Error: COMPILER_WARNING (CWE-563): [#def1] mesa-26.0.3/src/amd/vulkan/meta/radv_meta_clear.c: scope_hint: In function ‘radv_clear_htile’ mesa-26.0.3/src/amd/vulkan/meta/radv_meta_clear.c:1140:39: warning[-Wunused-variable]: unused variable ‘pdev’ # 1140 | const struct radv_physical_device *pdev = radv_device_physical(device); # | ^~~~ # 1138| { # 1139| struct radv_device *device = radv_cmd_buffer_device(cmd_buffer); # 1140|-> const struct radv_physical_device *pdev = radv_device_physical(device); # 1141| uint32_t level_count = vk_image_subresource_level_count(&image->vk, range); # 1142| uint32_t flush_bits = 0; Error: COMPILER_WARNING (CWE-563): [#def2] mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c: scope_hint: In function ‘get_sampler_desc’ mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:221:9: warning[-Wunused-variable]: unused variable ‘indirect’ # 221 | bool indirect = nir_deref_instr_has_indirect(deref); # | ^~~~~~~~ # 219| unsigned desc_set = var->data.descriptor_set; # 220| unsigned binding_index = var->data.binding; # 221|-> bool indirect = nir_deref_instr_has_indirect(deref); # 222| # 223| struct radv_descriptor_set_layout *layout = state->layout->set[desc_set].layout; Error: GCC_ANALYZER_WARNING (CWE-476): [#def3] mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:255:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’ mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:550:1: enter_function: entry to ‘radv_nir_apply_pipeline_layout’ mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:569:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘radv_nir_apply_pipeline_layout’ mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:569:4: return_function: returning to ‘radv_nir_apply_pipeline_layout’ from ‘nir_foreach_function_with_impl_first’ mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:569:4: branch_true: following ‘true’ branch... mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:577:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)... mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:578:10: branch_true: ...to here mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:578:10: branch_true: following ‘true’ branch... mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:578:10: branch_true: ...to here mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:579:16: branch_true: following ‘true’ branch... mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:580:33: branch_true: ...to here mesa-26.0.3/src/amd/vulkan/nir/radv_nir_apply_pipeline_layout.c:580:33: call_function: calling ‘apply_layout_to_tex’ from ‘radv_nir_apply_pipeline_layout’ # 253| # 254| nir_def *index = NULL; # 255|-> while (deref->deref_type != nir_deref_type_var) { # 256| assert(deref->deref_type == nir_deref_type_array); # 257| unsigned array_size = MAX2(glsl_get_aoa_size(deref->type), 1); Error: GCC_ANALYZER_WARNING (CWE-476): [#def4] mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:52:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’ mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:26:1: enter_function: entry to ‘lower_immediate_samplers’ mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:32:29: call_function: calling ‘nir_get_tex_deref’ from ‘lower_immediate_samplers’ mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:32:29: return_function: returning to ‘lower_immediate_samplers’ from ‘nir_get_tex_deref’ mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:33:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:36:8: branch_false: ...to here mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:36:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:39:24: branch_false: ...to here mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:47:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:47:7: branch_false: ...to here mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:52:11: branch_true: following ‘true’ branch... mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:54:29: branch_true: ...to here mesa-26.0.3/src/amd/vulkan/nir/radv_nir_lower_immediate_samplers.c:52:11: danger: dereference of NULL ‘deref’ # 50| unsigned constant_index = 0; # 51| # 52|-> while (deref->deref_type != nir_deref_type_var) { # 53| assert(deref->deref_type == nir_deref_type_array); # 54| unsigned array_size = MAX2(glsl_get_aoa_size(deref->type), 1); Error: GCC_ANALYZER_WARNING (CWE-476): [#def5] mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:132:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘cases’ mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:106:40: acquire_memory: this call could return NULL mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:109:25: branch_true: following ‘true’ branch... mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:110:47: branch_true: ...to here mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:132:10: danger: ‘cases + (long unsigned int)case_count * 16’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0) # 130| # 131| if (!duplicate) { # 132|-> cases[case_count++] = (struct inlined_shader_case){ # 133| .group = group, # 134| .call_idx = handle_index, Error: GCC_ANALYZER_WARNING (CWE-688): [#def6] mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:139:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘cases’ where non-null expected mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:106:40: acquire_memory: this call could return NULL mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_common.c:139:4: danger: argument 1 (‘cases’) from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected # 137| } # 138| # 139|-> qsort(cases, case_count, sizeof(struct inlined_shader_case), compare_inlined_shader_case); # 140| # 141| /* Do not emit 'if (sbt_idx != 0) { ... }' is there are only a few cases. */ Error: GCC_ANALYZER_WARNING (CWE-476): [#def7] mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:462:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:458:1: enter_function: entry to ‘radv_nir_lower_rt_abi_monolithic’ mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:461:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘radv_nir_lower_rt_abi_monolithic’ mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:461:30: return_function: returning to ‘radv_nir_lower_rt_abi_monolithic’ from ‘nir_shader_get_entrypoint’ mesa-26.0.3/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:462:4: danger: dereference of NULL ‘nir_shader_get_entrypoint(shader)’ # 460| { # 461| nir_function_impl *impl = nir_shader_get_entrypoint(shader); # 462|-> radv_nir_init_rt_function_params(impl->function, MESA_SHADER_RAYGEN, 0, 0); # 463| # 464| nir_builder b = nir_builder_at(nir_before_impl(impl)); Error: GCC_ANALYZER_WARNING (CWE-476): [#def8] mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:801:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:786:1: enter_function: entry to ‘radv_GetPipelineExecutableStatisticsKHR’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:793:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableStatisticsKHR’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:793:7: return_function: returning to ‘radv_GetPipelineExecutableStatisticsKHR’ from ‘radv_get_shader_from_executable_index’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:801:8: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’ # 799| # 800| struct amd_stats stats = {0}; # 801|-> if (shader->statistics) # 802| stats = *shader->statistics; # 803| stats.driverhash = pipeline->pipeline_hash; Error: GCC_ANALYZER_WARNING (CWE-476): [#def9] mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:987:60: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:967:1: enter_function: entry to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:976:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:976:7: return_function: returning to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ from ‘radv_get_shader_from_executable_index’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:980:9: branch_true: following ‘true’ branch (when ‘pInternalRepresentations’ is non-NULL)... mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:980:39: branch_true: ...to here mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:983:7: branch_true: following ‘true’ branch (when ‘pInternalRepresentations < end’)... mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:984:7: branch_true: ...to here mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:987:60: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’ # 985| VK_COPY_STR(p->name, "NIR Shader(s)"); # 986| VK_COPY_STR(p->description, "The optimized NIR shader(s)"); # 987|-> if (radv_copy_representation(p->pData, &p->dataSize, shader->nir_string) != VK_SUCCESS) # 988| result = VK_INCOMPLETE; # 989| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def10] mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:1002:60: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:967:1: enter_function: entry to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:976:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:976:7: return_function: returning to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ from ‘radv_get_shader_from_executable_index’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:980:9: branch_true: following ‘true’ branch (when ‘pInternalRepresentations’ is non-NULL)... mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:980:39: branch_true: ...to here mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:983:7: branch_false: following ‘false’ branch (when ‘pInternalRepresentations >= end’)... mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:983:7: branch_false: ...to here mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:993:7: branch_true: following ‘true’ branch (when ‘end > p’)... mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:994:7: branch_true: ...to here mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:995:10: branch_true: following ‘true’ branch... mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:996:10: branch_true: ...to here mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:1002:60: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’ # 1000| VK_COPY_STR(p->description, "The ACO IR after some optimizations"); # 1001| } # 1002|-> if (radv_copy_representation(p->pData, &p->dataSize, shader->ir_string) != VK_SUCCESS) # 1003| result = VK_INCOMPLETE; # 1004| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def11] mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:1008:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:967:1: enter_function: entry to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:976:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:976:7: return_function: returning to ‘radv_GetPipelineExecutableInternalRepresentationsKHR’ from ‘radv_get_shader_from_executable_index’ mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:980:9: branch_true: following ‘true’ branch (when ‘pInternalRepresentations’ is non-NULL)... mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:980:39: branch_true: ...to here mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:983:7: branch_false: following ‘false’ branch (when ‘pInternalRepresentations >= end’)... mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:983:7: branch_false: ...to here mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:993:7: branch_false: following ‘false’ branch (when ‘end <= p’)... mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:993:7: branch_false: ...to here mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:1008:7: branch_true: following ‘true’ branch (when ‘end > p’)... mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:1008:19: branch_true: ...to here mesa-26.0.3/src/amd/vulkan/radv_pipeline.c:1008:19: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’ # 1006| # 1007| /* Disassembler */ # 1008|-> if (p < end && shader->disasm_string) { # 1009| p->isText = true; # 1010| VK_COPY_STR(p->name, "Assembly"); Error: GCC_ANALYZER_WARNING (CWE-476): [#def12] mesa-26.0.3/src/amd/vulkan/radv_radeon_winsys.h:334:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘it_probs_bo’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3536:1: enter_function: entry to ‘radv_CmdDecodeVideoKHR’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3542:8: call_function: inlined call to ‘radv_has_uvd’ from ‘radv_CmdDecodeVideoKHR’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3542:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/amd/vulkan/radv_video.c:3543:7: branch_true: ...to here mesa-26.0.3/src/amd/vulkan/radv_video.c:3543:7: call_function: calling ‘radv_uvd_decode_video’ from ‘radv_CmdDecodeVideoKHR’ # 332| radv_buffer_get_va(const struct radeon_winsys_bo *bo) # 333| { # 334|-> return bo->va; # 335| } # 336| Error: GCC_ANALYZER_WARNING (CWE-476): [#def13] mesa-26.0.3/src/amd/vulkan/radv_shader.c:2739:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘submission’ mesa-26.0.3/src/amd/vulkan/radv_shader.c:3507:1: enter_function: entry to ‘radv_create_vs_prolog’ mesa-26.0.3/src/amd/vulkan/radv_shader.c:3514:4: call_function: calling ‘radv_fill_nir_compiler_options’ from ‘radv_create_vs_prolog’ mesa-26.0.3/src/amd/vulkan/radv_shader.c:3514:4: return_function: returning to ‘radv_create_vs_prolog’ from ‘radv_fill_nir_compiler_options’ mesa-26.0.3/src/amd/vulkan/radv_shader.c:3552:13: call_function: calling ‘radv_shader_part_create’ from ‘radv_create_vs_prolog’ # 2737| uint64_t *upload_seq_out) # 2738| { # 2739|-> struct radv_cmd_stream *cs = submission->cs; # 2740| struct radeon_winsys *ws = device->ws; # 2741| VkResult result; Error: GCC_ANALYZER_WARNING (CWE-476): [#def14] mesa-26.0.3/src/amd/vulkan/radv_video.c:1662:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3432:1: enter_function: entry to ‘radv_vcn_decode_video’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3440:25: release_memory: ‘it_probs_ptr’ is NULL mesa-26.0.3/src/amd/vulkan/radv_video.c:3496:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’ # 1660| vk_video_get_h264_parameters(&vid->vk, params, frame_info, h264_pic_info, &sps, &pps); # 1661| # 1662|-> *slice_offset = h264_pic_info->pSliceOffsets[0]; # 1663| # 1664| memset(&result, 0, sizeof(result)); Error: GCC_ANALYZER_WARNING (CWE-476): [#def15] mesa-26.0.3/src/amd/vulkan/radv_video.c:1805:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3432:1: enter_function: entry to ‘radv_vcn_decode_video’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3440:25: release_memory: ‘it_probs_ptr’ is NULL mesa-26.0.3/src/amd/vulkan/radv_video.c:3496:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’ # 1803| result.sps_info_flags |= sps->flags.separate_colour_plane_flag << 8; # 1804| # 1805|-> if (!h265_pic_info->pStdPictureInfo->flags.short_term_ref_pic_set_sps_flag) { # 1806| result.sps_info_flags |= 1 << 11; # 1807| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def16] mesa-26.0.3/src/amd/vulkan/radv_video.c:1933:47: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3432:1: enter_function: entry to ‘radv_vcn_decode_video’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3440:25: release_memory: ‘it_probs_ptr’ is NULL mesa-26.0.3/src/amd/vulkan/radv_video.c:3496:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’ # 1931| const struct VkVideoDecodeVP9PictureInfoKHR *vp9_pic_info = # 1932| vk_find_struct_const(frame_info->pNext, VIDEO_DECODE_VP9_PICTURE_INFO_KHR); # 1933|-> const struct StdVideoDecodeVP9PictureInfo *std_pic_info = vp9_pic_info->pStdPictureInfo; # 1934| # 1935| const int intra_only_decoding = vid->vk.max_dpb_slots == 0; Error: GCC_ANALYZER_WARNING (CWE-476): [#def17] mesa-26.0.3/src/amd/vulkan/radv_video.c:2638:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index_dynamic_dpb’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3432:1: enter_function: entry to ‘radv_vcn_decode_video’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3496:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’ # 2636| # 2637| if (vid->dpb_type == DPB_DYNAMIC_TIER_1 || vid->dpb_type == DPB_DYNAMIC_TIER_2) { # 2638|-> index_dynamic_dpb->message_id = RDECODE_MESSAGE_DYNAMIC_DPB; # 2639| index_dynamic_dpb->offset = offset_dynamic_dpb; # 2640| index_dynamic_dpb->filled = 0; Error: GCC_ANALYZER_WARNING (CWE-476): [#def18] mesa-26.0.3/src/amd/vulkan/radv_video.c:2885:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3373:1: enter_function: entry to ‘radv_uvd_decode_video’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3381:25: release_memory: ‘it_probs_ptr’ is NULL mesa-26.0.3/src/amd/vulkan/radv_video.c:3389:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/amd/vulkan/radv_video.c:3390:7: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_uvd_decode_video’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3398:4: call_function: calling ‘ruvd_dec_message_decode’ from ‘radv_uvd_decode_video’ # 2883| vk_video_get_h264_parameters(&vid->vk, params, frame_info, h264_pic_info, &sps, &pps); # 2884| # 2885|-> *slice_offset = h264_pic_info->pSliceOffsets[0]; # 2886| # 2887| memset(&result, 0, sizeof(result)); Error: GCC_ANALYZER_WARNING (CWE-476): [#def19] mesa-26.0.3/src/amd/vulkan/radv_video.c:2885:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘it_ptr’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3373:1: enter_function: entry to ‘radv_uvd_decode_video’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3381:25: release_memory: ‘it_probs_ptr’ is NULL mesa-26.0.3/src/amd/vulkan/radv_video.c:3389:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/amd/vulkan/radv_video.c:3394:4: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_uvd_decode_video’ mesa-26.0.3/src/amd/vulkan/radv_video.c:3398:4: release_memory: ‘it_probs_ptr’ is NULL mesa-26.0.3/src/amd/vulkan/radv_video.c:3398:4: call_function: calling ‘ruvd_dec_message_decode’ from ‘radv_uvd_decode_video’ # 2883| vk_video_get_h264_parameters(&vid->vk, params, frame_info, h264_pic_info, &sps, &pps); # 2884| # 2885|-> *slice_offset = h264_pic_info->pSliceOffsets[0]; # 2886| # 2887| memset(&result, 0, sizeof(result)); Error: GCC_ANALYZER_WARNING (CWE-457): [#def20] mesa-26.0.3/src/asahi/vulkan/hk_cmd_dispatch.c:88:1: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘grid.<Ubbe0>.count[2]’ mesa-26.0.3/src/asahi/vulkan/hk_cmd_dispatch.c:154:1: enter_function: entry to ‘hk_CmdDispatchIndirect’ mesa-26.0.3/src/asahi/vulkan/hk_cmd_dispatch.c:171:4: call_function: calling ‘dispatch’ from ‘hk_CmdDispatchIndirect’ # 86| # 87| static void # 88|-> dispatch(struct hk_cmd_buffer *cmd, struct agx_grid grid) # 89| { # 90| struct hk_shader *s = hk_only_variant(cmd->state.cs.shader); Error: GCC_ANALYZER_WARNING (CWE-476): [#def21] mesa-26.0.3/src/broadcom/vulkan/v3dv_pipeline.c:1075:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘rs_info’ mesa-26.0.3/src/broadcom/vulkan/v3dv_pipeline.c:3109:1: enter_function: entry to ‘v3dv_CreateGraphicsPipelines’ mesa-26.0.3/src/broadcom/vulkan/v3dv_pipeline.c:3124:11: branch_true: following ‘true’ branch (when ‘i < count’)... mesa-26.0.3/src/broadcom/vulkan/v3dv_pipeline.c:3132:58: branch_true: ...to here mesa-26.0.3/src/broadcom/vulkan/v3dv_pipeline.c:3128:22: call_function: calling ‘graphics_pipeline_create’ from ‘v3dv_CreateGraphicsPipelines’ # 1073| assert(rs_info); # 1074| const VkPipelineRasterizationLineStateCreateInfoKHR *ls_info = # 1075|-> vk_find_struct_const(rs_info->pNext, # 1076| PIPELINE_RASTERIZATION_LINE_STATE_CREATE_INFO_KHR); # 1077| Error: GCC_ANALYZER_WARNING (CWE-476): [#def22] mesa-26.0.3/src/broadcom/vulkan/v3dv_private.h:2560:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘job’ mesa-26.0.3/src/broadcom/vulkan/v3dv_cmd_buffer.c:2013:1: enter_function: entry to ‘v3dv_job_clone_in_cmd_buffer’ mesa-26.0.3/src/broadcom/vulkan/v3dv_cmd_buffer.c:2018:7: call_function: inlined call to ‘v3dv_flag_oom’ from ‘v3dv_job_clone_in_cmd_buffer’ # 2558| } else { # 2559| assert(job); # 2560|-> if (job->cmd_buffer) # 2561| job->cmd_buffer->state.oom = true; # 2562| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def23] mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3477:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘var2_written’ mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3583:1: enter_function: entry to ‘validate_vertex_shader_executable’ mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3587:7: branch_false: following ‘false’ branch (when ‘shader’ is non-NULL)... mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3616:8: branch_false: ...to here mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3616:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3618:10: branch_true: ...to here mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3623:7: call_function: calling ‘find_assignments’ from ‘validate_vertex_shader_executable’ # 3475| *var1_written = true; # 3476| else if (var == var2) # 3477|-> *var2_written = true; # 3478| else if (var == var3) # 3479| *var3_written = true; Error: GCC_ANALYZER_WARNING (CWE-476): [#def24] mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3479:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘var3_written’ mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3583:1: enter_function: entry to ‘validate_vertex_shader_executable’ mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3587:7: branch_false: following ‘false’ branch (when ‘shader’ is non-NULL)... mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3616:8: branch_false: ...to here mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3616:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3618:10: branch_true: ...to here mesa-26.0.3/src/compiler/glsl/gl_nir_linker.c:3623:7: call_function: calling ‘find_assignments’ from ‘validate_vertex_shader_executable’ # 3477| *var2_written = true; # 3478| else if (var == var3) # 3479|-> *var3_written = true; # 3480| } # 3481| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def25] mesa-26.0.3/src/compiler/nir/nir_divergence_analysis.c:807:31: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-26.0.3/src/compiler/nir/nir_divergence_analysis.c:1595:1: enter_function: entry to ‘nir_vertex_divergence_analysis’ mesa-26.0.3/src/compiler/nir/nir_divergence_analysis.c:1600:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_vertex_divergence_analysis’ mesa-26.0.3/src/compiler/nir/nir_divergence_analysis.c:1600:4: return_function: returning to ‘nir_vertex_divergence_analysis’ from ‘nir_foreach_function_with_impl_first’ mesa-26.0.3/src/compiler/nir/nir_divergence_analysis.c:1600:4: branch_true: following ‘true’ branch... mesa-26.0.3/src/compiler/nir/nir_divergence_analysis.c:1601:7: call_function: calling ‘nir_divergence_analysis_impl’ from ‘nir_vertex_divergence_analysis’ # 805| (state->options & nir_divergence_across_subgroups)) { # 806| unsigned num_srcs = nir_intrinsic_infos[instr->intrinsic].num_srcs; # 807|-> for (unsigned i = 0; i < num_srcs; i++) { # 808| if (src_divergent(instr->src[i], state)) { # 809| is_divergent = true; Error: GCC_ANALYZER_WARNING (CWE-835): [#def26] mesa-26.0.3/src/compiler/nir/nir_dominance.c:57:11: warning[-Wanalyzer-infinite-loop]: infinite loop # 55| intersect(nir_block *b1, nir_block *b2) # 56| { # 57|-> while (b1 != b2) { # 58| /* # 59| * Note, the comparisons here are the opposite of what the paper says Error: GCC_ANALYZER_WARNING (CWE-476): [#def27] mesa-26.0.3/src/compiler/nir/nir_opt_large_constants.c:172:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/compiler/nir/nir_opt_large_constants.c:163:1: enter_function: entry to ‘build_constant_load’ mesa-26.0.3/src/compiler/nir/nir_opt_large_constants.c:166:24: call_function: calling ‘nir_deref_instr_get_variable’ from ‘build_constant_load’ mesa-26.0.3/src/compiler/nir/nir_opt_large_constants.c:166:24: return_function: returning to ‘build_constant_load’ from ‘nir_deref_instr_get_variable’ mesa-26.0.3/src/compiler/nir/nir_opt_large_constants.c:172:15: danger: dereference of NULL ‘nir_deref_instr_get_variable(deref)’ # 170| # 171| UNUSED unsigned var_size, var_align; # 172|-> size_align(var->type, &var_size, &var_align); # 173| assert(var->data.location % var_align == 0); # 174| Error: GCC_ANALYZER_WARNING (CWE-476): [#def28] mesa-26.0.3/src/compiler/spirv/vtn_opencl.c:640:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dest_type’ mesa-26.0.3/src/compiler/spirv/vtn_opencl.c:1080:1: enter_function: entry to ‘vtn_handle_opencl_instruction’ mesa-26.0.3/src/compiler/spirv/vtn_opencl.c:1234:7: call_function: calling ‘handle_instr’ from ‘vtn_handle_opencl_instruction’ # 638| return nir_copysign(nb, srcs[0], srcs[1]); # 639| case OpenCLstd_Cross: # 640|-> if (dest_type->length == 4) # 641| return nir_cross4(nb, srcs[0], srcs[1]); # 642| return nir_cross3(nb, srcs[0], srcs[1]); Error: GCC_ANALYZER_WARNING (CWE-476): [#def29] mesa-26.0.3/src/compiler/spirv/vtn_variables.c:1806:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘interface_type’ mesa-26.0.3/src/compiler/spirv/vtn_variables.c:2693:1: enter_function: entry to ‘vtn_handle_variables’ mesa-26.0.3/src/compiler/spirv/vtn_variables.c:2852:36: call_function: calling ‘vtn_pointer_value’ from ‘vtn_handle_variables’ mesa-26.0.3/src/compiler/spirv/vtn_variables.c:2852:36: return_function: returning to ‘vtn_handle_variables’ from ‘vtn_pointer_value’ mesa-26.0.3/src/compiler/spirv/vtn_variables.c:2853:35: call_function: calling ‘vtn_pointer_value’ from ‘vtn_handle_variables’ mesa-26.0.3/src/compiler/spirv/vtn_variables.c:2853:35: return_function: returning to ‘vtn_handle_variables’ from ‘vtn_pointer_value’ mesa-26.0.3/src/compiler/spirv/vtn_variables.c:2854:34: call_function: calling ‘vtn_value_to_pointer’ from ‘vtn_handle_variables’ # 1804| */ # 1805| assert(interface_type != NULL); # 1806|-> if (interface_type->base_type == vtn_base_type_accel_struct) { # 1807| mode = vtn_variable_mode_accel_struct; # 1808| nir_mode = nir_var_uniform; Error: GCC_ANALYZER_WARNING (CWE-688): [#def30] mesa-26.0.3/src/freedreno/ir3/ir3_nir.c:1204:4: warning[-Wanalyzer-null-argument]: use of NULL ‘candidate_nonspilled.mem_ctx’ where non-null expected mesa-26.0.3/src/freedreno/ir3/ir3_nir.c:1177:1: enter_function: entry to ‘ir3_filter_vars_to_scratch_single_instr_limit’ mesa-26.0.3/src/freedreno/ir3/ir3_nir.c:1181:4: call_function: inlined call to ‘util_dynarray_init’ from ‘ir3_filter_vars_to_scratch_single_instr_limit’ mesa-26.0.3/src/freedreno/ir3/ir3_nir.c:1204:4: release_memory: ‘candidate_nonspilled.mem_ctx’ is NULL mesa-26.0.3/src/freedreno/ir3/ir3_nir.c:1204:4: danger: argument 1 (‘candidate_nonspilled.data’) NULL where non-null expected # 1202| } # 1203| # 1204|-> qsort( # 1205| util_dynarray_begin(&candidate_nonspilled), # 1206| util_dynarray_num_elements(&candidate_nonspilled, const nir_variable *), Error: GCC_ANALYZER_WARNING (CWE-415): [#def31] mesa-26.0.3/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:353:4: warning[-Wanalyzer-double-free]: double-‘free’ of ‘0’ mesa-26.0.3/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:341:1: enter_function: entry to ‘pipe_loader_get_compatible_render_capable_device_fd’ mesa-26.0.3/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:345:19: call_function: calling ‘pipe_loader_get_compatible_render_capable_device_fds’ from ‘pipe_loader_get_compatible_render_capable_device_fd’ mesa-26.0.3/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:345:19: return_function: returning to ‘pipe_loader_get_compatible_render_capable_device_fd’ from ‘pipe_loader_get_compatible_render_capable_device_fds’ mesa-26.0.3/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:347:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:353:4: branch_false: ...to here mesa-26.0.3/src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:353:4: danger: second ‘free’ here # 351| } # 352| # 353|-> free(gpu_fds); # 354| # 355| return result; Error: GCC_ANALYZER_WARNING (CWE-401): [#def32] mesa-26.0.3/src/gallium/auxiliary/util/u_inlines.h:197:1: warning[-Wanalyzer-malloc-leak]: leak of ‘surface’ mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:865:1: enter_function: entry to ‘tegra_create_surface’ mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:873:14: acquire_memory: allocated here mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:874:7: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)... mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:877:19: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:879:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:884:11: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:889:4: call_function: calling ‘pipe_resource_reference’ from ‘tegra_create_surface’ mesa-26.0.3/src/gallium/drivers/tegra/tegra_context.c:889:4: return_function: returning to ‘tegra_create_surface’ from ‘pipe_resource_reference’ mesa-26.0.3/src/gallium/auxiliary/util/u_inlines.h:197:1: danger: ‘surface’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1) # 195| } # 196| *dst = src; # 197|-> } # 198| # 199| static inline void Error: GCC_ANALYZER_WARNING (CWE-401): [#def33] mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:35:4: warning[-Wanalyzer-malloc-leak]: leak of ‘*subgraph.cmdstream’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:725:1: enter_function: entry to ‘ethosu_emit_cmdstream’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:738:4: call_function: calling ‘fill_memory_accesses’ from ‘ethosu_emit_cmdstream’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:738:4: return_function: returning to ‘ethosu_emit_cmdstream’ from ‘fill_memory_accesses’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:745:4: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:749:7: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:749:7: call_function: calling ‘get_wait_dependency’ from ‘ethosu_emit_cmdstream’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:749:7: return_function: returning to ‘ethosu_emit_cmdstream’ from ‘get_wait_dependency’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:754:10: call_function: calling ‘emit_convolution’ from ‘ethosu_emit_cmdstream’ # 33| # 34| unsigned cur_size = subgraph->cursor - subgraph->cmdstream; # 35|-> subgraph->cmdstream = realloc(subgraph->cmdstream, (subgraph->cmdstream_used + 32) * sizeof(*subgraph->cmdstream)); # 36| subgraph->cursor = subgraph->cmdstream + cur_size; # 37| subgraph->cmdstream_used += 32; Error: GCC_ANALYZER_WARNING (CWE-401): [#def34] mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:36:4: warning[-Wanalyzer-malloc-leak]: leak of ‘*subgraph.cursor’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:725:1: enter_function: entry to ‘ethosu_emit_cmdstream’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:735:26: acquire_memory: allocated here mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:738:4: call_function: calling ‘fill_memory_accesses’ from ‘ethosu_emit_cmdstream’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:738:4: return_function: returning to ‘ethosu_emit_cmdstream’ from ‘fill_memory_accesses’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:742:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:743:7: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:743:7: call_function: calling ‘ethosu_ensure_cmdstream’ from ‘ethosu_emit_cmdstream’ # 34| unsigned cur_size = subgraph->cursor - subgraph->cmdstream; # 35| subgraph->cmdstream = realloc(subgraph->cmdstream, (subgraph->cmdstream_used + 32) * sizeof(*subgraph->cmdstream)); # 36|-> subgraph->cursor = subgraph->cmdstream + cur_size; # 37| subgraph->cmdstream_used += 32; # 38| } Error: GCC_ANALYZER_WARNING (CWE-401): [#def35] mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:36:4: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:725:1: enter_function: entry to ‘ethosu_emit_cmdstream’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:738:4: call_function: calling ‘fill_memory_accesses’ from ‘ethosu_emit_cmdstream’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:738:4: return_function: returning to ‘ethosu_emit_cmdstream’ from ‘fill_memory_accesses’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:745:4: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:749:7: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:749:7: call_function: calling ‘get_wait_dependency’ from ‘ethosu_emit_cmdstream’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:749:7: return_function: returning to ‘ethosu_emit_cmdstream’ from ‘get_wait_dependency’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_cmd.c:754:10: call_function: calling ‘emit_convolution’ from ‘ethosu_emit_cmdstream’ # 34| unsigned cur_size = subgraph->cursor - subgraph->cmdstream; # 35| subgraph->cmdstream = realloc(subgraph->cmdstream, (subgraph->cmdstream_used + 32) * sizeof(*subgraph->cmdstream)); # 36|-> subgraph->cursor = subgraph->cmdstream + cur_size; # 37| subgraph->cmdstream_used += 32; # 38| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def36] mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:79:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘input_weights’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:63:1: enter_function: entry to ‘fill_weights’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:71:4: call_function: calling ‘calculate_weights_strides’ from ‘fill_weights’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:71:4: return_function: returning to ‘fill_weights’ from ‘calculate_weights_strides’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:76:29: acquire_memory: this call could return NULL mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:77:20: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:78:11: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:78:10: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:79:52: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:79:10: danger: ‘input_weights + (sizetype)i * 2’ could be NULL: unchecked value from [(7)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/6) # 77| for (int i = 0; i < pipe_buffer_size(weight_rsrc); i++) { # 78| if (operation->kernel.is_signed) # 79|-> input_weights[i] = (int8_t)input_weights_8[i] - operation->kernel.zero_point; # 80| else # 81| input_weights[i] = input_weights_8[i] - operation->kernel.zero_point; Error: GCC_ANALYZER_WARNING (CWE-476): [#def37] mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:81:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘input_weights’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:63:1: enter_function: entry to ‘fill_weights’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:71:4: call_function: calling ‘calculate_weights_strides’ from ‘fill_weights’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:71:4: return_function: returning to ‘fill_weights’ from ‘calculate_weights_strides’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:76:29: acquire_memory: this call could return NULL mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:77:20: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:78:11: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:78:10: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:81:44: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_coefs.c:81:10: danger: ‘input_weights + (sizetype)i * 2’ could be NULL: unchecked value from [(7)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/6) # 79| input_weights[i] = (int8_t)input_weights_8[i] - operation->kernel.zero_point; # 80| else # 81|-> input_weights[i] = input_weights_8[i] - operation->kernel.zero_point; # 82| } # 83| pipe_buffer_unmap(subgraph->base.context, transfer_in); Error: GCC_ANALYZER_WARNING (CWE-476): [#def38] mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_ml.c:69:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ # 67| unsigned size; # 68| # 69|-> if (tensor->layout == ETHOSU_LAYOUT_NHWC) { # 70| size = tensor->shape.width * tensor->shape.height * tensor->shape.depth; # 71| } else if (tensor->layout == ETHOSU_LAYOUT_NHCWB16) { Error: COMPILER_WARNING (CWE-563): [#def39] mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_ml.c: scope_hint: In function ‘ethosu_ml_subgraph_create’ mesa-26.0.3/src/gallium/drivers/ethosu/ethosu_ml.c:222:8: warning[-Wunused-variable]: unused variable ‘ret’ # 222 | int ret = drmIoctl(screen->fd, DRM_IOCTL_ETHOSU_CMDSTREAM_BO_CREATE, &cmd_bo_create); # | ^~~ # 220| ethosu_dump_buffer((uint8_t *)subgraph->cmdstream, "cmdstream", 0, 0, 0, (subgraph->cursor - subgraph->cmdstream) * sizeof(*subgraph->cursor)); # 221| # 222|-> int ret = drmIoctl(screen->fd, DRM_IOCTL_ETHOSU_CMDSTREAM_BO_CREATE, &cmd_bo_create); # 223| assert(ret == 0); # 224| Error: CPPCHECK_WARNING (CWE-401): [#def40] mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:114: error[memleakOnRealloc]: Common realloc mistake: 'restart_pos' nulled but not freed upon failure # 112| if (restart_i == max_palettes) { # 113| max_palettes = max_palettes*2; # 114|-> restart_pos = (int*)realloc( restart_pos, max_palettes*sizeof(int) ); # 115| if (!restart_pos) { # 116| return -1; Error: CPPCHECK_WARNING (CWE-401): [#def41] mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:185: error[memleakOnRealloc]: Common realloc mistake: 'restart_pos' nulled but not freed upon failure # 183| if (restart_i == max_palettes) { # 184| max_palettes = max_palettes*2; # 185|-> restart_pos = (int*)realloc( restart_pos, max_palettes*sizeof(int) ); # 186| if (!restart_pos) { # 187| return -1; Error: GCC_ANALYZER_WARNING (CWE-401): [#def42] mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:203:1: warning[-Wanalyzer-malloc-leak]: leak of ‘restart_pos’ mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:872:5: enter_function: entry to ‘mlw_encode’ mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:887:8: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:894:22: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:894:22: call_function: calling ‘search_palette_sections’ from ‘mlw_encode’ # 201| *palette_restart_positions = (int*)realloc( restart_pos, restart_i*sizeof(int) ); # 202| return *palette_restart_positions ? restart_i : -1; # 203|-> } # 204| # 205| // Calculate frequency table Error: CPPCHECK_WARNING (CWE-401): [#def43] mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:1093: error[memleakOnRealloc]: Common realloc mistake: 'weights' nulled but not freed upon failure # 1091| // Reallocate by doubling the buffer size as needed # 1092| length *= 2; # 1093|-> weights = (int16_t*)realloc(weights, length * sizeof(int16_t)); # 1094| if (!weights) # 1095| { // Realloc failed, so exit Error: CPPCHECK_WARNING (CWE-401): [#def44] mesa-26.0.3/src/gallium/drivers/ethosu/mlw_codec/mlw_encode.c:1111: error[memleakOnRealloc]: Common realloc mistake: 'weights' nulled but not freed upon failure # 1109| # 1110| # 1111|-> weights = (int16_t*)realloc(weights, weight_cnt * sizeof(int16_t)); # 1112| if ( weights ) { # 1113| *padded_length = weight_cnt; Error: GCC_ANALYZER_WARNING (CWE-476): [#def45] mesa-26.0.3/src/gallium/drivers/etnaviv/etnaviv_ml.c:763:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘subgraph’ mesa-26.0.3/src/gallium/drivers/etnaviv/etnaviv_ml.c:752:7: branch_false: following ‘false’ branch (when ‘nn_core_count != 0’)... mesa-26.0.3/src/gallium/drivers/etnaviv/etnaviv_ml.c:757:15: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/etnaviv/etnaviv_ml.c:757:15: acquire_memory: this call could return NULL mesa-26.0.3/src/gallium/drivers/etnaviv/etnaviv_ml.c:763:4: danger: ‘subgraph’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/7/codeFlows/0/threadFlows/0/locations/2) # 761| # 762| subgraph->base.context = pcontext; # 763|-> subgraph->operations = UTIL_DYNARRAY_INIT; # 764| # 765| subgraph->tensors = UTIL_DYNARRAY_INIT; Error: GCC_ANALYZER_WARNING (CWE-416): [#def46] mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:245:4: warning[-Wanalyzer-use-after-free]: use after ‘free’ of ‘batch’ mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:598:1: enter_function: entry to ‘fd_batch_check_size’ mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:600:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:601:7: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:601:7: call_function: calling ‘fd_batch_flush’ from ‘fd_batch_check_size’ # 243| fd_screen_assert_locked(batch->ctx->screen); # 244| # 245|-> set_foreach (batch->resources, entry) { # 246| struct fd_resource *rsc = (struct fd_resource *)entry->key; # 247| _mesa_set_remove(batch->resources, entry); Error: GCC_ANALYZER_WARNING (CWE-476): [#def47] mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:317:31: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘batch’ mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:598:1: enter_function: entry to ‘fd_batch_check_size’ mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:600:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:601:7: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch.c:601:7: call_function: calling ‘fd_batch_flush’ from ‘fd_batch_check_size’ # 315| __fd_batch_destroy(struct fd_batch *batch) # 316| { # 317|-> struct fd_screen *screen = batch->ctx->screen; # 318| fd_screen_lock(screen); # 319| __fd_batch_destroy_locked(batch); Error: GCC_ANALYZER_WARNING (CWE-476): [#def48] mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch_cache.c:445:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘batch’ mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch_cache.c:560:1: enter_function: entry to ‘fd_batch_from_fb’ mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch_cache.c:582:29: call_function: calling ‘batch_from_key’ from ‘fd_batch_from_fb’ mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch_cache.c:582:29: return_function: returning to ‘fd_batch_from_fb’ from ‘batch_from_key’ mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch_cache.c:583:4: call_function: inlined call to ‘fd_screen_unlock’ from ‘fd_batch_from_fb’ mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch_cache.c:583:4: call_function: inlined call to ‘fd_screen_unlock’ from ‘fd_batch_from_fb’ mesa-26.0.3/src/gallium/drivers/freedreno/freedreno_batch_cache.c:585:4: call_function: calling ‘alloc_query_buf’ from ‘fd_batch_from_fb’ # 443| alloc_query_buf(struct fd_context *ctx, struct fd_batch *batch) # 444| { # 445|-> if (batch->query_buf) # 446| return; # 447| Error: COMPILER_WARNING (CWE-563): [#def49] mesa-26.0.3/src/gallium/drivers/panfrost/pan_cmdstream.c: scope_hint: In function ‘panfrost_emit_blend’ mesa-26.0.3/src/gallium/drivers/panfrost/pan_cmdstream.c:326:40: warning[-Wunused-variable]: unused variable ‘fs’ # 326 | struct panfrost_compiled_shader *fs = ctx->prog[MESA_SHADER_FRAGMENT]; # | ^~ # 324| # 325| #if PAN_ARCH >= 6 # 326|-> struct panfrost_compiled_shader *fs = ctx->prog[MESA_SHADER_FRAGMENT]; # 327| struct mali_internal_blend_packed *internal_blend_packed = # 328| (struct mali_internal_blend_packed *)&packed->opaque[2]; Error: COMPILER_WARNING: [#def50] mesa-26.0.3/src/gallium/drivers/panfrost/pan_context.c: scope_hint: In function ‘panfrost_fence_server_sync’ mesa-26.0.3/src/gallium/drivers/panfrost/pan_context.c:964:17: warning[-Wunused-but-set-variable=]: variable ‘ret’ set but not used # 964 | int fd = -1, ret; # | ^~~ # 962| struct panfrost_device *dev = pan_device(pctx->screen); # 963| struct panfrost_context *ctx = pan_context(pctx); # 964|-> int fd = -1, ret; # 965| assert(!value); # 966| Error: COMPILER_WARNING (CWE-563): [#def51] mesa-26.0.3/src/gallium/drivers/panfrost/pan_csf.c: scope_hint: In function ‘csf_submit_wait_and_dump’ mesa-26.0.3/src/gallium/drivers/panfrost/pan_csf.c:588:11: warning[-Wunused-variable]: unused variable ‘ret’ # 588 | int ret = # | ^~~ # 586| /* Wait so we can get errors reported back */ # 587| if (wait) { # 588|-> int ret = # 589| drmSyncobjTimelineWait(panfrost_device_fd(dev), &vm_sync_handle, # 590| &vm_sync_signal_point, 1, INT64_MAX, 0, NULL); Error: COMPILER_WARNING (CWE-563): [#def52] mesa-26.0.3/src/gallium/drivers/panfrost/pan_csf.c: scope_hint: In function ‘csf_emit_draw_state’ mesa-26.0.3/src/gallium/drivers/panfrost/pan_csf.c:1103:9: warning[-Wunused-variable]: unused variable ‘idvs’ # 1103 | bool idvs = vs->info.vs.idvs; # | ^~~~ # 1101| struct panfrost_compiled_shader *fs = ctx->prog[MESA_SHADER_FRAGMENT]; # 1102| # 1103|-> bool idvs = vs->info.vs.idvs; # 1104| bool fs_required = panfrost_fs_required( # 1105| fs, ctx->blend, &ctx->pipe_framebuffer, ctx->depth_stencil); Error: COMPILER_WARNING: [#def53] mesa-26.0.3/src/gallium/drivers/panfrost/pan_csf.c: scope_hint: In function ‘csf_cleanup_context_v10’ mesa-26.0.3/src/gallium/drivers/panfrost/pan_csf.c:1646:8: warning[-Wunused-but-set-variable=]: variable ‘ret’ set but not used # 1646 | int ret; # | ^~~ # 1644| .handle = ctx->csf.heap.handle, # 1645| }; # 1646|-> int ret; # 1647| # 1648| /* Make sure all jobs are done before destroying the heap. */ Error: COMPILER_WARNING (CWE-563): [#def54] mesa-26.0.3/src/gallium/drivers/panfrost/pan_jm.c: scope_hint: In function ‘jm_emit_tiler_desc’ mesa-26.0.3/src/gallium/drivers/panfrost/pan_jm.c:403:13: warning[-Wunused-variable]: unused variable ‘max_levels’ # 403 | unsigned max_levels = dev->tiler_features.max_levels; # | ^~~~~~~~~~ # 401| # 402| uint64_t heap = t.gpu; # 403|-> unsigned max_levels = dev->tiler_features.max_levels; # 404| assert(max_levels >= 2); # 405| Error: COMPILER_WARNING (CWE-477): [#def55] mesa-26.0.3/src/gallium/drivers/r300/r300_context.c: scope_hint: In function ‘r300_release_referenced_objects’ mesa-26.0.3/src/gallium/drivers/r300/r300_context.c:33:5: warning[-Wdeprecated-declarations]: ‘util_framebuffer_init’ is deprecated # 33 | util_framebuffer_init(&r300->context, NULL, r300->fb_cbufs, &r300->fb_zsbuf); # | ^~~~~~~~~~~~~~~~~~~~~ mesa-26.0.3/src/gallium/auxiliary/util/u_blitter.h:30: included_from: Included from here. mesa-26.0.3/src/gallium/drivers/r300/r300_context.h:13: included_from: Included from here. mesa-26.0.3/src/gallium/drivers/r300/r300_context.c:16: included_from: Included from here. mesa-26.0.3/src/gallium/auxiliary/util/u_framebuffer.h:76:1: note: declared here # 76 | util_framebuffer_init(struct pipe_context *pctx, const struct pipe_framebuffer_state *fb, struct pipe_surface **cbufs, struct pipe_surface **zsbuf); # | ^~~~~~~~~~~~~~~~~~~~~ # 31| # 32| /* Framebuffer state. */ # 33|-> util_framebuffer_init(&r300->context, NULL, r300->fb_cbufs, &r300->fb_zsbuf); # 34| util_unreference_framebuffer_state(fb); # 35| Error: COMPILER_WARNING (CWE-477): [#def56] mesa-26.0.3/src/gallium/drivers/r300/r300_context.c:33:5: warning[-Wdeprecated-declarations]: ‘util_framebuffer_init’ is deprecated # 31| # 32| /* Framebuffer state. */ # 33|-> util_framebuffer_init(&r300->context, NULL, r300->fb_cbufs, &r300->fb_zsbuf); # 34| util_unreference_framebuffer_state(fb); # 35| Error: COMPILER_WARNING (CWE-477): [#def57] mesa-26.0.3/src/gallium/drivers/r300/r300_state.c: scope_hint: In function ‘r300_set_framebuffer_state’ mesa-26.0.3/src/gallium/drivers/r300/r300_state.c:1063:5: warning[-Wdeprecated-declarations]: ‘util_framebuffer_init’ is deprecated # 1063 | util_framebuffer_init(pipe, state, r300->fb_cbufs, &r300->fb_zsbuf); # | ^~~~~~~~~~~~~~~~~~~~~ mesa-26.0.3/src/gallium/drivers/r300/r300_state.c:9: included_from: Included from here. mesa-26.0.3/src/gallium/auxiliary/util/u_framebuffer.h:76:1: note: declared here # 76 | util_framebuffer_init(struct pipe_context *pctx, const struct pipe_framebuffer_state *fb, struct pipe_surface **cbufs, struct pipe_surface **zsbuf); # | ^~~~~~~~~~~~~~~~~~~~~ # 1061| } # 1062| # 1063|-> util_framebuffer_init(pipe, state, r300->fb_cbufs, &r300->fb_zsbuf); # 1064| util_copy_framebuffer_state(r300->fb_state.state, state); # 1065| Error: COMPILER_WARNING (CWE-477): [#def58] mesa-26.0.3/src/gallium/drivers/r300/r300_state.c:1063:5: warning[-Wdeprecated-declarations]: ‘util_framebuffer_init’ is deprecated # 1061| } # 1062| # 1063|-> util_framebuffer_init(pipe, state, r300->fb_cbufs, &r300->fb_zsbuf); # 1064| util_copy_framebuffer_state(r300->fb_state.state, state); # 1065| Error: GCC_ANALYZER_WARNING (CWE-476): [#def59] mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:614:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘drm_keyblob’ mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1430:31: enter_function: entry to ‘rvcn_dec_message_decode’ mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1471:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1487:13: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1490:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1515:12: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1535:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1562:26: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1675:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1676:7: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1676:7: call_function: calling ‘set_drm_keyblob’ from ‘rvcn_dec_message_decode’ # 612| static void set_drm_keyblob(rvcn_dec_message_drm_keyblob_t *drm_keyblob, amd_secure_buffer_format *secure_buf) # 613| { # 614|-> memcpy(drm_keyblob->contentKey, secure_buf->key_blob.local_policy.wrapped_key, 16); # 615| memcpy(drm_keyblob->signature, secure_buf->key_blob.local_policy.signature, 16); # 616| memcpy(&drm_keyblob->policyIndex, secure_buf->key_blob.local_policy.native_policy.enabled_policy_index, 4); Error: GCC_ANALYZER_WARNING (CWE-476): [#def60] mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1309:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dynamic_dpb_t2’ mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2541:6: enter_function: entry to ‘send_cmd_dec’ mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2554:4: call_function: calling ‘map_msg_fb_it_probs_buf’ from ‘send_cmd_dec’ mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2554:4: return_function: returning to ‘send_cmd_dec’ from ‘map_msg_fb_it_probs_buf’ mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2555:9: call_function: calling ‘rvcn_dec_message_decode’ from ‘send_cmd_dec’ # 1307| dynamic_dpb_t2->dpbAddrLo[i] = addr; # 1308| dynamic_dpb_t2->dpbAddrHi[i] = addr >> 32; # 1309|-> ++dynamic_dpb_t2->dpbArraySize; # 1310| found = true; # 1311| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def61] mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1544:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index_drm_keyblob’ mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1471:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1487:13: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1490:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1515:12: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1535:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1544:7: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1544:7: danger: dereference of NULL ‘index_drm_keyblob’ # 1542| # 1543| if (picture->cenc) { # 1544|-> index_drm_keyblob->message_id = RDECODE_MESSAGE_DRM_KEYBLOB; # 1545| index_drm_keyblob->offset = offset_drm_keyblob; # 1546| index_drm_keyblob->size = sizeof(rvcn_dec_message_drm_keyblob_t); Error: GCC_ANALYZER_WARNING (CWE-476): [#def62] mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1552:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index_dynamic_dpb’ mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1471:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1487:13: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1490:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1515:12: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1535:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1552:7: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1552:7: danger: dereference of NULL ‘index_dynamic_dpb’ # 1550| # 1551| if (dec->dpb_type == DPB_DYNAMIC_TIER_1 || dec->dpb_type == DPB_DYNAMIC_TIER_2) { # 1552|-> index_dynamic_dpb->message_id = RDECODE_MESSAGE_DYNAMIC_DPB; # 1553| index_dynamic_dpb->offset = offset_dynamic_dpb; # 1554| index_dynamic_dpb->filled = 0; Error: GCC_ANALYZER_WARNING (CWE-476): [#def63] mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1765:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dynamic_dpb’ mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1471:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1476:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1481:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1487:13: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1490:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1496:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1502:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1515:12: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1535:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1543:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1551:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1562:26: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1675:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1679:24: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1705:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1710:4: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1751:7: branch_false: following ‘false’ branch (when ‘encrypted == 0’)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1759:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1759:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1760:7: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1762:10: branch_false: following ‘false’ branch (when ‘dpb_resize == 0’)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1765:7: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1765:7: danger: dereference of NULL ‘dynamic_dpb’ # 1763| decode->decode_flags |= RDECODE_FLAGS_DPB_RESIZE_MASK; # 1764| # 1765|-> dynamic_dpb->dpbArraySize = NUM_VP9_REFS + 1; # 1766| dynamic_dpb->dpbLumaPitch = align(dec->max_width, dec->db_alignment); # 1767| dynamic_dpb->dpbLumaAlignedHeight = align(dec->max_height, dec->db_alignment); Error: GCC_ANALYZER_WARNING (CWE-476): [#def64] mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2828:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2790:7: branch_false: following ‘false’ branch (when ‘dec’ is non-NULL)... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2793:8: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2793:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2799:4: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2800:24: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2800:4: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2828:9: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2829:67: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2829:67: release_memory: using NULL here mesa-26.0.3/src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2828:9: danger: dereference of NULL ‘*dec.ectx’ # 2826| dec->sq.engine_ib_size_of_packages = NULL; # 2827| # 2828|-> if (!ws->cs_create(&dec->cs, # 2829| (sctx->vcn_has_ctx) ? ((struct si_context *)dec->ectx)->ctx : sctx->ctx, # 2830| ring, NULL, NULL)) { Error: GCC_ANALYZER_WARNING (CWE-476): [#def65] mesa-26.0.3/src/gallium/drivers/radeonsi/si_debug.c:171:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘chunk’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_debug.c:1049:6: enter_function: entry to ‘si_log_draw_state’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_debug.c:1056:4: call_function: inlined call to ‘si_dump_compute_shader’ from ‘si_log_draw_state’ # 169| # 170| struct si_log_chunk_shader *chunk = CALLOC_STRUCT(si_log_chunk_shader); # 171|-> chunk->ctx = ctx; # 172| chunk->shader = &program->shader; # 173| si_compute_reference(&chunk->program, program); Error: GCC_ANALYZER_WARNING (CWE-476): [#def66] mesa-26.0.3/src/gallium/drivers/radeonsi/si_debug.c:751:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘chunk’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_debug.c:1049:6: enter_function: entry to ‘si_log_draw_state’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_debug.c:1064:4: call_function: calling ‘si_dump_descriptor_list’ from ‘si_log_draw_state’ # 749| struct si_log_chunk_desc_list *chunk = # 750| CALLOC_VARIANT_LENGTH_STRUCT(si_log_chunk_desc_list, 4 * (size_t)element_dw_size * num_elements); # 751|-> chunk->shader_name = shader_name; # 752| chunk->elem_name = elem_name; # 753| chunk->element_dw_size = element_dw_size; Error: COMPILER_WARNING (CWE-563): [#def67] mesa-26.0.3/src/gallium/drivers/radeonsi/si_state.c: scope_hint: In function ‘gfx11_dgpu_emit_framebuffer_state’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_state.c:2993:9: warning[-Wunused-variable]: unused variable ‘is_msaa_resolve’ # 2993 | bool is_msaa_resolve = state->nr_cbufs == 2 && # | ^~~~~~~~~~~~~~~ # 2991| struct pipe_framebuffer_state *state = &sctx->framebuffer.state; # 2992| unsigned i, nr_cbufs = state->nr_cbufs; # 2993|-> bool is_msaa_resolve = state->nr_cbufs == 2 && # 2994| state->cbufs[0].texture && state->cbufs[0].texture->nr_samples > 1 && # 2995| state->cbufs[1].texture && state->cbufs[1].texture->nr_samples <= 1; Error: COMPILER_WARNING (CWE-563): [#def68] mesa-26.0.3/src/gallium/drivers/radeonsi/si_state.c: scope_hint: In function ‘gfx12_emit_framebuffer_state’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_state.c:3140:9: warning[-Wunused-variable]: unused variable ‘is_msaa_resolve’ # 3140 | bool is_msaa_resolve = state->nr_cbufs == 2 && # | ^~~~~~~~~~~~~~~ # 3138| struct pipe_framebuffer_state *state = &sctx->framebuffer.state; # 3139| unsigned i, nr_cbufs = state->nr_cbufs; # 3140|-> bool is_msaa_resolve = state->nr_cbufs == 2 && # 3141| state->cbufs[0].texture && state->cbufs[0].texture->nr_samples > 1 && # 3142| state->cbufs[1].texture && state->cbufs[1].texture->nr_samples <= 1; Error: GCC_ANALYZER_WARNING (CWE-688): [#def69] mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:90:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘line’ where non-null expected mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:69:28: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:88:4: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:88:25: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:88:25: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:89:28: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:90:24: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:90:10: danger: argument 2 (‘line’) from [(1)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected # 88| for (unsigned z = 0; z < tex->depth0; z++) { # 89| for (unsigned y = 0; y < tex->height0; y++) # 90|-> memcpy(map + t->layer_stride * z + t->stride * y, line, line_size); # 91| } # 92| Error: GCC_ANALYZER_WARNING (CWE-476): [#def70] mesa-26.0.3/src/gallium/drivers/rocket/rkt_ml.c:310:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘subgraph’ mesa-26.0.3/src/gallium/drivers/rocket/rkt_ml.c:306:15: acquire_memory: this call could return NULL mesa-26.0.3/src/gallium/drivers/rocket/rkt_ml.c:310:4: danger: ‘subgraph’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0) # 308| # 309| tensor_count = count_tensors(poperations, count); # 310|-> subgraph->tensors = UTIL_DYNARRAY_INIT; # 311| subgraph->operations = UTIL_DYNARRAY_INIT; # 312| if (!util_dynarray_resize(&subgraph->tensors, struct pipe_resource *, Error: GCC_ANALYZER_WARNING (CWE-122): [#def71] mesa-26.0.3/src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:257:13: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read mesa-26.0.3/src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:361:1: enter_function: entry to ‘lvp_flatten_as’ mesa-26.0.3/src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:371:7: branch_false: following ‘false’ branch (when ‘child_counts’ is non-NULL)... mesa-26.0.3/src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:371:7: branch_false: ...to here mesa-26.0.3/src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:377:25: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:396:4: branch_false: ...to here mesa-26.0.3/src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:398:4: call_function: calling ‘lvp_select_subtrees_to_flatten’ from ‘lvp_flatten_as’ # 255| uint32_t available_depth = 23 - depth; # 256| uint32_t allowed_child_count = 1 << available_depth; # 257|-> uint32_t child_count = child_counts[index]; # 258| bool flatten = child_count > allowed_child_count; # 259| Error: GCC_ANALYZER_WARNING (CWE-476): [#def72] mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:323:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘tensor’ mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:748:1: enter_function: entry to ‘PrepareDelegate’ mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:753:4: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:755:24: branch_false: ...to here mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:755:24: acquire_memory: this call could return NULL mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:757:20: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:758:7: branch_true: ...to here mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:758:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’ # 321| tensor->resource = create_resource(context, tf_tensor); # 322| # 323|-> tensor->index = index; # 324| for (int out_dim = 0; out_dim < 4; out_dim++) { # 325| int in_dim = tf_tensor.dims->size - 4 + out_dim; Error: GCC_ANALYZER_WARNING (CWE-688): [#def73] mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:341:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘calloc((long unsigned int)*MEM[(const struct TfLiteAffineQuantization *)tf_tensor$quantization$params_14].scale.size, 4)’ where non-null expected mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:748:1: enter_function: entry to ‘PrepareDelegate’ mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:753:4: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:755:24: branch_false: ...to here mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:757:20: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:758:7: branch_true: ...to here mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:758:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’ # 339| (!all_scales_equal(quant) || !all_zero_points_equal(quant))) { # 340| tensor->scales = calloc(quant->scale->size, sizeof(*tensor->scales)); # 341|-> memcpy(tensor->scales, quant->scale->data, quant->scale->size * sizeof(*tensor->scales)); # 342| # 343| tensor->zero_points = calloc(quant->zero_point->size, sizeof(*tensor->zero_points)); Error: GCC_ANALYZER_WARNING (CWE-688): [#def74] mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:344:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘calloc((long unsigned int)*MEM[(const struct TfLiteAffineQuantization *)tf_tensor$quantization$params_14].zero_point.size, 4)’ where non-null expected mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:748:1: enter_function: entry to ‘PrepareDelegate’ mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:753:4: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:755:24: branch_false: ...to here mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:757:20: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:758:7: branch_true: ...to here mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:758:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’ # 342| # 343| tensor->zero_points = calloc(quant->zero_point->size, sizeof(*tensor->zero_points)); # 344|-> memcpy(tensor->zero_points, quant->zero_point->data, quant->zero_point->size * sizeof(*tensor->zero_points)); # 345| } # 346| } Error: GCC_ANALYZER_WARNING (CWE-401): [#def75] mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:771:7: warning[-Wanalyzer-malloc-leak]: leak of ‘supported_nodes’ mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:748:1: enter_function: entry to ‘PrepareDelegate’ mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:753:4: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:755:24: branch_false: ...to here mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:760:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’ mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:760:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’ mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:761:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’ mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:761:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’ mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:764:38: acquire_memory: allocated here mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:767:20: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:768:11: branch_true: ...to here mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:771:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:771:7: branch_true: ...to here mesa-26.0.3/src/gallium/frontends/teflon/tfl_device.c:771:7: danger: ‘supported_nodes’ leaks here; was allocated at [(24)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/23) # 769| bool supported = false; # 770| TfLiteRegistration *registration; # 771|-> TF_LITE_ENSURE_STATUS(tf_context->GetNodeAndRegistration( # 772| tf_context, node_index, &node, ®istration)); # 773| Error: GCC_ANALYZER_WARNING (CWE-457): [#def76] mesa-26.0.3/src/intel/blorp/blorp_genX_exec_brw.h:1352:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘surface_offsets[1]’ mesa-26.0.3/src/intel/vulkan/genX_blorp_exec.c:530:1: enter_function: entry to ‘gfx9_blorp_exec’ mesa-26.0.3/src/intel/vulkan/genX_blorp_exec.c:549:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/intel/vulkan/genX_blorp_exec.c:550:7: call_function: inlined call to ‘blorp_exec_on_blitter’ from ‘gfx9_blorp_exec’ # 1350| # 1351| if (params->src.enabled) { # 1352|-> blorp_emit_surface_state(batch, ¶ms->src, # 1353| params->fast_clear_op, # 1354| surface_maps[BLORP_TEXTURE_BT_INDEX], Error: GCC_ANALYZER_WARNING (CWE-457): [#def77] mesa-26.0.3/src/intel/common/mi_builder.h:458:1: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘((int64_t *)((char *)&value + offsetof(struct mi_value, <U4140>)))[1]’ mesa-26.0.3/src/intel/vulkan_hasvk/genX_query.c:1282:6: enter_function: entry to ‘gfx7_CmdWriteTimestamp2’ mesa-26.0.3/src/intel/vulkan_hasvk/genX_query.c:1297:7: branch_true: following ‘true’ branch (when ‘stage == 1’)... mesa-26.0.3/src/intel/vulkan_hasvk/genX_query.c:1298:7: call_function: inlined call to ‘anv_address_add’ from ‘gfx7_CmdWriteTimestamp2’ mesa-26.0.3/src/intel/vulkan_hasvk/genX_query.c:1298:7: call_function: inlined call to ‘mi_store’ from ‘gfx7_CmdWriteTimestamp2’ # 456| # 457| static inline struct mi_value # 458|-> mi_value_half(struct mi_value value, bool top_32_bits) # 459| { # 460| switch (value.type) { Error: COMPILER_WARNING (CWE-563): [#def78] mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp: scope_hint: In function ‘void emit_pixel_interpolater_alu_at_offset(const brw_builder&, const brw_reg&, const brw_reg&, glsl_interp_mode)’ mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp:2153:35: warning[-Wunused-variable]: unused variable ‘wm_prog_data’ # 2153 | const struct brw_wm_prog_data *wm_prog_data = # | ^~~~~~~~~~~~ # 2151| # 2152| const brw_fs_thread_payload &payload = shader->fs_payload(); # 2153|-> const struct brw_wm_prog_data *wm_prog_data = # 2154| brw_wm_prog_data(shader->prog_data); # 2155| Error: COMPILER_WARNING (CWE-563): [#def79] mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp: scope_hint: In function ‘void emit_pixel_interpolater_alu_at_sample(const brw_builder&, const brw_reg&, const brw_reg&, glsl_interp_mode)’ mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp:2288:35: warning[-Wunused-variable]: unused variable ‘wm_prog_data’ # 2288 | const struct brw_wm_prog_data *wm_prog_data = # | ^~~~~~~~~~~~ # 2286| { # 2287| const brw_fs_thread_payload &payload = bld.shader->fs_payload(); # 2288|-> const struct brw_wm_prog_data *wm_prog_data = # 2289| brw_wm_prog_data(bld.shader->prog_data); # 2290| const brw_builder ubld = bld.exec_all().group(16, 0); Error: COMPILER_WARNING (CWE-563): [#def80] mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp: scope_hint: In function ‘void emit_barrier(nir_to_brw_state&)’ mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp:2859:16: warning[-Wunused-variable]: unused variable ‘s’ # 2859 | brw_shader &s = ntb.s; # | ^ # 2857| const brw_builder ubld = bld.exec_all(); # 2858| const brw_builder hbld = ubld.group(8 * reg_unit(devinfo), 0); # 2859|-> brw_shader &s = ntb.s; # 2860| # 2861| /* We are getting the barrier ID from the compute shader header */ Error: COMPILER_WARNING (CWE-563): [#def81] mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp: scope_hint: In function ‘brw_reg brw_per_primitive_reg(const brw_builder&, int, unsigned int)’ mesa-26.0.3/src/intel/compiler/brw/brw_from_nir.cpp:3761:35: warning[-Wunused-variable]: unused variable ‘prog_data’ # 3761 | const struct brw_wm_prog_data *prog_data = brw_wm_prog_data(s.prog_data); # | ^~~~~~~~~ # 3759| location == VARYING_SLOT_PRIMITIVE_ID); # 3760| # 3761|-> const struct brw_wm_prog_data *prog_data = brw_wm_prog_data(s.prog_data); # 3762| # 3763| comp += (s.fs.per_primitive_offsets[location] % 16) / 4; Error: GCC_ANALYZER_WARNING (CWE-476): [#def82] mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:175:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘any_hit_impl’ mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:149:1: enter_function: entry to ‘brw_nir_lower_intersection_shader’ mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:157:7: branch_false: following ‘false’ branch (when ‘any_hit’ is NULL)... mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:164:30: branch_false: ...to here mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:164:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘brw_nir_lower_intersection_shader’ mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:164:30: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘nir_shader_get_entrypoint’ mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:166:24: call_function: inlined call to ‘nir_before_impl’ from ‘brw_nir_lower_intersection_shader’ mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:169:22: call_function: calling ‘brw_nir_rt_mem_hit_addr’ from ‘brw_nir_lower_intersection_shader’ mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:169:22: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘brw_nir_rt_mem_hit_addr’ mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:172:4: call_function: inlined call to ‘nir_imm_false’ from ‘brw_nir_lower_intersection_shader’ mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:172:4: call_function: inlined call to ‘nir_imm_false’ from ‘brw_nir_lower_intersection_shader’ mesa-26.0.3/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:175:4: danger: dereference of NULL ‘nir_shader_get_entrypoint(intersection)’ # 173| # 174| assert(impl->end_block->predecessors.entries == 1); # 175|-> set_foreach(&impl->end_block->predecessors, block_entry) { # 176| struct nir_block *block = (void *)block_entry->key; # 177| b->cursor = nir_after_block_before_jump(block); Error: COMPILER_WARNING (CWE-563): [#def83] mesa-26.0.3/src/intel/compiler/brw/brw_shader.cpp: scope_hint: In member function ‘void brw_shader::assign_curb_setup()’ mesa-26.0.3/src/intel/compiler/brw/brw_shader.cpp:672:22: warning[-Wunused-variable]: unused variable ‘n_push_data_regs’ # 672 | const unsigned n_push_data_regs = reg_unit(devinfo) * # | ^~~~~~~~~~~~~~~~ # 670| * stateless messages. # 671| */ # 672|-> const unsigned n_push_data_regs = reg_unit(devinfo) * # 673| DIV_ROUND_UP(this->push_data_size, reg_unit(devinfo) * REG_SIZE); # 674| for (unsigned i = 0; i < this->push_data_size / REG_SIZE;) { Error: GCC_ANALYZER_WARNING (CWE-476): [#def84] mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:382:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bbo’ mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:595:1: enter_function: entry to ‘anv_cmd_buffer_chain_generation_batch’ mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:603:25: release_memory: ‘new_bbo’ is NULL mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:614:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:617:37: branch_false: ...to here mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:618:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:619:7: branch_true: ...to here mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:619:7: release_memory: ‘new_bbo’ is NULL mesa-26.0.3/src/intel/vulkan/anv_batch_chain.c:619:7: call_function: calling ‘anv_batch_bo_destroy’ from ‘anv_cmd_buffer_chain_generation_batch’ # 380| { # 381| anv_reloc_list_finish(&bbo->relocs); # 382|-> ANV_DMR_BO_FREE(&cmd_buffer->vk.base, bbo->bo); # 383| anv_bo_pool_free(&cmd_buffer->device->batch_bo_pool, bbo->bo); # 384| vk_free(&cmd_buffer->vk.pool->alloc, bbo); Error: GCC_ANALYZER_WARNING (CWE-476): [#def85] mesa-26.0.3/src/intel/vulkan_hasvk/anv_allocator.c:588:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bo’ mesa-26.0.3/src/intel/vulkan_hasvk/anv_allocator.c:1114:1: enter_function: entry to ‘anv_state_pool_alloc’ mesa-26.0.3/src/intel/vulkan_hasvk/anv_allocator.c:1119:29: call_function: calling ‘anv_state_pool_alloc_no_vg’ from ‘anv_state_pool_alloc’ # 586| assert((offset - bo_offset) + size <= bo->size); # 587| # 588|-> return bo->map + (offset - bo_offset); # 589| } else { # 590| return pool->map + offset; Error: GCC_ANALYZER_WARNING (CWE-775): [#def86] mesa-26.0.3/src/loader/loader.c:257:13: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘loader_open_device(device_40->nodes[2])’ mesa-26.0.3/src/loader/loader.c:230:1: enter_function: entry to ‘loader_open_render_node_platform_devices’ mesa-26.0.3/src/loader/loader.c:241:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/loader/loader.c:246:13: branch_false: ...to here mesa-26.0.3/src/loader/loader.c:249:16: branch_true: following ‘true’ branch... mesa-26.0.3/src/loader/loader.c:250:7: branch_true: ...to here mesa-26.0.3/src/loader/loader.c:252:10: branch_true: following ‘true’ branch... mesa-26.0.3/src/loader/loader.c:253:12: branch_true: ...to here mesa-26.0.3/src/loader/loader.c:252:11: branch_true: following ‘true’ branch... mesa-26.0.3/src/loader/loader.c:256:34: branch_true: ...to here mesa-26.0.3/src/loader/loader.c:256:15: call_function: calling ‘loader_open_device’ from ‘loader_open_render_node_platform_devices’ mesa-26.0.3/src/loader/loader.c:256:15: return_function: returning to ‘loader_open_render_node_platform_devices’ from ‘loader_open_device’ mesa-26.0.3/src/loader/loader.c:257:13: danger: ‘loader_open_device(device_40->nodes[2])’ leaks here; was opened at [(12)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/11) # 255| # 256| fd = loader_open_device(device->nodes[DRM_NODE_RENDER]); # 257|-> if (fd < 0) # 258| continue; # 259| Error: COMPILER_WARNING (CWE-252): [#def87] mesa-26.0.3/src/loader/loader_wayland_helper.c: scope_hint: In function ‘loader_wayland_wrap_surface’ mesa-26.0.3/src/loader/loader_wayland_helper.c:240:4: warning[-Wunused-result]: ignoring return value of ‘asprintf’ declared with attribute ‘warn_unused_result’ # 240 | asprintf(&track_name, "wl%d presentation", lws->id); # | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # 238| wl_proxy_set_queue((struct wl_proxy *)lws->wrapper, queue); # 239| # 240|-> asprintf(&track_name, "wl%d presentation", lws->id); # 241| lws->analytics.presentation_track_id = util_perfetto_new_track(track_name); # 242| free(track_name); Error: COMPILER_WARNING (CWE-252): [#def88] mesa-26.0.3/src/loader/loader_wayland_helper.c:244:4: warning[-Wunused-result]: ignoring return value of ‘asprintf’ declared with attribute ‘warn_unused_result’ # 244 | asprintf(&lws->analytics.latency_str, "wl%d latency", lws->id); # | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # 242| free(track_name); # 243| # 244|-> asprintf(&lws->analytics.latency_str, "wl%d latency", lws->id); # 245| return true; # 246| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def89] mesa-26.0.3/src/nouveau/vulkan/nvk_cmd_draw.c:1782:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘last_vtgm’ mesa-26.0.3/src/nouveau/vulkan/nvk_cmd_draw.c:4801:1: enter_function: entry to ‘nvk_CmdDrawIndirectByteCountEXT’ mesa-26.0.3/src/nouveau/vulkan/nvk_cmd_draw.c:4812:4: call_function: calling ‘nvk_cmd_flush_gfx_state’ from ‘nvk_CmdDrawIndirectByteCountEXT’ # 1780| # 1781| assert(last_vtgm->vtgm_push_dw_count > last_vtgm->push_dw_count); # 1782|-> const uint16_t dw_start = last_vtgm->push_dw_count; # 1783| const uint16_t dw_count = last_vtgm->vtgm_push_dw_count - dw_start; # 1784| struct nv_push *p = nvk_cmd_buffer_push(cmd, dw_count); Error: GCC_ANALYZER_WARNING (CWE-688): [#def90] mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:189:16: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*a.<U9280>.sparse’ where non-null expected mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:153:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:154:16: branch_true: ...to here mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:162:13: branch_false: following ‘false’ branch... mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:169:13: branch_false: ...to here mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:173:10: branch_true: following ‘true’ branch... mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:181:13: branch_true: following ‘true’ branch... mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:183:16: branch_true: ...to here mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:185:45: acquire_memory: this call could return NULL mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:188:16: branch_true: following ‘true’ branch (when ‘left != 0’)... mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:189:16: branch_true: ...to here mesa-26.0.3/src/panfrost/compiler/bifrost/nodearray.h:189:16: danger: argument 1 (‘malloc((long unsigned int)min(max >> 2, max(*a.sparse_capacity * 2, 64)) * 8)’) from [(9)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/8) could be NULL where non-null expected # 187| # 188| if (left) # 189|-> memcpy(a->sparse, data, left * sizeof(nodearray_sparse)); # 190| } # 191| Error: COMPILER_WARNING (CWE-563): [#def91] mesa-26.0.3/src/panfrost/compiler/bifrost/valhall/va_lower_isel.c: scope_hint: In function ‘lower_swz_v4i8’ mesa-26.0.3/src/panfrost/compiler/bifrost/valhall/va_lower_isel.c:19:12: warning[-Wunused-variable]: unused variable ‘valid_swizzle’ # 19 | bool valid_swizzle = # | ^~~~~~~~~~~~~ # 17| bi_index srcs[4] = {I->src[0], I->src[0], I->src[0], I->src[0]}; # 18| unsigned channels[4]; # 19|-> bool valid_swizzle = # 20| bi_swizzle_to_byte_channels(I->src[0].swizzle, channels); # 21| assert(valid_swizzle); Error: GCC_ANALYZER_WARNING (CWE-401): [#def92] mesa-26.0.3/src/panfrost/lib/pan_encoder.h:236:1: warning[-Wanalyzer-malloc-leak]: leak of ‘*batch.jobs.data’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:17:1: enter_function: entry to ‘panvk_v6_dispatch_precomp’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:55:25: call_function: calling ‘panvk_pool_descs_to_alloc_info’ from ‘panvk_v6_dispatch_precomp’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:55:25: return_function: returning to ‘panvk_v6_dispatch_precomp’ from ‘panvk_pool_descs_to_alloc_info’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:58:4: call_function: calling ‘pan_pack_work_groups_compute’ from ‘panvk_v6_dispatch_precomp’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:58:4: return_function: returning to ‘panvk_v6_dispatch_precomp’ from ‘pan_pack_work_groups_compute’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:76:4: branch_false: following ‘false’ branch... mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: branch_false: ...to here mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘panvk_v6_dispatch_precomp’ # 234| quirk_graphics ? MALI_SPLIT_MIN_EFFICIENT : cfg.workgroups_x_shift; # 235| } # 236|-> } # 237| #endif # 238| Error: COMPILER_WARNING (CWE-563): [#def93] mesa-26.0.3/src/panfrost/lib/pan_texture.c: scope_hint: In function ‘emit_linear_or_u_tiled_chroma_2p_plane’ mesa-26.0.3/src/panfrost/lib/pan_texture.c:499:42: warning[-Wunused-variable]: unused variable ‘desc’ # 499 | const struct util_format_description *desc = # | ^~~~ # 497| unsigned layer_or_z_slice, void *payload) # 498| { # 499|-> const struct util_format_description *desc = # 500| util_format_description(iview->format); # 501| const struct pan_image_plane_ref pref1 = pan_image_view_get_plane(iview, 1); Error: COMPILER_WARNING (CWE-563): [#def94] mesa-26.0.3/src/panfrost/lib/pan_texture.c:711:42: warning[-Wunused-variable]: unused variable ‘desc’ # 711 | const struct util_format_description *desc = # | ^~~~ # 709| const struct pan_afrc_format_info finfo = # 710| pan_afrc_get_format_info(iview->format); # 711|-> const struct util_format_description *desc = # 712| util_format_description(iview->format); # 713| const struct pan_image_plane_ref pref1 = Error: COMPILER_WARNING (CWE-563): [#def95] mesa-26.0.3/src/panfrost/lib/pan_texture.c: scope_hint: In function ‘emit_afrc_chroma_2p_plane’ mesa-26.0.3/src/panfrost/lib/pan_texture.c:715:37: warning[-Wunused-variable]: unused variable ‘pref2’ # 715 | const struct pan_image_plane_ref pref2 = # | ^~~~~ # 713| const struct pan_image_plane_ref pref1 = # 714| pan_image_view_get_plane(iview, 1); # 715|-> const struct pan_image_plane_ref pref2 = # 716| pan_image_view_get_plane(iview, 2); # 717| Error: COMPILER_WARNING (CWE-563): [#def96] mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_bind_queue.c: scope_hint: In function ‘panvk_bind_queue_submit_process_signals’ mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_bind_queue.c:246:11: warning[-Wunused-variable]: unused variable ‘ret’ # 246 | int ret = drmSyncobjWait(device->drm_fd, &queue->syncobj_handle, 1, # | ^~~ # 244| # 245| if (submit->force_sync) { # 246|-> int ret = drmSyncobjWait(device->drm_fd, &queue->syncobj_handle, 1, # 247| INT64_MAX, DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL, # 248| NULL); Error: COMPILER_WARNING (CWE-563): [#def97] mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c: scope_hint: In function ‘get_tiler_desc’ mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:1042:16: warning[-Wunused-variable]: unused variable ‘max_levels’ # 1042 | unsigned max_levels = tiler_features.max_levels; # | ^~~~~~~~~~ # 1040| # 1041| pan_pack(&tiler_tmpl, TILER_CONTEXT, cfg) { # 1042|-> unsigned max_levels = tiler_features.max_levels; # 1043| assert(max_levels >= 2); # 1044| Error: COMPILER_WARNING (CWE-563): [#def98] mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c: scope_hint: In function ‘get_fb_descs’ mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:1410:16: warning[-Wunused-variable]: unused variable ‘new_fbd_flags’ # 1410 | uint32_t new_fbd_flags = prepare_fb_desc(cmdbuf, &ir_fbinfos[ir_pass], 0, # | ^~~~~~~~~~~~~ # 1408| # 1409| /* Construct our temporary full IR FBD */ # 1410|-> uint32_t new_fbd_flags = prepare_fb_desc(cmdbuf, &ir_fbinfos[ir_pass], 0, # 1411| scratch_fbd_init_memory); # 1412| /* Make sure all FBDs have the same flags. */ Error: COMPILER_WARNING (CWE-563): [#def99] mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:2240:9: warning[-Wunused-variable]: unused variable ‘idvs’ # 2240 | bool idvs = vs->info.vs.idvs; # | ^~~~ # 2238| panvk_shader_only_variant(get_fs(cmdbuf)); # 2239| struct panvk_descriptor_state *desc_state = &cmdbuf->state.gfx.desc_state; # 2240|-> bool idvs = vs->info.vs.idvs; # 2241| VkResult result; # 2242| Error: COMPILER_WARNING (CWE-563): [#def100] mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c: scope_hint: In function ‘prepare_draw’ mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:2264:33: warning[-Wunused-variable]: unused variable ‘fbinfo’ # 2264 | const struct pan_fb_info *fbinfo = &cmdbuf->state.gfx.render.fb.info; # | ^~~~~~ # 2262| # 2263| if (!cmdbuf->vk.dynamic_graphics_state.rs.rasterizer_discard_enable) { # 2264|-> const struct pan_fb_info *fbinfo = &cmdbuf->state.gfx.render.fb.info; # 2265| uint32_t *nr_samples = &cmdbuf->state.gfx.render.fb.nr_samples; # 2266| uint32_t rasterization_samples = Error: COMPILER_WARNING (CWE-563): [#def101] mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c: scope_hint: In function ‘panvk_v10_CmdBeginRendering’ mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:3031:37: warning[-Wunused-variable]: unused variable ‘state’ # 3031 | struct panvk_cmd_graphics_state *state = &cmdbuf->state.gfx; # | ^~~~~ # 3029| { # 3030| VK_FROM_HANDLE(panvk_cmd_buffer, cmdbuf, commandBuffer); # 3031|-> struct panvk_cmd_graphics_state *state = &cmdbuf->state.gfx; # 3032| bool resuming = pRenderingInfo->flags & VK_RENDERING_RESUMING_BIT; # 3033| Error: COMPILER_WARNING (CWE-563): [#def102] mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_precomp.c: scope_hint: In function ‘panvk_v10_dispatch_precomp’ mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_cmd_precomp.c:25:24: warning[-Wunused-variable]: unused variable ‘supported_barriers’ # 25 | enum panlib_barrier supported_barriers = # | ^~~~~~~~~~~~~~~~~~ # 23| size_t data_size) # 24| { # 25|-> enum panlib_barrier supported_barriers = # 26| PANLIB_BARRIER_CSF_SYNC | PANLIB_BARRIER_CSF_WAIT; # 27| assert(!(barrier & ~supported_barriers) && "Unsupported barrier flags"); Error: COMPILER_WARNING: [#def103] mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_gpu_queue.c: scope_hint: In function ‘panvk_queue_submit_process_signals’ mesa-26.0.3/src/panfrost/vulkan/csf/panvk_vX_gpu_queue.c:1176:8: warning[-Wunused-but-set-variable=]: variable ‘ret’ set but not used # 1176 | int ret; # | ^~~ # 1174| struct panvk_device *dev = submit->dev; # 1175| struct panvk_gpu_queue *queue = submit->queue; # 1176|-> int ret; # 1177| # 1178| if (!submit->signal_queue_mask) Error: COMPILER_WARNING (CWE-563): [#def104] mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_draw.c: scope_hint: In function ‘prepare_draw’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_draw.c:1300:33: warning[-Wunused-variable]: unused variable ‘fbinfo’ # 1300 | const struct pan_fb_info *fbinfo = &cmdbuf->state.gfx.render.fb.info; # | ^~~~~~ # 1298| # 1299| if (!rs->rasterizer_discard_enable) { # 1300|-> const struct pan_fb_info *fbinfo = &cmdbuf->state.gfx.render.fb.info; # 1301| uint32_t *nr_samples = &cmdbuf->state.gfx.render.fb.nr_samples; # 1302| uint32_t rasterization_samples = Error: COMPILER_WARNING (CWE-563): [#def105] mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c: scope_hint: In function ‘panvk_v6_dispatch_precomp’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:23:24: warning[-Wunused-variable]: unused variable ‘supported_barriers’ # 23 | enum panlib_barrier supported_barriers = # | ^~~~~~~~~~~~~~~~~~ # 21| size_t data_size) # 22| { # 23|-> enum panlib_barrier supported_barriers = # 24| PANLIB_BARRIER_JM_BARRIER | PANLIB_BARRIER_JM_SUPPRESS_PREFETCH; # 25| assert(!(barrier & ~supported_barriers) && "Unsupported barrier flags"); Error: GCC_ANALYZER_WARNING (CWE-476): [#def106] mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:17:1: enter_function: entry to ‘panvk_v6_dispatch_precomp’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:55:25: call_function: calling ‘panvk_pool_descs_to_alloc_info’ from ‘panvk_v6_dispatch_precomp’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:55:25: return_function: returning to ‘panvk_v6_dispatch_precomp’ from ‘panvk_pool_descs_to_alloc_info’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:58:4: call_function: calling ‘pan_pack_work_groups_compute’ from ‘panvk_v6_dispatch_precomp’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:58:4: return_function: returning to ‘panvk_v6_dispatch_precomp’ from ‘pan_pack_work_groups_compute’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:76:4: branch_false: following ‘false’ branch... mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: branch_false: ...to here mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘panvk_v6_dispatch_precomp’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: return_function: returning to ‘panvk_v6_dispatch_precomp’ from ‘util_dynarray_grow_bytes’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*batch.jobs, 1, 8)’ # 80| } # 81| # 82|-> util_dynarray_append(&batch->jobs, job.cpu); # 83| # 84| bool job_barrier = (barrier & PANLIB_BARRIER_JM_BARRIER) != 0; Error: COMPILER_WARNING: [#def107] mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c: scope_hint: In function ‘panvk_queue_submit_batch’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c:42:8: warning[-Wunused-but-set-variable=]: variable ‘ret’ set but not used # 42 | int ret; # | ^~~ # 40| struct panvk_physical_device *phys_dev = # 41| to_panvk_physical_device(dev->vk.physical); # 42|-> int ret; # 43| # 44| /* Reset the batch if it's already been issued */ Error: COMPILER_WARNING: [#def108] mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c: scope_hint: In function ‘panvk_queue_transfer_sync’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c:158:8: warning[-Wunused-but-set-variable=]: variable ‘ret’ set but not used # 158 | int ret; # | ^~~ # 156| { # 157| struct panvk_device *dev = to_panvk_device(queue->vk.base.device); # 158|-> int ret; # 159| # 160| struct drm_syncobj_handle handle = { Error: COMPILER_WARNING (CWE-563): [#def109] mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c: scope_hint: In function ‘panvk_signal_event_syncobjs’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c:217:14: warning[-Wunused-variable]: unused variable ‘ret’ # 217 | int ret = pan_kmod_ioctl(dev->drm_fd, DRM_IOCTL_SYNCOBJ_RESET, # | ^~~ # 215| .count_handles = 1}; # 216| # 217|-> int ret = pan_kmod_ioctl(dev->drm_fd, DRM_IOCTL_SYNCOBJ_RESET, # 218| &objs); # 219| assert(!ret); Error: COMPILER_WARNING (CWE-563): [#def110] mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c: scope_hint: In function ‘panvk_v6_QueueWaitIdle’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_gpu_queue.c:399:8: warning[-Wunused-variable]: unused variable ‘ret’ # 399 | int ret = drmSyncobjWait(dev->drm_fd, &queue->sync, 1, # | ^~~ # 397| return VK_ERROR_DEVICE_LOST; # 398| # 399|-> int ret = drmSyncobjWait(dev->drm_fd, &queue->sync, 1, # 400| INT64_MAX, DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL, NULL); # 401| assert(!ret); Error: COMPILER_WARNING (CWE-563): [#def111] mesa-26.0.3/src/panfrost/vulkan/panvk_host_copy.c:427:42: warning[-Wunused-variable]: unused variable ‘dst_fmt’ # 427 | const struct util_format_description *dst_fmt = # | ^~~~~~~ # 425| const struct util_format_description *src_fmt = # 426| util_format_description(src_pfmt); # 427|-> const struct util_format_description *dst_fmt = # 428| util_format_description(dst_pfmt); # 429| Error: COMPILER_WARNING (CWE-563): [#def112] mesa-26.0.3/src/panfrost/vulkan/panvk_host_copy.c: scope_hint: In function ‘panvk_copy_image_to_image’ mesa-26.0.3/src/panfrost/vulkan/panvk_host_copy.c:446:13: warning[-Wunused-variable]: unused variable ‘dst_layer_count’ # 446 | unsigned dst_layer_count = # | ^~~~~~~~~~~~~~~ # 444| unsigned src_layer_count = # 445| vk_image_subresource_layer_count(&src->vk, &src_subres); # 446|-> unsigned dst_layer_count = # 447| vk_image_subresource_layer_count(&dst->vk, &dst_subres); # 448| /* This also is not explicitly required in the spec */ Error: COMPILER_WARNING (CWE-563): [#def113] mesa-26.0.3/src/panfrost/vulkan/panvk_image.c: scope_hint: In function ‘bind_ms_images’ mesa-26.0.3/src/panfrost/vulkan/panvk_image.c:1218:22: warning[-Wunused-variable]: unused variable ‘res’ # 1218 | const VkResult res = panvk_image_bind(dev, &sub_bind_info); # | ^~~ # 1216| }; # 1217| # 1218|-> const VkResult res = panvk_image_bind(dev, &sub_bind_info); # 1219| assert(res == VK_SUCCESS); # 1220| Error: COMPILER_WARNING (CWE-563): [#def114] mesa-26.0.3/src/panfrost/vulkan/panvk_vX_descriptor_set.c:742:15: warning[-Wunused-variable]: unused variable ‘src_mutable’ # 742 | const bool src_mutable = src_binding_layout->type == VK_DESCRIPTOR_TYPE_MUTABLE_EXT; # | ^~~~~~~~~~~ # 740| &src_set->layout->bindings[copy->srcBinding]; # 741| # 742|-> const bool src_mutable = src_binding_layout->type == VK_DESCRIPTOR_TYPE_MUTABLE_EXT; # 743| const bool dst_mutable = dst_binding_layout->type == VK_DESCRIPTOR_TYPE_MUTABLE_EXT; # 744| assert(dst_binding_layout->type == src_binding_layout->type || src_mutable || dst_mutable); Error: COMPILER_WARNING (CWE-563): [#def115] mesa-26.0.3/src/panfrost/vulkan/panvk_vX_descriptor_set.c: scope_hint: In function ‘panvk_descriptor_set_copy’ mesa-26.0.3/src/panfrost/vulkan/panvk_vX_descriptor_set.c:743:15: warning[-Wunused-variable]: unused variable ‘dst_mutable’ # 743 | const bool dst_mutable = dst_binding_layout->type == VK_DESCRIPTOR_TYPE_MUTABLE_EXT; # | ^~~~~~~~~~~ # 741| # 742| const bool src_mutable = src_binding_layout->type == VK_DESCRIPTOR_TYPE_MUTABLE_EXT; # 743|-> const bool dst_mutable = dst_binding_layout->type == VK_DESCRIPTOR_TYPE_MUTABLE_EXT; # 744| assert(dst_binding_layout->type == src_binding_layout->type || src_mutable || dst_mutable); # 745| Error: COMPILER_WARNING (CWE-563): [#def116] mesa-26.0.3/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c: scope_hint: In function ‘get_img_index’ mesa-26.0.3/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:857:54: warning[-Wunused-variable]: unused variable ‘bind_layout’ # 857 | const struct panvk_descriptor_set_binding_layout *bind_layout = # | ^~~~~~~~~~~ # 855| &max_idx); # 856| # 857|-> const struct panvk_descriptor_set_binding_layout *bind_layout = # 858| get_binding_layout(set, binding, ctx); # 859| assert(bind_layout->type == VK_DESCRIPTOR_TYPE_STORAGE_IMAGE || Error: COMPILER_WARNING (CWE-563): [#def117] mesa-26.0.3/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:950:13: warning[-Wunused-variable]: unused variable ‘subdesc_idx’ # 950 | uint32_t subdesc_idx = get_subdesc_idx(binding_layout, subdesc); # | ^~~~~~~~~~~ # 948| const struct panvk_descriptor_set_binding_layout *binding_layout = # 949| &set_layout->bindings[binding]; # 950|-> uint32_t subdesc_idx = get_subdesc_idx(binding_layout, subdesc); # 951| uint32_t desc_stride = panvk_get_desc_stride(binding_layout); # 952| uint32_t max_desc_stride = MAX2( Error: COMPILER_WARNING (CWE-563): [#def118] mesa-26.0.3/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:951:13: warning[-Wunused-variable]: unused variable ‘desc_stride’ # 951 | uint32_t desc_stride = panvk_get_desc_stride(binding_layout); # | ^~~~~~~~~~~ # 949| &set_layout->bindings[binding]; # 950| uint32_t subdesc_idx = get_subdesc_idx(binding_layout, subdesc); # 951|-> uint32_t desc_stride = panvk_get_desc_stride(binding_layout); # 952| uint32_t max_desc_stride = MAX2( # 953| binding_layout->samplers_per_desc + binding_layout->textures_per_desc, 1); Error: COMPILER_WARNING (CWE-563): [#def119] mesa-26.0.3/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c: scope_hint: In function ‘record_binding’ mesa-26.0.3/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:952:13: warning[-Wunused-variable]: unused variable ‘max_desc_stride’ # 952 | uint32_t max_desc_stride = MAX2( # | ^~~~~~~~~~~~~~~ # 950| uint32_t subdesc_idx = get_subdesc_idx(binding_layout, subdesc); # 951| uint32_t desc_stride = panvk_get_desc_stride(binding_layout); # 952|-> uint32_t max_desc_stride = MAX2( # 953| binding_layout->samplers_per_desc + binding_layout->textures_per_desc, 1); # 954| Error: COMPILER_WARNING (CWE-252): [#def120] mesa-26.0.3/src/util/anon_file.c: scope_hint: In function ‘os_create_anonymous_file’ mesa-26.0.3/src/util/anon_file.c:214:13: warning[-Wunused-result]: ignoring return value of ‘asprintf’ declared with attribute ‘warn_unused_result’ # 214 | asprintf(&name, "%s/mesa-shared-%s-XXXXXX", path, debug_name); # | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # 212| # 213| if (debug_name) # 214|-> asprintf(&name, "%s/mesa-shared-%s-XXXXXX", path, debug_name); # 215| else # 216| asprintf(&name, "%s/mesa-shared-XXXXXX", path); Error: COMPILER_WARNING (CWE-252): [#def121] mesa-26.0.3/src/util/anon_file.c:216:13: warning[-Wunused-result]: ignoring return value of ‘asprintf’ declared with attribute ‘warn_unused_result’ # 216 | asprintf(&name, "%s/mesa-shared-XXXXXX", path); # | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # 214| asprintf(&name, "%s/mesa-shared-%s-XXXXXX", path, debug_name); # 215| else # 216|-> asprintf(&name, "%s/mesa-shared-XXXXXX", path); # 217| if (!name) # 218| return -1; Error: GCC_ANALYZER_WARNING (CWE-476): [#def122] mesa-26.0.3/src/util/ralloc.c:877:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘header’ mesa-26.0.3/src/util/ralloc.c:891:1: enter_function: entry to ‘gc_zalloc_size’ mesa-26.0.3/src/util/ralloc.c:893:16: call_function: calling ‘gc_alloc_size’ from ‘gc_zalloc_size’ # 875| } # 876| # 877|-> header->flags = ctx->current_gen | IS_USED; # 878| #ifndef NDEBUG # 879| header->canary = GC_CANARY; Error: CPPCHECK_WARNING (CWE-758): [#def123] mesa-26.0.3/src/util/softfloat.c:168: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 166| e = 0xff; # 167| m = 0; # 168|-> result.u = (s << 31) + (e << 23) + m; # 169| result.u -= !round_increment; # 170| return result.f; Error: CPPCHECK_WARNING (CWE-758): [#def124] mesa-26.0.3/src/util/softfloat.c:181: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 179| e = 0; # 180| # 181|-> result.u = (s << 31) + (e << 23) + m; # 182| return result.f; # 183| } Error: CPPCHECK_WARNING (CWE-758): [#def125] mesa-26.0.3/src/util/softfloat.c:1216: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 1214| fi_type result; # 1215| e = 0xff; # 1216|-> result.u = (s << 31) + (e << 23) + 0x1; # 1217| return result.f; # 1218| } Error: CPPCHECK_WARNING (CWE-758): [#def126] mesa-26.0.3/src/util/softfloat.c:1224: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 1222| fi_type result; # 1223| e = 0xff; # 1224|-> result.u = (s << 31) + (e << 23) + 0x1; # 1225| return result.f; # 1226| } Error: CPPCHECK_WARNING (CWE-758): [#def127] mesa-26.0.3/src/util/softfloat.c:1231: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 1229| fi_type result; # 1230| e = 0xff; # 1231|-> result.u = (s << 31) + (e << 23) + 0; # 1232| return result.f; # 1233| } Error: CPPCHECK_WARNING (CWE-758): [#def128] mesa-26.0.3/src/util/softfloat.c:1248: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 1246| fi_type result; # 1247| e = 0xff; # 1248|-> result.u = (s << 31) + (e << 23) + 0x1; # 1249| return result.f; # 1250| } Error: CPPCHECK_WARNING (CWE-758): [#def129] mesa-26.0.3/src/util/softfloat.c:1256: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 1254| fi_type result; # 1255| e = 0xff; # 1256|-> result.u = (s << 31) + (e << 23) + 0x1; # 1257| return result.f; # 1258| } Error: CPPCHECK_WARNING (CWE-758): [#def130] mesa-26.0.3/src/util/softfloat.c:1263: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 1261| fi_type result; # 1262| e = 0xff; # 1263|-> result.u = (s << 31) + (e << 23) + 0; # 1264| return result.f; # 1265| } Error: CPPCHECK_WARNING (CWE-758): [#def131] mesa-26.0.3/src/util/softfloat.c:1337: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 1335| /* Return zero */ # 1336| fi_type result; # 1337|-> result.u = (s << 31) + 0; # 1338| return result.f; # 1339| } Error: CPPCHECK_WARNING (CWE-758): [#def132] mesa-26.0.3/src/util/softfloat.c:1384: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 1382| e = 0xff; # 1383| m = 0x1; # 1384|-> result.u = (s << 31) + (e << 23) + m; # 1385| return result.f; # 1386| } Error: CPPCHECK_WARNING (CWE-758): [#def133] mesa-26.0.3/src/util/softfloat.c:1391: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 1389| fi_type result; # 1390| e = 0xff; # 1391|-> result.u = (s << 31) + (e << 23) + m; # 1392| return result.f; # 1393| } Error: CPPCHECK_WARNING (CWE-758): [#def134] mesa-26.0.3/src/util/softfloat.c:1399: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 1397| fi_type result; # 1398| e = 0; # 1399|-> result.u = (s << 31) + (e << 23) + m; # 1400| return result.f; # 1401| } Error: CPPCHECK_WARNING (CWE-758): [#def135] mesa-26.0.3/src/util/softfloat.c:1408: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 1406| fi_type result; # 1407| e = 0; # 1408|-> result.u = (s << 31) + (e << 23) + m; # 1409| return result.f; # 1410| } Error: GCC_ANALYZER_WARNING (CWE-401): [#def136] mesa-26.0.3/src/util/u_dynarray.h:173:14: warning[-Wanalyzer-malloc-leak]: leak of ‘*batch.jobs.data’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:17:1: enter_function: entry to ‘panvk_v6_dispatch_precomp’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:55:25: call_function: calling ‘panvk_pool_descs_to_alloc_info’ from ‘panvk_v6_dispatch_precomp’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:55:25: return_function: returning to ‘panvk_v6_dispatch_precomp’ from ‘panvk_pool_descs_to_alloc_info’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:58:4: call_function: calling ‘pan_pack_work_groups_compute’ from ‘panvk_v6_dispatch_precomp’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:58:4: return_function: returning to ‘panvk_v6_dispatch_precomp’ from ‘pan_pack_work_groups_compute’ mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:76:4: branch_false: following ‘false’ branch... mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: branch_false: ...to here mesa-26.0.3/src/panfrost/vulkan/jm/panvk_vX_cmd_precomp.c:82:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘panvk_v6_dispatch_precomp’ # 171| # 172| unsigned newsize = buf->size + growbytes; # 173|-> void *p = util_dynarray_ensure_cap(buf, newsize); # 174| if (!p) # 175| return NULL; Error: GCC_ANALYZER_WARNING (CWE-476): [#def137] mesa-26.0.3/src/util/u_pack_color.h:99:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’ # 97| case PIPE_FORMAT_B5G6R5_UNORM: # 98| { # 99|-> uc->us = ((r & 0xf8) << 8) | ((g & 0xfc) << 3) | (b >> 3); # 100| } # 101| return; Error: GCC_ANALYZER_WARNING (CWE-476): [#def138] mesa-26.0.3/src/util/u_pack_color.h:104:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’ # 102| case PIPE_FORMAT_B5G5R5X1_UNORM: # 103| { # 104|-> uc->us = ((0x80) << 8) | ((r & 0xf8) << 7) | ((g & 0xf8) << 2) | (b >> 3); # 105| } # 106| return; Error: GCC_ANALYZER_WARNING (CWE-476): [#def139] mesa-26.0.3/src/util/u_pack_color.h:109:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’ # 107| case PIPE_FORMAT_B5G5R5A1_UNORM: # 108| { # 109|-> uc->us = ((a & 0x80) << 8) | ((r & 0xf8) << 7) | ((g & 0xf8) << 2) | (b >> 3); # 110| } # 111| return; Error: GCC_ANALYZER_WARNING (CWE-476): [#def140] mesa-26.0.3/src/util/u_pack_color.h:114:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’ # 112| case PIPE_FORMAT_B4G4R4A4_UNORM: # 113| { # 114|-> uc->us = ((a & 0xf0) << 8) | ((r & 0xf0) << 4) | ((g & 0xf0) << 0) | (b >> 4); # 115| } # 116| return; Error: GCC_ANALYZER_WARNING (CWE-476): [#def141] mesa-26.0.3/src/util/u_pack_color.h:119:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’ # 117| case PIPE_FORMAT_A8_UNORM: # 118| { # 119|-> uc->ub = a; # 120| } # 121| return; Error: GCC_ANALYZER_WARNING (CWE-476): [#def142] mesa-26.0.3/src/util/u_pack_color.h:125:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘uc’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:56:13: enter_function: entry to ‘set_gradient_pixels’ mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:66:30: acquire_memory: this call could return NULL mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:68:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:15: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: following ‘false’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:75:14: branch_false: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:83:28: branch_true: following ‘true’ branch... mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:82: branch_true: ...to here mesa-26.0.3/src/gallium/drivers/radeonsi/si_test_blit_perf.c:84:10: call_function: calling ‘util_pack_color_ub’ from ‘set_gradient_pixels’ # 123| case PIPE_FORMAT_I8_UNORM: # 124| { # 125|-> uc->ub = r; # 126| } # 127| return; Error: GCC_ANALYZER_WARNING (CWE-476): [#def143] mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1798:25: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fences’ mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1833:1: enter_function: entry to ‘vn_WaitForFences’ mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1844:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1845:7: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1845:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1845:7: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1845:7: acquire_memory: this call could return NULL mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1846:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1849:10: branch_false: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1850:14: branch_true: following ‘true’ branch (when ‘result == 1’)... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1851:19: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1851:19: call_function: calling ‘vn_remove_signaled_fences’ from ‘vn_WaitForFences’ # 1796| uint32_t cur = 0; # 1797| for (uint32_t i = 0; i < *count; i++) { # 1798|-> VkResult result = vn_GetFenceStatus(device, fences[i]); # 1799| if (result != VK_SUCCESS) { # 1800| if (result < 0) Error: GCC_ANALYZER_WARNING (CWE-457): [#def144] mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1798:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’ mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1833:1: enter_function: entry to ‘vn_WaitForFences’ mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1844:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1845:7: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1845:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1845:7: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1846:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1849:10: branch_false: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1850:14: branch_true: following ‘true’ branch (when ‘result == 1’)... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1851:19: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:1851:19: call_function: calling ‘vn_remove_signaled_fences’ from ‘vn_WaitForFences’ # 1796| uint32_t cur = 0; # 1797| for (uint32_t i = 0; i < *count; i++) { # 1798|-> VkResult result = vn_GetFenceStatus(device, fences[i]); # 1799| if (result != VK_SUCCESS) { # 1800| if (result < 0) Error: GCC_ANALYZER_WARNING (CWE-476): [#def145] mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2355:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘semaphores’ mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2367:1: enter_function: entry to ‘vn_WaitSemaphores’ mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2376:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2377:10: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2376:8: branch_true: following ‘true’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2378:16: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2379:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2379:7: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2379:7: acquire_memory: this call could return NULL mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2380:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2380:7: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2381:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2382:7: branch_false: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2382:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2385:10: branch_false: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2386:14: branch_true: following ‘true’ branch (when ‘result == 1’)... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2387:19: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2387:19: call_function: calling ‘vn_remove_signaled_semaphores’ from ‘vn_WaitSemaphores’ # 2353| uint64_t val = 0; # 2354| VkResult result = # 2355|-> vn_GetSemaphoreCounterValue(device, semaphores[i], &val); # 2356| if (result != VK_SUCCESS) # 2357| return result; Error: GCC_ANALYZER_WARNING (CWE-457): [#def146] mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2355:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’ mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2367:1: enter_function: entry to ‘vn_WaitSemaphores’ mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2376:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2377:10: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2376:8: branch_true: following ‘true’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2378:16: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2379:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2379:7: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2380:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2380:7: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2381:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2382:7: branch_false: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2382:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2385:10: branch_false: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2386:14: branch_true: following ‘true’ branch (when ‘result == 1’)... mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2387:19: branch_true: ...to here mesa-26.0.3/src/virtio/vulkan/vn_queue.c:2387:19: call_function: calling ‘vn_remove_signaled_semaphores’ from ‘vn_WaitSemaphores’ # 2353| uint64_t val = 0; # 2354| VkResult result = # 2355|-> vn_GetSemaphoreCounterValue(device, semaphores[i], &val); # 2356| if (result != VK_SUCCESS) # 2357| return result; Error: GCC_ANALYZER_WARNING (CWE-688): [#def147] mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:827:16: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:767:28: enter_function: entry to ‘vk_cmd_enqueue_CmdPushDescriptorSet2’ mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:779:7: branch_true: following ‘true’ branch (when ‘pPushDescriptorSetInfo’ is non-NULL)... mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:780:62: branch_true: ...to here mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:814:10: branch_true: following ‘true’ branch... mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:815:118: branch_true: ...to here mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:819:31: branch_true: following ‘true’ branch... mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:820:54: branch_true: ...to here mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:824:77: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_cmd_enqueue_CmdPushDescriptorSet2’ mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:826:62: branch_true: ...to here mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:827:16: danger: argument 2 (‘<unknown>’) NULL where non-null expected # 825| assert(uniform_data); # 826| VkWriteDescriptorSetInlineUniformBlock *dst = rzalloc(ctx, VkWriteDescriptorSetInlineUniformBlock); # 827|-> memcpy((void*)dst, uniform_data, sizeof(*uniform_data)); # 828| dst->pData = ralloc_size(ctx, uniform_data->dataSize); # 829| memcpy((void*)dst->pData, uniform_data->pData, uniform_data->dataSize); Error: GCC_ANALYZER_WARNING (CWE-476): [#def148] mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:870:83: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:767:28: enter_function: entry to ‘vk_cmd_enqueue_CmdPushDescriptorSet2’ mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:779:7: branch_true: following ‘true’ branch (when ‘pPushDescriptorSetInfo’ is non-NULL)... mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:780:62: branch_true: ...to here mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:814:10: branch_true: following ‘true’ branch... mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:815:118: branch_true: ...to here mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:819:31: branch_true: following ‘true’ branch... mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:820:54: branch_true: ...to here mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:868:19: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_cmd_enqueue_CmdPushDescriptorSet2’ mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:870:83: branch_true: ...to here mesa-26.0.3/src/vulkan/runtime/vk_cmd_enqueue.c:870:83: danger: dereference of NULL ‘<unknown>’ # 868| vk_find_struct_const(write->pNext, WRITE_DESCRIPTOR_SET_ACCELERATION_STRUCTURE_KHR); # 869| # 870|-> uint32_t accel_structs_size = sizeof(VkAccelerationStructureKHR) * accel_structs->accelerationStructureCount; # 871| VkWriteDescriptorSetAccelerationStructureKHR *write_accel_structs = # 872| rzalloc_size(ctx, sizeof(VkWriteDescriptorSetAccelerationStructureKHR) + accel_structs_size); Error: GCC_ANALYZER_WARNING (CWE-476): [#def149] mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:80:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:72:1: enter_function: entry to ‘vk_sampler_border_color_value’ mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:75:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:77:10: branch_true: ...to here mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:77:10: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_sampler_border_color_value’ mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:79:10: branch_true: ...to here mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:79:10: branch_true: following ‘true’ branch (when ‘format_out’ is non-NULL)... mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:80:24: branch_true: ...to here mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:80:24: danger: dereference of NULL ‘<unknown>’ # 78| SAMPLER_CUSTOM_BORDER_COLOR_CREATE_INFO_EXT); # 79| if (format_out) # 80|-> *format_out = border_color_info->format; # 81| # 82| return border_color_info->customBorderColor; Error: GCC_ANALYZER_WARNING (CWE-476): [#def150] mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:82:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:72:1: enter_function: entry to ‘vk_sampler_border_color_value’ mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:75:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:77:10: branch_true: ...to here mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:77:10: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_sampler_border_color_value’ mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:79:10: branch_true: ...to here mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:79:10: branch_false: following ‘false’ branch (when ‘format_out’ is NULL)... mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:82:14: branch_false: ...to here mesa-26.0.3/src/vulkan/runtime/vk_sampler.c:82:14: danger: dereference of NULL ‘<unknown>’ # 80| *format_out = border_color_info->format; # 81| # 82|-> return border_color_info->customBorderColor; # 83| } else { # 84| if (format_out) Error: GCC_ANALYZER_WARNING (CWE-415): [#def151] mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:1649:19: warning[-Wanalyzer-double-free]: double-‘free’ of ‘modifiers’ mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:2971:1: enter_function: entry to ‘wsi_display_surface_create_swapchain’ mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:2989:25: branch_true: following ‘true’ branch (when ‘i != 10’)... mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:2990:11: branch_true: ...to here mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3007:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3010:32: branch_false: ...to here mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3016:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3021:10: branch_false: ...to here mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3022:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3029:35: branch_false: ...to here mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3030:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3033:13: branch_false: ...to here mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3035:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3037:48: branch_true: ...to here mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3036:19: call_function: calling ‘wsi_get_modifiers_for_format’ from ‘wsi_display_surface_create_swapchain’ # 1647| continue; # 1648| # 1649|-> modifiers = realloc(modifiers, # 1650| (count_modifiers + 1) * # 1651| sizeof(modifiers[0])); Error: GCC_ANALYZER_WARNING (CWE-476): [#def152] mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:1653:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘modifiers’ mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:2971:1: enter_function: entry to ‘wsi_display_surface_create_swapchain’ mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:2989:25: branch_true: following ‘true’ branch (when ‘i != 10’)... mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:2990:11: branch_true: ...to here mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3007:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3010:32: branch_false: ...to here mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3016:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3021:10: branch_false: ...to here mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3022:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3029:35: branch_false: ...to here mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3030:7: branch_false: following ‘false’ branch... mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3033:13: branch_false: ...to here mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3035:7: branch_true: following ‘true’ branch... mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3037:48: branch_true: ...to here mesa-26.0.3/src/vulkan/wsi/wsi_common_display.c:3036:19: call_function: calling ‘wsi_get_modifiers_for_format’ from ‘wsi_display_surface_create_swapchain’ # 1651| sizeof(modifiers[0])); # 1652| assert(modifiers); # 1653|-> modifiers[count_modifiers++] = mod->modifier; # 1654| } # 1655|
| analyzer-version-clippy | 1.95.0 |
| analyzer-version-cppcheck | 2.20.0 |
| analyzer-version-gcc | 16.1.1 |
| analyzer-version-gcc-analyzer | 16.1.1 |
| analyzer-version-shellcheck | 0.11.0 |
| analyzer-version-unicontrol | 0.0.2 |
| diffbase-analyzer-version-clippy | 1.95.0 |
| diffbase-analyzer-version-cppcheck | 2.20.0 |
| diffbase-analyzer-version-gcc | 16.1.1 |
| diffbase-analyzer-version-gcc-analyzer | 16.1.1 |
| diffbase-analyzer-version-shellcheck | 0.11.0 |
| diffbase-analyzer-version-unicontrol | 0.0.2 |
| diffbase-enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol |
| diffbase-exit-code | 0 |
| diffbase-host | ip-172-16-1-208.us-west-2.compute.internal |
| diffbase-known-false-positives | /usr/share/csmock/known-false-positives.js |
| diffbase-known-false-positives-rpm | known-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch |
| diffbase-mock-config | fedora-rawhide-x86_64 |
| diffbase-project-name | mesa-26.1.1-1.fc45 |
| diffbase-store-results-to | /tmp/tmpxrn63af7/mesa-26.1.1-1.fc45.tar.xz |
| diffbase-time-created | 2026-06-01 15:51:24 |
| diffbase-time-finished | 2026-06-01 16:42:29 |
| diffbase-tool | csmock |
| diffbase-tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'shellcheck,cppcheck,clippy,unicontrol,gcc' '-o' '/tmp/tmpxrn63af7/mesa-26.1.1-1.fc45.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpxrn63af7/mesa-26.1.1-1.fc45.src.rpm' |
| diffbase-tool-version | csmock-3.8.5.20260529.133039.g6f3b5c6-1.el9 |
| enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol |
| exit-code | 0 |
| host | ip-172-16-1-208.us-west-2.compute.internal |
| known-false-positives | /usr/share/csmock/known-false-positives.js |
| known-false-positives-rpm | known-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch |
| mock-config | fedora-rawhide-x86_64 |
| project-name | mesa-26.0.3-4.fc44 |
| store-results-to | /tmp/tmp7slj1i3c/mesa-26.0.3-4.fc44.tar.xz |
| time-created | 2026-06-01 15:00:07 |
| time-finished | 2026-06-01 15:49:17 |
| title | Fixed findings |
| tool | csmock |
| tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'shellcheck,cppcheck,clippy,unicontrol,gcc' '-o' '/tmp/tmp7slj1i3c/mesa-26.0.3-4.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmp7slj1i3c/mesa-26.0.3-4.fc44.src.rpm' |
| tool-version | csmock-3.8.5.20260529.133039.g6f3b5c6-1.el9 |