:854:24: branch_false: following ‘false’ branch (when ‘i >= kernel_size’)...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:863:43: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:863:29: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:876:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:877:15: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:877:7: danger: ‘calloc(1, (long unsigned int)(*operation.output_channels * 4)) + (long unsigned int)oc * 4’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/11/codeFlows/0/threadFlows/0/locations/2)
# 875| int bias = zero_point_diff * round(bias_scale);
# 876| for(unsigned oc = 0; oc < operation->output_channels; oc++)
# 877|-> bias_map[oc] = bias;
# 878| }
# 879|
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:934:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*operation.weight_tensor’ where non-null expected
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:933:31: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:934:4: danger: argument 1 (‘malloc((long unsigned int)fc_weight_size)’) from [(1)](sarif:/runs/0/results/12/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
# 932| poperation->conv.weight_tensor->dims[3];
# 933| operation->weight_tensor = malloc(fc_weight_size);
# 934|-> memcpy(operation->weight_tensor, poperation->conv.weight_tensor->data, fc_weight_size);
# 935| operation->weight_tensor_size = fc_weight_size;
# 936| operation->weight_width = poperation->conv.weight_tensor->dims[3];
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:948:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*operation.bias_tensor’ where non-null expected
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:947:29: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:948:4: danger: argument 1 (‘malloc((long unsigned int)fc_bias_size)’) from [(1)](sarif:/runs/0/results/13/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
# 946| sizeof(int32_t);
# 947| operation->bias_tensor = malloc(fc_bias_size);
# 948|-> memcpy(operation->bias_tensor, poperation->conv.bias_tensor->data, fc_bias_size);
# 949| operation->bias_tensor_size = fc_bias_size;
# 950| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/freedreno/ir3/ir3_gallium.c:334:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘hwcso’
mesa-26.1.1/src/gallium/drivers/freedreno/ir3/ir3_gallium.c:299:37: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/freedreno/ir3/ir3_gallium.c:334:4: danger: ‘hwcso’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
# 332| */
# 333|
# 334|-> hwcso->shader =
# 335| ir3_shader_from_nir(compiler, nir, &(struct ir3_shader_options){
# 336| /* TODO: force to single on a6xx with legacy
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4000:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘so’
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:3998:37: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4000:4: danger: ‘so’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
# 3998| struct panfrost_rasterizer *so = CALLOC_STRUCT(panfrost_rasterizer);
# 3999|
# 4000|-> so->base = *cso;
# 4001|
# 4002| #if PAN_ARCH <= 7
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4073:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘so’
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4070:39: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4073:4: danger: ‘so’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
# 4071| UNUSED struct panfrost_device *dev = pan_device(pctx->screen);
# 4072|
# 4073|-> so->num_elements = num_elements;
# 4074| memcpy(so->pipe, elements, sizeof(*elements) * num_elements);
# 4075|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4171:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘so’
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4170:36: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4171:4: danger: ‘so’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
# 4169|
# 4170| struct panfrost_zsa_state *so = CALLOC_STRUCT(panfrost_zsa_state);
# 4171|-> so->base = *zsa;
# 4172|
# 4173| const struct pipe_stencil_state front = zsa->stencil[0];
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4300:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘so’
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4299:38: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4300:4: danger: ‘so’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
# 4298|
# 4299| struct panfrost_blend_state *so = CALLOC_STRUCT(panfrost_blend_state);
# 4300|-> so->base = *blend;
# 4301|
# 4302| so->pan.logicop_enable = blend->logicop_enable;
Error: COMPILER_WARNING:
mesa-26.1.1/src/gallium/drivers/r300/r300_emit.c: scope_hint: In function ‘r300_emit_query_start’
mesa-26.1.1/src/gallium/drivers/r300/r300_emit.c:678:14: warning[-Wunused-but-set-variable=]: variable ‘dwords’ set but not used
# 678 | unsigned dwords = 4;
# | ^~~~~~
# 676| struct r300_surface *surf = NULL;
# 677| bool use_dummy_z = false;
# 678|-> unsigned dwords = 4;
# 679| CS_LOCALS(r300);
# 680|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:93:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘chunk’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:630:6: enter_function: entry to ‘si_log_draw_state’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:632:7: branch_false: following ‘false’ branch (when ‘log’ is non-NULL)...
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:635:4: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:638:4: call_function: calling ‘si_dump_gfx_shader’ from ‘si_log_draw_state’
# 91|
# 92| struct si_log_chunk_shader *chunk = CALLOC_STRUCT(si_log_chunk_shader);
# 93|-> chunk->ctx = ctx;
# 94| chunk->shader = current;
# 95| si_shader_selector_reference(ctx, &chunk->sel, current->selector);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:107:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘chunk’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:106:40: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:107:4: danger: ‘chunk’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
# 105|
# 106| struct si_log_chunk_shader *chunk = CALLOC_STRUCT(si_log_chunk_shader);
# 107|-> chunk->ctx = ctx;
# 108| chunk->shader = &program->shader;
# 109| si_compute_reference(&chunk->program, program);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:363:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘chunk’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:438:13: enter_function: entry to ‘si_dump_compute_descriptors’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:445:4: call_function: calling ‘si_dump_descriptors’ from ‘si_dump_compute_descriptors’
# 361| struct si_log_chunk_desc_list *chunk =
# 362| CALLOC_VARIANT_LENGTH_STRUCT(si_log_chunk_desc_list, 4 * (size_t)element_dw_size * num_elements);
# 363|-> chunk->shader_name = shader_name;
# 364| chunk->elem_name = elem_name;
# 365| chunk->element_dw_size = element_dw_size;
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:505:13: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘transfer’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:442:6: enter_function: entry to ‘si_handle_sqtt’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:445:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:479:28: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:488:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:490:11: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:490:11: call_function: calling ‘si_get_sqtt_trace’ from ‘si_handle_sqtt’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:490:11: return_function: returning to ‘si_handle_sqtt’ from ‘si_get_sqtt_trace’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:488:11: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:495:14: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:495:13: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:498:14: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:504:13: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:505:13: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:505:13: danger: use of uninitialized value ‘transfer’ here
# 503|
# 504| if (sctx->spm.ptr) {
# 505|-> pipe_buffer_unmap(&sctx->b, transfer);
# 506| sctx->spm.ptr = NULL;
# 507| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/rocket/rkt_ml.c:316:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘subgraph’
mesa-26.1.1/src/gallium/drivers/rocket/rkt_ml.c:314:15: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/rocket/rkt_ml.c:316:4: danger: ‘subgraph’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
# 314| subgraph = calloc(1, sizeof(*subgraph));
# 315| subgraph->base.device = pdevice;
# 316|-> subgraph->context = dev->context;
# 317|
# 318| tensor_count = count_tensors(poperations, count);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5656:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5640:1: enter_function: entry to ‘lower_vri_to_var_instr’
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5648:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5648:7: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5650:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5652:31: call_function: inlined call to ‘nir_src_as_intrinsic’ from ‘lower_vri_to_var_instr’
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5653:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5653:7: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5655:31: call_function: inlined call to ‘nir_src_as_intrinsic’ from ‘lower_vri_to_var_instr’
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5656:8: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5656:8: danger: dereference of NULL ‘<unknown>’
# 5654| return false;
# 5655| nir_intrinsic_instr *vri = nir_src_as_intrinsic(lvd->src[0]);
# 5656|-> if (vri->intrinsic != nir_intrinsic_vulkan_resource_index)
# 5657| return false;
# 5658|
Error: COMPILER_WARNING:
mesa-26.1.1/src/util/u_math.h:48: included_from: Included from here.
mesa-26.1.1/src/util/box.h:4: included_from: Included from here.
mesa-26.1.1/src/gallium/include/pipe/p_state.h:52: included_from: Included from here.
mesa-26.1.1/src/gallium/drivers/zink/zink_types.h:37: included_from: Included from here.
mesa-26.1.1/src/gallium/drivers/zink/zink_program.h:27: included_from: Included from here.
mesa-26.1.1/src/gallium/drivers/zink/zink_program.c:24: included_from: Included from here.
mesa-26.1.1/src/gallium/drivers/zink/zink_program.c: scope_hint: In function ‘zink_link_gfx_shader’
mesa-26.1.1/src/gallium/drivers/zink/zink_program.c:2549:18: warning[-Wunused-but-set-variable=]: variable ‘i’ set but not used
# 2549 | u_foreach_bit(i, shader_stages)
# | ^
mesa-26.1.1/src/util/bitscan.h:110:37: note: in definition of macro ‘u_foreach_bit’
# 110 | for (uint32_t __dword = (dword), b; \
# | ^
# 2547| }
# 2548| struct zink_gfx_program *prog = gfx_program_create(ctx, zshaders, 3, hash, is_mesh);
# 2549|-> u_foreach_bit(i, shader_stages)
# 2550| assert(prog->shaders[i]);
# 2551| _mesa_hash_table_insert_pre_hashed(ht, hash, prog->shaders, prog);
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:398:19: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘a_comps[i]’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:782:1: enter_function: entry to ‘lvp_nir_lower_cooperative_matrix’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:786:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:789:38: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:791:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: call_function: calling ‘nir_shader_get_entrypoint’ from ‘lvp_nir_lower_cooperative_matrix’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: return_function: returning to ‘lvp_nir_lower_cooperative_matrix’ from ‘nir_shader_get_entrypoint’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: call_function: calling ‘lower_impl’ from ‘lvp_nir_lower_cooperative_matrix’
# 396| ref = nir_imm_zero(b, 1, glsl_base_type_bit_size(c_desc.element_type));
# 397|
# 398|-> nir_def *a_i = a_comps[i];
# 399| nir_def *b_j = b_comps[j]; /* B is stored transposed */
# 400| nir_def *val;
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:431:16: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘c_comps[i]’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:782:1: enter_function: entry to ‘lvp_nir_lower_cooperative_matrix’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:786:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:789:38: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:791:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: call_function: calling ‘nir_shader_get_entrypoint’ from ‘lvp_nir_lower_cooperative_matrix’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: return_function: returning to ‘lvp_nir_lower_cooperative_matrix’ from ‘nir_shader_get_entrypoint’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: call_function: calling ‘lower_impl’ from ‘lvp_nir_lower_cooperative_matrix’
# 429|
# 430| if (glsl_base_type_is_integer(c_desc.element_type)) {
# 431|-> ref = nir_iadd(b, ref, c_comps[i]);
# 432| } else {
# 433| ref = nir_fadd(b, ref, c_comps[i]);
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:433:16: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘c_comps[i]’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:782:1: enter_function: entry to ‘lvp_nir_lower_cooperative_matrix’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:786:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:789:38: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:791:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: call_function: calling ‘nir_shader_get_entrypoint’ from ‘lvp_nir_lower_cooperative_matrix’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: return_function: returning to ‘lvp_nir_lower_cooperative_matrix’ from ‘nir_shader_get_entrypoint’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: call_function: calling ‘lower_impl’ from ‘lvp_nir_lower_cooperative_matrix’
# 431| ref = nir_iadd(b, ref, c_comps[i]);
# 432| } else {
# 433|-> ref = nir_fadd(b, ref, c_comps[i]);
# 434| }
# 435| d_comps[i] = ref;
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c: scope_hint: In function ‘lower_cmat_reduce_finish_call’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:457:33: warning[-Wunused-variable]: unused variable ‘src_desc’
# 457 | struct glsl_cmat_description src_desc = *glsl_get_cmat_description(src0_deref->type);
# | ^~~~~~~~
# 455| nir_deref_instr *dst_deref = nir_src_as_deref(call->params[0]);
# 456| nir_deref_instr *src0_deref = nir_src_as_deref(call->params[1]);
# 457|-> struct glsl_cmat_description src_desc = *glsl_get_cmat_description(src0_deref->type);
# 458| nir_function *fnptr = call->callee;
# 459| nir_cmat_reduce reduce = nir_cmat_call_reduce_flags(call);
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c: scope_hint: In function ‘lower_cmat_reduce_call’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:506:33: warning[-Wunused-variable]: unused variable ‘src_desc’
# 506 | struct glsl_cmat_description src_desc = *glsl_get_cmat_description(src_deref->type);
# | ^~~~~~~~
# 504| nir_deref_instr *dst_deref = nir_src_as_deref(call->params[0]);
# 505| nir_deref_instr *src_deref = nir_src_as_deref(call->params[1]);
# 506|-> struct glsl_cmat_description src_desc = *glsl_get_cmat_description(src_deref->type);
# 507| nir_cmat_reduce reduce = nir_cmat_call_reduce_flags(call);
# 508| nir_def *src = load_cmat_src(b, call->params[1]);
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c: scope_hint: In function ‘lower_cmat_reduce_2x2_call’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:565:33: warning[-Wunused-variable]: unused variable ‘src_desc’
# 565 | struct glsl_cmat_description src_desc = *glsl_get_cmat_description(src_deref->type);
# | ^~~~~~~~
# 563| nir_deref_instr *dst_deref = nir_src_as_deref(call->params[0]);
# 564| nir_deref_instr *src_deref = nir_src_as_deref(call->params[1]);
# 565|-> struct glsl_cmat_description src_desc = *glsl_get_cmat_description(src_deref->type);
# 566| nir_function *fnptr = call->callee;
# 567| nir_def *lane_id = nir_load_subgroup_invocation(b);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:82:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘operation.input_tensors’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:833:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:834:11: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:837:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: call_function: calling ‘check_op_support’ from ‘PrepareDelegate’
# 80| operation->input_tensors = calloc(operation->input_count, sizeof(void *));
# 81| for (unsigned i = 0; i < node->inputs->size; i++)
# 82|-> operation->input_tensors[i] = &tensors[node->inputs->data[i]];
# 83|
# 84| operation->output_count = node->outputs->size;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:87:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘operation.output_tensors’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:833:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:834:11: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:837:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: call_function: calling ‘check_op_support’ from ‘PrepareDelegate’
# 85| operation->output_tensors = calloc(operation->output_count, sizeof(void *));
# 86| for (unsigned i = 0; i < node->outputs->size; i++)
# 87|-> operation->output_tensors[i] = &tensors[node->outputs->data[i]];
# 88|
# 89| switch (node_registration->builtin_code) {
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:111:33: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘operation.input_tensors’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:833:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:834:11: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:837:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: call_function: calling ‘check_op_support’ from ‘PrepareDelegate’
# 109| operation->conv.stride_y = params->stride_height;
# 110| if (params->padding == kTfLitePaddingSame) {
# 111|-> struct pipe_tensor *in = operation->input_tensors[0];
# 112| struct pipe_tensor *wt = &tensors[node->inputs->data[1]];
# 113| calc_same_padding(in->dims[1], wt->dims[1], params->stride_height,
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:143:33: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘operation.input_tensors’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:833:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:834:11: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:837:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: call_function: calling ‘check_op_support’ from ‘PrepareDelegate’
# 141| operation->conv.stride_y = params->stride_height;
# 142| if (params->padding == kTfLitePaddingSame) {
# 143|-> struct pipe_tensor *in = operation->input_tensors[0];
# 144| struct pipe_tensor *wt = &tensors[node->inputs->data[1]];
# 145| calc_same_padding(in->dims[1], wt->dims[1], params->stride_height,
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:177:30: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘operation.input_tensors’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:833:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:834:11: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:837:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: call_function: calling ‘check_op_support’ from ‘PrepareDelegate’
# 175| operation->pooling.stride_y = params->stride_height;
# 176| if (params->padding == kTfLitePaddingSame) {
# 177|-> struct pipe_tensor *in = operation->input_tensors[0];
# 178| calc_same_padding(in->dims[1], params->filter_height, params->stride_height,
# 179| 1, &operation->pooling.padding_top, &operation->pooling.padding_bottom);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:366:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘tensor’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:822:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
# 364| if (tf_tensor.data.data) {
# 365| unsigned size = tensor_data_size(tf_tensor);
# 366|-> tensor->data = malloc(size);
# 367| memcpy(tensor->data, tf_tensor.data.data, size);
# 368| }
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:367:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘malloc((long unsigned int)tensor_data_size(*<unknown>))’ where non-null expected
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:822:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
# 365| unsigned size = tensor_data_size(tf_tensor);
# 366| tensor->data = malloc(size);
# 367|-> memcpy(tensor->data, tf_tensor.data.data, size);
# 368| }
# 369|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:370:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘tensor’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:822:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
# 368| }
# 369|
# 370|-> tensor->type_size = tf_format_to_size(tf_tensor.type);
# 371| tensor->index = index;
# 372| for (int out_dim = 0; out_dim < 4; out_dim++) {
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:388:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘calloc((long unsigned int)*MEM[(const struct TfLiteAffineQuantization *)tf_tensor$quantization$params_69].scale.size, 4)’ where non-null expected
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:822:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
# 386| if (quant->scale->size > 1 && !all_scales_equal(quant)) {
# 387| tensor->scales = calloc(quant->scale->size, sizeof(*tensor->scales));
# 388|-> memcpy(tensor->scales, quant->scale->data, quant->scale->size * sizeof(*tensor->scales));
# 389|
# 390| tensor->zero_points = calloc(quant->scale->size, sizeof(*tensor->zero_points));
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:393:13: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘calloc((long unsigned int)*MEM[(const struct TfLiteAffineQuantization *)tf_tensor$quantization$params_69].scale.size, 4)’ where non-null expected
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:822:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
# 391| if (quant->zero_point->size == quant->scale->size) {
# 392| /* Same number of zero_points as scales - copy directly */
# 393|-> memcpy(tensor->zero_points, quant->zero_point->data, quant->scale->size * sizeof(*tensor->zero_points));
# 394| } else if (quant->zero_point->size == 1) {
# 395| /* Single zero_point for all channels (common for symmetric quantization) - replicate it */
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:397:16: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘calloc((long unsigned int)*MEM[(const struct TfLiteAffineQuantization *)tf_tensor$quantization$params_69].scale.size, 4)’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:822:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
# 395| /* Single zero_point for all channels (common for symmetric quantization) - replicate it */
# 396| for (int i = 0; i < quant->scale->size; i++) {
# 397|-> tensor->zero_points[i] = quant->zero_point->data[0];
# 398| }
# 399| } else {
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:404:16: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*tensor.zero_points + (long unsigned int)i * 4’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:822:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
# 402| index, quant->scale->size, quant->zero_point->size);
# 403| for (int i = 0; i < quant->scale->size; i++) {
# 404|-> tensor->zero_points[i] = quant->zero_point->data[0];
# 405| }
# 406| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:138:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:68:10: enter_function: entry to ‘pvr_rogue_CreateImageView’
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:85:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:88:12: call_function: inlined call to ‘pvr_image_view_get_image’ from ‘pvr_rogue_CreateImageView’
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:127:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:132:4: branch_false: ...to here
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:134:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:136:10: branch_true: ...to here
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:136:10: call_function: inlined call to ‘__vk_find_struct’ from ‘pvr_rogue_CreateImageView’
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:138:7: branch_true: ...to here
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:138:7: danger: dereference of NULL ‘<unknown>’
# 136| vk_find_struct_const(pCreateInfo->pNext,
# 137| SAMPLER_YCBCR_CONVERSION_INFO);
# 138|-> VK_FROM_HANDLE(vk_ycbcr_conversion, conversion, pConversion->conversion);
# 139| assert(conversion);
# 140|
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:2870:14: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*mrt_attachment_map[i]’
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3388:10: enter_function: entry to ‘pvr_rogue_CreateGraphicsPipelines’
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3400:25: branch_true: following ‘true’ branch (when ‘i < createInfoCount’)...
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3406:50: branch_true: ...to here
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3407:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3409:10: branch_true: ...to here
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3400:25: branch_true: following ‘true’ branch (when ‘i < createInfoCount’)...
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3406:50: branch_true: ...to here
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3402:10: call_function: calling ‘pvr_graphics_pipeline_create’ from ‘pvr_rogue_CreateGraphicsPipelines’
# 2868|
# 2869| for (uint32_t i = 0; i < rp->color_attachment_count; i++) {
# 2870|-> if (mrt_attachment_map[i] != VK_ATTACHMENT_UNUSED) {
# 2871| memcpy(&mrt_setup.mrt_resources[i],
# 2872| &mrt_setup_tmp.mrt_resources[mrt_attachment_map[i]],
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/intel/common/mi_builder.h:458:1: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘((int64_t *)((char *)&value + offsetof(struct mi_value, <U6dc0>)))[1]’
mesa-26.1.1/src/intel/vulkan_hasvk/genX_query.c:1282:6: enter_function: entry to ‘gfx7_CmdWriteTimestamp2’
mesa-26.1.1/src/intel/vulkan_hasvk/genX_query.c:1297:7: branch_true: following ‘true’ branch (when ‘stage == 1’)...
mesa-26.1.1/src/intel/vulkan_hasvk/genX_query.c:1298:7: call_function: inlined call to ‘anv_address_add’ from ‘gfx7_CmdWriteTimestamp2’
mesa-26.1.1/src/intel/vulkan_hasvk/genX_query.c:1298:7: call_function: inlined call to ‘mi_store’ from ‘gfx7_CmdWriteTimestamp2’
# 456|
# 457| static inline struct mi_value
# 458|-> mi_value_half(struct mi_value value, bool top_32_bits)
# 459| {
# 460| switch (value.type) {
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/intel/compiler/brw/brw_compile_tcs.cpp: scope_hint: In function ‘bool run_tcs(brw_shader&)’
mesa-26.1.1/src/intel/compiler/brw/brw_compile_tcs.cpp:94:30: warning[-Wunused-variable]: unused variable ‘vue_prog_data’
# 94 | struct brw_vue_prog_data *vue_prog_data = brw_vue_prog_data(s.prog_data);
# | ^~~~~~~~~~~~~
# 92| assert(s.stage == MESA_SHADER_TESS_CTRL);
# 93|
# 94|-> struct brw_vue_prog_data *vue_prog_data = brw_vue_prog_data(s.prog_data);
# 95|
# 96| assert(vue_prog_data->dispatch_mode == INTEL_DISPATCH_MODE_TCS_SINGLE_PATCH ||
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/intel/compiler/brw/brw_from_nir.cpp: scope_hint: In function ‘void emit_pixel_interpolater_alu_at_offset(const brw_builder&, const brw_reg&, const brw_reg&, glsl_interp_mode)’
mesa-26.1.1/src/intel/compiler/brw/brw_from_nir.cpp:2081:35: warning[-Wunused-variable]: unused variable ‘fs_prog_data’
# 2081 | const struct brw_fs_prog_data *fs_prog_data =
# | ^~~~~~~~~~~~
# 2079|
# 2080| const brw_fs_thread_payload &payload = shader->fs_payload();
# 2081|-> const struct brw_fs_prog_data *fs_prog_data =
# 2082| brw_fs_prog_data(shader->prog_data);
# 2083|
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/intel/compiler/brw/brw_from_nir.cpp: scope_hint: In function ‘void emit_pixel_interpolater_alu_at_sample(const brw_builder&, const brw_reg&, const brw_reg&, glsl_interp_mode)’
mesa-26.1.1/src/intel/compiler/brw/brw_from_nir.cpp:2216:35: warning[-Wunused-variable]: unused variable ‘fs_prog_data’
# 2216 | const struct brw_fs_prog_data *fs_prog_data =
# | ^~~~~~~~~~~~
# 2214| {
# 2215| const brw_fs_thread_payload &payload = bld.shader->fs_payload();
# 2216|-> const struct brw_fs_prog_data *fs_prog_data =
# 2217| brw_fs_prog_data(bld.shader->prog_data);
# 2218| const brw_builder ubld = bld.exec_all().group(16, 0);
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/intel/compiler/brw/brw_from_nir.cpp: scope_hint: In function ‘brw_reg brw_per_primitive_reg(const brw_builder&, int, unsigned int)’
mesa-26.1.1/src/intel/compiler/brw/brw_from_nir.cpp:3699:35: warning[-Wunused-variable]: unused variable ‘prog_data’
# 3699 | const struct brw_fs_prog_data *prog_data = brw_fs_prog_data(s.prog_data);
# | ^~~~~~~~~
# 3697| location == VARYING_SLOT_PRIMITIVE_ID);
# 3698|
# 3699|-> const struct brw_fs_prog_data *prog_data = brw_fs_prog_data(s.prog_data);
# 3700|
# 3701| comp += (s.fs.per_primitive_offsets[location] % 16) / 4;
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_cooperative_matrix.c: scope_hint: In function ‘lower_cmat_per_element_op’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_cooperative_matrix.c:595:22: warning[-Wunused-variable]: unused variable ‘src_info’
# 595 | const slice_info *src_info = get_slice_info(state, src_slice);
# | ^~~~~~~~
# 593| nir_deref_instr *src_slice = nir_src_as_deref(call->params[3]);
# 594| const slice_info *dst_info = get_slice_info(state, dst_slice);
# 595|-> const slice_info *src_info = get_slice_info(state, src_slice);
# 596| assert(cmat_descriptions_are_equal(dst_info->desc, src_info->desc));
# 597|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:157:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘any_hit_impl’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:131:1: enter_function: entry to ‘brw_nir_lower_intersection_shader’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:139:7: branch_false: following ‘false’ branch (when ‘any_hit’ is NULL)...
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:146:30: branch_false: ...to here
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:146:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘brw_nir_lower_intersection_shader’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:146:30: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘nir_shader_get_entrypoint’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:148:24: call_function: inlined call to ‘nir_before_impl’ from ‘brw_nir_lower_intersection_shader’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:151:22: call_function: calling ‘brw_nir_rt_mem_hit_addr’ from ‘brw_nir_lower_intersection_shader’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:151:22: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘brw_nir_rt_mem_hit_addr’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:154:4: call_function: inlined call to ‘nir_imm_false’ from ‘brw_nir_lower_intersection_shader’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:154:4: call_function: inlined call to ‘nir_imm_false’ from ‘brw_nir_lower_intersection_shader’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:157:4: danger: dereference of NULL ‘nir_shader_get_entrypoint(intersection)’
# 155|
# 156| assert(nir_block_num_preds(impl->end_block) == 1);
# 157|-> nir_foreach_pred(block, impl->end_block) {
# 158| b->cursor = nir_after_block_before_jump(block);
# 159| nir_push_if(b, nir_load_var(b, commit));
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:113:7: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*end_preds[i]’
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:91:1: enter_function: entry to ‘intel_nir_apply_tcs_quads_workaround’
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:95:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘intel_nir_apply_tcs_quads_workaround’
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:95:30: return_function: returning to ‘intel_nir_apply_tcs_quads_workaround’ from ‘nir_shader_get_entrypoint’
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:108:4: call_function: inlined call to ‘_nir_pred_iter_end’ from ‘intel_nir_apply_tcs_quads_workaround’
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:112:16: branch_true: following ‘true’ branch...
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:113:7: branch_true: ...to here
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:113:7: danger: use of uninitialized value ‘*end_preds[i]’ here
# 111|
# 112| for (i = 0; i < num_end_preds; i++) {
# 113|-> emit_quads_workaround(&b, end_preds[i]);
# 114| }
# 115|
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/intel/compiler/jay/jay_from_nir.c: scope_hint: In function ‘jay_emit_intrinsic’
mesa-26.1.1/src/intel/compiler/jay/jay_from_nir.c:1097:18: warning[-Wunused-variable]: unused variable ‘f’
# 1097 | jay_function *f = nj->f;
# | ^
# 1095| {
# 1096| jay_shader *s = nj->s;
# 1097|-> jay_function *f = nj->f;
# 1098| jay_builder *b = &nj->bld;
# 1099| jay_cs_payload *cs =
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/intel/compiler/jay/jay_from_nir.c: scope_hint: In function ‘jay_emit_if’
mesa-26.1.1/src/intel/compiler/jay/jay_from_nir.c:2122:15: warning[-Wunused-variable]: unused variable ‘else_first_2’
# 2122 | jay_block *else_first_2 = jay_emit_cf_list(nj, &nif->else_list);
# | ^~~~~~~~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c23-extensions’ may have been intended to silence earlier diagnostics
# 2120| nj->after_block = else_first;
# 2121|
# 2122|-> jay_block *else_first_2 = jay_emit_cf_list(nj, &nif->else_list);
# 2123| jay_block *else_last = nj->current_block;
# 2124| assert(else_first == else_first_2);
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/intel/compiler/jay/jay_lower_scoreboard.c:360:13: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘access’ where non-null expected
mesa-26.1.1/src/intel/compiler/jay/jay_lower_scoreboard.c:353:27: acquire_memory: this call could return NULL
mesa-26.1.1/src/intel/compiler/jay/jay_lower_scoreboard.c:355:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/intel/compiler/jay/jay_lower_scoreboard.c:356:11: branch_true: ...to here
mesa-26.1.1/src/intel/compiler/jay/jay_lower_scoreboard.c:359:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/intel/compiler/jay/jay_lower_scoreboard.c:360:13: branch_true: ...to here
mesa-26.1.1/src/intel/compiler/jay/jay_lower_scoreboard.c:360:13: danger: argument 1 (‘access’) from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
# 358| } else {
# 359| jay_foreach_block(func, block) {
# 360|-> memset(access, 0, sizeof(*access) * nr_keys);
# 361| lower_send_local(func, block);
# 362| lower_regdist_local(func, block, access);
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c: scope_hint: In function ‘collect_fragment_output’
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:136:13: warning[-Wunused-variable]: unused variable ‘wrmask’
# 136 | unsigned wrmask = nir_intrinsic_write_mask(intr);
# | ^~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c23-extensions’ may have been intended to silence earlier diagnostics
# 134| return false;
# 135|
# 136|-> unsigned wrmask = nir_intrinsic_write_mask(intr);
# 137| assert(nir_intrinsic_component(intr) == 0 && "component should be lowered");
# 138| assert(util_is_power_of_two_nonzero(wrmask + 1) &&
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/intel/compiler/jay/jay_register_allocate.c:361:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/intel/compiler/jay/jay_register_allocate.c:357:1: enter_function: entry to ‘add_copy’
mesa-26.1.1/src/intel/compiler/jay/jay_register_allocate.c:361:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘add_copy’
mesa-26.1.1/src/intel/compiler/jay/jay_register_allocate.c:361:7: return_function: returning to ‘add_copy’ from ‘util_dynarray_grow_bytes’
mesa-26.1.1/src/intel/compiler/jay/jay_register_allocate.c:361:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(copies, 1, 4)’
# 359| if (dst != src) {
# 360| assert(r_file(dst) == r_file(src));
# 361|-> util_dynarray_append(copies, ((struct jay_parallel_copy) { dst, src }));
# 362| }
# 363| }
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/intel/compiler/jay/jay_register_allocate.c: scope_hint: In function ‘build_partition’
mesa-26.1.1/src/intel/compiler/jay/jay_register_allocate.c:1393:19: warning[-Wunused-variable]: unused variable ‘max_vec’
# 1393 | unsigned max_vec = 8;
# | ^~~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c23-extensions’ may have been intended to silence earlier diagnostics
# 1391| /* GPR partition blocks must be vector size aligned to avoid crossing */
# 1392| if (file == GPR && i != (n - 1)) {
# 1393|-> unsigned max_vec = 8;
# 1394| assert(util_is_aligned(blocks[i], max_vec * jay_grf_per_gpr(shader)));
# 1395| }
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/intel/compiler/jay/jay_spill.c: scope_hint: In function ‘remat_to’
mesa-26.1.1/src/intel/compiler/jay/jay_spill.c:187:14: warning[-Wunused-variable]: unused variable ‘I’
# 187 | jay_inst *I = ctx->defs[node];
# | ^
cc1: note: unrecognized command-line option ‘-Wno-c23-extensions’ may have been intended to silence earlier diagnostics
# 185| remat_to(jay_builder *b, jay_def dst, struct spill_ctx *ctx, unsigned node)
# 186| {
# 187|-> jay_inst *I = ctx->defs[node];
# 188| assert(can_remat(I));
# 189|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:385:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bbo’
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:603:1: enter_function: entry to ‘anv_cmd_buffer_chain_generation_batch’
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:611:25: release_memory: ‘new_bbo’ is NULL
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:622:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:625:37: branch_false: ...to here
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:626:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:627:7: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:627:7: release_memory: ‘new_bbo’ is NULL
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:627:7: call_function: calling ‘anv_batch_bo_destroy’ from ‘anv_cmd_buffer_chain_generation_batch’
# 383| {
# 384| anv_reloc_list_finish(&bbo->relocs);
# 385|-> ANV_ADDR_BINDING_REPORT_BO_UNBIND(cmd_buffer->device, &cmd_buffer->vk.base,
# 386| bbo->bo);
# 387| ANV_DMR_BO_FREE(&cmd_buffer->vk.base, bbo->bo);
Error: GCC_ANALYZER_WARNING (CWE-126):
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:385:4: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:1146:1: enter_function: entry to ‘anv_cmd_buffer_add_secondary’
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:1176:25: call_function: calling ‘anv_batch_bo_list_clone’ from ‘anv_cmd_buffer_add_secondary’
# 383| {
# 384| anv_reloc_list_finish(&bbo->relocs);
# 385|-> ANV_ADDR_BINDING_REPORT_BO_UNBIND(cmd_buffer->device, &cmd_buffer->vk.base,
# 386| bbo->bo);
# 387| ANV_DMR_BO_FREE(&cmd_buffer->vk.base, bbo->bo);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/intel/vulkan/anv_device.c:2174:58: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/intel/vulkan/anv_device.c:2169:1: enter_function: entry to ‘get_effective_time_domain’
mesa-26.1.1/src/intel/vulkan/anv_device.c:2173:10: call_function: inlined call to ‘__vk_find_struct’ from ‘get_effective_time_domain’
mesa-26.1.1/src/intel/vulkan/anv_device.c:2174:58: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_device.c:2174:58: danger: dereference of NULL ‘<unknown>’
# 2172| const VkSwapchainCalibratedTimestampInfoEXT *swap =
# 2173| vk_find_struct_const(timestamp->pNext, SWAPCHAIN_CALIBRATED_TIMESTAMP_INFO_EXT);
# 2174|-> return wsi_common_get_time_domain(swap->swapchain, swap->presentStage, swap->timeDomainId);
# 2175| } else {
# 2176| return timestamp->timeDomain;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/intel/vulkan/anv_device.c:2304:58: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/intel/vulkan/anv_device.c:2180:10: enter_function: entry to ‘anv_GetCalibratedTimestampsKHR’
mesa-26.1.1/src/intel/vulkan/anv_device.c:2201:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/intel/vulkan/anv_device.c:2203:4: branch_false: ...to here
mesa-26.1.1/src/intel/vulkan/anv_device.c:2299:25: branch_true: following ‘true’ branch (when ‘i < timestampCount’)...
mesa-26.1.1/src/intel/vulkan/anv_device.c:2300:26: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_device.c:2303:16: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetCalibratedTimestampsKHR’
mesa-26.1.1/src/intel/vulkan/anv_device.c:2304:58: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_device.c:2304:58: danger: dereference of NULL ‘<unknown>’
# 2302| const VkSwapchainCalibratedTimestampInfoEXT *swap =
# 2303| vk_find_struct_const(pTimestampInfos[i].pNext, SWAPCHAIN_CALIBRATED_TIMESTAMP_INFO_EXT);
# 2304|-> if (wsi_common_get_time_domain(swap->swapchain, swap->presentStage, swap->timeDomainId) ==
# 2305| VK_TIME_DOMAIN_DEVICE_KHR) {
# 2306| pTimestamps[i] = (uint64_t)((double)pTimestamps[i] * 1e9 / (double)device->physical->info.timestamp_frequency);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:271:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:197:1: enter_function: entry to ‘anv_nir_analyze_push_constants_ranges’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:212:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘anv_nir_analyze_push_constants_ranges’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:212:4: return_function: returning to ‘anv_nir_analyze_push_constants_ranges’ from ‘nir_foreach_function_with_impl_first’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:212:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:213:7: branch_false: following ‘false’ branch (when ‘block’ is NULL)...
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:212:4: branch_false: ...to here
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:212:4: call_function: calling ‘nir_foreach_function_with_impl_next’ from ‘anv_nir_analyze_push_constants_ranges’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:212:4: return_function: returning to ‘anv_nir_analyze_push_constants_ranges’ from ‘nir_foreach_function_with_impl_next’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:212:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:224:4: branch_true: following ‘true’ branch (when ‘entry’ is non-NULL)...
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:225:37: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:248:13: branch_true: following ‘true’ branch (when ‘first_hole == -1’)...
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:260:13: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:260:13: call_function: calling ‘util_dynarray_grow_bytes’ from ‘anv_nir_analyze_push_constants_ranges’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:260:13: return_function: returning to ‘anv_nir_analyze_push_constants_ranges’ from ‘util_dynarray_grow_bytes’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:271:10: danger: dereference of NULL ‘util_dynarray_grow_bytes(&ranges, 1, 12)’
# 269| /* first_hole is one beyond the end, so we don't need to add 1 */
# 270| entry->range.length = first_hole - first_bit;
# 271|-> entry->benefit = 0;
# 272|
# 273| for (int i = 0; i < entry->range.length; i++)
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/intel/vulkan/anv_shader.c:330:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘stream’ where non-null expected
mesa-26.1.1/src/intel/vulkan/anv_shader.c:280:19: acquire_memory: this call could return NULL
mesa-26.1.1/src/intel/vulkan/anv_shader.c:284:25: branch_true: following ‘true’ branch (when ‘i != 4’)...
mesa-26.1.1/src/intel/vulkan/anv_shader.c:285:20: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_shader.c:284:25: branch_true: following ‘true’ branch (when ‘i != 4’)...
mesa-26.1.1/src/intel/vulkan/anv_shader.c:285:20: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_shader.c:286:7: branch_false: following ‘false’ branch (when ‘push_size == 0’)...
mesa-26.1.1/src/intel/vulkan/anv_shader.c:329:8: branch_false: ...to here
mesa-26.1.1/src/intel/vulkan/anv_shader.c:329:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/intel/vulkan/anv_shader.c:330:7: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_shader.c:330:7: danger: argument 4 (‘stream’) from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#argument 4 of ‘__builtin_fwrite’ must be non-null
# 328|
# 329| if (shader->bind_map.inline_dwords_count > 0) {
# 330|-> fprintf(stream, "Inline promoted dwords: ");
# 331| for (unsigned i = 0; i < bind_map->inline_dwords_count; i++)
# 332| fprintf(stream, "%hhu, ", bind_map->inline_dwords[i]);
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/intel/vulkan/anv_shader.c:586:4: warning[-Wanalyzer-null-argument]: use of NULL ‘code’ where non-null expected
mesa-26.1.1/src/intel/vulkan/anv_shader.c:561:1: enter_function: entry to ‘anv_shader_reloc_begin’
mesa-26.1.1/src/intel/vulkan/anv_shader.c:575:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘anv_shader_reloc_begin’
mesa-26.1.1/src/intel/vulkan/anv_shader.c:578:9: call_function: inlined call to ‘vk_multialloc_zalloc2’ from ‘anv_shader_reloc_begin’
mesa-26.1.1/src/intel/vulkan/anv_shader.c:585:4: release_memory: ‘code’ is NULL
mesa-26.1.1/src/intel/vulkan/anv_shader.c:585:4: release_memory: ‘code’ is NULL
mesa-26.1.1/src/intel/vulkan/anv_shader.c:586:4: danger: argument 1 (‘code’) NULL where non-null expected
# 584| */
# 585| reloc->relocated_code = code;
# 586|-> memcpy(reloc->relocated_code, in_code, shader->prog_data->program_size);
# 587|
# 588| uint32_t rv_count = anv_shader_set_relocs(device, reloc_values, shader);
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/intel/vulkan/anv_shader.c: scope_hint: In function ‘anv_replay_rt_shader_group’
mesa-26.1.1/src/intel/vulkan/anv_shader.c:911:19: warning[-Wunused-variable]: unused variable ‘result’
# 911 | VkResult result = anv_shader_reloc_begin(&reloc, device,
# | ^~~~~~
# 909|
# 910| struct anv_shader_reloc reloc;
# 911|-> VkResult result = anv_shader_reloc_begin(&reloc, device,
# 912| shader->code,
# 913| shader, NULL);
Error: GCC_ANALYZER_WARNING (CWE-775):
mesa-26.1.1/src/loader/loader.c:257:13: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘loader_open_device(device_41->nodes[2])’
mesa-26.1.1/src/loader/loader.c:230:1: enter_function: entry to ‘loader_open_render_node_platform_devices’
mesa-26.1.1/src/loader/loader.c:241:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/loader/loader.c:246:13: branch_false: ...to here
mesa-26.1.1/src/loader/loader.c:249:16: branch_true: following ‘true’ branch...
mesa-26.1.1/src/loader/loader.c:250:7: branch_true: ...to here
mesa-26.1.1/src/loader/loader.c:252:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/loader/loader.c:253:12: branch_true: ...to here
mesa-26.1.1/src/loader/loader.c:252:11: branch_true: following ‘true’ branch...
mesa-26.1.1/src/loader/loader.c:256:34: branch_true: ...to here
mesa-26.1.1/src/loader/loader.c:256:15: call_function: calling ‘loader_open_device’ from ‘loader_open_render_node_platform_devices’
mesa-26.1.1/src/loader/loader.c:256:15: return_function: returning to ‘loader_open_render_node_platform_devices’ from ‘loader_open_device’
mesa-26.1.1/src/loader/loader.c:257:13: danger: ‘loader_open_device(device_41->nodes[2])’ leaks here; was opened at [(12)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/11)
# 255|
# 256| fd = loader_open_device(device->nodes[DRM_NODE_RENDER]);
# 257|-> if (fd < 0)
# 258| continue;
# 259|
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_draw.c:1473:16: warning[-Wunused-variable]: unused variable ‘start_count’
# 1473 | uint32_t start_count = nv_push_dw_count(p);
# | ^~~~~~~~~~~
# 1471|
# 1472| if (use_zcull) {
# 1473|-> uint32_t start_count = nv_push_dw_count(p);
# 1474| struct nil_zcull zcull_info;
# 1475| uint64_t addr_begin, addr_end;
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_draw.c: scope_hint: In function ‘nvk_CmdBeginRendering’
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_draw.c:1583:16: warning[-Wunused-variable]: unused variable ‘end_count’
# 1583 | uint32_t end_count = nv_push_dw_count(p);
# | ^~~~~~~~~
# 1581| break;
# 1582| }
# 1583|-> uint32_t end_count = nv_push_dw_count(p);
# 1584| assert(end_count - start_count <= zcull_count);
# 1585| } else {
Error: COMPILER_WARNING:
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_draw.c: scope_hint: In function ‘nvk_mme_set_anti_alias_test_check’
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_draw.c:3483:20: warning[-Wunused-but-set-variable=]: variable ‘expected’ set but not used
# 3483 | const uint32_t* expected = NULL;
# | ^~~~~~~~
# 3481| {0x000f0002, 0x32, 0x12, 0x0f000f, 0x0f000f, 0xf000f0, 0xf000f0},
# 3482| };
# 3483|-> const uint32_t* expected = NULL;
# 3484| for (int i = 0; i < ARRAY_SIZE(expected_table); i++) {
# 3485| if (expected_table[i][0] == test->params[0]) {
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1309:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1273:1: enter_function: entry to ‘nvk_CmdCopyMemoryIndirectKHR’
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1281:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1285:13: branch_false: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1286:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1293:33: branch_false: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1295:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1295:7: branch_false: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1301:11: branch_true: following ‘true’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1304:16: branch_true: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1305:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1309:7: branch_false: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1309:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘nvk_CmdCopyMemoryIndirectKHR’
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1309:7: return_function: returning to ‘nvk_CmdCopyMemoryIndirectKHR’ from ‘util_dynarray_grow_bytes’
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1309:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*(struct nvk_cmd_buffer *)commandBuffer.copy_memory_indirect_temps, 1, 8)’
# 1307| return;
# 1308| }
# 1309|-> util_dynarray_append_typed(&cmd->copy_memory_indirect_temps,
# 1310| struct nvk_cmd_mem*, temp_mem);
# 1311| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:210:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:165:1: enter_function: entry to ‘nvkmd_nouveau_exec_ctx_exec’
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:175:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:175:7: branch_false: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:178:25: branch_true: following ‘true’ branch (when ‘i < exec_count’)...
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:178:25: branch_true: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:180:28: branch_true: following ‘true’ branch (when ‘j < exec_count’)...
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:181:20: branch_true: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:181:13: branch_false: following ‘false’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:191:11: branch_false: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:191:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:192:28: branch_true: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:193:13: branch_false: following ‘false’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:202:16: branch_false: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:202:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:202:10: branch_true: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:210:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘nvkmd_nouveau_exec_ctx_exec’
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:210:7: return_function: returning to ‘nvkmd_nouveau_exec_ctx_exec’ from ‘util_dynarray_grow_bytes’
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:210:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*(struct nvkmd_nouveau_exec_ctx *)_ctx.req_push, 1, 16)’
# 208| .flags = flags,
# 209| };
# 210|-> util_dynarray_append(&ctx->req_push, push);
# 211| ctx->req.push_count++;
# 212| }
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/panfrost/compiler/bifrost/bi_lower_mkvec_swz.c: scope_hint: In function ‘build_mkvec_v4i8_to’
mesa-26.1.1/src/panfrost/compiler/bifrost/bi_lower_mkvec_swz.c:136:12: warning[-Wunused-variable]: unused variable ‘valid_swizzle’
# 136 | bool valid_swizzle =
# | ^~~~~~~~~~~~~
# 134| bi_is_zero(src[1]) && bi_is_zero(src[3])) {
# 135| unsigned v2u8_bytes[4] = { bytes[0], bytes[0], bytes[2], bytes[2] };
# 136|-> bool valid_swizzle =
# 137| bi_swizzle_from_byte_channels(v2u8_bytes, &swizzle);
# 138| assert(valid_swizzle);
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:189:16: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*a.<U2320>.sparse’ where non-null expected
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:153:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:154:16: branch_true: ...to here
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:162:13: branch_false: following ‘false’ branch...
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:169:13: branch_false: ...to here
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:173:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:181:13: branch_true: following ‘true’ branch...
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:183:16: branch_true: ...to here
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:185:45: acquire_memory: this call could return NULL
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:188:16: branch_true: following ‘true’ branch (when ‘left != 0’)...
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:189:16: branch_true: ...to here
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:189:16: danger: argument 1 (‘malloc((long unsigned int)min(max >> 2, max(*a.sparse_capacity * 2, 64)) * 8)’) from [(9)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/8) could be NULL where non-null expected
# 187|
# 188| if (left)
# 189|-> memcpy(a->sparse, data, left * sizeof(nodearray_sparse));
# 190| }
# 191|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:60:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:19:1: enter_function: entry to ‘lower_fs_input_load’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:24:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:28:33: call_function: inlined call to ‘nir_intrinsic_io_semantics’ from ‘lower_fs_input_load’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:56:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:60:24: danger: dereference of NULL ‘pan_varying_layout_find_slot(*(const struct lower_fs_inputs_ctx *)cb_data.varying_layout, (enum <anonymous>)sem.location)’
# 58| slot = pan_varying_layout_find_slot(ctx->varying_layout, sem.location);
# 59| assert(slot);
# 60|-> use_ld_var_buf = slot->offset < pan_ld_var_buf_off_size(ctx->arch);
# 61| }
# 62|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:89:46: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:138:1: enter_function: entry to ‘lower_vs_output_store’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:150:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:150:34: branch_true: ...to here
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:153:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:154:7: call_function: calling ‘build_attr_buf_write’ from ‘lower_vs_output_store’
# 87| nir_def *addr = nir_lea_buf_pan(b, nir_imm_int(b, res), index);
# 88| addr = nir_pack_64_2x32(b, addr);
# 89|-> addr = nir_iadd(b, addr, nir_imm_int64(b, slot->offset));
# 90|
# 91| /* Tag writes to gl_PointSize with a special intrinsic */
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:196:60: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:181:7: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:191:7: branch_false: ...to here
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:196:60: danger: dereference of NULL ‘<unknown>’
# 194| slot->location == sem.location);
# 195|
# 196|-> const glsl_type *var_type = glsl_vector_type(base_type, slot->ncomps);
# 197| if (is_per_view)
# 198| var_type = glsl_array_type(var_type, PAN_MAX_MULTIVIEW_VIEW_COUNT, false);
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c: scope_hint: In function ‘panvk_v10_CmdBeginRendering’
mesa-26.1.1/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:3002:9: warning[-Wunused-variable]: unused variable ‘resuming’
# 3002 | bool resuming = pRenderingInfo->flags & VK_RENDERING_RESUMING_BIT;
# | ^~~~~~~~
# 3000| VK_FROM_HANDLE(panvk_cmd_buffer, cmdbuf, commandBuffer);
# 3001| ASSERTED struct panvk_cmd_graphics_state *state = &cmdbuf->state.gfx;
# 3002|-> bool resuming = pRenderingInfo->flags & VK_RENDERING_RESUMING_BIT;
# 3003|
# 3004| panvk_per_arch(cmd_init_render_state)(cmdbuf, pRenderingInfo);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:338:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:290:1: enter_function: entry to ‘panvk_MapMemory2KHR’
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:296:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:301:23: branch_false: ...to here
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:326:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:333:8: branch_false: ...to here
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:333:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:334:53: branch_true: ...to here
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:334:53: call_function: inlined call to ‘__vk_find_struct’ from ‘panvk_MapMemory2KHR’
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:338:7: branch_true: ...to here
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:338:7: danger: dereference of NULL ‘<unknown>’
# 336| assert(placed_info != NULL);
# 337| assert(offset == 0 && size == mem->bo->size);
# 338|-> host_addr = placed_info->pPlacedAddress;
# 339| map_flags |= MAP_FIXED;
# 340| }
Error: COMPILER_WARNING (CWE-563):
mesa-26.1.1/src/panfrost/vulkan/panvk_image.c: scope_hint: In function ‘create_ms_images’
mesa-26.1.1/src/panfrost/vulkan/panvk_image.c:646:27: warning[-Wunused-variable]: unused variable ‘res’
# 646 | struct panvk_image *res = panvk_image_from_handle(img->ms_imgs[msaa_idx]);
# | ^~~
# 644| &img->ms_imgs[msaa_idx]);
# 645|
# 646|-> struct panvk_image *res = panvk_image_from_handle(img->ms_imgs[msaa_idx]);
# 647| assert(res->vk.format == img->vk.format);
# 648| assert(res->plane_count == img->plane_count);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:796:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘vtdev’
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:780:1: enter_function: entry to ‘vdrm_vpipe_connect’
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:784:18: call_function: calling ‘connect_sock’ from ‘vdrm_vpipe_connect’
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:784:18: return_function: returning to ‘vdrm_vpipe_connect’ from ‘connect_sock’
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:789:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:794:12: branch_false: ...to here
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:794:12: acquire_memory: this call could return NULL
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:796:4: danger: ‘vtdev’ could be NULL: unchecked value from [(10)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/9)
# 794| vtdev = calloc(1, sizeof(*vtdev));
# 795|
# 796|-> vtdev->sock_fd = sock_fd;
# 797| simple_mtx_init(&vtdev->lock, mtx_plain);
# 798|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1829:25: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fences’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1864:1: enter_function: entry to ‘vn_WaitForFences’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1870:4: call_function: calling ‘_mesa_trace_scope_begin’ from ‘vn_WaitForFences’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1870:4: return_function: returning to ‘vn_WaitForFences’ from ‘_mesa_trace_scope_begin’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1875:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1876:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1876:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1876:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1876:7: acquire_memory: this call could return NULL
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1877:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1880:10: branch_false: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1881:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1882:19: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1882:19: call_function: calling ‘vn_remove_signaled_fences’ from ‘vn_WaitForFences’
# 1827| uint32_t cur = 0;
# 1828| for (uint32_t i = 0; i < *count; i++) {
# 1829|-> VkResult result = vn_get_fence_status(device, fences[i], relax_state);
# 1830| if (result != VK_SUCCESS) {
# 1831| if (result < 0)
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1829:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1864:1: enter_function: entry to ‘vn_WaitForFences’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1870:4: call_function: calling ‘_mesa_trace_scope_begin’ from ‘vn_WaitForFences’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1870:4: return_function: returning to ‘vn_WaitForFences’ from ‘_mesa_trace_scope_begin’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1875:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1876:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1876:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1876:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1877:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1880:10: branch_false: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1881:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1882:19: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1882:19: call_function: calling ‘vn_remove_signaled_fences’ from ‘vn_WaitForFences’
# 1827| uint32_t cur = 0;
# 1828| for (uint32_t i = 0; i < *count; i++) {
# 1829|-> VkResult result = vn_get_fence_status(device, fences[i], relax_state);
# 1830| if (result != VK_SUCCESS) {
# 1831| if (result < 0)
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2420:25: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘semaphores’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2433:1: enter_function: entry to ‘vn_WaitSemaphores’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2437:4: call_function: calling ‘_mesa_trace_scope_begin’ from ‘vn_WaitSemaphores’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2437:4: return_function: returning to ‘vn_WaitSemaphores’ from ‘_mesa_trace_scope_begin’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2442:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2443:10: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2442:8: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2444:16: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2445:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2445:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2445:7: acquire_memory: this call could return NULL
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2446:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2446:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2447:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2448:7: branch_false: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2448:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2451:10: branch_false: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2452:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2453:19: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2453:19: call_function: calling ‘vn_remove_signaled_semaphores’ from ‘vn_WaitSemaphores’
# 2418| for (uint32_t i = 0; i < *count; i++) {
# 2419| uint64_t val = 0;
# 2420|-> VkResult result = vn_get_semaphore_counter_value(device, semaphores[i],
# 2421| relax_state, &val);
# 2422| if (result != VK_SUCCESS)
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2420:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2433:1: enter_function: entry to ‘vn_WaitSemaphores’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2437:4: call_function: calling ‘_mesa_trace_scope_begin’ from ‘vn_WaitSemaphores’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2437:4: return_function: returning to ‘vn_WaitSemaphores’ from ‘_mesa_trace_scope_begin’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2442:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2443:10: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2442:8: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2444:16: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2445:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2445:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2446:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2446:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2447:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2448:7: branch_false: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2448:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2451:10: branch_false: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2452:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2453:19: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2453:19: call_function: calling ‘vn_remove_signaled_semaphores’ from ‘vn_WaitSemaphores’
# 2418| for (uint32_t i = 0; i < *count; i++) {
# 2419| uint64_t val = 0;
# 2420|-> VkResult result = vn_get_semaphore_counter_value(device, semaphores[i],
# 2421| relax_state, &val);
# 2422| if (result != VK_SUCCESS)
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:147:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘state’
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:1185:1: enter_function: entry to ‘vk_cmd_build_acceleration_structures’
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:1198:59: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:1219:25: branch_true: following ‘true’ branch (when ‘i < infoCount’)...
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:1219:25: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:1221:28: branch_false: following ‘false’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:1225:7: branch_false: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:1225:7: call_function: calling ‘vk_acceleration_structure_build_state_init’ from ‘vk_cmd_build_acceleration_structures’
# 145| const struct vk_acceleration_structure_build_args *args)
# 146| {
# 147|-> state->build_info = build_info;
# 148| state->leaf_node_count = leaf_count;
# 149| state->internal_node_count = MAX2(leaf_count, 2) - 1;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:423:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘bindings’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:407:1: enter_function: entry to ‘vk_common_CmdBindVertexBuffers2EXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:418:4: branch_true: following ‘true’ branch (when ‘bindingCount > 8’)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:418:4: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:418:4: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:420:25: branch_true: following ‘true’ branch (when ‘b < bindingCount’)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:421:7: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:425:26: branch_true: following ‘true’ branch (when ‘pStrides’ is non-NULL)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:428:40: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:425:26: branch_true: following ‘true’ branch (when ‘pSizes’ is non-NULL)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:427:36: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:425:26: call_function: inlined call to ‘vk_strided_device_address_range’ from ‘vk_common_CmdBindVertexBuffers2EXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:429:26: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:429:26: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:423:7: danger: ‘bindings + (long unsigned int)b * 56’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/3)
# 421| VK_FROM_HANDLE(vk_buffer, buffer, pBuffers[b]);
# 422|
# 423|-> bindings[b] = (VkBindVertexBuffer3InfoKHR) {
# 424| .sType = VK_STRUCTURE_TYPE_BIND_VERTEX_BUFFER_3_INFO_KHR,
# 425| .addressRange = vk_strided_device_address_range(
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:586:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘bindings’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:571:1: enter_function: entry to ‘vk_common_CmdBindTransformFeedbackBuffersEXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:581:4: branch_true: following ‘true’ branch (when ‘bindingCount > 8’)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:581:4: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:581:4: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:583:25: branch_true: following ‘true’ branch (when ‘b < bindingCount’)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:584:7: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:588:26: branch_true: following ‘true’ branch (when ‘pSizes’ is non-NULL)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:590:28: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:588:26: branch_true: following ‘true’ branch (when ‘pOffsets’ is non-NULL)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:589:40: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:588:26: call_function: inlined call to ‘vk_device_address_range’ from ‘vk_common_CmdBindTransformFeedbackBuffersEXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:591:26: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:591:26: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:586:7: danger: ‘bindings + (long unsigned int)b * 40’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/3)
# 584| VK_FROM_HANDLE(vk_buffer, buffer, pBuffers[b]);
# 585|
# 586|-> bindings[b] = (VkBindTransformFeedbackBuffer2InfoEXT) {
# 587| .sType = VK_STRUCTURE_TYPE_BIND_TRANSFORM_FEEDBACK_BUFFER_2_INFO_EXT,
# 588| .addressRange = vk_device_address_range(
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:619:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘buffers’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:605:1: enter_function: entry to ‘vk_common_CmdBeginTransformFeedbackEXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:614:4: branch_true: following ‘true’ branch (when ‘counterBufferCount > 8’)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:614:4: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:614:4: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:616:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:617:7: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:621:26: branch_true: following ‘true’ branch (when ‘pCounterBufferOffsets’ is non-NULL)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:622:66: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:621:26: call_function: inlined call to ‘vk_device_address_range’ from ‘vk_common_CmdBeginTransformFeedbackEXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:624:26: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:624:26: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:619:7: danger: ‘buffers + (long unsigned int)b * 40’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/3)
# 617| VK_FROM_HANDLE(vk_buffer, buffer, pCounterBuffers[b]);
# 618|
# 619|-> buffers[b] = (VkBindTransformFeedbackBuffer2InfoEXT) {
# 620| .sType = VK_STRUCTURE_TYPE_BIND_TRANSFORM_FEEDBACK_BUFFER_2_INFO_EXT,
# 621| .addressRange = vk_device_address_range(
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:652:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘buffers’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:638:1: enter_function: entry to ‘vk_common_CmdEndTransformFeedbackEXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:647:4: branch_true: following ‘true’ branch (when ‘counterBufferCount > 8’)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:647:4: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:647:4: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:649:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:650:7: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:654:26: branch_true: following ‘true’ branch (when ‘pCounterBufferOffsets’ is non-NULL)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:655:66: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:654:26: call_function: inlined call to ‘vk_device_address_range’ from ‘vk_common_CmdEndTransformFeedbackEXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:657:26: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:657:26: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:652:7: danger: ‘buffers + (long unsigned int)b * 40’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/3)
# 650| VK_FROM_HANDLE(vk_buffer, buffer, pCounterBuffers[b]);
# 651|
# 652|-> buffers[b] = (VkBindTransformFeedbackBuffer2InfoEXT) {
# 653| .sType = VK_STRUCTURE_TYPE_BIND_TRANSFORM_FEEDBACK_BUFFER_2_INFO_EXT,
# 654| .addressRange = vk_device_address_range(
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:806:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘regions’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:795:1: enter_function: entry to ‘vk_common_CmdCopyBuffer2’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:803:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:803:4: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:803:4: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:805:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:806:14: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:807:22: call_function: inlined call to ‘vk_device_address_range’ from ‘vk_common_CmdCopyBuffer2’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:812:22: call_function: inlined call to ‘vk_device_address_range’ from ‘vk_common_CmdCopyBuffer2’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:806:7: danger: ‘regions + (long unsigned int)r * 64’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/3)
# 804|
# 805| for (uint32_t r = 0; r < pCopyBufferInfo->regionCount; r++) {
# 806|-> regions[r] = (VkDeviceMemoryCopyKHR) {
# 807| .srcRange = vk_device_address_range(
# 808| src_buffer,
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:845:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘regions’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:834:1: enter_function: entry to ‘vk_common_CmdCopyBufferToImage2’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:841:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:841:4: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:841:4: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:844:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:845:14: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:847:26: call_function: inlined call to ‘vk_device_address_range’ from ‘vk_common_CmdCopyBufferToImage2’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:845:7: danger: ‘regions + (long unsigned int)r * 88’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/3)
# 843|
# 844| for (uint32_t r = 0; r < pCopyBufferToImageInfo->regionCount; r++) {
# 845|-> regions[r] = (VkDeviceMemoryImageCopyKHR) {
# 846| .sType = VK_STRUCTURE_TYPE_DEVICE_MEMORY_IMAGE_COPY_KHR,
# 847| .addressRange = vk_device_address_range(
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:886:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘regions’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:875:1: enter_function: entry to ‘vk_common_CmdCopyImageToBuffer2’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:882:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:882:4: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:882:4: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:885:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:886:14: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:888:26: call_function: inlined call to ‘vk_device_address_range’ from ‘vk_common_CmdCopyImageToBuffer2’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:886:7: danger: ‘regions + (long unsigned int)r * 88’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/3)
# 884|
# 885| for (uint32_t r = 0; r < pCopyImageToBufferInfo->regionCount; r++) {
# 886|-> regions[r] = (VkDeviceMemoryImageCopyKHR) {
# 887| .sType = VK_STRUCTURE_TYPE_DEVICE_MEMORY_IMAGE_COPY_KHR,
# 888| .addressRange = vk_device_address_range(
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/vulkan/runtime/vk_device.c:890:63: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/vulkan/runtime/vk_device.c:873:1: enter_function: entry to ‘vk_common_GetCalibratedTimestampsKHR’
mesa-26.1.1/src/vulkan/runtime/vk_device.c:885:25: branch_true: following ‘true’ branch (when ‘i < timestampCount’)...
mesa-26.1.1/src/vulkan/runtime/vk_device.c:886:47: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_device.c:887:10: branch_true: following ‘true’ branch (when ‘domain == 1000208000’)...
mesa-26.1.1/src/vulkan/runtime/vk_device.c:889:16: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_device.c:889:16: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_common_GetCalibratedTimestampsKHR’
mesa-26.1.1/src/vulkan/runtime/vk_device.c:890:63: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_device.c:890:63: danger: dereference of NULL ‘<unknown>’
# 888| const VkSwapchainCalibratedTimestampInfoEXT *swap =
# 889| vk_find_struct_const(pTimestampInfos[i].pNext, SWAPCHAIN_CALIBRATED_TIMESTAMP_INFO_EXT);
# 890|-> domain = wsi_common_get_time_domain(swap->swapchain, swap->presentStage, swap->timeDomainId);
# 891| }
# 892| if (domain == device->calibrate_time_domain)
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/vulkan/runtime/vk_nir_lower_descriptor_heaps.c:517:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-26.1.1/src/vulkan/runtime/vk_nir_lower_descriptor_heaps.c:1035:1: enter_function: entry to ‘vk_nir_lower_descriptor_heaps’
mesa-26.1.1/src/vulkan/runtime/vk_nir_lower_descriptor_heaps.c:1049:7: call_function: calling ‘nir_shader_instructions_pass’ from ‘vk_nir_lower_descriptor_heaps’
# 515| {
# 516| nir_def *index = NULL;
# 517|-> if (deref->deref_type == nir_deref_type_array) {
# 518| index = deref->arr.index.ssa;
# 519| deref = nir_deref_instr_parent(deref);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.1.1/src/vulkan/runtime/vk_nir_lower_descriptor_heaps.c:522:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-26.1.1/src/vulkan/runtime/vk_nir_lower_descriptor_heaps.c:1035:1: enter_function: entry to ‘vk_nir_lower_descriptor_heaps’
mesa-26.1.1/src/vulkan/runtime/vk_nir_lower_descriptor_heaps.c:1049:7: call_function: calling ‘nir_shader_instructions_pass’ from ‘vk_nir_lower_descriptor_heaps’
# 520| }
# 521|
# 522|-> if (deref->deref_type != nir_deref_type_var)
# 523| return false;
# 524|