Newly introduced findings

List of Findings

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1]
openssl-4.0.1/crypto/cms/cms_env.c:665:5: warning[-Wanalyzer-null-dereference]: dereference of NULL '0'
openssl-4.0.1/crypto/cms/cms_env.c:599:12: enter_function: entry to 'cms_RecipientInfo_ktri_decrypt'
openssl-4.0.1/crypto/cms/cms_env.c:615:10: call_function: calling 'ossl_cms_get0_env_enc_content' from 'cms_RecipientInfo_ktri_decrypt'
openssl-4.0.1/crypto/cms/cms_env.c:615:10: return_function: returning to 'cms_RecipientInfo_ktri_decrypt' from 'ossl_cms_get0_env_enc_content'
openssl-4.0.1/crypto/cms/cms_env.c:617:8: branch_false: following 'false' branch...
openssl-4.0.1/crypto/cms/cms_env.c:622:9: branch_false: ...to here
openssl-4.0.1/crypto/cms/cms_env.c:648:8: branch_false: following 'false' branch...
openssl-4.0.1/crypto/cms/cms_env.c:651:9: branch_false: ...to here
openssl-4.0.1/crypto/cms/cms_env.c:651:8: branch_false: following 'false' branch...
openssl-4.0.1/crypto/cms/cms_env.c:654:10: branch_false: ...to here
openssl-4.0.1/crypto/cms/cms_env.c:654:8: branch_false: following 'false' branch...
openssl-4.0.1/crypto/cms/cms_env.c:659:13: branch_false: ...to here
openssl-4.0.1/crypto/cms/cms_env.c:657:8: branch_false: following 'false' branch...
openssl-4.0.1/crypto/cms/cms_env.c:665:5: branch_false: ...to here
openssl-4.0.1/crypto/cms/cms_env.c:665:5: danger: dereference of NULL 'ossl_cms_get0_env_enc_content(cms)'
#  663|       ret = 1;
#  664|   
#  665|->     OPENSSL_clear_free(ec->key, ec->keylen);
#  666|       ec->key = ek;
#  667|       ec->keylen = eklen;

Error: CPPCHECK_WARNING (CWE-457): [#def2]
openssl-4.0.1/include/openssl/x509_vfy.h:126: warning[uninitvar]: Uninitialized variables: ptr.check_time, ptr.inh_flags, ptr.flags, ptr.purpose, ptr.trust, ptr.depth, ptr.auth_level, ptr.policies, ptr.hosts, ptr.validate_host, ptr.ips, ptr.validate_ip, ptr.rfc822s, ptr.validate_rfc822, ptr.smtputf8s, ptr.validate_smtputf8, ptr.hostflags, ptr.peername
#  124|   #define sk_X509_OBJECT_deep_copy(sk, copyfunc, freefunc) ((STACK_OF(X509_OBJECT) *)OPENSSL_sk_deep_copy(ossl_check_const_X509_OBJECT_sk_type(sk), ossl_check_X509_OBJECT_copyfunc_type(copyfunc), ossl_check_X509_OBJECT_freefunc_type(freefunc)))
#  125|   #define sk_X509_OBJECT_set_cmp_func(sk, cmp) ((sk_X509_OBJECT_compfunc)OPENSSL_sk_set_cmp_func(ossl_check_X509_OBJECT_sk_type(sk), ossl_check_X509_OBJECT_compfunc_type(cmp)))
#  126|-> SKM_DEFINE_STACK_OF_INTERNAL(X509_VERIFY_PARAM, X509_VERIFY_PARAM, X509_VERIFY_PARAM)
#  127|   #define sk_X509_VERIFY_PARAM_num(sk) OPENSSL_sk_num(ossl_check_const_X509_VERIFY_PARAM_sk_type(sk))
#  128|   #define sk_X509_VERIFY_PARAM_value(sk, idx) ((X509_VERIFY_PARAM *)OPENSSL_sk_value(ossl_check_const_X509_VERIFY_PARAM_sk_type(sk), (idx)))

Error: CPPCHECK_WARNING (CWE-457): [#def3]
openssl-4.0.1/providers/implementations/signature/ml_dsa_sig.c:287: warning[uninitvar]: Uninitialized variable: mu
#  285|       }
#  286|   
#  287|->     ret = ossl_ml_dsa_sign(ctx->key, 1, mu, sizeof(mu), NULL, 0, rnd,
#  288|           sizeof(rand_tmp), 0, sig, siglen, sigsize);
#  289|       if (rnd != ctx->test_entropy)

Scan Properties