Error: CPPCHECK_WARNING (CWE-457): [#def1] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/include/bits/bigint.h:29: warning[uninitvar]: Uninitialized variable: value0 # 27| unsigned int size ) { # 28| bigint_t ( size ) __attribute__ (( may_alias )) *value = # 29|-> ( ( void * ) value0 ); # 30| long index; # 31| void *discard_S; Error: CPPCHECK_WARNING (CWE-457): [#def2] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/include/bits/bigint.h:144: warning[uninitvar]: Uninitialized variable: dest0 # 142| uint32_t *dest0, unsigned int dest_size ) { # 143| bigint_t ( dest_size ) __attribute__ (( may_alias )) *dest = # 144|-> ( ( void * ) dest0 ); # 145| long pad_size = ( dest_size - source_size ); # 146| void *discard_D; Error: GCC_ANALYZER_WARNING (CWE-457): [#def3] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/include/bits/bigint.h:178:9: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(<U70a0> *)&e’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/x25519.c:675:9: call_function: inlined call to ‘x25519_add’ from ‘x25519_step’ # 176| long discard_c; # 177| # 178|-> __asm__ __volatile__ ( "rep movsl\n\t" # 179| : "=&D" ( discard_D ), "=&S" ( discard_S ), # 180| "=&c" ( discard_c ), "+m" ( *dest ) Error: GCC_ANALYZER_WARNING (CWE-457): [#def4] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/include/bits/bigint.h:178:9: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(<U70a0> *)((char *)&tmp + offsetof(x25519_t, element[0]))’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/x25519.c:576:9: call_function: inlined call to ‘bigint_shrink_raw’ from ‘x25519_reduce_by’ # 176| long discard_c; # 177| # 178|-> __asm__ __volatile__ ( "rep movsl\n\t" # 179| : "=&D" ( discard_D ), "=&S" ( discard_S ), # 180| "=&c" ( discard_c ), "+m" ( *dest ) Error: GCC_ANALYZER_WARNING (CWE-457): [#def5] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/include/bits/bigint.h:178:9: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(<Ub320> *)&e’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/x25519.c:675:9: call_function: inlined call to ‘x25519_add’ from ‘x25519_step’ # 176| long discard_c; # 177| # 178|-> __asm__ __volatile__ ( "rep movsl\n\t" # 179| : "=&D" ( discard_D ), "=&S" ( discard_S ), # 180| "=&c" ( discard_c ), "+m" ( *dest ) Error: GCC_ANALYZER_WARNING (CWE-457): [#def6] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/include/bits/bigint.h:178:9: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*(<Ub320> *)((char *)&tmp + offsetof(x25519_t, element[0]))’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/x25519.c:576:9: call_function: inlined call to ‘bigint_shrink_raw’ from ‘x25519_reduce_by’ # 176| long discard_c; # 177| # 178|-> __asm__ __volatile__ ( "rep movsl\n\t" # 179| : "=&D" ( discard_D ), "=&S" ( discard_S ), # 180| "=&c" ( discard_c ), "+m" ( *dest ) Error: GCC_ANALYZER_WARNING (CWE-457): [#def7] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:113:50: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘shuf[i].src’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:102:13: enter_function: entry to ‘shuffle’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:108:9: call_function: inlined call to ‘memcpy’ from ‘shuffle’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:112:22: branch_true: following ‘true’ branch (when ‘count > i’)... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:113:50: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:113:50: danger: use of uninitialized value ‘shuf[i].src’ here # 111| /* Do the copies */ # 112| for ( i = 0; i < count; i++ ) { # 113|-> const void *src = phys_to_virt ( shuf[ i ].src ); # 114| void *dest = phys_to_virt ( shuf[ i ].dest ); # 115| Error: GCC_ANALYZER_WARNING (CWE-457): [#def8] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:118:43: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘shuf[i].len’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:102:13: enter_function: entry to ‘shuffle’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:108:9: call_function: inlined call to ‘memcpy’ from ‘shuffle’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:112:22: branch_true: following ‘true’ branch (when ‘count > i’)... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:113:50: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:116:20: branch_true: following ‘true’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:118:43: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:118:43: danger: use of uninitialized value ‘shuf[i].len’ here # 116| if ( shuf[ i ].src == 0xFFFFFFFF ) { # 117| /* Fill with 0 instead of copying */ # 118|-> memset ( dest, 0, shuf[ i ].len ); # 119| } else if ( shuf[ i ].dest == 0xFFFFFFFF ) { # 120| /* Copy new list of descriptors */ Error: GCC_ANALYZER_WARNING (CWE-457): [#def9] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:127:46: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘shuf[i].len’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:102:13: enter_function: entry to ‘shuffle’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:108:9: call_function: inlined call to ‘memcpy’ from ‘shuffle’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:112:22: branch_true: following ‘true’ branch (when ‘count > i’)... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:113:50: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:116:20: branch_false: following ‘false’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:119:27: branch_false: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:119:27: branch_false: following ‘false’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:127:46: branch_false: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/arch/x86/interface/syslinux/comboot_call.c:127:46: danger: use of uninitialized value ‘shuf[i].len’ here # 125| } else { # 126| /* Regular copy */ # 127|-> memmove ( dest, src, shuf[ i ].len ); # 128| } # 129| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def10] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/core/memmap.c:109:17: warning[-Wanalyzer-out-of-bounds]: buffer over-read ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/core/memmap.c:108:9: branch_true: following ‘true’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/core/memmap.c:109:17: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/core/memmap.c:109:17: danger: out-of-bounds read from byte 0 till byte 3 but ‘__table_entries’ ends at byte 0 # 107| /* Update descriptor to hide all in-use regions */ # 108| for_each_table_entry ( used, USED_REGIONS ) { # 109|-> memmap_update ( region, used->start, used->size, # 110| MEMMAP_FL_USED, used->name ); # 111| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def11] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/core/memmap.c:109:41: warning[-Wanalyzer-out-of-bounds]: buffer over-read ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/core/memmap.c:108:9: branch_true: following ‘true’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/core/memmap.c:109:17: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/core/memmap.c:109:41: danger: out-of-bounds read from byte 4 till byte 7 but ‘__table_entries’ ends at byte 0 # 107| /* Update descriptor to hide all in-use regions */ # 108| for_each_table_entry ( used, USED_REGIONS ) { # 109|-> memmap_update ( region, used->start, used->size, # 110| MEMMAP_FL_USED, used->name ); # 111| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def12] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/core/memmap.c:109:54: warning[-Wanalyzer-out-of-bounds]: buffer over-read ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/core/memmap.c:108:9: branch_true: following ‘true’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/core/memmap.c:109:17: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/core/memmap.c:109:54: danger: out-of-bounds read from byte 8 till byte 11 but ‘__table_entries’ ends at byte 0 # 107| /* Update descriptor to hide all in-use regions */ # 108| for_each_table_entry ( used, USED_REGIONS ) { # 109|-> memmap_update ( region, used->start, used->size, # 110| MEMMAP_FL_USED, used->name ); # 111| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def13] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/asn1.c:462:39: warning[-Wanalyzer-out-of-bounds]: buffer over-read ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/asn1.c:705:5: enter_function: entry to ‘asn1_check_algorithm’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/asn1.c:712:21: call_function: calling ‘asn1_algorithm’ from ‘asn1_check_algorithm’ # 460| int difference; # 461| # 462|-> difference = ( cursor2->len - cursor1->len ); # 463| return ( difference ? difference : # 464| memcmp ( cursor1->data, cursor2->data, cursor1->len ) ); Error: GCC_ANALYZER_WARNING (CWE-126): [#def14] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/asn1.c:464:27: warning[-Wanalyzer-out-of-bounds]: buffer over-read ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/asn1.c:705:5: enter_function: entry to ‘asn1_check_algorithm’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/asn1.c:712:21: call_function: calling ‘asn1_algorithm’ from ‘asn1_check_algorithm’ # 462| difference = ( cursor2->len - cursor1->len ); # 463| return ( difference ? difference : # 464|-> memcmp ( cursor1->data, cursor2->data, cursor1->len ) ); # 465| } # 466| Error: CPPCHECK_WARNING (CWE-758): [#def15] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/des.c:267: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 265| * {x5,x4,x3,x2,x1,x0}+1 into {~x2,~x1,~x0,x4,x3,~x5}+1 # 266| */ # 267|-> DES_GENERATOR ( des_ip, 1, 1, 2, 1, 1, 1, 0, 0, 4, 0, 3, 1, 5 ), # 268| # 269| /* The DES final permutation transforms the bit index Error: CPPCHECK_WARNING (CWE-758): [#def16] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/des.c:283: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 281| * {x5,x4,x3,x2,x1,x0}+1 into {x0,x2,x1,~x5,~x4,~x3}+1 # 282| */ # 283|-> DES_GENERATOR ( des_fp, 1, 0, 0, 0, 2, 0, 1, 1, 5, 1, 4, 1, 3 ), # 284| # 285| /* The "C" half of DES permuted choice 1 (PC1) transforms the Error: CPPCHECK_WARNING (CWE-758): [#def17] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/des.c:288: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 286| * bit index {x5,x4,x3,x2,x1,x0}+1 into {~x2,~x1,~x0,x5,x4,x3}+1 # 287| */ # 288|-> DES_GENERATOR ( des_pc1c, 1, 1, 2, 1, 1, 1, 0, 0, 5, 0, 4, 0, 3 ), # 289| # 290| /* The "D" half of DES permuted choice 1 (PC1) transforms the Error: CPPCHECK_WARNING (CWE-758): [#def18] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/des.c:298: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 296| * [24:27]. This is adjusted for in @c des_setkey(). # 297| */ # 298|-> DES_GENERATOR ( des_pc1d, 0, 1, 2, 1, 1, 1, 0, 1, 5, 1, 4, 1, 3 ), # 299| }; # 300| Error: GCC_ANALYZER_WARNING (CWE-457): [#def19] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/des.c:502:9: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*block.<U3b40>.right.dword’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/des.c:666:13: enter_function: entry to ‘des_decrypt’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/des.c:673:9: call_function: calling ‘des_rounds’ from ‘des_decrypt’ # 500| /* Extract left and right halves L[n-1] and R[n-1] */ # 501| left = block->left.dword; # 502|-> right = block->right.dword; # 503| DBGC2 ( block, "DES L=%08x R=%08x K=%08x%08x", be32_to_cpu ( left ), # 504| be32_to_cpu ( right ), be32_to_cpu ( rkey->dword[0] ), Error: GCC_ANALYZER_WARNING (CWE-457): [#def20] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/des.c:502:9: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*block.<Ue6e0>.right.dword’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/des.c:666:13: enter_function: entry to ‘des_decrypt’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/des.c:673:9: call_function: calling ‘des_rounds’ from ‘des_decrypt’ # 500| /* Extract left and right halves L[n-1] and R[n-1] */ # 501| left = block->left.dword; # 502|-> right = block->right.dword; # 503| DBGC2 ( block, "DES L=%08x R=%08x K=%08x%08x", be32_to_cpu ( left ), # 504| be32_to_cpu ( right ), be32_to_cpu ( rkey->dword[0] ), Error: CPPCHECK_WARNING (CWE-457): [#def21] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/crypto/hkdf.c:95: warning[uninitvar]: Uninitialized variable: hash # 93| hmac_init ( digest, ctx, prk, digestsize ); # 94| if ( index++ ) # 95|-> hmac_update ( digest, ctx, hash, digestsize ); # 96| hmac_update ( digest, ctx, info, info_len ); # 97| hmac_update ( digest, ctx, &index, sizeof ( index ) ); Error: GCC_ANALYZER_WARNING (CWE-126): [#def22] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/devtree.c:133:43: warning[-Wanalyzer-out-of-bounds]: buffer over-read ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/devtree.c:129:26: branch_true: following ‘true’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/devtree.c:129:26: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/devtree.c:133:43: danger: out-of-bounds read from byte 8 till byte 11 but ‘__table_entries’ ends at byte 0 # 131| dt->name, id ); # 132| for_each_table_entry ( driver, DT_DRIVERS ) { # 133|-> for ( i = 0 ; i < driver->id_count ; i++ ) { # 134| if ( strcmp ( id, driver->ids[i] ) == 0 ) { # 135| DBGC ( dt, "DT %s has %s driver %s\n", Error: CPPCHECK_WARNING (CWE-476): [#def23] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/devtree.c:181: error[ctunullpointer]: Null pointer dereference: dt # 179| */ # 180| static void dt_remove ( struct dt_device *dt ) { # 181|-> struct dt_driver *driver = dt->driver; # 182| # 183| /* Remove device */ Error: CPPCHECK_WARNING (CWE-476): [#def24] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/devtree.c:181: warning[nullPointer]: Possible null pointer dereference: dt # 179| */ # 180| static void dt_remove ( struct dt_device *dt ) { # 181|-> struct dt_driver *driver = dt->driver; # 182| # 183| /* Remove device */ Error: GCC_ANALYZER_WARNING (CWE-476): [#def25] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/devtree.c:181:27: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dt’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/devtree.c:241:6: enter_function: entry to ‘dt_remove_node’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/devtree.c:245:14: branch_false: following ‘false’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/devtree.c:250:9: branch_false: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/devtree.c:250:9: call_function: calling ‘dt_remove’ from ‘dt_remove_node’ # 179| */ # 180| static void dt_remove ( struct dt_device *dt ) { # 181|-> struct dt_driver *driver = dt->driver; # 182| # 183| /* Remove device */ Error: GCC_ANALYZER_WARNING (CWE-126): [#def26] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/pcicloud.c:68:17: warning[-Wanalyzer-out-of-bounds]: buffer over-read ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/pcicloud.c:254:15: enter_function: entry to ‘pcicloud_ioremap’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/pcicloud.c:256:31: call_function: calling ‘pcicloud_api’ from ‘pcicloud_ioremap’ # 66| # 67| /* Discover via this API */ # 68|-> api->pci_discover ( busdevfn, &candidate ); # 69| # 70| /* Check for a matching or new closest allocation */ Error: CPPCHECK_WARNING (CWE-758): [#def27] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/bus/usb_settings.c:81: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour # 79| # 80| /* Extract parameters from tag */ # 81|-> tag_direction = ( ( setting->tag & ( 1 << 31 ) ) ? +1 : -1 ); # 82| tag_busdev = ( ( setting->tag >> 16 ) & 0x7fff ); # 83| tag_offset = ( ( setting->tag >> 8 ) & 0xff ); Error: CPPCHECK_WARNING (CWE-457): [#def28] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/gpio/dwgpio.c:135: error[legacyUninitvar]: Uninitialized variable: _io_addr # 133| static inline void dwgpio_dump ( struct dwgpio *dwgpio ) { # 134| # 135|-> DBGC2 ( dwgpio, "DWGPIO %s dr %#08x ddr %#08x ctl %#08x\n", # 136| dwgpio->name, readl ( dwgpio->swport + DWGPIO_SWPORT_DR ), # 137| readl ( dwgpio->swport + DWGPIO_SWPORT_DDR ), Error: CPPCHECK_WARNING (CWE-786): [#def29] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_eeprom_4k.c:485: error[negativeIndex]: Array 'rep->ctlEdges[1][4]' accessed at index -1, which is out of bounds. # 483| twiceMinEdgePower = ath9k_hw_get_max_edge_power( # 484| freq, # 485|-> rep->ctlEdges[ # 486| ar5416_get_ntxchains(ah->txchainmask) - 1], # 487| IS_CHAN_2GHZ(chan), Error: CPPCHECK_WARNING (CWE-823): [#def30] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c:612: error[arrayIndexOutOfBounds]: Array 'rep->ctlEdges[2][4]' accessed at index 2, which is out of bounds. # 610| rep = &(pEepData->ctlData[i]); # 611| pRdEdgesPower = # 612|-> rep->ctlEdges[ar5416_get_ntxchains(tx_chainmask) - 1]; # 613| # 614| twiceMinEdgePower = ath9k_hw_get_max_edge_power(freq, Error: CPPCHECK_WARNING (CWE-786): [#def31] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c:612: error[negativeIndex]: Array 'rep->ctlEdges[2][4]' accessed at index -1, which is out of bounds. # 610| rep = &(pEepData->ctlData[i]); # 611| pRdEdgesPower = # 612|-> rep->ctlEdges[ar5416_get_ntxchains(tx_chainmask) - 1]; # 613| # 614| twiceMinEdgePower = ath9k_hw_get_max_edge_power(freq, Error: GCC_ANALYZER_WARNING (CWE-457): [#def32] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c:694:46: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘targetPowerHt20.tPow2x[i]’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c:552:12: branch_false: following ‘false’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c:590:9: branch_false: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c:590:27: branch_false: following ‘false’ branch (when ‘numCtlModes <= ctlMode’)... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c:686:32: branch_false: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c:693:21: branch_true: following ‘true’ branch (when ‘i != 8’)... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c:694:46: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_eeprom_9287.c:694:46: danger: use of uninitialized value ‘targetPowerHt20.tPow2x[i]’ here # 692| # 693| for (i = 0; i < ARRAY_SIZE(targetPowerHt20.tPow2x); i++) # 694|-> ratesArray[rateHt20_0 + i] = targetPowerHt20.tPow2x[i]; # 695| # 696| if (IS_CHAN_2GHZ(chan)) { Error: CPPCHECK_WARNING (CWE-786): [#def33] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_eeprom_def.c:1044: error[negativeIndex]: Array 'rep->ctlEdges[3][8]' accessed at index -1, which is out of bounds. # 1042| # 1043| twiceMinEdgePower = ath9k_hw_get_max_edge_power(freq, # 1044|-> rep->ctlEdges[ar5416_get_ntxchains(tx_chainmask) - 1], # 1045| IS_CHAN_2GHZ(chan), AR5416_NUM_BAND_EDGES); # 1046| Error: CPPCHECK_WARNING (CWE-476): [#def34] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_recv.c:214: warning[nullPointer]: Possible null pointer dereference: bf # 212| # 213| bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list); # 214|-> ath9k_hw_putrxbuf(ah, bf->bf_daddr); # 215| ath9k_hw_rxena(ah); # 216| Error: CPPCHECK_WARNING (CWE-476): [#def35] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_recv.c:265: warning[nullPointer]: Possible null pointer dereference: bf # 263| # 264| bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list); # 265|-> ds = bf->bf_desc; # 266| # 267| /* Error: CPPCHECK_WARNING (CWE-476): [#def36] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_xmit.c:200: warning[nullPointer]: Possible null pointer dereference: bf # 198| list); # 199| # 200|-> if (bf->bf_stale) { # 201| list_del(&bf->list); # 202| Error: CPPCHECK_WARNING (CWE-476): [#def37] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_xmit.c:372: warning[nullPointer]: Possible null pointer dereference: bf # 370| # 371| bf = list_first_entry(bf_head, struct ath_buf, list); # 372|-> bf->bf_state.bf_type &= ~BUF_AMPDU; # 373| # 374| /* update starting sequence number for subsequent ADDBA request */ Error: GCC_ANALYZER_WARNING (CWE-476): [#def38] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_xmit.c:378:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bf’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_xmit.c:551:13: enter_function: entry to ‘ath_tx_start_dma’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_xmit.c:567:9: call_function: calling ‘ath_tx_send_normal’ from ‘ath_tx_start_dma’ # 376| INCR(tid->seq_start, IEEE80211_SEQ_MAX); # 377| # 378|-> bf->bf_lastbf = bf; # 379| ath_buf_set_rate(sc, bf, iob_len(bf->bf_mpdu) + FCS_LEN); # 380| ath_tx_txqaddbuf(sc, txq, bf_head); Error: CPPCHECK_WARNING (CWE-476): [#def39] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/ath/ath9k/ath9k_xmit.c:690: warning[nullPointer]: Possible null pointer dereference: bf # 688| */ # 689| bf_held = NULL; # 690|-> if (bf->bf_stale) { # 691| bf_held = bf; # 692| if (list_is_last(&bf_held->list, &txq->axq_q)) { Error: CPPCHECK_WARNING (CWE-457): [#def40] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/dwmac.c:64: error[legacyUninitvar]: Uninitialized variable: _io_addr # 62| # 63| /* Dump MAC registers */ # 64|-> DBGC ( dwmac, "DWMAC %s ver %08x cfg %08x flt %08x flo %08x\n", # 65| dwmac->name, readl ( dwmac->regs + DWMAC_VER ), # 66| readl ( dwmac->regs + DWMAC_CFG ), Error: CPPCHECK_WARNING (CWE-457): [#def41] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/dwmac.c:69: error[legacyUninitvar]: Uninitialized variable: _io_addr # 67| readl ( dwmac->regs + DWMAC_FILTER ), # 68| readl ( dwmac->regs + DWMAC_FLOW ) ); # 69|-> DBGC ( dwmac, "DWMAC %s isr %08x dbg %08x gmi %08x\n", # 70| dwmac->name, readl ( dwmac->regs + DWMAC_ISR ), # 71| readl ( dwmac->regs + DWMAC_DEBUG ), Error: CPPCHECK_WARNING (CWE-457): [#def42] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/dwmac.c:89: error[legacyUninitvar]: Uninitialized variable: _io_addr # 87| /* Dump DMA registers */ # 88| status = readl ( dwmac->regs + DWMAC_STATUS ); # 89|-> DBGC ( dwmac, "DWMAC %s bus %08x fea %08x axi %08x ahb %08x\n", # 90| dwmac->name, readl ( dwmac->regs + DWMAC_BUS ), # 91| readl ( dwmac->regs + DWMAC_FEATURE ), Error: CPPCHECK_WARNING (CWE-457): [#def43] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/dwmac.c:94: error[legacyUninitvar]: Uninitialized variable: _io_addr # 92| readl ( dwmac->regs + DWMAC_AXI ), # 93| readl ( dwmac->regs + DWMAC_AHB ) ); # 94|-> DBGC ( dwmac, "DWMAC %s opm %08x sta %08x drp %08x\n", # 95| dwmac->name, readl ( dwmac->regs + DWMAC_OP ), # 96| status, readl ( dwmac->regs + DWMAC_DROP ) ); Error: CPPCHECK_WARNING (CWE-457): [#def44] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/dwmac.c:97: error[legacyUninitvar]: Uninitialized variable: _io_addr # 95| dwmac->name, readl ( dwmac->regs + DWMAC_OP ), # 96| status, readl ( dwmac->regs + DWMAC_DROP ) ); # 97|-> DBGC ( dwmac, "DWMAC %s txb %08x txd %08x txb %08x\n", # 98| dwmac->name, readl ( dwmac->regs + DWMAC_TXBASE ), # 99| readl ( dwmac->regs + DWMAC_TXDESC ), Error: CPPCHECK_WARNING (CWE-457): [#def45] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/dwmac.c:101: error[legacyUninitvar]: Uninitialized variable: _io_addr # 99| readl ( dwmac->regs + DWMAC_TXDESC ), # 100| readl ( dwmac->regs + DWMAC_TXBUF ) ); # 101|-> DBGC ( dwmac, "DWMAC %s rxb %08x rxd %08x rxb %08x\n", # 102| dwmac->name, readl ( dwmac->regs + DWMAC_RXBASE ), # 103| readl ( dwmac->regs + DWMAC_RXDESC ), Error: CPPCHECK_WARNING (CWE-457): [#def46] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/gve.c:226: error[legacyUninitvar]: Uninitialized variable: _io_addr # 224| } # 225| # 226|-> DBGC ( gve, "GVE %p reset timed out (PFN %#08x devstat %#08x)\n", # 227| gve, bswap_32 ( pfn ), # 228| bswap_32 ( readl ( gve->cfg + GVE_CFG_DEVSTAT ) ) ); Error: CPPCHECK_WARNING (CWE-457): [#def47] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/gve.c:381: error[legacyUninitvar]: Uninitialized variable: _io_addr # 379| /* Check event counter */ # 380| rmb(); # 381|-> evt = bswap_32 ( readl ( gve->cfg + GVE_CFG_ADMIN_EVT ) ); # 382| if ( evt == admin->prod ) # 383| return 0; Error: CPPCHECK_WARNING (CWE-457): [#def48] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/gve.c:394: error[legacyUninitvar]: Uninitialized variable: _io_addr # 392| } # 393| # 394|-> DBGC ( gve, "GVE %p AQ %#02x %s (completed %#02x, status %#08x)\n", # 395| gve, admin->prod, ( pfn ? "timed out" : "saw reset" ), evt, # 396| bswap_32 ( readl ( gve->cfg + GVE_CFG_DEVSTAT ) ) ); Error: GCC_ANALYZER_WARNING (CWE-401): [#def49] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/jme.c:309:1: warning[-Wanalyzer-malloc-leak]: leak of ‘edi’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/jme.c:702:1: enter_function: entry to ‘jme_open’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/jme.c:710:14: call_function: calling ‘jme_alloc_rx_resources’ from ‘jme_open’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/jme.c:710:14: return_function: returning to ‘jme_open’ from ‘jme_alloc_rx_resources’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/jme.c:711:12: branch_false: following ‘false’ branch (when ‘rc == 0’)... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/jme.c:719:14: branch_false: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/jme.c:719:14: call_function: calling ‘jme_alloc_tx_resources’ from ‘jme_open’ # 307| jme_free_tx_resources(jme); # 308| return -ENOMEM; # 309|-> } # 310| # 311| static void Error: GCC_ANALYZER_WARNING (CWE-401): [#def50] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/jme.c:495:1: warning[-Wanalyzer-malloc-leak]: leak of ‘bufinf’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/jme.c:702:1: enter_function: entry to ‘jme_open’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/jme.c:710:14: call_function: calling ‘jme_alloc_rx_resources’ from ‘jme_open’ # 493| jme_free_rx_resources(jme); # 494| return -ENOMEM; # 495|-> } # 496| # 497| static void Error: GCC_ANALYZER_WARNING (CWE-401): [#def51] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/jme.c:495:1: warning[-Wanalyzer-malloc-leak]: leak of ‘edi’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/jme.c:702:1: enter_function: entry to ‘jme_open’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/jme.c:710:14: call_function: calling ‘jme_alloc_rx_resources’ from ‘jme_open’ # 493| jme_free_rx_resources(jme); # 494| return -ENOMEM; # 495|-> } # 496| # 497| static void Error: CPPCHECK_WARNING (CWE-457): [#def52] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/marvell/aqc1xx.c:236: error[legacyUninitvar]: Uninitialized variable: _io_addr # 234| # 235| /*Enable rings*/ # 236|-> ATL_WRITE_REG ( ATL_READ_REG ( ATL_RING_TX_CTRL ) | ATL_RING_TX_CTRL_EN, # 237| ATL_RING_TX_CTRL ); # 238| ATL_WRITE_REG ( ATL_READ_REG ( ATL_RING_RX_CTRL ) | ATL_RING_RX_CTRL_EN, Error: CPPCHECK_WARNING (CWE-457): [#def53] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/marvell/aqc1xx.c:238: error[legacyUninitvar]: Uninitialized variable: _io_addr # 236| ATL_WRITE_REG ( ATL_READ_REG ( ATL_RING_TX_CTRL ) | ATL_RING_TX_CTRL_EN, # 237| ATL_RING_TX_CTRL ); # 238|-> ATL_WRITE_REG ( ATL_READ_REG ( ATL_RING_RX_CTRL ) | ATL_RING_RX_CTRL_EN, # 239| ATL_RING_RX_CTRL ); # 240| Error: CPPCHECK_WARNING (CWE-457): [#def54] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/marvell/aqc1xx.c:272: error[legacyUninitvar]: Uninitialized variable: _io_addr # 270| ATL_WRITE_REG ( ATL_TPB_CTRL_DIS, ATL_TPB_CTRL); # 271| # 272|-> ATL_WRITE_REG ( ATL_READ_REG ( ATL_RING_TX_CTRL ) | ( ~ATL_RING_TX_CTRL_EN ), # 273| ATL_RING_TX_CTRL ); # 274| ATL_WRITE_REG ( ATL_READ_REG ( ATL_RING_RX_CTRL ) | ( ~ATL_RING_RX_CTRL_EN ), Error: CPPCHECK_WARNING (CWE-457): [#def55] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/marvell/aqc1xx.c:274: error[legacyUninitvar]: Uninitialized variable: _io_addr # 272| ATL_WRITE_REG ( ATL_READ_REG ( ATL_RING_TX_CTRL ) | ( ~ATL_RING_TX_CTRL_EN ), # 273| ATL_RING_TX_CTRL ); # 274|-> ATL_WRITE_REG ( ATL_READ_REG ( ATL_RING_RX_CTRL ) | ( ~ATL_RING_RX_CTRL_EN ), # 275| ATL_RING_RX_CTRL ); # 276| Error: CPPCHECK_WARNING (CWE-457): [#def56] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/marvell/atl2_hw.c:75: error[legacyUninitvar]: Uninitialized variable: _io_addr # 73| int err = 0; # 74| # 75|-> ATL_WRITE_REG ( ATL_READ_REG ( ATL2_HOST_FINISHED_WRITE ) # 76| | 1, ATL2_HOST_FINISHED_WRITE ); # 77| Error: CPPCHECK_WARNING (CWE-457): [#def57] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/marvell/atl_hw.c:56: error[legacyUninitvar]: Uninitialized variable: _io_addr # 54| ATL_WRITE_REG ( val | ATL_GBL_NVR_PROV4_RESET, ATL_GLB_NVR_PROV4 ); # 55| # 56|-> ATL_WRITE_REG( ( ATL_READ_REG ( ATL_GLB_STD_CTRL ) & # 57| ~ATL_GLB_CTRL_RST_DIS ) | ATL_GLB_STD_CTRL_RESET, # 58| ATL_GLB_STD_CTRL ); Error: CPPCHECK_WARNING (CWE-457): [#def58] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/marvell/atl_hw.c:97: error[legacyUninitvar]: Uninitialized variable: _io_addr # 95| # 96| /* Global software reset*/ # 97|-> ATL_WRITE_REG ( ATL_READ_REG ( ATL_RX_CTRL ) & # 98| ~ATL_RX_CTRL_RST_DIS, ATL_RX_CTRL ); # 99| ATL_WRITE_REG ( ATL_READ_REG ( ATL_TX_CTRL ) & Error: CPPCHECK_WARNING (CWE-457): [#def59] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/marvell/atl_hw.c:99: error[legacyUninitvar]: Uninitialized variable: _io_addr # 97| ATL_WRITE_REG ( ATL_READ_REG ( ATL_RX_CTRL ) & # 98| ~ATL_RX_CTRL_RST_DIS, ATL_RX_CTRL ); # 99|-> ATL_WRITE_REG ( ATL_READ_REG ( ATL_TX_CTRL ) & # 100| ~ATL_TX_CTRL_RST_DIS, ATL_TX_CTRL ); # 101| Error: CPPCHECK_WARNING (CWE-457): [#def60] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/marvell/atl_hw.c:102: error[legacyUninitvar]: Uninitialized variable: _io_addr # 100| ~ATL_TX_CTRL_RST_DIS, ATL_TX_CTRL ); # 101| # 102|-> ATL_WRITE_REG ( ATL_READ_REG ( ATL_MAC_PHY_CTRL ) & # 103| ~ATL_MAC_PHY_CTRL_RST_DIS, ATL_MAC_PHY_CTRL ); # 104| Error: CPPCHECK_WARNING (CWE-457): [#def61] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/marvell/atl_hw.c:105: error[legacyUninitvar]: Uninitialized variable: _io_addr # 103| ~ATL_MAC_PHY_CTRL_RST_DIS, ATL_MAC_PHY_CTRL ); # 104| # 105|-> ATL_WRITE_REG ( ( ATL_READ_REG ( ATL_GLB_STD_CTRL ) & # 106| ~ATL_GLB_CTRL_RST_DIS ) | ATL_GLB_STD_CTRL_RESET, # 107| ATL_GLB_STD_CTRL ); Error: CPPCHECK_WARNING (CWE-457): [#def62] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/marvell/atl_hw.c:143: error[legacyUninitvar]: Uninitialized variable: _io_addr # 141| # 142| /* Global software reset*/ # 143|-> ATL_WRITE_REG ( ATL_READ_REG ( ATL_RX_CTRL ) & ~ATL_RX_CTRL_RST_DIS, # 144| ATL_RX_CTRL ); # 145| ATL_WRITE_REG ( ATL_READ_REG ( ATL_TX_CTRL ) & ~ATL_TX_CTRL_RST_DIS, Error: CPPCHECK_WARNING (CWE-457): [#def63] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/marvell/atl_hw.c:145: error[legacyUninitvar]: Uninitialized variable: _io_addr # 143| ATL_WRITE_REG ( ATL_READ_REG ( ATL_RX_CTRL ) & ~ATL_RX_CTRL_RST_DIS, # 144| ATL_RX_CTRL ); # 145|-> ATL_WRITE_REG ( ATL_READ_REG ( ATL_TX_CTRL ) & ~ATL_TX_CTRL_RST_DIS, # 146| ATL_TX_CTRL ); # 147| ATL_WRITE_REG ( ATL_READ_REG ( ATL_MAC_PHY_CTRL ) & Error: CPPCHECK_WARNING (CWE-457): [#def64] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/marvell/atl_hw.c:147: error[legacyUninitvar]: Uninitialized variable: _io_addr # 145| ATL_WRITE_REG ( ATL_READ_REG ( ATL_TX_CTRL ) & ~ATL_TX_CTRL_RST_DIS, # 146| ATL_TX_CTRL ); # 147|-> ATL_WRITE_REG ( ATL_READ_REG ( ATL_MAC_PHY_CTRL ) & # 148| ~ATL_MAC_PHY_CTRL_RST_DIS, ATL_MAC_PHY_CTRL ); # 149| Error: CPPCHECK_WARNING (CWE-457): [#def65] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/marvell/atl_hw.c:150: error[legacyUninitvar]: Uninitialized variable: _io_addr # 148| ~ATL_MAC_PHY_CTRL_RST_DIS, ATL_MAC_PHY_CTRL ); # 149| # 150|-> ATL_WRITE_REG ( ( ATL_READ_REG ( ATL_GLB_STD_CTRL ) & # 151| ~ATL_GLB_CTRL_RST_DIS ) | ATL_GLB_STD_CTRL_RESET, # 152| ATL_GLB_STD_CTRL ); Error: CPPCHECK_WARNING (CWE-457): [#def66] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/drivers/net/thunderx.c:92: error[legacyUninitvar]: Uninitialized variable: _io_addr # 90| readq ( vnic->regs + TXNIC_QS_RBDR_HEAD(0) ), # 91| readq ( vnic->regs + TXNIC_QS_RBDR_STATUS0(0) ) ); # 92|-> DBGC ( vnic, "TXNIC %s CQ xxxxx(%05llx)/%05zx(%05llx) %08llx:%08llx\n", # 93| vnic->name, readq ( vnic->regs + TXNIC_QS_CQ_TAIL(0) ), # 94| ( ( vnic->cq.cons % TXNIC_CQES ) * TXNIC_CQ_STRIDE ), Error: CPPCHECK_WARNING (CWE-476): [#def67] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/hci/editstring.c:100: warning[nullPointer]: Possible null pointer dereference: insert_text # 98| # 99| /* Copy inserted text to cursor position */ # 100|-> memcpy ( ( buf + string->cursor ), insert_text, insert_len ); # 101| string->cursor += insert_len; # 102| Error: GCC_ANALYZER_WARNING (CWE-126): [#def68] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/interface/efi/efi_driver.c:244:29: warning[-Wanalyzer-out-of-bounds]: buffer over-read ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/interface/efi/efi_driver.c:202:1: enter_function: entry to ‘efi_driver_start’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/interface/efi/efi_driver.c:228:12: branch_false: following ‘false’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/interface/efi/efi_driver.c:236:18: branch_false: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/interface/efi/efi_driver.c:236:18: call_function: calling ‘efidev_alloc’ from ‘efi_driver_start’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/interface/efi/efi_driver.c:236:18: return_function: returning to ‘efi_driver_start’ from ‘efidev_alloc’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/interface/efi/efi_driver.c:237:12: branch_false: following ‘false’ branch (when ‘efidev’ is non-NULL)... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/interface/efi/efi_driver.c:237:12: branch_false: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/interface/efi/efi_driver.c:243:9: branch_true: following ‘true’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/interface/efi/efi_driver.c:244:29: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/interface/efi/efi_driver.c:244:29: danger: out-of-bounds read from byte 16 till byte 23 but ‘__table_entries’ ends at byte 0 # 242| /* Try to start this device */ # 243| for_each_table_entry ( efidrv, EFI_DRIVERS ) { # 244|-> if ( ( rc = efidrv->supported ( device ) ) != 0 ) { # 245| DBGC ( device, "EFIDRV %s is not supported by driver " # 246| "\"%s\": %s\n", efi_handle_name ( device ), Error: GCC_ANALYZER_WARNING (CWE-126): [#def69] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/eap.c:99:22: warning[-Wanalyzer-out-of-bounds]: buffer over-read ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/eap.c:98:9: branch_true: following ‘true’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/eap.c:99:22: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/eap.c:99:22: danger: out-of-bounds read at byte 0 but ‘__table_entries’ ends at byte 0 # 97| DBGC ( netdev, "EAP %s Nak offering types {", netdev->name ); # 98| for_each_table_entry ( method, EAP_METHODS ) { # 99|-> if ( method->type > EAP_TYPE_NAK ) { # 100| DBGC ( netdev, "%s%d", # 101| ( count ? ", " : "" ), method->type ); Error: CPPCHECK_WARNING (CWE-476): [#def70] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/eth_slow.c:163: warning[nullPointer]: Possible null pointer dereference: system # 161| # 162| /* Check for looped-back packets */ # 163|-> if ( memcmp ( lacp->actor.system, system->ll_addr, # 164| sizeof ( lacp->actor.system ) ) == 0 ) { # 165| DBGC ( netdev, "SLOW %s RX loopback detected\n", Error: GCC_ANALYZER_WARNING (CWE-469): [#def71] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:1118:39: warning[-Wanalyzer-undefined-behavior-ptrdiff]: undefined behavior when subtracting pointers ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3722:13: enter_function: entry to ‘tls_tx_step’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3728:12: branch_false: following ‘false’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3732:14: branch_false: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3732:12: branch_true: following ‘true’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3737:17: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3744:20: branch_true: following ‘true’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3746:51: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3760:29: call_function: calling ‘tls_send_client_hello’ from ‘tls_tx_step’ # 1116| struct { # 1117| uint16_t len; # 1118|-> uint16_t code[TLS_NUM_SIG_HASH_ALGORITHMS]; # 1119| } __attribute__ (( packed )) data; # 1120| } __attribute__ (( packed )) *signature_algorithms_ext; Error: GCC_ANALYZER_WARNING (CWE-469): [#def72] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:1142:39: warning[-Wanalyzer-undefined-behavior-ptrdiff]: undefined behavior when subtracting pointers ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3722:13: enter_function: entry to ‘tls_tx_step’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3728:12: branch_false: following ‘false’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3732:14: branch_false: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3732:12: branch_true: following ‘true’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3737:17: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3744:20: branch_true: following ‘true’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3746:51: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3760:29: call_function: calling ‘tls_send_client_hello’ from ‘tls_tx_step’ # 1140| struct { # 1141| uint16_t len; # 1142|-> uint16_t code[TLS_NUM_NAMED_CURVES]; # 1143| } __attribute__ (( packed )) data; # 1144| } __attribute__ (( packed )) *named_curve_ext; Error: GCC_ANALYZER_WARNING (CWE-469): [#def73] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:1157:37: warning[-Wanalyzer-undefined-behavior-ptrdiff]: undefined behavior when subtracting pointers ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3722:13: enter_function: entry to ‘tls_tx_step’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3728:12: branch_false: following ‘false’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3732:14: branch_false: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3732:12: branch_true: following ‘true’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3737:17: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3744:20: branch_false: following ‘false’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3755:51: branch_false: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3760:29: call_function: calling ‘tls_send_client_hello’ from ‘tls_tx_step’ # 1155| typeof ( *extended_master_secret_ext ) extended_master_secret; # 1156| typeof ( *named_curve_ext ) # 1157|-> named_curve[TLS_NUM_NAMED_CURVES ? 1 : 0]; # 1158| } __attribute__ (( packed )) *extensions; # 1159| struct { Error: GCC_ANALYZER_WARNING (CWE-126): [#def74] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:1221:60: warning[-Wanalyzer-out-of-bounds]: buffer over-read ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3722:13: enter_function: entry to ‘tls_tx_step’ ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3728:12: branch_false: following ‘false’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3732:14: branch_false: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3732:12: branch_true: following ‘true’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3737:17: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3744:20: branch_true: following ‘true’ branch... ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3746:51: branch_true: ...to here ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/net/tls.c:3760:29: call_function: calling ‘tls_send_client_hello’ from ‘tls_tx_step’ # 1219| = htons ( sizeof ( signature_algorithms_ext->data.code ) ); # 1220| i = 0 ; for_each_table_entry ( sighash, TLS_SIG_HASH_ALGORITHMS ) # 1221|-> signature_algorithms_ext->data.code[i++] = sighash->code; # 1222| # 1223| /* Construct renegotiation information extension */ Error: CPPCHECK_WARNING (CWE-758): [#def75] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/tests/math_test.c:369: error[shiftTooManyBitsSigned]: Shifting signed 64-bit value by 63 bits is undefined behaviour # 367| # 368| /* Verify as a compile-time calculation */ # 369|-> okx ( ( value >> shift ) == expected, file, line ); # 370| # 371| /* Verify as a runtime calculation */ Error: CPPCHECK_WARNING (CWE-476): [#def76] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/tests/memcpy_test.c:143: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: src # 141| /* Generate random source data */ # 142| for ( i = 0 ; i < len ; i++ ) # 143|-> src[ src_offset + i ] = random(); # 144| # 145| /* Check correctness of copied data */ Error: CPPCHECK_WARNING (CWE-476): [#def77] ipxe-13a83f4ab30bd75831261e6b197903244f1ad753/src/tests/x509_test.c:1360: warning[nullPointer]: Possible null pointer dereference: link # 1358| link = list_last_entry ( &server_chain.chain->links, # 1359| struct x509_link, list ); # 1360|-> ok ( link->cert == root_crt.cert ); # 1361| link = list_prev_entry ( link, &server_chain.chain->links, list ); # 1362| ok ( link->cert == intermediate_crt.cert );
| analyzer-version-clippy | 1.97.1 |
| analyzer-version-cppcheck | 2.21.1 |
| analyzer-version-gcc | 16.1.1 |
| analyzer-version-gcc-analyzer | 16.1.1 |
| analyzer-version-shellcheck | 0.11.0 |
| analyzer-version-unicontrol | 0.0.2 |
| diffbase-analyzer-version-clippy | 1.97.1 |
| diffbase-analyzer-version-cppcheck | 2.21.1 |
| diffbase-analyzer-version-gcc | 16.1.1 |
| diffbase-analyzer-version-gcc-analyzer | 16.1.1 |
| diffbase-analyzer-version-shellcheck | 0.11.0 |
| diffbase-analyzer-version-unicontrol | 0.0.2 |
| diffbase-enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol |
| diffbase-exit-code | 0 |
| diffbase-host | ip-172-16-1-88.us-west-2.compute.internal |
| diffbase-known-false-positives | /usr/share/csmock/known-false-positives.js |
| diffbase-known-false-positives-rpm | known-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch |
| diffbase-mock-config | fedora-rawhide-x86_64 |
| diffbase-project-name | ipxe-20240119-5.gitde8a0821.fc44 |
| diffbase-store-results-to | /tmp/tmpbnqs9i56/ipxe-20240119-5.gitde8a0821.fc44.tar.xz |
| diffbase-time-created | 2026-08-03 15:29:12 |
| diffbase-time-finished | 2026-08-03 16:02:08 |
| diffbase-tool | csmock |
| diffbase-tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,clippy,unicontrol,shellcheck,cppcheck' '-o' '/tmp/tmpbnqs9i56/ipxe-20240119-5.gitde8a0821.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpbnqs9i56/ipxe-20240119-5.gitde8a0821.fc44.src.rpm' |
| diffbase-tool-version | csmock-3.8.7.20260803.142340.gb75b18e-1.el9 |
| enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol |
| exit-code | 0 |
| host | ip-172-16-1-88.us-west-2.compute.internal |
| known-false-positives | /usr/share/csmock/known-false-positives.js |
| known-false-positives-rpm | known-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch |
| mock-config | fedora-rawhide-x86_64 |
| project-name | ipxe-2.0.0^20260614git13a83f4-4.fc45 |
| store-results-to | /tmp/tmpupbsxqop/ipxe-2.0.0^20260614git13a83f4-4.fc45.tar.xz |
| time-created | 2026-08-03 16:02:50 |
| time-finished | 2026-08-03 16:24:20 |
| title | Newly introduced findings |
| tool | csmock |
| tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,clippy,unicontrol,shellcheck,cppcheck' '-o' '/tmp/tmpupbsxqop/ipxe-2.0.0^20260614git13a83f4-4.fc45.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpupbsxqop/ipxe-2.0.0^20260614git13a83f4-4.fc45.src.rpm' |
| tool-version | csmock-3.8.7.20260803.142340.gb75b18e-1.el9 |