Task #119239 - fixed.err
back to task #119239download
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/amd/vulkan/meta/radv_meta_clear.c: scope_hint: In function ‘radv_clear_htile’
mesa-26.0.3/src/amd/vulkan/meta/radv_meta_clear.c:1140:39: warning[-Wunused-variable]: unused variable ‘pdev’
# 1140 | const struct radv_physical_device *pdev = radv_device_physical(device);
# | ^~~~
# 1138| {
# 1139| struct radv_device *device = radv_cmd_buffer_device(cmd_buffer);
# 1140|-> const struct radv_physical_device *pdev = radv_device_physical(device);
# 1141| uint32_t level_count = vk_image_subresource_level_count(&image->vk, range);
# 1142| uint32_t flush_bits = 0;
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c: scope_hint: In function ‘get_sampler_desc’
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:221:9: warning[-Wunused-variable]: unused variable ‘indirect’
# 221 | bool indirect = nir_deref_instr_has_indirect(deref);
# | ^~~~~~~~
# 219| unsigned desc_set = var->data.descriptor_set;
# 220| unsigned binding_index = var->data.binding;
# 221|-> bool indirect = nir_deref_instr_has_indirect(deref);
# 222|
# 223| struct radv_descriptor_set_layout *layout = state->layout->set[desc_set].layout;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:255:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:550:1: enter_function: entry to ‘radv_nir_apply_pipeline_layout’
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:569:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘radv_nir_apply_pipeline_layout’
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:569:4: return_function: returning to ‘radv_nir_apply_pipeline_layout’ from ‘nir_foreach_function_with_impl_first’
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:569:4: branch_true: following ‘true’ branch...
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:577:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:578:10: branch_true: ...to here
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:578:10: branch_true: following ‘true’ branch...
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:578:10: branch_true: ...to here
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:579:16: branch_true: following ‘true’ branch...
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:580:33: branch_true: ...to here
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:580:33: call_function: calling ‘apply_layout_to_tex’ from ‘radv_nir_apply_pipeline_layout’
# 253|
# 254| nir_def *index = NULL;
# 255|-> while (deref->deref_type != nir_deref_type_var) {
# 256| assert(deref->deref_type == nir_deref_type_array);
# 257| unsigned array_size = MAX2(glsl_get_aoa_size(deref->type), 1);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:52:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:26:1: enter_function: entry to ‘lower_immediate_samplers’
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:32:29: call_function: calling ‘nir_get_tex_deref’ from ‘lower_immediate_samplers’
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:32:29: return_function: returning to ‘lower_immediate_samplers’ from ‘nir_get_tex_deref’
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:33:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:36:8: branch_false: ...to here
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:36:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:39:24: branch_false: ...to here
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:47:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:47:7: branch_false: ...to here
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:52:11: branch_true: following ‘true’ branch...
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:54:29: branch_true: ...to here
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:52:11: danger: dereference of NULL ‘deref’
# 50| unsigned constant_index = 0;
# 51|
# 52|-> while (deref->deref_type != nir_deref_type_var) {
# 53| assert(deref->deref_type == nir_deref_type_array);
# 54| unsigned array_size = MAX2(glsl_get_aoa_size(deref->type), 1);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:132:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘cases’
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:106:40: acquire_memory: this call could return NULL
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:109:25: branch_true: following ‘true’ branch...
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:110:47: branch_true: ...to here
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:132:10: danger: ‘cases + (long unsigned int)case_count * 16’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
# 130|
# 131| if (!duplicate) {
# 132|-> cases[case_count++] = (struct inlined_shader_case){
# 133| .group = group,
# 134| .call_idx = handle_index,
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:139:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘cases’ where non-null expected
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:106:40: acquire_memory: this call could return NULL
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:139:4: danger: argument 1 (‘cases’) from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
# 137| }
# 138|
# 139|-> qsort(cases, case_count, sizeof(struct inlined_shader_case), compare_inlined_shader_case);
# 140|
# 141| /* Do not emit 'if (sbt_idx != 0) { ... }' is there are only a few cases. */
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:462:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:458:1: enter_function: entry to ‘radv_nir_lower_rt_abi_monolithic’
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:461:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘radv_nir_lower_rt_abi_monolithic’
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:461:30: return_function: returning to ‘radv_nir_lower_rt_abi_monolithic’ from ‘nir_shader_get_entrypoint’
mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:462:4: danger: dereference of NULL ‘nir_shader_get_entrypoint(shader)’
# 460| {
# 461| nir_function_impl *impl = nir_shader_get_entrypoint(shader);
# 462|-> radv_nir_init_rt_function_params(impl->function, MESA_SHADER_RAYGEN, 0, 0);
# 463|
# 464| nir_builder b = nir_builder_at(nir_before_impl(impl));
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:801:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:786:1: enter_function: entry to ‘radv_GetPipelineExecutableStatisticsKHR’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:793:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableStatisticsKHR’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:793:7: return_function: returning to ‘radv_GetPipelineExecutableStatisticsKHR’ from ‘radv_get_shader_from_executable_index’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:801:8: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’
# 799|
# 800| struct amd_stats stats = {0};
# 801|-> if (shader->statistics)
# 802| stats = *shader->statistics;
# 803| stats.driverhash = pipeline->pipeline_hash;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:987:60: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:967:1: enter_function: entry to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:976:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableInternalRepresentationsKHR’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:976:7: return_function: returning to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ from ‘radv_get_shader_from_executable_index’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:980:9: branch_true: following ‘true’ branch (when ‘pInternalRepresentations’ is non-NULL)...
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:980:39: branch_true: ...to here
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:983:7: branch_true: following ‘true’ branch (when ‘pInternalRepresentations < end’)...
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:984:7: branch_true: ...to here
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:987:60: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’
# 985| VK_COPY_STR(p->name, "NIR Shader(s)");
# 986| VK_COPY_STR(p->description, "The optimized NIR shader(s)");
# 987|-> if (radv_copy_representation(p->pData, &p->dataSize, shader->nir_string) != VK_SUCCESS)
# 988| result = VK_INCOMPLETE;
# 989| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:1002:60: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:967:1: enter_function: entry to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:976:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableInternalRepresentationsKHR’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:976:7: return_function: returning to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ from ‘radv_get_shader_from_executable_index’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:980:9: branch_true: following ‘true’ branch (when ‘pInternalRepresentations’ is non-NULL)...
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:980:39: branch_true: ...to here
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:983:7: branch_false: following ‘false’ branch (when ‘pInternalRepresentations >= end’)...
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:983:7: branch_false: ...to here
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:993:7: branch_true: following ‘true’ branch (when ‘end > p’)...
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:994:7: branch_true: ...to here
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:995:10: branch_true: following ‘true’ branch...
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:996:10: branch_true: ...to here
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:1002:60: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’
# 1000| VK_COPY_STR(p->description, "The ACO IR after some optimizations");
# 1001| }
# 1002|-> if (radv_copy_representation(p->pData, &p->dataSize, shader->ir_string) != VK_SUCCESS)
# 1003| result = VK_INCOMPLETE;
# 1004| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:1008:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:967:1: enter_function: entry to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:976:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableInternalRepresentationsKHR’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:976:7: return_function: returning to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ from ‘radv_get_shader_from_executable_index’
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:980:9: branch_true: following ‘true’ branch (when ‘pInternalRepresentations’ is non-NULL)...
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:980:39: branch_true: ...to here
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:983:7: branch_false: following ‘false’ branch (when ‘pInternalRepresentations >= end’)...
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:983:7: branch_false: ...to here
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:993:7: branch_false: following ‘false’ branch (when ‘end <= p’)...
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:993:7: branch_false: ...to here
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:1008:7: branch_true: following ‘true’ branch (when ‘end > p’)...
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:1008:19: branch_true: ...to here
mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:1008:19: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’
# 1006|
# 1007| /* Disassembler */
# 1008|-> if (p < end && shader->disasm_string) {
# 1009| p->isText = true;
# 1010| VK_COPY_STR(p->name, "Assembly");
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/radv_radeon_winsys.h:334:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘it_probs_bo’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3536:1: enter_function: entry to ‘radv_CmdDecodeVideoKHR’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3542:8: call_function: inlined call to ‘radv_has_uvd’ from ‘radv_CmdDecodeVideoKHR’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3542:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/amd/vulkan/radv_video.c:3543:7: branch_true: ...to here
mesa-26.0.3/src/amd/vulkan/radv_video.c:3543:7: call_function: calling ‘radv_uvd_decode_video’ from ‘radv_CmdDecodeVideoKHR’
# 332| radv_buffer_get_va(const struct radeon_winsys_bo *bo)
# 333| {
# 334|-> return bo->va;
# 335| }
# 336|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/radv_shader.c:2739:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘submission’
mesa-26.0.3/src/amd/vulkan/radv_shader.c:3507:1: enter_function: entry to ‘radv_create_vs_prolog’
mesa-26.0.3/src/amd/vulkan/radv_shader.c:3514:4: call_function: calling ‘radv_fill_nir_compiler_options’ from ‘radv_create_vs_prolog’
mesa-26.0.3/src/amd/vulkan/radv_shader.c:3514:4: return_function: returning to ‘radv_create_vs_prolog’ from ‘radv_fill_nir_compiler_options’
mesa-26.0.3/src/amd/vulkan/radv_shader.c:3552:13: call_function: calling ‘radv_shader_part_create’ from ‘radv_create_vs_prolog’
# 2737| uint64_t *upload_seq_out)
# 2738| {
# 2739|-> struct radv_cmd_stream *cs = submission->cs;
# 2740| struct radeon_winsys *ws = device->ws;
# 2741| VkResult result;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/radv_video.c:1662:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3432:1: enter_function: entry to ‘radv_vcn_decode_video’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3440:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-26.0.3/src/amd/vulkan/radv_video.c:3496:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’
# 1660| vk_video_get_h264_parameters(&vid->vk, params, frame_info, h264_pic_info, &sps, &pps);
# 1661|
# 1662|-> *slice_offset = h264_pic_info->pSliceOffsets[0];
# 1663|
# 1664| memset(&result, 0, sizeof(result));
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/radv_video.c:1805:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3432:1: enter_function: entry to ‘radv_vcn_decode_video’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3440:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-26.0.3/src/amd/vulkan/radv_video.c:3496:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’
# 1803| result.sps_info_flags |= sps->flags.separate_colour_plane_flag << 8;
# 1804|
# 1805|-> if (!h265_pic_info->pStdPictureInfo->flags.short_term_ref_pic_set_sps_flag) {
# 1806| result.sps_info_flags |= 1 << 11;
# 1807| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/radv_video.c:1933:47: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3432:1: enter_function: entry to ‘radv_vcn_decode_video’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3440:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-26.0.3/src/amd/vulkan/radv_video.c:3496:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’
# 1931| const struct VkVideoDecodeVP9PictureInfoKHR *vp9_pic_info =
# 1932| vk_find_struct_const(frame_info->pNext, VIDEO_DECODE_VP9_PICTURE_INFO_KHR);
# 1933|-> const struct StdVideoDecodeVP9PictureInfo *std_pic_info = vp9_pic_info->pStdPictureInfo;
# 1934|
# 1935| const int intra_only_decoding = vid->vk.max_dpb_slots == 0;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/radv_video.c:2638:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index_dynamic_dpb’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3432:1: enter_function: entry to ‘radv_vcn_decode_video’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3496:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’
# 2636|
# 2637| if (vid->dpb_type == DPB_DYNAMIC_TIER_1 || vid->dpb_type == DPB_DYNAMIC_TIER_2) {
# 2638|-> index_dynamic_dpb->message_id = RDECODE_MESSAGE_DYNAMIC_DPB;
# 2639| index_dynamic_dpb->offset = offset_dynamic_dpb;
# 2640| index_dynamic_dpb->filled = 0;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/radv_video.c:2885:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3373:1: enter_function: entry to ‘radv_uvd_decode_video’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3381:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-26.0.3/src/amd/vulkan/radv_video.c:3389:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/amd/vulkan/radv_video.c:3390:7: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_uvd_decode_video’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3398:4: call_function: calling ‘ruvd_dec_message_decode’ from ‘radv_uvd_decode_video’
# 2883| vk_video_get_h264_parameters(&vid->vk, params, frame_info, h264_pic_info, &sps, &pps);
# 2884|
# 2885|-> *slice_offset = h264_pic_info->pSliceOffsets[0];
# 2886|
# 2887| memset(&result, 0, sizeof(result));
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/amd/vulkan/radv_video.c:2885:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘it_ptr’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3373:1: enter_function: entry to ‘radv_uvd_decode_video’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3381:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-26.0.3/src/amd/vulkan/radv_video.c:3389:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/amd/vulkan/radv_video.c:3394:4: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_uvd_decode_video’
mesa-26.0.3/src/amd/vulkan/radv_video.c:3398:4: release_memory: ‘it_probs_ptr’ is NULL
mesa-26.0.3/src/amd/vulkan/radv_video.c:3398:4: call_function: calling ‘ruvd_dec_message_decode’ from ‘radv_uvd_decode_video’
# 2883| vk_video_get_h264_parameters(&vid->vk, params, frame_info, h264_pic_info, &sps, &pps);
# 2884|
# 2885|-> *slice_offset = h264_pic_info->pSliceOffsets[0];
# 2886|
# 2887| memset(&result, 0, sizeof(result));
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.0.3/src/asahi/vulkan/hk_cmd_dispatch.c:88:1: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘grid.<Ubbe0>.count[2]’
mesa-26.0.3/src/asahi/vulkan/hk_cmd_dispatch.c:154:1: enter_function: entry to ‘hk_CmdDispatchIndirect’
mesa-26.0.3/src/asahi/vulkan/hk_cmd_dispatch.c:171:4: call_function: calling ‘dispatch’ from ‘hk_CmdDispatchIndirect’
# 86|
# 87| static void
# 88|-> dispatch(struct hk_cmd_buffer *cmd, struct agx_grid grid)
# 89| {
# 90| struct hk_shader *s = hk_only_variant(cmd->state.cs.shader);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/broadcom/vulkan/v3dv_pipeline.c:1075:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘rs_info’
mesa-26.0.3/src/broadcom/vulkan/v3dv_pipeline.c:3109:1: enter_function: entry to ‘v3dv_CreateGraphicsPipelines’
mesa-26.0.3/src/broadcom/vulkan/v3dv_pipeline.c:3124:11: branch_true: following ‘true’ branch (when ‘i < count’)...
mesa-26.0.3/src/broadcom/vulkan/v3dv_pipeline.c:3132:58: branch_true: ...to here
mesa-26.0.3/src/broadcom/vulkan/v3dv_pipeline.c:3128:22: call_function: calling ‘graphics_pipeline_create’ from ‘v3dv_CreateGraphicsPipelines’
# 1073| assert(rs_info);
# 1074| const VkPipelineRasterizationLineStateCreateInfoKHR *ls_info =
# 1075|-> vk_find_struct_const(rs_info->pNext,
# 1076| PIPELINE_RASTERIZATION_LINE_STATE_CREATE_INFO_KHR);
# 1077|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/broadcom/vulkan/v3dv_private.h:2560:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘job’
mesa-26.0.3/src/broadcom/vulkan/v3dv_cmd_buffer.c:2013:1: enter_function: entry to ‘v3dv_job_clone_in_cmd_buffer’
mesa-26.0.3/src/broadcom/vulkan/v3dv_cmd_buffer.c:2018:7: call_function: inlined call to ‘v3dv_flag_oom’ from ‘v3dv_job_clone_in_cmd_buffer’
# 2558| } else {
# 2559| assert(job);
# 2560|-> if (job->cmd_buffer)
# 2561| job->cmd_buffer->state.oom = true;
# 2562| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3477:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘var2_written’
mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3583:1: enter_function: entry to ‘validate_vertex_shader_executable’
mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3587:7: branch_false: following ‘false’ branch (when ‘shader’ is non-NULL)...
mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3616:8: branch_false: ...to here
mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3616:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3618:10: branch_true: ...to here
mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3623:7: call_function: calling ‘find_assignments’ from ‘validate_vertex_shader_executable’
# 3475| *var1_written = true;
# 3476| else if (var == var2)
# 3477|-> *var2_written = true;
# 3478| else if (var == var3)
# 3479| *var3_written = true;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3479:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘var3_written’
mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3583:1: enter_function: entry to ‘validate_vertex_shader_executable’
mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3587:7: branch_false: following ‘false’ branch (when ‘shader’ is non-NULL)...
mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3616:8: branch_false: ...to here
mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3616:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3618:10: branch_true: ...to here
mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3623:7: call_function: calling ‘find_assignments’ from ‘validate_vertex_shader_executable’
# 3477| *var2_written = true;
# 3478| else if (var == var3)
# 3479|-> *var3_written = true;
# 3480| }
# 3481| }
Error: GCC_ANALYZER_WARNING (CWE-126):
mesa-26.0.3/src/compiler/nir/nir_divergence_analysis.c:807:31: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-26.0.3/src/compiler/nir/nir_divergence_analysis.c:1595:1: enter_function: entry to ‘nir_vertex_divergence_analysis’
mesa-26.0.3/src/compiler/nir/nir_divergence_analysis.c:1600:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_vertex_divergence_analysis’
mesa-26.0.3/src/compiler/nir/nir_divergence_analysis.c:1600:4: return_function: returning to ‘nir_vertex_divergence_analysis’ from ‘nir_foreach_function_with_impl_first’
mesa-26.0.3/src/compiler/nir/nir_divergence_analysis.c:1600:4: branch_true: following ‘true’ branch...
mesa-26.0.3/src/compiler/nir/nir_divergence_analysis.c:1601:7: call_function: calling ‘nir_divergence_analysis_impl’ from ‘nir_vertex_divergence_analysis’
# 805| (state->options & nir_divergence_across_subgroups)) {
# 806| unsigned num_srcs = nir_intrinsic_infos[instr->intrinsic].num_srcs;
# 807|-> for (unsigned i = 0; i < num_srcs; i++) {
# 808| if (src_divergent(instr->src[i], state)) {
# 809| is_divergent = true;
Error: GCC_ANALYZER_WARNING (CWE-835):
mesa-26.0.3/src/compiler/nir/nir_dominance.c:57:11: warning[-Wanalyzer-infinite-loop]: infinite loop
# 55| intersect(nir_block *b1, nir_block *b2)
# 56| {
# 57|-> while (b1 != b2) {
# 58| /*
# 59| * Note, the comparisons here are the opposite of what the paper says
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/compiler/nir/nir_opt_large_constants.c:172:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/compiler/nir/nir_opt_large_constants.c:163:1: enter_function: entry to ‘build_constant_load’
mesa-26.0.3/src/compiler/nir/nir_opt_large_constants.c:166:24: call_function: calling ‘nir_deref_instr_get_variable’ from ‘build_constant_load’
mesa-26.0.3/src/compiler/nir/nir_opt_large_constants.c:166:24: return_function: returning to ‘build_constant_load’ from ‘nir_deref_instr_get_variable’
mesa-26.0.3/src/compiler/nir/nir_opt_large_constants.c:172:15: danger: dereference of NULL ‘nir_deref_instr_get_variable(deref)’
# 170|
# 171| UNUSED unsigned var_size, var_align;
# 172|-> size_align(var->type, &var_size, &var_align);
# 173| assert(var->data.location % var_align == 0);
# 174|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/compiler/spirv/vtn_opencl.c:640:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dest_type’
mesa-26.0.3/src/compiler/spirv/vtn_opencl.c:1080:1: enter_function: entry to ‘vtn_handle_opencl_instruction’
mesa-26.0.3/src/compiler/spirv/vtn_opencl.c:1234:7: call_function: calling ‘handle_instr’ from ‘vtn_handle_opencl_instruction’
# 638| return nir_copysign(nb, srcs[0], srcs[1]);
# 639| case OpenCLstd_Cross:
# 640|-> if (dest_type->length == 4)
# 641| return nir_cross4(nb, srcs[0], srcs[1]);
# 642| return nir_cross3(nb, srcs[0], srcs[1]);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/compiler/spirv/vtn_variables.c:1806:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘interface_type’
mesa-26.0.3/src/compiler/spirv/vtn_variables.c:2693:1: enter_function: entry to ‘vtn_handle_variables’
mesa-26.0.3/src/compiler/spirv/vtn_variables.c:2852:36: call_function: calling ‘vtn_pointer_value’ from ‘vtn_handle_variables’
mesa-26.0.3/src/compiler/spirv/vtn_variables.c:2852:36: return_function: returning to ‘vtn_handle_variables’ from ‘vtn_pointer_value’
mesa-26.0.3/src/compiler/spirv/vtn_variables.c:2853:35: call_function: calling ‘vtn_pointer_value’ from ‘vtn_handle_variables’
mesa-26.0.3/src/compiler/spirv/vtn_variables.c:2853:35: return_function: returning to ‘vtn_handle_variables’ from ‘vtn_pointer_value’
mesa-26.0.3/src/compiler/spirv/vtn_variables.c:2854:34: call_function: calling ‘vtn_value_to_pointer’ from ‘vtn_handle_variables’
# 1804| */
# 1805| assert(interface_type != NULL);
# 1806|-> if (interface_type->base_type == vtn_base_type_accel_struct) {
# 1807| mode = vtn_variable_mode_accel_struct;
# 1808| nir_mode = nir_var_uniform;
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.0.3/src/freedreno/ir3/ir3_nir.c:1204:4: warning[-Wanalyzer-null-argument]: use of NULL ‘candidate_nonspilled.mem_ctx’ where non-null expected
mesa-26.0.3/src/freedreno/ir3/ir3_nir.c:1177:1: enter_function: entry to ‘ir3_filter_vars_to_scratch_single_instr_limit’
mesa-26.0.3/src/freedreno/ir3/ir3_nir.c:1181:4: call_function: inlined call to ‘util_dynarray_init’ from ‘ir3_filter_vars_to_scratch_single_instr_limit’
mesa-26.0.3/src/freedreno/ir3/ir3_nir.c:1204:4: release_memory: ‘candidate_nonspilled.mem_ctx’ is NULL
mesa-26.0.3/src/freedreno/ir3/ir3_nir.c:1204:4: danger: argument 1 (‘candidate_nonspilled.data’) NULL where non-null expected
# 1202| }
# 1203|
# 1204|-> qsort(
# 1205| util_dynarray_begin(&candidate_nonspilled),
# 1206| util_dynarray_num_elements(&candidate_nonspilled, const nir_variable *),
Error: GCC_ANALYZER_WARNING (CWE-415):
mesa-26.0.3/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:353:4: warning[-Wanalyzer-double-free]: double-‘free’ of ‘0’
mesa-26.0.3/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:341:1: enter_function: entry to ‘pipe_loader_get_compatible_render_capable_device_fd’
mesa-26.0.3/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:345:19: call_function: calling ‘pipe_loader_get_compatible_render_capable_device_fds’ from ‘pipe_loader_get_compatible_render_capable_device_fd’
mesa-26.0.3/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:345:19: return_function: returning to ‘pipe_loader_get_compatible_render_capable_device_fd’ from ‘pipe_loader_get_compatible_render_capable_device_fds’
mesa-26.0.3/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:347:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:353:4: branch_false: ...to here
mesa-26.0.3/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:353:4: danger: second ‘free’ here
# 351| }
# 352|
# 353|-> free(gpu_fds);
# 354|
# 355| return result;
Error: GCC_ANALYZER_WARNING (CWE-401):
mesa-26.0.3/src/gallium/auxiliary/util/u_inlines.h:197:1: warning[-Wanalyzer-malloc-leak]: leak of ‘surface’
mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:865:1: enter_function: entry to ‘tegra_create_surface’
mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:873:14: acquire_memory: allocated here
mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:874:7: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)...
mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:877:19: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:879:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:884:11: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:889:4: call_function: calling ‘pipe_resource_reference’ from ‘tegra_create_surface’
mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:889:4: return_function: returning to ‘tegra_create_surface’ from ‘pipe_resource_reference’
mesa-26.0.3/src/gallium/auxiliary/util/u_inlines.h:197:1: danger: ‘surface’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
# 195| }
# 196| *dst = src;
# 197|-> }
# 198|
# 199| static inline void
Error: GCC_ANALYZER_WARNING (CWE-401):
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:35:4: warning[-Wanalyzer-malloc-leak]: leak of ‘*subgraph.cmdstream’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:725:1: enter_function: entry to ‘ethosu_emit_cmdstream’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:738:4: call_function: calling ‘fill_memory_accesses’ from ‘ethosu_emit_cmdstream’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:738:4: return_function: returning to ‘ethosu_emit_cmdstream’ from ‘fill_memory_accesses’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:745:4: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:749:7: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:749:7: call_function: calling ‘get_wait_dependency’ from ‘ethosu_emit_cmdstream’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:749:7: return_function: returning to ‘ethosu_emit_cmdstream’ from ‘get_wait_dependency’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:754:10: call_function: calling ‘emit_convolution’ from ‘ethosu_emit_cmdstream’
# 33|
# 34| unsigned cur_size = subgraph->cursor - subgraph->cmdstream;
# 35|-> subgraph->cmdstream = realloc(subgraph->cmdstream, (subgraph->cmdstream_used + 32) * sizeof(*subgraph->cmdstream));
# 36| subgraph->cursor = subgraph->cmdstream + cur_size;
# 37| subgraph->cmdstream_used += 32;
Error: GCC_ANALYZER_WARNING (CWE-401):
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:36:4: warning[-Wanalyzer-malloc-leak]: leak of ‘*subgraph.cursor’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:725:1: enter_function: entry to ‘ethosu_emit_cmdstream’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:735:26: acquire_memory: allocated here
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:738:4: call_function: calling ‘fill_memory_accesses’ from ‘ethosu_emit_cmdstream’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:738:4: return_function: returning to ‘ethosu_emit_cmdstream’ from ‘fill_memory_accesses’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:742:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:743:7: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:743:7: call_function: calling ‘ethosu_ensure_cmdstream’ from ‘ethosu_emit_cmdstream’
# 34| unsigned cur_size = subgraph->cursor - subgraph->cmdstream;
# 35| subgraph->cmdstream = realloc(subgraph->cmdstream, (subgraph->cmdstream_used + 32) * sizeof(*subgraph->cmdstream));
# 36|-> subgraph->cursor = subgraph->cmdstream + cur_size;
# 37| subgraph->cmdstream_used += 32;
# 38| }
Error: GCC_ANALYZER_WARNING (CWE-401):
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:36:4: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:725:1: enter_function: entry to ‘ethosu_emit_cmdstream’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:738:4: call_function: calling ‘fill_memory_accesses’ from ‘ethosu_emit_cmdstream’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:738:4: return_function: returning to ‘ethosu_emit_cmdstream’ from ‘fill_memory_accesses’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:745:4: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:749:7: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:749:7: call_function: calling ‘get_wait_dependency’ from ‘ethosu_emit_cmdstream’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:749:7: return_function: returning to ‘ethosu_emit_cmdstream’ from ‘get_wait_dependency’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:754:10: call_function: calling ‘emit_convolution’ from ‘ethosu_emit_cmdstream’
# 34| unsigned cur_size = subgraph->cursor - subgraph->cmdstream;
# 35| subgraph->cmdstream = realloc(subgraph->cmdstream, (subgraph->cmdstream_used + 32) * sizeof(*subgraph->cmdstream));
# 36|-> subgraph->cursor = subgraph->cmdstream + cur_size;
# 37| subgraph->cmdstream_used += 32;
# 38| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:79:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘input_weights’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:63:1: enter_function: entry to ‘fill_weights’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:71:4: call_function: calling ‘calculate_weights_strides’ from ‘fill_weights’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:71:4: return_function: returning to ‘fill_weights’ from ‘calculate_weights_strides’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:76:29: acquire_memory: this call could return NULL
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:77:20: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:78:11: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:78:10: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:79:52: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:79:10: danger: ‘input_weights + (sizetype)i * 2’ could be NULL: unchecked value from [(7)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/6)
# 77| for (int i = 0; i < pipe_buffer_size(weight_rsrc); i++) {
# 78| if (operation->kernel.is_signed)
# 79|-> input_weights[i] = (int8_t)input_weights_8[i] - operation->kernel.zero_point;
# 80| else
# 81| input_weights[i] = input_weights_8[i] - operation->kernel.zero_point;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:81:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘input_weights’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:63:1: enter_function: entry to ‘fill_weights’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:71:4: call_function: calling ‘calculate_weights_strides’ from ‘fill_weights’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:71:4: return_function: returning to ‘fill_weights’ from ‘calculate_weights_strides’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:76:29: acquire_memory: this call could return NULL
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:77:20: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:78:11: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:78:10: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:81:44: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:81:10: danger: ‘input_weights + (sizetype)i * 2’ could be NULL: unchecked value from [(7)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/6)
# 79| input_weights[i] = (int8_t)input_weights_8[i] - operation->kernel.zero_point;
# 80| else
# 81|-> input_weights[i] = input_weights_8[i] - operation->kernel.zero_point;
# 82| }
# 83| pipe_buffer_unmap(subgraph->base.context, transfer_in);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_ml.c:69:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
# 67| unsigned size;
# 68|
# 69|-> if (tensor->layout == ETHOSU_LAYOUT_NHWC) {
# 70| size = tensor->shape.width * tensor->shape.height * tensor->shape.depth;
# 71| } else if (tensor->layout == ETHOSU_LAYOUT_NHCWB16) {
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_ml.c: scope_hint: In function ‘ethosu_ml_subgraph_create’
mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_ml.c:222:8: warning[-Wunused-variable]: unused variable ‘ret’
# 222 | int ret = drmIoctl(screen->fd, DRM_IOCTL_ETHOSU_CMDSTREAM_BO_CREATE, &cmd_bo_create);
# | ^~~
# 220| ethosu_dump_buffer((uint8_t *)subgraph->cmdstream, "cmdstream", 0, 0, 0, (subgraph->cursor - subgraph->cmdstream) * sizeof(*subgraph->cursor));
# 221|
# 222|-> int ret = drmIoctl(screen->fd, DRM_IOCTL_ETHOSU_CMDSTREAM_BO_CREATE, &cmd_bo_create);
# 223| assert(ret == 0);
# 224|
Error: CPPCHECK_WARNING (CWE-401):
mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:114: error[memleakOnRealloc]: Common realloc mistake: 'restart_pos' nulled but not freed upon failure
# 112| if (restart_i == max_palettes) {
# 113| max_palettes = max_palettes*2;
# 114|-> restart_pos = (int*)realloc( restart_pos, max_palettes*sizeof(int) );
# 115| if (!restart_pos) {
# 116| return -1;
Error: CPPCHECK_WARNING (CWE-401):
mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:185: error[memleakOnRealloc]: Common realloc mistake: 'restart_pos' nulled but not freed upon failure
# 183| if (restart_i == max_palettes) {
# 184| max_palettes = max_palettes*2;
# 185|-> restart_pos = (int*)realloc( restart_pos, max_palettes*sizeof(int) );
# 186| if (!restart_pos) {
# 187| return -1;
Error: GCC_ANALYZER_WARNING (CWE-401):
mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:203:1: warning[-Wanalyzer-malloc-leak]: leak of ‘restart_pos’
mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:872:5: enter_function: entry to ‘mlw_encode’
mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:887:8: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:894:22: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:894:22: call_function: calling ‘search_palette_sections’ from ‘mlw_encode’
# 201| *palette_restart_positions = (int*)realloc( restart_pos, restart_i*sizeof(int) );
# 202| return *palette_restart_positions ? restart_i : -1;
# 203|-> }
# 204|
# 205| // Calculate frequency table
Error: CPPCHECK_WARNING (CWE-401):
mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:1093: error[memleakOnRealloc]: Common realloc mistake: 'weights' nulled but not freed upon failure
# 1091| // Reallocate by doubling the buffer size as needed
# 1092| length *= 2;
# 1093|-> weights = (int16_t*)realloc(weights, length * sizeof(int16_t));
# 1094| if (!weights)
# 1095| { // Realloc failed, so exit
Error: CPPCHECK_WARNING (CWE-401):
mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:1111: error[memleakOnRealloc]: Common realloc mistake: 'weights' nulled but not freed upon failure
# 1109|
# 1110|
# 1111|-> weights = (int16_t*)realloc(weights, weight_cnt * sizeof(int16_t));
# 1112| if ( weights ) {
# 1113| *padded_length = weight_cnt;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/etnaviv/etnaviv_ml.c:763:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘subgraph’
mesa-26.0.3/src/gallium/drivers/etnaviv/etnaviv_ml.c:752:7: branch_false: following ‘false’ branch (when ‘nn_core_count != 0’)...
mesa-26.0.3/src/gallium/drivers/etnaviv/etnaviv_ml.c:757:15: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/etnaviv/etnaviv_ml.c:757:15: acquire_memory: this call could return NULL
mesa-26.0.3/src/gallium/drivers/etnaviv/etnaviv_ml.c:763:4: danger: ‘subgraph’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/7/codeFlows/0/threadFlows/0/locations/2)
# 761|
# 762| subgraph->base.context = pcontext;
# 763|-> subgraph->operations = UTIL_DYNARRAY_INIT;
# 764|
# 765| subgraph->tensors = UTIL_DYNARRAY_INIT;
Error: GCC_ANALYZER_WARNING (CWE-416):
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:245:4: warning[-Wanalyzer-use-after-free]: use after ‘free’ of ‘batch’
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:598:1: enter_function: entry to ‘fd_batch_check_size’
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:600:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:601:7: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:601:7: call_function: calling ‘fd_batch_flush’ from ‘fd_batch_check_size’
# 243| fd_screen_assert_locked(batch->ctx->screen);
# 244|
# 245|-> set_foreach (batch->resources, entry) {
# 246| struct fd_resource *rsc = (struct fd_resource *)entry->key;
# 247| _mesa_set_remove(batch->resources, entry);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:317:31: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘batch’
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:598:1: enter_function: entry to ‘fd_batch_check_size’
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:600:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:601:7: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:601:7: call_function: calling ‘fd_batch_flush’ from ‘fd_batch_check_size’
# 315| __fd_batch_destroy(struct fd_batch *batch)
# 316| {
# 317|-> struct fd_screen *screen = batch->ctx->screen;
# 318| fd_screen_lock(screen);
# 319| __fd_batch_destroy_locked(batch);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch_cache.c:445:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘batch’
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch_cache.c:560:1: enter_function: entry to ‘fd_batch_from_fb’
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch_cache.c:582:29: call_function: calling ‘batch_from_key’ from ‘fd_batch_from_fb’
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch_cache.c:582:29: return_function: returning to ‘fd_batch_from_fb’ from ‘batch_from_key’
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch_cache.c:583:4: call_function: inlined call to ‘fd_screen_unlock’ from ‘fd_batch_from_fb’
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch_cache.c:583:4: call_function: inlined call to ‘fd_screen_unlock’ from ‘fd_batch_from_fb’
mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch_cache.c:585:4: call_function: calling ‘alloc_query_buf’ from ‘fd_batch_from_fb’
# 443| alloc_query_buf(struct fd_context *ctx, struct fd_batch *batch)
# 444| {
# 445|-> if (batch->query_buf)
# 446| return;
# 447|
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/gallium/drivers/panfrost/pan_cmdstream.c: scope_hint: In function ‘panfrost_emit_blend’
mesa-26.0.3/src/gallium/drivers/panfrost/pan_cmdstream.c:326:40: warning[-Wunused-variable]: unused variable ‘fs’
# 326 | struct panfrost_compiled_shader *fs = ctx->prog[MESA_SHADER_FRAGMENT];
# | ^~
# 324|
# 325| #if PAN_ARCH >= 6
# 326|-> struct panfrost_compiled_shader *fs = ctx->prog[MESA_SHADER_FRAGMENT];
# 327| struct mali_internal_blend_packed *internal_blend_packed =
# 328| (struct mali_internal_blend_packed *)&packed->opaque[2];
Error: COMPILER_WARNING:
mesa-26.0.3/src/gallium/drivers/panfrost/pan_context.c: scope_hint: In function ‘panfrost_fence_server_sync’
mesa-26.0.3/src/gallium/drivers/panfrost/pan_context.c:964:17: warning[-Wunused-but-set-variable=]: variable ‘ret’ set but not used
# 964 | int fd = -1, ret;
# | ^~~
# 962| struct panfrost_device *dev = pan_device(pctx->screen);
# 963| struct panfrost_context *ctx = pan_context(pctx);
# 964|-> int fd = -1, ret;
# 965| assert(!value);
# 966|
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/gallium/drivers/panfrost/pan_csf.c: scope_hint: In function ‘csf_submit_wait_and_dump’
mesa-26.0.3/src/gallium/drivers/panfrost/pan_csf.c:588:11: warning[-Wunused-variable]: unused variable ‘ret’
# 588 | int ret =
# | ^~~
# 586| /* Wait so we can get errors reported back */
# 587| if (wait) {
# 588|-> int ret =
# 589| drmSyncobjTimelineWait(panfrost_device_fd(dev), &vm_sync_handle,
# 590| &vm_sync_signal_point, 1, INT64_MAX, 0, NULL);
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/gallium/drivers/panfrost/pan_csf.c: scope_hint: In function ‘csf_emit_draw_state’
mesa-26.0.3/src/gallium/drivers/panfrost/pan_csf.c:1103:9: warning[-Wunused-variable]: unused variable ‘idvs’
# 1103 | bool idvs = vs->info.vs.idvs;
# | ^~~~
# 1101| struct panfrost_compiled_shader *fs = ctx->prog[MESA_SHADER_FRAGMENT];
# 1102|
# 1103|-> bool idvs = vs->info.vs.idvs;
# 1104| bool fs_required = panfrost_fs_required(
# 1105| fs, ctx->blend, &ctx->pipe_framebuffer, ctx->depth_stencil);
Error: COMPILER_WARNING:
mesa-26.0.3/src/gallium/drivers/panfrost/pan_csf.c: scope_hint: In function ‘csf_cleanup_context_v10’
mesa-26.0.3/src/gallium/drivers/panfrost/pan_csf.c:1646:8: warning[-Wunused-but-set-variable=]: variable ‘ret’ set but not used
# 1646 | int ret;
# | ^~~
# 1644| .handle = ctx->csf.heap.handle,
# 1645| };
# 1646|-> int ret;
# 1647|
# 1648| /* Make sure all jobs are done before destroying the heap. */
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/gallium/drivers/panfrost/pan_jm.c: scope_hint: In function ‘jm_emit_tiler_desc’
mesa-26.0.3/src/gallium/drivers/panfrost/pan_jm.c:403:13: warning[-Wunused-variable]: unused variable ‘max_levels’
# 403 | unsigned max_levels = dev->tiler_features.max_levels;
# | ^~~~~~~~~~
# 401|
# 402| uint64_t heap = t.gpu;
# 403|-> unsigned max_levels = dev->tiler_features.max_levels;
# 404| assert(max_levels >= 2);
# 405|
Error: COMPILER_WARNING (CWE-477):
mesa-26.0.3/src/gallium/drivers/r300/r300_context.c: scope_hint: In function ‘r300_release_referenced_objects’
mesa-26.0.3/src/gallium/drivers/r300/r300_context.c:33:5: warning[-Wdeprecated-declarations]: ‘util_framebuffer_init’ is deprecated
# 33 | util_framebuffer_init(&r300->context, NULL, r300->fb_cbufs, &r300->fb_zsbuf);
# | ^~~~~~~~~~~~~~~~~~~~~
mesa-26.0.3/src/gallium/auxiliary/util/u_blitter.h:30: included_from: Included from here.
mesa-26.0.3/src/gallium/drivers/r300/r300_context.h:13: included_from: Included from here.
mesa-26.0.3/src/gallium/drivers/r300/r300_context.c:16: included_from: Included from here.
mesa-26.0.3/src/gallium/auxiliary/util/u_framebuffer.h:76:1: note: declared here
# 76 | util_framebuffer_init(struct pipe_context *pctx, const struct pipe_framebuffer_state *fb, struct pipe_surface **cbufs, struct pipe_surface **zsbuf);
# | ^~~~~~~~~~~~~~~~~~~~~
# 31|
# 32| /* Framebuffer state. */
# 33|-> util_framebuffer_init(&r300->context, NULL, r300->fb_cbufs, &r300->fb_zsbuf);
# 34| util_unreference_framebuffer_state(fb);
# 35|
Error: COMPILER_WARNING (CWE-477):
mesa-26.0.3/src/gallium/drivers/r300/r300_context.c:33:5: warning[-Wdeprecated-declarations]: ‘util_framebuffer_init’ is deprecated
# 31|
# 32| /* Framebuffer state. */
# 33|-> util_framebuffer_init(&r300->context, NULL, r300->fb_cbufs, &r300->fb_zsbuf);
# 34| util_unreference_framebuffer_state(fb);
# 35|
Error: COMPILER_WARNING (CWE-477):
mesa-26.0.3/src/gallium/drivers/r300/r300_state.c: scope_hint: In function ‘r300_set_framebuffer_state’
mesa-26.0.3/src/gallium/drivers/r300/r300_state.c:1063:5: warning[-Wdeprecated-declarations]: ‘util_framebuffer_init’ is deprecated
# 1063 | util_framebuffer_init(pipe, state, r300->fb_cbufs, &r300->fb_zsbuf);
# | ^~~~~~~~~~~~~~~~~~~~~
mesa-26.0.3/src/gallium/drivers/r300/r300_state.c:9: included_from: Included from here.
mesa-26.0.3/src/gallium/auxiliary/util/u_framebuffer.h:76:1: note: declared here
# 76 | util_framebuffer_init(struct pipe_context *pctx, const struct pipe_framebuffer_state *fb, struct pipe_surface **cbufs, struct pipe_surface **zsbuf);
# | ^~~~~~~~~~~~~~~~~~~~~
# 1061| }
# 1062|
# 1063|-> util_framebuffer_init(pipe, state, r300->fb_cbufs, &r300->fb_zsbuf);
# 1064| util_copy_framebuffer_state(r300->fb_state.state, state);
# 1065|
Error: COMPILER_WARNING (CWE-477):
mesa-26.0.3/src/gallium/drivers/r300/r300_state.c:1063:5: warning[-Wdeprecated-declarations]: ‘util_framebuffer_init’ is deprecated
# 1061| }
# 1062|
# 1063|-> util_framebuffer_init(pipe, state, r300->fb_cbufs, &r300->fb_zsbuf);
# 1064| util_copy_framebuffer_state(r300->fb_state.state, state);
# 1065|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:614:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘drm_keyblob’
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1430:31: enter_function: entry to ‘rvcn_dec_message_decode’
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1471:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1487:13: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1490:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1515:12: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1535:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1562:26: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1675:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1676:7: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1676:7: call_function: calling ‘set_drm_keyblob’ from ‘rvcn_dec_message_decode’
# 612| static void set_drm_keyblob(rvcn_dec_message_drm_keyblob_t *drm_keyblob, amd_secure_buffer_format *secure_buf)
# 613| {
# 614|-> memcpy(drm_keyblob->contentKey, secure_buf->key_blob.local_policy.wrapped_key, 16);
# 615| memcpy(drm_keyblob->signature, secure_buf->key_blob.local_policy.signature, 16);
# 616| memcpy(&drm_keyblob->policyIndex, secure_buf->key_blob.local_policy.native_policy.enabled_policy_index, 4);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1309:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dynamic_dpb_t2’
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2541:6: enter_function: entry to ‘send_cmd_dec’
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2554:4: call_function: calling ‘map_msg_fb_it_probs_buf’ from ‘send_cmd_dec’
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2554:4: return_function: returning to ‘send_cmd_dec’ from ‘map_msg_fb_it_probs_buf’
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2555:9: call_function: calling ‘rvcn_dec_message_decode’ from ‘send_cmd_dec’
# 1307| dynamic_dpb_t2->dpbAddrLo[i] = addr;
# 1308| dynamic_dpb_t2->dpbAddrHi[i] = addr >> 32;
# 1309|-> ++dynamic_dpb_t2->dpbArraySize;
# 1310| found = true;
# 1311| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1544:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index_drm_keyblob’
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1471:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1487:13: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1490:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1515:12: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1535:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1544:7: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1544:7: danger: dereference of NULL ‘index_drm_keyblob’
# 1542|
# 1543| if (picture->cenc) {
# 1544|-> index_drm_keyblob->message_id = RDECODE_MESSAGE_DRM_KEYBLOB;
# 1545| index_drm_keyblob->offset = offset_drm_keyblob;
# 1546| index_drm_keyblob->size = sizeof(rvcn_dec_message_drm_keyblob_t);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1552:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index_dynamic_dpb’
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1471:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1487:13: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1490:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1515:12: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1535:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1552:7: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1552:7: danger: dereference of NULL ‘index_dynamic_dpb’
# 1550|
# 1551| if (dec->dpb_type == DPB_DYNAMIC_TIER_1 || dec->dpb_type == DPB_DYNAMIC_TIER_2) {
# 1552|-> index_dynamic_dpb->message_id = RDECODE_MESSAGE_DYNAMIC_DPB;
# 1553| index_dynamic_dpb->offset = offset_dynamic_dpb;
# 1554| index_dynamic_dpb->filled = 0;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1765:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dynamic_dpb’
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1471:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1487:13: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1490:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1515:12: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1535:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1562:26: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1675:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1679:24: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1705:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1710:4: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1751:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1759:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1759:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1760:7: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1762:10: branch_false: following ‘false’ branch (when ‘dpb_resize == 0’)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1765:7: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1765:7: danger: dereference of NULL ‘dynamic_dpb’
# 1763| decode->decode_flags |= RDECODE_FLAGS_DPB_RESIZE_MASK;
# 1764|
# 1765|-> dynamic_dpb->dpbArraySize = NUM_VP9_REFS + 1;
# 1766| dynamic_dpb->dpbLumaPitch = align(dec->max_width, dec->db_alignment);
# 1767| dynamic_dpb->dpbLumaAlignedHeight = align(dec->max_height, dec->db_alignment);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2828:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2790:7: branch_false: following ‘false’ branch (when ‘dec’ is non-NULL)...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2793:8: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2793:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2799:4: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2800:24: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2800:4: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2828:9: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2829:67: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2829:67: release_memory: using NULL here
mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2828:9: danger: dereference of NULL ‘*dec.ectx’
# 2826| dec->sq.engine_ib_size_of_packages = NULL;
# 2827|
# 2828|-> if (!ws->cs_create(&dec->cs,
# 2829| (sctx->vcn_has_ctx) ? ((struct si_context *)dec->ectx)->ctx : sctx->ctx,
# 2830| ring, NULL, NULL)) {
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/radeonsi/si_debug.c:171:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘chunk’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_debug.c:1049:6: enter_function: entry to ‘si_log_draw_state’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_debug.c:1056:4: call_function: inlined call to ‘si_dump_compute_shader’ from ‘si_log_draw_state’
# 169|
# 170| struct si_log_chunk_shader *chunk = CALLOC_STRUCT(si_log_chunk_shader);
# 171|-> chunk->ctx = ctx;
# 172| chunk->shader = &program->shader;
# 173| si_compute_reference(&chunk->program, program);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/radeonsi/si_debug.c:751:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘chunk’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_debug.c:1049:6: enter_function: entry to ‘si_log_draw_state’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_debug.c:1064:4: call_function: calling ‘si_dump_descriptor_list’ from ‘si_log_draw_state’
# 749| struct si_log_chunk_desc_list *chunk =
# 750| CALLOC_VARIANT_LENGTH_STRUCT(si_log_chunk_desc_list, 4 * (size_t)element_dw_size * num_elements);
# 751|-> chunk->shader_name = shader_name;
# 752| chunk->elem_name = elem_name;
# 753| chunk->element_dw_size = element_dw_size;
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/gallium/drivers/radeonsi/si_state.c: scope_hint: In function ‘gfx11_dgpu_emit_framebuffer_state’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_state.c:2993:9: warning[-Wunused-variable]: unused variable ‘is_msaa_resolve’
# 2993 | bool is_msaa_resolve = state->nr_cbufs == 2 &&
# | ^~~~~~~~~~~~~~~
# 2991| struct pipe_framebuffer_state *state = &sctx->framebuffer.state;
# 2992| unsigned i, nr_cbufs = state->nr_cbufs;
# 2993|-> bool is_msaa_resolve = state->nr_cbufs == 2 &&
# 2994| state->cbufs[0].texture && state->cbufs[0].texture->nr_samples > 1 &&
# 2995| state->cbufs[1].texture && state->cbufs[1].texture->nr_samples <= 1;
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/gallium/drivers/radeonsi/si_state.c: scope_hint: In function ‘gfx12_emit_framebuffer_state’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_state.c:3140:9: warning[-Wunused-variable]: unused variable ‘is_msaa_resolve’
# 3140 | bool is_msaa_resolve = state->nr_cbufs == 2 &&
# | ^~~~~~~~~~~~~~~
# 3138| struct pipe_framebuffer_state *state = &sctx->framebuffer.state;
# 3139| unsigned i, nr_cbufs = state->nr_cbufs;
# 3140|-> bool is_msaa_resolve = state->nr_cbufs == 2 &&
# 3141| state->cbufs[0].texture && state->cbufs[0].texture->nr_samples > 1 &&
# 3142| state->cbufs[1].texture && state->cbufs[1].texture->nr_samples <= 1;
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:90:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘line’ where non-null expected
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:69:28: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:88:4: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:88:25: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:88:25: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:89:28: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:90:24: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:90:10: danger: argument 2 (‘line’) from [(1)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
# 88| for (unsigned z = 0; z < tex->depth0; z++) {
# 89| for (unsigned y = 0; y < tex->height0; y++)
# 90|-> memcpy(map + t->layer_stride * z + t->stride * y, line, line_size);
# 91| }
# 92|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/drivers/rocket/rkt_ml.c:310:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘subgraph’
mesa-26.0.3/src/gallium/drivers/rocket/rkt_ml.c:306:15: acquire_memory: this call could return NULL
mesa-26.0.3/src/gallium/drivers/rocket/rkt_ml.c:310:4: danger: ‘subgraph’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
# 308|
# 309| tensor_count = count_tensors(poperations, count);
# 310|-> subgraph->tensors = UTIL_DYNARRAY_INIT;
# 311| subgraph->operations = UTIL_DYNARRAY_INIT;
# 312| if (!util_dynarray_resize(&subgraph->tensors, struct pipe_resource *,
Error: GCC_ANALYZER_WARNING (CWE-122):
mesa-26.0.3/src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:257:13: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-26.0.3/src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:361:1: enter_function: entry to ‘lvp_flatten_as’
mesa-26.0.3/src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:371:7: branch_false: following ‘false’ branch (when ‘child_counts’ is non-NULL)...
mesa-26.0.3/src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:371:7: branch_false: ...to here
mesa-26.0.3/src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:377:25: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:396:4: branch_false: ...to here
mesa-26.0.3/src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:398:4: call_function: calling ‘lvp_select_subtrees_to_flatten’ from ‘lvp_flatten_as’
# 255| uint32_t available_depth = 23 - depth;
# 256| uint32_t allowed_child_count = 1 << available_depth;
# 257|-> uint32_t child_count = child_counts[index];
# 258| bool flatten = child_count > allowed_child_count;
# 259|
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:323:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘tensor’
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:748:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:753:4: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:755:24: branch_false: ...to here
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:755:24: acquire_memory: this call could return NULL
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:757:20: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:758:7: branch_true: ...to here
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:758:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
# 321| tensor->resource = create_resource(context, tf_tensor);
# 322|
# 323|-> tensor->index = index;
# 324| for (int out_dim = 0; out_dim < 4; out_dim++) {
# 325| int in_dim = tf_tensor.dims->size - 4 + out_dim;
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:341:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘calloc((long unsigned int)*MEM[(const struct TfLiteAffineQuantization *)tf_tensor$quantization$params_14].scale.size, 4)’ where non-null expected
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:748:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:753:4: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:755:24: branch_false: ...to here
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:757:20: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:758:7: branch_true: ...to here
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:758:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
# 339| (!all_scales_equal(quant) || !all_zero_points_equal(quant))) {
# 340| tensor->scales = calloc(quant->scale->size, sizeof(*tensor->scales));
# 341|-> memcpy(tensor->scales, quant->scale->data, quant->scale->size * sizeof(*tensor->scales));
# 342|
# 343| tensor->zero_points = calloc(quant->zero_point->size, sizeof(*tensor->zero_points));
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:344:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘calloc((long unsigned int)*MEM[(const struct TfLiteAffineQuantization *)tf_tensor$quantization$params_14].zero_point.size, 4)’ where non-null expected
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:748:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:753:4: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:755:24: branch_false: ...to here
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:757:20: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:758:7: branch_true: ...to here
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:758:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
# 342|
# 343| tensor->zero_points = calloc(quant->zero_point->size, sizeof(*tensor->zero_points));
# 344|-> memcpy(tensor->zero_points, quant->zero_point->data, quant->zero_point->size * sizeof(*tensor->zero_points));
# 345| }
# 346| }
Error: GCC_ANALYZER_WARNING (CWE-401):
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:771:7: warning[-Wanalyzer-malloc-leak]: leak of ‘supported_nodes’
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:748:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:753:4: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:755:24: branch_false: ...to here
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:760:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:760:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:761:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:761:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:764:38: acquire_memory: allocated here
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:767:20: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:768:11: branch_true: ...to here
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:771:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:771:7: branch_true: ...to here
mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:771:7: danger: ‘supported_nodes’ leaks here; was allocated at [(24)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/23)
# 769| bool supported = false;
# 770| TfLiteRegistration *registration;
# 771|-> TF_LITE_ENSURE_STATUS(tf_context->GetNodeAndRegistration(
# 772| tf_context, node_index, &node, ®istration));
# 773|
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.0.3/src/intel/blorp/blorp_genX_exec_brw.h:1352:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘surface_offsets[1]’
mesa-26.0.3/src/intel/vulkan/genX_blorp_exec.c:530:1: enter_function: entry to ‘gfx9_blorp_exec’
mesa-26.0.3/src/intel/vulkan/genX_blorp_exec.c:549:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/intel/vulkan/genX_blorp_exec.c:550:7: call_function: inlined call to ‘blorp_exec_on_blitter’ from ‘gfx9_blorp_exec’
# 1350|
# 1351| if (params->src.enabled) {
# 1352|-> blorp_emit_surface_state(batch, ¶ms->src,
# 1353| params->fast_clear_op,
# 1354| surface_maps[BLORP_TEXTURE_BT_INDEX],
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.0.3/src/intel/common/mi_builder.h:458:1: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘((int64_t *)((char *)&value + offsetof(struct mi_value, <U4140>)))[1]’
mesa-26.0.3/src/intel/vulkan_hasvk/genX_query.c:1282:6: enter_function: entry to ‘gfx7_CmdWriteTimestamp2’
mesa-26.0.3/src/intel/vulkan_hasvk/genX_query.c:1297:7: branch_true: following ‘true’ branch (when ‘stage == 1’)...
mesa-26.0.3/src/intel/vulkan_hasvk/genX_query.c:1298:7: call_function: inlined call to ‘anv_address_add’ from ‘gfx7_CmdWriteTimestamp2’
mesa-26.0.3/src/intel/vulkan_hasvk/genX_query.c:1298:7: call_function: inlined call to ‘mi_store’ from ‘gfx7_CmdWriteTimestamp2’
# 456|
# 457| static inline struct mi_value
# 458|-> mi_value_half(struct mi_value value, bool top_32_bits)
# 459| {
# 460| switch (value.type) {
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp: scope_hint: In function ‘void emit_pixel_interpolater_alu_at_offset(const brw_builder&, const brw_reg&, const brw_reg&, glsl_interp_mode)’
mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp:2153:35: warning[-Wunused-variable]: unused variable ‘wm_prog_data’
# 2153 | const struct brw_wm_prog_data *wm_prog_data =
# | ^~~~~~~~~~~~
# 2151|
# 2152| const brw_fs_thread_payload &payload = shader->fs_payload();
# 2153|-> const struct brw_wm_prog_data *wm_prog_data =
# 2154| brw_wm_prog_data(shader->prog_data);
# 2155|
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp: scope_hint: In function ‘void emit_pixel_interpolater_alu_at_sample(const brw_builder&, const brw_reg&, const brw_reg&, glsl_interp_mode)’
mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp:2288:35: warning[-Wunused-variable]: unused variable ‘wm_prog_data’
# 2288 | const struct brw_wm_prog_data *wm_prog_data =
# | ^~~~~~~~~~~~
# 2286| {
# 2287| const brw_fs_thread_payload &payload = bld.shader->fs_payload();
# 2288|-> const struct brw_wm_prog_data *wm_prog_data =
# 2289| brw_wm_prog_data(bld.shader->prog_data);
# 2290| const brw_builder ubld = bld.exec_all().group(16, 0);
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp: scope_hint: In function ‘void emit_barrier(nir_to_brw_state&)’
mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp:2859:16: warning[-Wunused-variable]: unused variable ‘s’
# 2859 | brw_shader &s = ntb.s;
# | ^
# 2857| const brw_builder ubld = bld.exec_all();
# 2858| const brw_builder hbld = ubld.group(8 * reg_unit(devinfo), 0);
# 2859|-> brw_shader &s = ntb.s;
# 2860|
# 2861| /* We are getting the barrier ID from the compute shader header */
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp: scope_hint: In function ‘brw_reg brw_per_primitive_reg(const brw_builder&, int, unsigned int)’
mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp:3761:35: warning[-Wunused-variable]: unused variable ‘prog_data’
# 3761 | const struct brw_wm_prog_data *prog_data = brw_wm_prog_data(s.prog_data);
# | ^~~~~~~~~
# 3759| location == VARYING_SLOT_PRIMITIVE_ID);
# 3760|
# 3761|-> const struct brw_wm_prog_data *prog_data = brw_wm_prog_data(s.prog_data);
# 3762|
# 3763| comp += (s.fs.per_primitive_offsets[location] % 16) / 4;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:175:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘any_hit_impl’
mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:149:1: enter_function: entry to ‘brw_nir_lower_intersection_shader’
mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:157:7: branch_false: following ‘false’ branch (when ‘any_hit’ is NULL)...
mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:164:30: branch_false: ...to here
mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:164:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘brw_nir_lower_intersection_shader’
mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:164:30: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘nir_shader_get_entrypoint’
mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:166:24: call_function: inlined call to ‘nir_before_impl’ from ‘brw_nir_lower_intersection_shader’
mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:169:22: call_function: calling ‘brw_nir_rt_mem_hit_addr’ from ‘brw_nir_lower_intersection_shader’
mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:169:22: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘brw_nir_rt_mem_hit_addr’
mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:172:4: call_function: inlined call to ‘nir_imm_false’ from ‘brw_nir_lower_intersection_shader’
mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:172:4: call_function: inlined call to ‘nir_imm_false’ from ‘brw_nir_lower_intersection_shader’
mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:175:4: danger: dereference of NULL ‘nir_shader_get_entrypoint(intersection)’
# 173|
# 174| assert(impl->end_block->predecessors.entries == 1);
# 175|-> set_foreach(&impl->end_block->predecessors, block_entry) {
# 176| struct nir_block *block = (void *)block_entry->key;
# 177| b->cursor = nir_after_block_before_jump(block);
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/intel/compiler/brw/brw_shader.cpp: scope_hint: In member function ‘void brw_shader::assign_curb_setup()’
mesa-26.0.3/src/intel/compiler/brw/brw_shader.cpp:672:22: warning[-Wunused-variable]: unused variable ‘n_push_data_regs’
# 672 | const unsigned n_push_data_regs = reg_unit(devinfo) *
# | ^~~~~~~~~~~~~~~~
# 670| * stateless messages.
# 671| */
# 672|-> const unsigned n_push_data_regs = reg_unit(devinfo) *
# 673| DIV_ROUND_UP(this->push_data_size, reg_unit(devinfo) * REG_SIZE);
# 674| for (unsigned i = 0; i < this->push_data_size / REG_SIZE;) {
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:382:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bbo’
mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:595:1: enter_function: entry to ‘anv_cmd_buffer_chain_generation_batch’
mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:603:25: release_memory: ‘new_bbo’ is NULL
mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:614:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:617:37: branch_false: ...to here
mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:618:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:619:7: branch_true: ...to here
mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:619:7: release_memory: ‘new_bbo’ is NULL
mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:619:7: call_function: calling ‘anv_batch_bo_destroy’ from ‘anv_cmd_buffer_chain_generation_batch’
# 380| {
# 381| anv_reloc_list_finish(&bbo->relocs);
# 382|-> ANV_DMR_BO_FREE(&cmd_buffer->vk.base, bbo->bo);
# 383| anv_bo_pool_free(&cmd_buffer->device->batch_bo_pool, bbo->bo);
# 384| vk_free(&cmd_buffer->vk.pool->alloc, bbo);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/intel/vulkan_hasvk/anv_allocator.c:588:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bo’
mesa-26.0.3/src/intel/vulkan_hasvk/anv_allocator.c:1114:1: enter_function: entry to ‘anv_state_pool_alloc’
mesa-26.0.3/src/intel/vulkan_hasvk/anv_allocator.c:1119:29: call_function: calling ‘anv_state_pool_alloc_no_vg’ from ‘anv_state_pool_alloc’
# 586| assert((offset - bo_offset) + size <= bo->size);
# 587|
# 588|-> return bo->map + (offset - bo_offset);
# 589| } else {
# 590| return pool->map + offset;
Error: GCC_ANALYZER_WARNING (CWE-775):
mesa-26.0.3/src/loader/loader.c:257:13: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘loader_open_device(device_40->nodes[2])’
mesa-26.0.3/src/loader/loader.c:230:1: enter_function: entry to ‘loader_open_render_node_platform_devices’
mesa-26.0.3/src/loader/loader.c:241:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/loader/loader.c:246:13: branch_false: ...to here
mesa-26.0.3/src/loader/loader.c:249:16: branch_true: following ‘true’ branch...
mesa-26.0.3/src/loader/loader.c:250:7: branch_true: ...to here
mesa-26.0.3/src/loader/loader.c:252:10: branch_true: following ‘true’ branch...
mesa-26.0.3/src/loader/loader.c:253:12: branch_true: ...to here
mesa-26.0.3/src/loader/loader.c:252:11: branch_true: following ‘true’ branch...
mesa-26.0.3/src/loader/loader.c:256:34: branch_true: ...to here
mesa-26.0.3/src/loader/loader.c:256:15: call_function: calling ‘loader_open_device’ from ‘loader_open_render_node_platform_devices’
mesa-26.0.3/src/loader/loader.c:256:15: return_function: returning to ‘loader_open_render_node_platform_devices’ from ‘loader_open_device’
mesa-26.0.3/src/loader/loader.c:257:13: danger: ‘loader_open_device(device_40->nodes[2])’ leaks here; was opened at [(12)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/11)
# 255|
# 256| fd = loader_open_device(device->nodes[DRM_NODE_RENDER]);
# 257|-> if (fd < 0)
# 258| continue;
# 259|
Error: COMPILER_WARNING (CWE-252):
mesa-26.0.3/src/loader/loader_wayland_helper.c: scope_hint: In function ‘loader_wayland_wrap_surface’
mesa-26.0.3/src/loader/loader_wayland_helper.c:240:4: warning[-Wunused-result]: ignoring return value of ‘asprintf’ declared with attribute ‘warn_unused_result’
# 240 | asprintf(&track_name, "wl%d presentation", lws->id);
# | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# 238| wl_proxy_set_queue((struct wl_proxy *)lws->wrapper, queue);
# 239|
# 240|-> asprintf(&track_name, "wl%d presentation", lws->id);
# 241| lws->analytics.presentation_track_id = util_perfetto_new_track(track_name);
# 242| free(track_name);
Error: COMPILER_WARNING (CWE-252):
mesa-26.0.3/src/loader/loader_wayland_helper.c:244:4: warning[-Wunused-result]: ignoring return value of ‘asprintf’ declared with attribute ‘warn_unused_result’
# 244 | asprintf(&lws->analytics.latency_str, "wl%d latency", lws->id);
# | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# 242| free(track_name);
# 243|
# 244|-> asprintf(&lws->analytics.latency_str, "wl%d latency", lws->id);
# 245| return true;
# 246| }
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/nouveau/vulkan/nvk_cmd_draw.c:1782:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘last_vtgm’
mesa-26.0.3/src/nouveau/vulkan/nvk_cmd_draw.c:4801:1: enter_function: entry to ‘nvk_CmdDrawIndirectByteCountEXT’
mesa-26.0.3/src/nouveau/vulkan/nvk_cmd_draw.c:4812:4: call_function: calling ‘nvk_cmd_flush_gfx_state’ from ‘nvk_CmdDrawIndirectByteCountEXT’
# 1780|
# 1781| assert(last_vtgm->vtgm_push_dw_count > last_vtgm->push_dw_count);
# 1782|-> const uint16_t dw_start = last_vtgm->push_dw_count;
# 1783| const uint16_t dw_count = last_vtgm->vtgm_push_dw_count - dw_start;
# 1784| struct nv_push *p = nvk_cmd_buffer_push(cmd, dw_count);
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:189:16: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*a.<U9280>.sparse’ where non-null expected
mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:153:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:154:16: branch_true: ...to here
mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:162:13: branch_false: following ‘false’ branch...
mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:169:13: branch_false: ...to here
mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:173:10: branch_true: following ‘true’ branch...
mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:181:13: branch_true: following ‘true’ branch...
mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:183:16: branch_true: ...to here
mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:185:45: acquire_memory: this call could return NULL
mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:188:16: branch_true: following ‘true’ branch (when ‘left != 0’)...
mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:189:16: branch_true: ...to here
mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:189:16: danger: argument 1 (‘malloc((long unsigned int)min(max >> 2, max(*a.sparse_capacity * 2, 64)) * 8)’) from [(9)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/8) could be NULL where non-null expected
# 187|
# 188| if (left)
# 189|-> memcpy(a->sparse, data, left * sizeof(nodearray_sparse));
# 190| }
# 191|
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/compiler/bifrost/valhall/va_lower_isel.c: scope_hint: In function ‘lower_swz_v4i8’
mesa-26.0.3/src/panfrost/compiler/bifrost/valhall/va_lower_isel.c:19:12: warning[-Wunused-variable]: unused variable ‘valid_swizzle’
# 19 | bool valid_swizzle =
# | ^~~~~~~~~~~~~
# 17| bi_index srcs[4] = {I->src[0], I->src[0], I->src[0], I->src[0]};
# 18| unsigned channels[4];
# 19|-> bool valid_swizzle =
# 20| bi_swizzle_to_byte_channels(I->src[0].swizzle, channels);
# 21| assert(valid_swizzle);
Error: GCC_ANALYZER_WARNING (CWE-401):
mesa-26.0.3/src/panfrost/lib/pan_encoder.h:236:1: warning[-Wanalyzer-malloc-leak]: leak of ‘*batch.jobs.data’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:17:1: enter_function: entry to ‘panvk_v6_dispatch_precomp’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:55:25: call_function: calling ‘panvk_pool_descs_to_alloc_info’ from ‘panvk_v6_dispatch_precomp’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:55:25: return_function: returning to ‘panvk_v6_dispatch_precomp’ from ‘panvk_pool_descs_to_alloc_info’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:58:4: call_function: calling ‘pan_pack_work_groups_compute’ from ‘panvk_v6_dispatch_precomp’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:58:4: return_function: returning to ‘panvk_v6_dispatch_precomp’ from ‘pan_pack_work_groups_compute’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:76:4: branch_false: following ‘false’ branch...
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: branch_false: ...to here
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘panvk_v6_dispatch_precomp’
# 234| quirk_graphics ? MALI_SPLIT_MIN_EFFICIENT : cfg.workgroups_x_shift;
# 235| }
# 236|-> }
# 237| #endif
# 238|
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/lib/pan_texture.c: scope_hint: In function ‘emit_linear_or_u_tiled_chroma_2p_plane’
mesa-26.0.3/src/panfrost/lib/pan_texture.c:499:42: warning[-Wunused-variable]: unused variable ‘desc’
# 499 | const struct util_format_description *desc =
# | ^~~~
# 497| unsigned layer_or_z_slice, void *payload)
# 498| {
# 499|-> const struct util_format_description *desc =
# 500| util_format_description(iview->format);
# 501| const struct pan_image_plane_ref pref1 = pan_image_view_get_plane(iview, 1);
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/lib/pan_texture.c:711:42: warning[-Wunused-variable]: unused variable ‘desc’
# 711 | const struct util_format_description *desc =
# | ^~~~
# 709| const struct pan_afrc_format_info finfo =
# 710| pan_afrc_get_format_info(iview->format);
# 711|-> const struct util_format_description *desc =
# 712| util_format_description(iview->format);
# 713| const struct pan_image_plane_ref pref1 =
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/lib/pan_texture.c: scope_hint: In function ‘emit_afrc_chroma_2p_plane’
mesa-26.0.3/src/panfrost/lib/pan_texture.c:715:37: warning[-Wunused-variable]: unused variable ‘pref2’
# 715 | const struct pan_image_plane_ref pref2 =
# | ^~~~~
# 713| const struct pan_image_plane_ref pref1 =
# 714| pan_image_view_get_plane(iview, 1);
# 715|-> const struct pan_image_plane_ref pref2 =
# 716| pan_image_view_get_plane(iview, 2);
# 717|
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_bind_queue.c: scope_hint: In function ‘panvk_bind_queue_submit_process_signals’
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_bind_queue.c:246:11: warning[-Wunused-variable]: unused variable ‘ret’
# 246 | int ret = drmSyncobjWait(device->drm_fd, &queue->syncobj_handle, 1,
# | ^~~
# 244|
# 245| if (submit->force_sync) {
# 246|-> int ret = drmSyncobjWait(device->drm_fd, &queue->syncobj_handle, 1,
# 247| INT64_MAX, DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL,
# 248| NULL);
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c: scope_hint: In function ‘get_tiler_desc’
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:1042:16: warning[-Wunused-variable]: unused variable ‘max_levels’
# 1042 | unsigned max_levels = tiler_features.max_levels;
# | ^~~~~~~~~~
# 1040|
# 1041| pan_pack(&tiler_tmpl, TILER_CONTEXT, cfg) {
# 1042|-> unsigned max_levels = tiler_features.max_levels;
# 1043| assert(max_levels >= 2);
# 1044|
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c: scope_hint: In function ‘get_fb_descs’
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:1410:16: warning[-Wunused-variable]: unused variable ‘new_fbd_flags’
# 1410 | uint32_t new_fbd_flags = prepare_fb_desc(cmdbuf, &ir_fbinfos[ir_pass], 0,
# | ^~~~~~~~~~~~~
# 1408|
# 1409| /* Construct our temporary full IR FBD */
# 1410|-> uint32_t new_fbd_flags = prepare_fb_desc(cmdbuf, &ir_fbinfos[ir_pass], 0,
# 1411| scratch_fbd_init_memory);
# 1412| /* Make sure all FBDs have the same flags. */
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:2240:9: warning[-Wunused-variable]: unused variable ‘idvs’
# 2240 | bool idvs = vs->info.vs.idvs;
# | ^~~~
# 2238| panvk_shader_only_variant(get_fs(cmdbuf));
# 2239| struct panvk_descriptor_state *desc_state = &cmdbuf->state.gfx.desc_state;
# 2240|-> bool idvs = vs->info.vs.idvs;
# 2241| VkResult result;
# 2242|
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c: scope_hint: In function ‘prepare_draw’
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:2264:33: warning[-Wunused-variable]: unused variable ‘fbinfo’
# 2264 | const struct pan_fb_info *fbinfo = &cmdbuf->state.gfx.render.fb.info;
# | ^~~~~~
# 2262|
# 2263| if (!cmdbuf->vk.dynamic_graphics_state.rs.rasterizer_discard_enable) {
# 2264|-> const struct pan_fb_info *fbinfo = &cmdbuf->state.gfx.render.fb.info;
# 2265| uint32_t *nr_samples = &cmdbuf->state.gfx.render.fb.nr_samples;
# 2266| uint32_t rasterization_samples =
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c: scope_hint: In function ‘panvk_v10_CmdBeginRendering’
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:3031:37: warning[-Wunused-variable]: unused variable ‘state’
# 3031 | struct panvk_cmd_graphics_state *state = &cmdbuf->state.gfx;
# | ^~~~~
# 3029| {
# 3030| VK_FROM_HANDLE(panvk_cmd_buffer, cmdbuf, commandBuffer);
# 3031|-> struct panvk_cmd_graphics_state *state = &cmdbuf->state.gfx;
# 3032| bool resuming = pRenderingInfo->flags & VK_RENDERING_RESUMING_BIT;
# 3033|
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_precomp.c: scope_hint: In function ‘panvk_v10_dispatch_precomp’
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_precomp.c:25:24: warning[-Wunused-variable]: unused variable ‘supported_barriers’
# 25 | enum panlib_barrier supported_barriers =
# | ^~~~~~~~~~~~~~~~~~
# 23| size_t data_size)
# 24| {
# 25|-> enum panlib_barrier supported_barriers =
# 26| PANLIB_BARRIER_CSF_SYNC | PANLIB_BARRIER_CSF_WAIT;
# 27| assert(!(barrier & ~supported_barriers) && "Unsupported barrier flags");
Error: COMPILER_WARNING:
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_gpu_queue.c: scope_hint: In function ‘panvk_queue_submit_process_signals’
mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_gpu_queue.c:1176:8: warning[-Wunused-but-set-variable=]: variable ‘ret’ set but not used
# 1176 | int ret;
# | ^~~
# 1174| struct panvk_device *dev = submit->dev;
# 1175| struct panvk_gpu_queue *queue = submit->queue;
# 1176|-> int ret;
# 1177|
# 1178| if (!submit->signal_queue_mask)
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_draw.c: scope_hint: In function ‘prepare_draw’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_draw.c:1300:33: warning[-Wunused-variable]: unused variable ‘fbinfo’
# 1300 | const struct pan_fb_info *fbinfo = &cmdbuf->state.gfx.render.fb.info;
# | ^~~~~~
# 1298|
# 1299| if (!rs->rasterizer_discard_enable) {
# 1300|-> const struct pan_fb_info *fbinfo = &cmdbuf->state.gfx.render.fb.info;
# 1301| uint32_t *nr_samples = &cmdbuf->state.gfx.render.fb.nr_samples;
# 1302| uint32_t rasterization_samples =
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c: scope_hint: In function ‘panvk_v6_dispatch_precomp’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:23:24: warning[-Wunused-variable]: unused variable ‘supported_barriers’
# 23 | enum panlib_barrier supported_barriers =
# | ^~~~~~~~~~~~~~~~~~
# 21| size_t data_size)
# 22| {
# 23|-> enum panlib_barrier supported_barriers =
# 24| PANLIB_BARRIER_JM_BARRIER | PANLIB_BARRIER_JM_SUPPRESS_PREFETCH;
# 25| assert(!(barrier & ~supported_barriers) && "Unsupported barrier flags");
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:17:1: enter_function: entry to ‘panvk_v6_dispatch_precomp’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:55:25: call_function: calling ‘panvk_pool_descs_to_alloc_info’ from ‘panvk_v6_dispatch_precomp’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:55:25: return_function: returning to ‘panvk_v6_dispatch_precomp’ from ‘panvk_pool_descs_to_alloc_info’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:58:4: call_function: calling ‘pan_pack_work_groups_compute’ from ‘panvk_v6_dispatch_precomp’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:58:4: return_function: returning to ‘panvk_v6_dispatch_precomp’ from ‘pan_pack_work_groups_compute’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:76:4: branch_false: following ‘false’ branch...
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: branch_false: ...to here
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘panvk_v6_dispatch_precomp’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: return_function: returning to ‘panvk_v6_dispatch_precomp’ from ‘util_dynarray_grow_bytes’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*batch.jobs, 1, 8)’
# 80| }
# 81|
# 82|-> util_dynarray_append(&batch->jobs, job.cpu);
# 83|
# 84| bool job_barrier = (barrier & PANLIB_BARRIER_JM_BARRIER) != 0;
Error: COMPILER_WARNING:
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c: scope_hint: In function ‘panvk_queue_submit_batch’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c:42:8: warning[-Wunused-but-set-variable=]: variable ‘ret’ set but not used
# 42 | int ret;
# | ^~~
# 40| struct panvk_physical_device *phys_dev =
# 41| to_panvk_physical_device(dev->vk.physical);
# 42|-> int ret;
# 43|
# 44| /* Reset the batch if it's already been issued */
Error: COMPILER_WARNING:
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c: scope_hint: In function ‘panvk_queue_transfer_sync’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c:158:8: warning[-Wunused-but-set-variable=]: variable ‘ret’ set but not used
# 158 | int ret;
# | ^~~
# 156| {
# 157| struct panvk_device *dev = to_panvk_device(queue->vk.base.device);
# 158|-> int ret;
# 159|
# 160| struct drm_syncobj_handle handle = {
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c: scope_hint: In function ‘panvk_signal_event_syncobjs’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c:217:14: warning[-Wunused-variable]: unused variable ‘ret’
# 217 | int ret = pan_kmod_ioctl(dev->drm_fd, DRM_IOCTL_SYNCOBJ_RESET,
# | ^~~
# 215| .count_handles = 1};
# 216|
# 217|-> int ret = pan_kmod_ioctl(dev->drm_fd, DRM_IOCTL_SYNCOBJ_RESET,
# 218| &objs);
# 219| assert(!ret);
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c: scope_hint: In function ‘panvk_v6_QueueWaitIdle’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c:399:8: warning[-Wunused-variable]: unused variable ‘ret’
# 399 | int ret = drmSyncobjWait(dev->drm_fd, &queue->sync, 1,
# | ^~~
# 397| return VK_ERROR_DEVICE_LOST;
# 398|
# 399|-> int ret = drmSyncobjWait(dev->drm_fd, &queue->sync, 1,
# 400| INT64_MAX, DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL, NULL);
# 401| assert(!ret);
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/panvk_host_copy.c:427:42: warning[-Wunused-variable]: unused variable ‘dst_fmt’
# 427 | const struct util_format_description *dst_fmt =
# | ^~~~~~~
# 425| const struct util_format_description *src_fmt =
# 426| util_format_description(src_pfmt);
# 427|-> const struct util_format_description *dst_fmt =
# 428| util_format_description(dst_pfmt);
# 429|
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/panvk_host_copy.c: scope_hint: In function ‘panvk_copy_image_to_image’
mesa-26.0.3/src/panfrost/vulkan/panvk_host_copy.c:446:13: warning[-Wunused-variable]: unused variable ‘dst_layer_count’
# 446 | unsigned dst_layer_count =
# | ^~~~~~~~~~~~~~~
# 444| unsigned src_layer_count =
# 445| vk_image_subresource_layer_count(&src->vk, &src_subres);
# 446|-> unsigned dst_layer_count =
# 447| vk_image_subresource_layer_count(&dst->vk, &dst_subres);
# 448| /* This also is not explicitly required in the spec */
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/panvk_image.c: scope_hint: In function ‘bind_ms_images’
mesa-26.0.3/src/panfrost/vulkan/panvk_image.c:1218:22: warning[-Wunused-variable]: unused variable ‘res’
# 1218 | const VkResult res = panvk_image_bind(dev, &sub_bind_info);
# | ^~~
# 1216| };
# 1217|
# 1218|-> const VkResult res = panvk_image_bind(dev, &sub_bind_info);
# 1219| assert(res == VK_SUCCESS);
# 1220|
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/panvk_vX_descriptor_set.c:742:15: warning[-Wunused-variable]: unused variable ‘src_mutable’
# 742 | const bool src_mutable = src_binding_layout->type == VK_DESCRIPTOR_TYPE_MUTABLE_EXT;
# | ^~~~~~~~~~~
# 740| &src_set->layout->bindings[copy->srcBinding];
# 741|
# 742|-> const bool src_mutable = src_binding_layout->type == VK_DESCRIPTOR_TYPE_MUTABLE_EXT;
# 743| const bool dst_mutable = dst_binding_layout->type == VK_DESCRIPTOR_TYPE_MUTABLE_EXT;
# 744| assert(dst_binding_layout->type == src_binding_layout->type || src_mutable || dst_mutable);
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/panvk_vX_descriptor_set.c: scope_hint: In function ‘panvk_descriptor_set_copy’
mesa-26.0.3/src/panfrost/vulkan/panvk_vX_descriptor_set.c:743:15: warning[-Wunused-variable]: unused variable ‘dst_mutable’
# 743 | const bool dst_mutable = dst_binding_layout->type == VK_DESCRIPTOR_TYPE_MUTABLE_EXT;
# | ^~~~~~~~~~~
# 741|
# 742| const bool src_mutable = src_binding_layout->type == VK_DESCRIPTOR_TYPE_MUTABLE_EXT;
# 743|-> const bool dst_mutable = dst_binding_layout->type == VK_DESCRIPTOR_TYPE_MUTABLE_EXT;
# 744| assert(dst_binding_layout->type == src_binding_layout->type || src_mutable || dst_mutable);
# 745|
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c: scope_hint: In function ‘get_img_index’
mesa-26.0.3/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:857:54: warning[-Wunused-variable]: unused variable ‘bind_layout’
# 857 | const struct panvk_descriptor_set_binding_layout *bind_layout =
# | ^~~~~~~~~~~
# 855| &max_idx);
# 856|
# 857|-> const struct panvk_descriptor_set_binding_layout *bind_layout =
# 858| get_binding_layout(set, binding, ctx);
# 859| assert(bind_layout->type == VK_DESCRIPTOR_TYPE_STORAGE_IMAGE ||
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:950:13: warning[-Wunused-variable]: unused variable ‘subdesc_idx’
# 950 | uint32_t subdesc_idx = get_subdesc_idx(binding_layout, subdesc);
# | ^~~~~~~~~~~
# 948| const struct panvk_descriptor_set_binding_layout *binding_layout =
# 949| &set_layout->bindings[binding];
# 950|-> uint32_t subdesc_idx = get_subdesc_idx(binding_layout, subdesc);
# 951| uint32_t desc_stride = panvk_get_desc_stride(binding_layout);
# 952| uint32_t max_desc_stride = MAX2(
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:951:13: warning[-Wunused-variable]: unused variable ‘desc_stride’
# 951 | uint32_t desc_stride = panvk_get_desc_stride(binding_layout);
# | ^~~~~~~~~~~
# 949| &set_layout->bindings[binding];
# 950| uint32_t subdesc_idx = get_subdesc_idx(binding_layout, subdesc);
# 951|-> uint32_t desc_stride = panvk_get_desc_stride(binding_layout);
# 952| uint32_t max_desc_stride = MAX2(
# 953| binding_layout->samplers_per_desc + binding_layout->textures_per_desc, 1);
Error: COMPILER_WARNING (CWE-563):
mesa-26.0.3/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c: scope_hint: In function ‘record_binding’
mesa-26.0.3/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:952:13: warning[-Wunused-variable]: unused variable ‘max_desc_stride’
# 952 | uint32_t max_desc_stride = MAX2(
# | ^~~~~~~~~~~~~~~
# 950| uint32_t subdesc_idx = get_subdesc_idx(binding_layout, subdesc);
# 951| uint32_t desc_stride = panvk_get_desc_stride(binding_layout);
# 952|-> uint32_t max_desc_stride = MAX2(
# 953| binding_layout->samplers_per_desc + binding_layout->textures_per_desc, 1);
# 954|
Error: COMPILER_WARNING (CWE-252):
mesa-26.0.3/src/util/anon_file.c: scope_hint: In function ‘os_create_anonymous_file’
mesa-26.0.3/src/util/anon_file.c:214:13: warning[-Wunused-result]: ignoring return value of ‘asprintf’ declared with attribute ‘warn_unused_result’
# 214 | asprintf(&name, "%s/mesa-shared-%s-XXXXXX", path, debug_name);
# | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# 212|
# 213| if (debug_name)
# 214|-> asprintf(&name, "%s/mesa-shared-%s-XXXXXX", path, debug_name);
# 215| else
# 216| asprintf(&name, "%s/mesa-shared-XXXXXX", path);
Error: COMPILER_WARNING (CWE-252):
mesa-26.0.3/src/util/anon_file.c:216:13: warning[-Wunused-result]: ignoring return value of ‘asprintf’ declared with attribute ‘warn_unused_result’
# 216 | asprintf(&name, "%s/mesa-shared-XXXXXX", path);
# | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# 214| asprintf(&name, "%s/mesa-shared-%s-XXXXXX", path, debug_name);
# 215| else
# 216|-> asprintf(&name, "%s/mesa-shared-XXXXXX", path);
# 217| if (!name)
# 218| return -1;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/util/ralloc.c:877:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘header’
mesa-26.0.3/src/util/ralloc.c:891:1: enter_function: entry to ‘gc_zalloc_size’
mesa-26.0.3/src/util/ralloc.c:893:16: call_function: calling ‘gc_alloc_size’ from ‘gc_zalloc_size’
# 875| }
# 876|
# 877|-> header->flags = ctx->current_gen | IS_USED;
# 878| #ifndef NDEBUG
# 879| header->canary = GC_CANARY;
Error: CPPCHECK_WARNING (CWE-758):
mesa-26.0.3/src/util/softfloat.c:168: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 166| e = 0xff;
# 167| m = 0;
# 168|-> result.u = (s << 31) + (e << 23) + m;
# 169| result.u -= !round_increment;
# 170| return result.f;
Error: CPPCHECK_WARNING (CWE-758):
mesa-26.0.3/src/util/softfloat.c:181: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 179| e = 0;
# 180|
# 181|-> result.u = (s << 31) + (e << 23) + m;
# 182| return result.f;
# 183| }
Error: CPPCHECK_WARNING (CWE-758):
mesa-26.0.3/src/util/softfloat.c:1216: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1214| fi_type result;
# 1215| e = 0xff;
# 1216|-> result.u = (s << 31) + (e << 23) + 0x1;
# 1217| return result.f;
# 1218| }
Error: CPPCHECK_WARNING (CWE-758):
mesa-26.0.3/src/util/softfloat.c:1224: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1222| fi_type result;
# 1223| e = 0xff;
# 1224|-> result.u = (s << 31) + (e << 23) + 0x1;
# 1225| return result.f;
# 1226| }
Error: CPPCHECK_WARNING (CWE-758):
mesa-26.0.3/src/util/softfloat.c:1231: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1229| fi_type result;
# 1230| e = 0xff;
# 1231|-> result.u = (s << 31) + (e << 23) + 0;
# 1232| return result.f;
# 1233| }
Error: CPPCHECK_WARNING (CWE-758):
mesa-26.0.3/src/util/softfloat.c:1248: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1246| fi_type result;
# 1247| e = 0xff;
# 1248|-> result.u = (s << 31) + (e << 23) + 0x1;
# 1249| return result.f;
# 1250| }
Error: CPPCHECK_WARNING (CWE-758):
mesa-26.0.3/src/util/softfloat.c:1256: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1254| fi_type result;
# 1255| e = 0xff;
# 1256|-> result.u = (s << 31) + (e << 23) + 0x1;
# 1257| return result.f;
# 1258| }
Error: CPPCHECK_WARNING (CWE-758):
mesa-26.0.3/src/util/softfloat.c:1263: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1261| fi_type result;
# 1262| e = 0xff;
# 1263|-> result.u = (s << 31) + (e << 23) + 0;
# 1264| return result.f;
# 1265| }
Error: CPPCHECK_WARNING (CWE-758):
mesa-26.0.3/src/util/softfloat.c:1337: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1335| /* Return zero */
# 1336| fi_type result;
# 1337|-> result.u = (s << 31) + 0;
# 1338| return result.f;
# 1339| }
Error: CPPCHECK_WARNING (CWE-758):
mesa-26.0.3/src/util/softfloat.c:1384: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1382| e = 0xff;
# 1383| m = 0x1;
# 1384|-> result.u = (s << 31) + (e << 23) + m;
# 1385| return result.f;
# 1386| }
Error: CPPCHECK_WARNING (CWE-758):
mesa-26.0.3/src/util/softfloat.c:1391: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1389| fi_type result;
# 1390| e = 0xff;
# 1391|-> result.u = (s << 31) + (e << 23) + m;
# 1392| return result.f;
# 1393| }
Error: CPPCHECK_WARNING (CWE-758):
mesa-26.0.3/src/util/softfloat.c:1399: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1397| fi_type result;
# 1398| e = 0;
# 1399|-> result.u = (s << 31) + (e << 23) + m;
# 1400| return result.f;
# 1401| }
Error: CPPCHECK_WARNING (CWE-758):
mesa-26.0.3/src/util/softfloat.c:1408: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1406| fi_type result;
# 1407| e = 0;
# 1408|-> result.u = (s << 31) + (e << 23) + m;
# 1409| return result.f;
# 1410| }
Error: GCC_ANALYZER_WARNING (CWE-401):
mesa-26.0.3/src/util/u_dynarray.h:173:14: warning[-Wanalyzer-malloc-leak]: leak of ‘*batch.jobs.data’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:17:1: enter_function: entry to ‘panvk_v6_dispatch_precomp’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:55:25: call_function: calling ‘panvk_pool_descs_to_alloc_info’ from ‘panvk_v6_dispatch_precomp’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:55:25: return_function: returning to ‘panvk_v6_dispatch_precomp’ from ‘panvk_pool_descs_to_alloc_info’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:58:4: call_function: calling ‘pan_pack_work_groups_compute’ from ‘panvk_v6_dispatch_precomp’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:58:4: return_function: returning to ‘panvk_v6_dispatch_precomp’ from ‘pan_pack_work_groups_compute’
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:76:4: branch_false: following ‘false’ branch...
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: branch_false: ...to here
mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘panvk_v6_dispatch_precomp’
# 171|
# 172| unsigned newsize = buf->size + growbytes;
# 173|-> void *p = util_dynarray_ensure_cap(buf, newsize);
# 174| if (!p)
# 175| return NULL;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/util/u_pack_color.h:99:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’
# 97| case PIPE_FORMAT_B5G6R5_UNORM:
# 98| {
# 99|-> uc->us = ((r & 0xf8) << 8) | ((g & 0xfc) << 3) | (b >> 3);
# 100| }
# 101| return;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/util/u_pack_color.h:104:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’
# 102| case PIPE_FORMAT_B5G5R5X1_UNORM:
# 103| {
# 104|-> uc->us = ((0x80) << 8) | ((r & 0xf8) << 7) | ((g & 0xf8) << 2) | (b >> 3);
# 105| }
# 106| return;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/util/u_pack_color.h:109:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’
# 107| case PIPE_FORMAT_B5G5R5A1_UNORM:
# 108| {
# 109|-> uc->us = ((a & 0x80) << 8) | ((r & 0xf8) << 7) | ((g & 0xf8) << 2) | (b >> 3);
# 110| }
# 111| return;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/util/u_pack_color.h:114:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’
# 112| case PIPE_FORMAT_B4G4R4A4_UNORM:
# 113| {
# 114|-> uc->us = ((a & 0xf0) << 8) | ((r & 0xf0) << 4) | ((g & 0xf0) << 0) | (b >> 4);
# 115| }
# 116| return;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/util/u_pack_color.h:119:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’
# 117| case PIPE_FORMAT_A8_UNORM:
# 118| {
# 119|-> uc->ub = a;
# 120| }
# 121| return;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/util/u_pack_color.h:125:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch...
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here
mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’
# 123| case PIPE_FORMAT_I8_UNORM:
# 124| {
# 125|-> uc->ub = r;
# 126| }
# 127| return;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1798:25: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fences’
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1833:1: enter_function: entry to ‘vn_WaitForFences’
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1844:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1845:7: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1845:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1845:7: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1845:7: acquire_memory: this call could return NULL
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1846:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1849:10: branch_false: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1850:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1851:19: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1851:19: call_function: calling ‘vn_remove_signaled_fences’ from ‘vn_WaitForFences’
# 1796| uint32_t cur = 0;
# 1797| for (uint32_t i = 0; i < *count; i++) {
# 1798|-> VkResult result = vn_GetFenceStatus(device, fences[i]);
# 1799| if (result != VK_SUCCESS) {
# 1800| if (result < 0)
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1798:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1833:1: enter_function: entry to ‘vn_WaitForFences’
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1844:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1845:7: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1845:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1845:7: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1846:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1849:10: branch_false: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1850:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1851:19: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1851:19: call_function: calling ‘vn_remove_signaled_fences’ from ‘vn_WaitForFences’
# 1796| uint32_t cur = 0;
# 1797| for (uint32_t i = 0; i < *count; i++) {
# 1798|-> VkResult result = vn_GetFenceStatus(device, fences[i]);
# 1799| if (result != VK_SUCCESS) {
# 1800| if (result < 0)
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2355:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘semaphores’
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2367:1: enter_function: entry to ‘vn_WaitSemaphores’
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2376:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2377:10: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2376:8: branch_true: following ‘true’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2378:16: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2379:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2379:7: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2379:7: acquire_memory: this call could return NULL
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2380:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2380:7: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2381:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2382:7: branch_false: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2382:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2385:10: branch_false: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2386:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2387:19: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2387:19: call_function: calling ‘vn_remove_signaled_semaphores’ from ‘vn_WaitSemaphores’
# 2353| uint64_t val = 0;
# 2354| VkResult result =
# 2355|-> vn_GetSemaphoreCounterValue(device, semaphores[i], &val);
# 2356| if (result != VK_SUCCESS)
# 2357| return result;
Error: GCC_ANALYZER_WARNING (CWE-457):
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2355:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2367:1: enter_function: entry to ‘vn_WaitSemaphores’
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2376:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2377:10: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2376:8: branch_true: following ‘true’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2378:16: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2379:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2379:7: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2380:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2380:7: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2381:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2382:7: branch_false: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2382:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2385:10: branch_false: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2386:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2387:19: branch_true: ...to here
mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2387:19: call_function: calling ‘vn_remove_signaled_semaphores’ from ‘vn_WaitSemaphores’
# 2353| uint64_t val = 0;
# 2354| VkResult result =
# 2355|-> vn_GetSemaphoreCounterValue(device, semaphores[i], &val);
# 2356| if (result != VK_SUCCESS)
# 2357| return result;
Error: GCC_ANALYZER_WARNING (CWE-688):
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:827:16: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:767:28: enter_function: entry to ‘vk_cmd_enqueue_CmdPushDescriptorSet2’
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:779:7: branch_true: following ‘true’ branch (when ‘pPushDescriptorSetInfo’ is non-NULL)...
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:780:62: branch_true: ...to here
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:814:10: branch_true: following ‘true’ branch...
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:815:118: branch_true: ...to here
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:819:31: branch_true: following ‘true’ branch...
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:820:54: branch_true: ...to here
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:824:77: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_cmd_enqueue_CmdPushDescriptorSet2’
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:826:62: branch_true: ...to here
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:827:16: danger: argument 2 (‘<unknown>’) NULL where non-null expected
# 825| assert(uniform_data);
# 826| VkWriteDescriptorSetInlineUniformBlock *dst = rzalloc(ctx, VkWriteDescriptorSetInlineUniformBlock);
# 827|-> memcpy((void*)dst, uniform_data, sizeof(*uniform_data));
# 828| dst->pData = ralloc_size(ctx, uniform_data->dataSize);
# 829| memcpy((void*)dst->pData, uniform_data->pData, uniform_data->dataSize);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:870:83: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:767:28: enter_function: entry to ‘vk_cmd_enqueue_CmdPushDescriptorSet2’
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:779:7: branch_true: following ‘true’ branch (when ‘pPushDescriptorSetInfo’ is non-NULL)...
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:780:62: branch_true: ...to here
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:814:10: branch_true: following ‘true’ branch...
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:815:118: branch_true: ...to here
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:819:31: branch_true: following ‘true’ branch...
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:820:54: branch_true: ...to here
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:868:19: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_cmd_enqueue_CmdPushDescriptorSet2’
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:870:83: branch_true: ...to here
mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:870:83: danger: dereference of NULL ‘<unknown>’
# 868| vk_find_struct_const(write->pNext, WRITE_DESCRIPTOR_SET_ACCELERATION_STRUCTURE_KHR);
# 869|
# 870|-> uint32_t accel_structs_size = sizeof(VkAccelerationStructureKHR) * accel_structs->accelerationStructureCount;
# 871| VkWriteDescriptorSetAccelerationStructureKHR *write_accel_structs =
# 872| rzalloc_size(ctx, sizeof(VkWriteDescriptorSetAccelerationStructureKHR) + accel_structs_size);
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:80:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:72:1: enter_function: entry to ‘vk_sampler_border_color_value’
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:75:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:77:10: branch_true: ...to here
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:77:10: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_sampler_border_color_value’
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:79:10: branch_true: ...to here
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:79:10: branch_true: following ‘true’ branch (when ‘format_out’ is non-NULL)...
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:80:24: branch_true: ...to here
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:80:24: danger: dereference of NULL ‘<unknown>’
# 78| SAMPLER_CUSTOM_BORDER_COLOR_CREATE_INFO_EXT);
# 79| if (format_out)
# 80|-> *format_out = border_color_info->format;
# 81|
# 82| return border_color_info->customBorderColor;
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:82:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:72:1: enter_function: entry to ‘vk_sampler_border_color_value’
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:75:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:77:10: branch_true: ...to here
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:77:10: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_sampler_border_color_value’
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:79:10: branch_true: ...to here
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:79:10: branch_false: following ‘false’ branch (when ‘format_out’ is NULL)...
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:82:14: branch_false: ...to here
mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:82:14: danger: dereference of NULL ‘<unknown>’
# 80| *format_out = border_color_info->format;
# 81|
# 82|-> return border_color_info->customBorderColor;
# 83| } else {
# 84| if (format_out)
Error: GCC_ANALYZER_WARNING (CWE-415):
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:1649:19: warning[-Wanalyzer-double-free]: double-‘free’ of ‘modifiers’
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:2971:1: enter_function: entry to ‘wsi_display_surface_create_swapchain’
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:2989:25: branch_true: following ‘true’ branch (when ‘i != 10’)...
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:2990:11: branch_true: ...to here
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3007:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3010:32: branch_false: ...to here
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3016:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3021:10: branch_false: ...to here
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3022:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3029:35: branch_false: ...to here
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3030:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3033:13: branch_false: ...to here
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3035:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3037:48: branch_true: ...to here
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3036:19: call_function: calling ‘wsi_get_modifiers_for_format’ from ‘wsi_display_surface_create_swapchain’
# 1647| continue;
# 1648|
# 1649|-> modifiers = realloc(modifiers,
# 1650| (count_modifiers + 1) *
# 1651| sizeof(modifiers[0]));
Error: GCC_ANALYZER_WARNING (CWE-476):
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:1653:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘modifiers’
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:2971:1: enter_function: entry to ‘wsi_display_surface_create_swapchain’
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:2989:25: branch_true: following ‘true’ branch (when ‘i != 10’)...
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:2990:11: branch_true: ...to here
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3007:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3010:32: branch_false: ...to here
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3016:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3021:10: branch_false: ...to here
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3022:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3029:35: branch_false: ...to here
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3030:7: branch_false: following ‘false’ branch...
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3033:13: branch_false: ...to here
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3035:7: branch_true: following ‘true’ branch...
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3037:48: branch_true: ...to here
mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3036:19: call_function: calling ‘wsi_get_modifiers_for_format’ from ‘wsi_display_surface_create_swapchain’
# 1651| sizeof(modifiers[0]));
# 1652| assert(modifiers);
# 1653|-> modifiers[count_modifiers++] = mod->modifier;
# 1654| }
# 1655|