Error: GCC_ANALYZER_WARNING (CWE-775): [#def1] libcbor-0.14.0/examples/capped_alloc.c:133:6: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(argv[1], "rb")’ libcbor-0.14.0/examples/capped_alloc.c:119:6: branch_false: following ‘false’ branch (when ‘argc == 2’)... libcbor-0.14.0/examples/capped_alloc.c:122:3: branch_false: ...to here libcbor-0.14.0/examples/capped_alloc.c:124:13: acquire_resource: opened here libcbor-0.14.0/examples/capped_alloc.c:125:6: branch_false: following ‘false’ branch... libcbor-0.14.0/examples/capped_alloc.c:126:3: branch_false: ...to here libcbor-0.14.0/examples/capped_alloc.c:133:6: danger: ‘fopen(argv[1], "rb")’ leaks here; was opened at [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2) # 131| * libcbor's internal allocations, not to our own buffer. */ # 132| unsigned char* buffer = malloc(length); # 133|-> if (buffer == NULL || fread(buffer, length, 1, f) != 1) { # 134| fprintf(stderr, "Failed to read input\n"); # 135| exit(1); Error: GCC_ANALYZER_WARNING (CWE-401): [#def2] libcbor-0.14.0/examples/capped_alloc.c:133:6: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(argv[1], "rb")’ libcbor-0.14.0/examples/capped_alloc.c:119:6: branch_false: following ‘false’ branch (when ‘argc == 2’)... libcbor-0.14.0/examples/capped_alloc.c:122:3: branch_false: ...to here libcbor-0.14.0/examples/capped_alloc.c:124:13: acquire_memory: allocated here libcbor-0.14.0/examples/capped_alloc.c:125:6: branch_false: following ‘false’ branch... libcbor-0.14.0/examples/capped_alloc.c:126:3: branch_false: ...to here libcbor-0.14.0/examples/capped_alloc.c:133:6: danger: ‘fopen(argv[1], "rb")’ leaks here; was allocated at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2) # 131| * libcbor's internal allocations, not to our own buffer. */ # 132| unsigned char* buffer = malloc(length); # 133|-> if (buffer == NULL || fread(buffer, length, 1, f) != 1) { # 134| fprintf(stderr, "Failed to read input\n"); # 135| exit(1); Error: GCC_ANALYZER_WARNING (CWE-775): [#def3] libcbor-0.14.0/examples/capped_alloc.c:133:7: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(argv[1], "rb")’ libcbor-0.14.0/examples/capped_alloc.c:119:6: branch_false: following ‘false’ branch (when ‘argc == 2’)... libcbor-0.14.0/examples/capped_alloc.c:122:3: branch_false: ...to here libcbor-0.14.0/examples/capped_alloc.c:124:13: acquire_resource: opened here libcbor-0.14.0/examples/capped_alloc.c:125:6: branch_false: following ‘false’ branch... libcbor-0.14.0/examples/capped_alloc.c:126:3: branch_false: ...to here libcbor-0.14.0/examples/capped_alloc.c:133:6: branch_false: following ‘false’ branch (when ‘buffer’ is non-NULL)... libcbor-0.14.0/examples/capped_alloc.c:133:25: branch_false: ...to here libcbor-0.14.0/examples/capped_alloc.c:133:7: danger: ‘fopen(argv[1], "rb")’ leaks here; was opened at [(3)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/2) # 131| * libcbor's internal allocations, not to our own buffer. */ # 132| unsigned char* buffer = malloc(length); # 133|-> if (buffer == NULL || fread(buffer, length, 1, f) != 1) { # 134| fprintf(stderr, "Failed to read input\n"); # 135| exit(1); Error: GCC_ANALYZER_WARNING (CWE-401): [#def4] libcbor-0.14.0/examples/capped_alloc.c:133:7: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(argv[1], "rb")’ libcbor-0.14.0/examples/capped_alloc.c:119:6: branch_false: following ‘false’ branch (when ‘argc == 2’)... libcbor-0.14.0/examples/capped_alloc.c:122:3: branch_false: ...to here libcbor-0.14.0/examples/capped_alloc.c:124:13: acquire_memory: allocated here libcbor-0.14.0/examples/capped_alloc.c:125:6: branch_false: following ‘false’ branch... libcbor-0.14.0/examples/capped_alloc.c:126:3: branch_false: ...to here libcbor-0.14.0/examples/capped_alloc.c:133:6: branch_false: following ‘false’ branch (when ‘buffer’ is non-NULL)... libcbor-0.14.0/examples/capped_alloc.c:133:25: branch_false: ...to here libcbor-0.14.0/examples/capped_alloc.c:133:7: danger: ‘fopen(argv[1], "rb")’ leaks here; was allocated at [(3)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/2) # 131| * libcbor's internal allocations, not to our own buffer. */ # 132| unsigned char* buffer = malloc(length); # 133|-> if (buffer == NULL || fread(buffer, length, 1, f) != 1) { # 134| fprintf(stderr, "Failed to read input\n"); # 135| exit(1); Error: CPPCHECK_WARNING (CWE-476): [#def5] libcbor-0.14.0/examples/readfile.c:30: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: buffer # 28| fseek(f, 0, SEEK_SET); # 29| unsigned char* buffer = malloc(length); # 30|-> if (fread(buffer, length, 1, f) != 1) { # 31| fprintf(stderr, "Failed to read input\n"); # 32| exit(1); Error: GCC_ANALYZER_WARNING (CWE-775): [#def6] libcbor-0.14.0/examples/readfile.c:30:6: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(argv[1], "rb")’ libcbor-0.14.0/examples/readfile.c:23:6: branch_false: following ‘false’ branch (when ‘argc == 2’)... libcbor-0.14.0/examples/readfile.c:24:13: branch_false: ...to here libcbor-0.14.0/examples/readfile.c:24:13: acquire_resource: opened here libcbor-0.14.0/examples/readfile.c:25:6: branch_false: following ‘false’ branch... libcbor-0.14.0/examples/readfile.c:26:3: branch_false: ...to here libcbor-0.14.0/examples/readfile.c:30:6: danger: ‘fopen(argv[1], "rb")’ leaks here; was opened at [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2) # 28| fseek(f, 0, SEEK_SET); # 29| unsigned char* buffer = malloc(length); # 30|-> if (fread(buffer, length, 1, f) != 1) { # 31| fprintf(stderr, "Failed to read input\n"); # 32| exit(1); Error: GCC_ANALYZER_WARNING (CWE-401): [#def7] libcbor-0.14.0/examples/readfile.c:30:6: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(argv[1], "rb")’ libcbor-0.14.0/examples/readfile.c:23:6: branch_false: following ‘false’ branch (when ‘argc == 2’)... libcbor-0.14.0/examples/readfile.c:24:13: branch_false: ...to here libcbor-0.14.0/examples/readfile.c:24:13: acquire_memory: allocated here libcbor-0.14.0/examples/readfile.c:25:6: branch_false: following ‘false’ branch... libcbor-0.14.0/examples/readfile.c:26:3: branch_false: ...to here libcbor-0.14.0/examples/readfile.c:30:6: danger: ‘fopen(argv[1], "rb")’ leaks here; was allocated at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2) # 28| fseek(f, 0, SEEK_SET); # 29| unsigned char* buffer = malloc(length); # 30|-> if (fread(buffer, length, 1, f) != 1) { # 31| fprintf(stderr, "Failed to read input\n"); # 32| exit(1); Error: CPPCHECK_WARNING (CWE-476): [#def8] libcbor-0.14.0/examples/streaming_parser.c:45: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: buffer # 43| fseek(f, 0, SEEK_SET); # 44| unsigned char* buffer = malloc(length); # 45|-> if (fread(buffer, length, 1, f) != 1) { # 46| fprintf(stderr, "Failed to read input\n"); # 47| exit(1); Error: GCC_ANALYZER_WARNING (CWE-775): [#def9] libcbor-0.14.0/examples/streaming_parser.c:45:6: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(argv[1], "rb")’ libcbor-0.14.0/examples/streaming_parser.c:38:6: branch_false: following ‘false’ branch (when ‘argc == 2’)... libcbor-0.14.0/examples/streaming_parser.c:39:13: branch_false: ...to here libcbor-0.14.0/examples/streaming_parser.c:39:13: acquire_resource: opened here libcbor-0.14.0/examples/streaming_parser.c:40:6: branch_false: following ‘false’ branch... libcbor-0.14.0/examples/streaming_parser.c:41:3: branch_false: ...to here libcbor-0.14.0/examples/streaming_parser.c:45:6: danger: ‘fopen(argv[1], "rb")’ leaks here; was opened at [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2) # 43| fseek(f, 0, SEEK_SET); # 44| unsigned char* buffer = malloc(length); # 45|-> if (fread(buffer, length, 1, f) != 1) { # 46| fprintf(stderr, "Failed to read input\n"); # 47| exit(1); Error: GCC_ANALYZER_WARNING (CWE-401): [#def10] libcbor-0.14.0/examples/streaming_parser.c:45:6: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(argv[1], "rb")’ libcbor-0.14.0/examples/streaming_parser.c:38:6: branch_false: following ‘false’ branch (when ‘argc == 2’)... libcbor-0.14.0/examples/streaming_parser.c:39:13: branch_false: ...to here libcbor-0.14.0/examples/streaming_parser.c:39:13: acquire_memory: allocated here libcbor-0.14.0/examples/streaming_parser.c:40:6: branch_false: following ‘false’ branch... libcbor-0.14.0/examples/streaming_parser.c:41:3: branch_false: ...to here libcbor-0.14.0/examples/streaming_parser.c:45:6: danger: ‘fopen(argv[1], "rb")’ leaks here; was allocated at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2) # 43| fseek(f, 0, SEEK_SET); # 44| unsigned char* buffer = malloc(length); # 45|-> if (fread(buffer, length, 1, f) != 1) { # 46| fprintf(stderr, "Failed to read input\n"); # 47| exit(1); Error: COMPILER_WARNING (CWE-252): [#def11] libcbor-0.14.0/test/cbor_serialize_test.c: scope_hint: In function ‘test_serialize_indef_bytestring_size_overflow’ libcbor-0.14.0/test/cbor_serialize_test.c:197:3: warning[-Wunused-result]: ignoring return value of ‘cbor_bytestring_add_chunk’, declared with attribute ‘nodiscard’ # 197 | cbor_bytestring_add_chunk(item, cbor_move(chunk)); # | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ libcbor-0.14.0/src/cbor.h:15: included_from: Included from here. libcbor-0.14.0/test/assertions.h:9: included_from: Included from here. libcbor-0.14.0/test/cbor_serialize_test.c:20: included_from: Included from here. libcbor-0.14.0/src/cbor/bytestrings.h:108:18: note: declared here # 108 | CBOR_EXPORT bool cbor_bytestring_add_chunk(cbor_item_t* item, # | ^~~~~~~~~~~~~~~~~~~~~~~~~ # 195| unsigned char* data = malloc(1); # 196| cbor_bytestring_set_handle(chunk, data, SIZE_MAX); # 197|-> cbor_bytestring_add_chunk(item, cbor_move(chunk)); # 198| # 199| assert_size_equal(cbor_serialized_size(item), 0); Error: COMPILER_WARNING (CWE-252): [#def12] libcbor-0.14.0/test/cbor_serialize_test.c:197:3: warning[-Wunused-result]: ignoring return value of ‘cbor_bytestring_add_chunk’, declared with attribute ‘nodiscard’ # 195| unsigned char* data = malloc(1); # 196| cbor_bytestring_set_handle(chunk, data, SIZE_MAX); # 197|-> cbor_bytestring_add_chunk(item, cbor_move(chunk)); # 198| # 199| assert_size_equal(cbor_serialized_size(item), 0); Error: COMPILER_WARNING (CWE-252): [#def13] libcbor-0.14.0/test/cbor_serialize_test.c: scope_hint: In function ‘test_serialize_indef_string_size_overflow’ libcbor-0.14.0/test/cbor_serialize_test.c:213:3: warning[-Wunused-result]: ignoring return value of ‘cbor_string_add_chunk’, declared with attribute ‘nodiscard’ # 213 | cbor_string_add_chunk(item, cbor_move(chunk)); # | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ libcbor-0.14.0/src/cbor.h:19: included_from: Included from here. libcbor-0.14.0/src/cbor/strings.h:126:34: note: declared here # 126 | _CBOR_NODISCARD CBOR_EXPORT bool cbor_string_add_chunk(cbor_item_t* item, # | ^~~~~~~~~~~~~~~~~~~~~ # 211| chunk->data = data; # 212| chunk->metadata.string_metadata.length = SIZE_MAX; # 213|-> cbor_string_add_chunk(item, cbor_move(chunk)); # 214| # 215| assert_size_equal(cbor_serialized_size(item), 0); Error: COMPILER_WARNING (CWE-252): [#def14] libcbor-0.14.0/test/cbor_serialize_test.c:213:3: warning[-Wunused-result]: ignoring return value of ‘cbor_string_add_chunk’, declared with attribute ‘nodiscard’ # 211| chunk->data = data; # 212| chunk->metadata.string_metadata.length = SIZE_MAX; # 213|-> cbor_string_add_chunk(item, cbor_move(chunk)); # 214| # 215| assert_size_equal(cbor_serialized_size(item), 0);
| analyzer-version-clippy | 1.97.1 |
| analyzer-version-cppcheck | 2.21.1 |
| analyzer-version-gcc | 16.1.1 |
| analyzer-version-gcc-analyzer | 16.1.1 |
| analyzer-version-shellcheck | 0.11.0 |
| analyzer-version-unicontrol | 0.0.2 |
| diffbase-analyzer-version-clippy | 1.97.1 |
| diffbase-analyzer-version-cppcheck | 2.21.1 |
| diffbase-analyzer-version-gcc | 16.1.1 |
| diffbase-analyzer-version-gcc-analyzer | 16.1.1 |
| diffbase-analyzer-version-shellcheck | 0.11.0 |
| diffbase-analyzer-version-unicontrol | 0.0.2 |
| diffbase-enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol |
| diffbase-exit-code | 0 |
| diffbase-host | ip-172-16-1-117.us-west-2.compute.internal |
| diffbase-known-false-positives | /usr/share/csmock/known-false-positives.js |
| diffbase-known-false-positives-rpm | known-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch |
| diffbase-mock-config | fedora-rawhide-x86_64 |
| diffbase-project-name | libcbor-0.13.0-2.fc44 |
| diffbase-store-results-to | /tmp/tmp2cvwu3g1/libcbor-0.13.0-2.fc44.tar.xz |
| diffbase-time-created | 2026-08-03 17:06:53 |
| diffbase-time-finished | 2026-08-03 17:09:09 |
| diffbase-tool | csmock |
| diffbase-tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,clippy,unicontrol,shellcheck,cppcheck' '-o' '/tmp/tmp2cvwu3g1/libcbor-0.13.0-2.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmp2cvwu3g1/libcbor-0.13.0-2.fc44.src.rpm' |
| diffbase-tool-version | csmock-3.8.7.20260803.142340.gb75b18e-1.el9 |
| enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol |
| exit-code | 0 |
| host | ip-172-16-1-117.us-west-2.compute.internal |
| known-false-positives | /usr/share/csmock/known-false-positives.js |
| known-false-positives-rpm | known-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch |
| mock-config | fedora-rawhide-x86_64 |
| project-name | libcbor-0.14.0-3.fc45 |
| store-results-to | /tmp/tmpngrd5k28/libcbor-0.14.0-3.fc45.tar.xz |
| time-created | 2026-08-03 17:09:37 |
| time-finished | 2026-08-03 17:11:02 |
| title | Newly introduced findings |
| tool | csmock |
| tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,clippy,unicontrol,shellcheck,cppcheck' '-o' '/tmp/tmpngrd5k28/libcbor-0.14.0-3.fc45.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpngrd5k28/libcbor-0.14.0-3.fc45.src.rpm' |
| tool-version | csmock-3.8.7.20260803.142340.gb75b18e-1.el9 |