Newly introduced findings

List of Findings

Error: SHELLCHECK_WARNING (CWE-563): [#def1]
/usr/lib64/tclConfig.sh:16:1: warning[SC2034]: TCL_PATCH_LEVEL appears unused. Verify use (or export if used externally).
#   14|   TCL_MAJOR_VERSION='9'
#   15|   TCL_MINOR_VERSION='0'
#   16|-> TCL_PATCH_LEVEL='.3'
#   17|   
#   18|   # C compiler to use for compilation.

Error: SHELLCHECK_WARNING (CWE-563): [#def2]
/usr/lib64/tclConfig.sh:39:1: warning[SC2034]: TCL_ZIP_FILE appears unused. Verify use (or export if used externally).
#   37|   
#   38|   # The name of a zip containing the /library and /encodings (may be either a .zip file or a shared library):
#   39|-> TCL_ZIP_FILE='libtcl9.0.3.zip'
#   40|   
#   41|   # Additional libraries to use when linking Tcl.

Error: GCC_ANALYZER_WARNING (CWE-476): [#def3]
tcl9.0.3/generic/regc_cvec.c:84:5: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘cv’
tcl9.0.3/generic/regcomp.c:1690:1: enter_function: entry to ‘wordchrs’
tcl9.0.3/generic/regcomp.c:1700:12: call_function: calling ‘newstate’ from ‘wordchrs’
tcl9.0.3/generic/regcomp.c:1700:12: return_function: returning to ‘wordchrs’ from ‘newstate’
tcl9.0.3/generic/regcomp.c:1701:13: call_function: calling ‘newstate’ from ‘wordchrs’
tcl9.0.3/generic/regcomp.c:1701:13: return_function: returning to ‘wordchrs’ from ‘newstate’
tcl9.0.3/generic/regcomp.c:1702:5: branch_false: following ‘false’ branch...
tcl9.0.3/generic/regcomp.c:1708:5: branch_false: ...to here
tcl9.0.3/generic/regcomp.c:1708:5: call_function: calling ‘lexword’ from ‘wordchrs’
tcl9.0.3/generic/regcomp.c:1708:5: return_function: returning to ‘wordchrs’ from ‘lexword’
tcl9.0.3/generic/regcomp.c:1709:5: call_function: calling ‘next’ from ‘wordchrs’
tcl9.0.3/generic/regcomp.c:1709:5: return_function: returning to ‘wordchrs’ from ‘next’
tcl9.0.3/generic/regcomp.c:1710:5: branch_true: following ‘true’ branch...
tcl9.0.3/generic/regcomp.c:1711:5: call_function: calling ‘bracket’ from ‘wordchrs’
#   82|       pchr c)			/* character to add */
#   83|   {
#   84|->     assert(cv->nchrs < cv->chrspace);
#   85|       cv->chrs[cv->nchrs++] = (chr)c;
#   86|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def4]
tcl9.0.3/generic/regc_cvec.c:98:5: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘cv’
tcl9.0.3/generic/regcomp.c:1690:1: enter_function: entry to ‘wordchrs’
tcl9.0.3/generic/regcomp.c:1700:12: call_function: calling ‘newstate’ from ‘wordchrs’
tcl9.0.3/generic/regcomp.c:1700:12: return_function: returning to ‘wordchrs’ from ‘newstate’
tcl9.0.3/generic/regcomp.c:1701:13: call_function: calling ‘newstate’ from ‘wordchrs’
tcl9.0.3/generic/regcomp.c:1701:13: return_function: returning to ‘wordchrs’ from ‘newstate’
tcl9.0.3/generic/regcomp.c:1702:5: branch_false: following ‘false’ branch...
tcl9.0.3/generic/regcomp.c:1708:5: branch_false: ...to here
tcl9.0.3/generic/regcomp.c:1708:5: call_function: calling ‘lexword’ from ‘wordchrs’
tcl9.0.3/generic/regcomp.c:1708:5: return_function: returning to ‘wordchrs’ from ‘lexword’
tcl9.0.3/generic/regcomp.c:1709:5: call_function: calling ‘next’ from ‘wordchrs’
#   96|       pchr to)			/* last character of range */
#   97|   {
#   98|->     assert(cv->nranges < cv->rangespace);
#   99|       cv->ranges[cv->nranges*2] = (chr)from;
#  100|       cv->ranges[cv->nranges*2 + 1] = (chr)to;

Error: COMPILER_WARNING (CWE-569): [#def5]
tcl9.0.3/generic/tclInt.h:66: included_from: Included from here.
tcl9.0.3/generic/regex.h:4: included_from: Included from here.
tcl9.0.3/generic/regcustom.h:33: included_from: Included from here.
tcl9.0.3/generic/regguts.h:36: included_from: Included from here.
tcl9.0.3/generic/regexec.c:31: included_from: Included from here.
tcl9.0.3/generic/regexec.c: scope_hint: In function ‘TclReExec’
tcl9.0.3/generic/regexec.c:233:24: warning[-Wtype-limits]: comparison of unsigned expression in ‘>= 0’ is always true
#  233 |     assert(v->g->ntree >= 0);
#      |                        ^~
#  231|       v->stop = (chr *)string + len;
#  232|       v->err = 0;
#  233|->     assert(v->g->ntree >= 0);
#  234|       n = v->g->ntree;
#  235|       if (n <= LOCALDFAS) {

Error: CPPCHECK_WARNING (CWE-457): [#def6]
tcl9.0.3/generic/tclOODefineCmds.c:2883: error[legacyUninitvar]: Uninitialized variable: *(&listv)
# 2881|   
# 2882|       /* Prepare a set of items in the list to set */
# 2883|->     if (TclListObjGetElements(interp, list, &listc, &listv) != TCL_OK) {
# 2884|   	Tcl_DecrRefCount(list);
# 2885|   	Tcl_DecrRefCount(resolved);

Error: CPPCHECK_WARNING (CWE-457): [#def7]
tcl9.0.3/generic/tclObj.c:2111: error[uninitvar]: Uninitialized variable: cachePtr
# 2109|   	Tcl_Obj *msg;
# 2110|   
# 2111|-> 	TclNewLiteralStringObj(msg, "expected boolean value but got ");
# 2112|   
# 2113|   	Tcl_Size argc;

Error: CPPCHECK_WARNING (CWE-457): [#def8]
tcl9.0.3/generic/tclObj.c:2111: error[uninitvar]: Uninitialized variable: msg
# 2109|   	Tcl_Obj *msg;
# 2110|   
# 2111|-> 	TclNewLiteralStringObj(msg, "expected boolean value but got ");
# 2112|   
# 2113|   	Tcl_Size argc;

Scan Properties

analyzer-version-clippy1.95.0
analyzer-version-cppcheck2.20.0
analyzer-version-gcc16.1.1
analyzer-version-gcc-analyzer16.1.1
analyzer-version-shellcheck0.11.0
analyzer-version-unicontrol0.0.2
diffbase-analyzer-version-clippy1.95.0
diffbase-analyzer-version-cppcheck2.20.0
diffbase-analyzer-version-gcc16.1.1
diffbase-analyzer-version-gcc-analyzer16.1.1
diffbase-analyzer-version-shellcheck0.11.0
diffbase-analyzer-version-unicontrol0.0.2
diffbase-enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
diffbase-exit-code0
diffbase-hostip-172-16-1-117.us-west-2.compute.internal
diffbase-known-false-positives/usr/share/csmock/known-false-positives.js
diffbase-known-false-positives-rpmknown-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch
diffbase-mock-configfedora-rawhide-x86_64
diffbase-project-nametcl-9.0.2-1.fc44
diffbase-store-results-to/tmp/tmph4j_7ole/tcl-9.0.2-1.fc44.tar.xz
diffbase-time-created2026-06-01 16:58:28
diffbase-time-finished2026-06-01 17:01:52
diffbase-toolcsmock
diffbase-tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'shellcheck,cppcheck,clippy,unicontrol,gcc' '-o' '/tmp/tmph4j_7ole/tcl-9.0.2-1.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmph4j_7ole/tcl-9.0.2-1.fc44.src.rpm'
diffbase-tool-versioncsmock-3.8.5.20260529.133039.g6f3b5c6-1.el9
enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
exit-code0
hostip-172-16-1-117.us-west-2.compute.internal
known-false-positives/usr/share/csmock/known-false-positives.js
known-false-positives-rpmknown-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch
mock-configfedora-rawhide-x86_64
project-nametcl-9.0.3-1.fc45
store-results-to/tmp/tmpqqb6a8g4/tcl-9.0.3-1.fc45.tar.xz
time-created2026-06-01 17:02:13
time-finished2026-06-01 17:05:06
titleNewly introduced findings
toolcsmock
tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'shellcheck,cppcheck,clippy,unicontrol,gcc' '-o' '/tmp/tmpqqb6a8g4/tcl-9.0.3-1.fc45.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpqqb6a8g4/tcl-9.0.3-1.fc45.src.rpm'
tool-versioncsmock-3.8.5.20260529.133039.g6f3b5c6-1.el9