Fixed findings

List of Findings

Error: CPPCHECK_WARNING (CWE-190): [#def1]
pipewire-1.6.2/spa/plugins/alsa/alsa-seq-bridge.c:441: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  439|   
#  440|   	if (info == NULL) {
#  441|-> 		spa_log_debug(state->log, "free port %d.%d", addr->client, addr->port);
#  442|   		if (port)
#  443|   			free_port(state, stream, port);

Error: CPPCHECK_WARNING (CWE-190): [#def2]
pipewire-1.6.2/spa/plugins/alsa/alsa-seq-bridge.c:453: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  451|   		} else if (port != NULL) {
#  452|   			if ((caps & stream->caps) != stream->caps) {
#  453|-> 				spa_log_debug(state->log, "free port %d.%d", addr->client, addr->port);
#  454|   				free_port(state, stream, port);
#  455|   			}

Error: CPPCHECK_WARNING (CWE-190): [#def3]
pipewire-1.6.2/spa/plugins/alsa/alsa-seq-bridge.c:803: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  801|   	info.size = size;
#  802|   
#  803|-> 	spa_log_debug(this->log, "%p: io %d.%d %d %p %zd", this,
#  804|   			direction, port_id, id, data, size);
#  805|   

Error: CPPCHECK_WARNING (CWE-190): [#def4]
pipewire-1.6.2/spa/plugins/audiomixer/mixer-dsp.c:850: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  848|   	if (SPA_UNLIKELY(outb == NULL)) {
#  849|   		if (outport->n_buffers > 0)
#  850|-> 			spa_log_warn(this->log, "%p: out of buffers (%d)", this,
#  851|   					outport->n_buffers);
#  852|   		return -EPIPE;

Error: CPPCHECK_WARNING (CWE-758): [#def5]
pipewire-1.6.2/spa/plugins/bluez5/a2dp-codec-aac.c:226: error[comparePointers]: Comparing pointers that point to different objects
#  224|   	choice = (struct spa_pod_choice*)spa_pod_builder_frame(b, &f[1]);
#  225|   	i = 0;
#  226|-> 	SPA_FOR_EACH_ELEMENT_VAR(aac_frequencies, f) {
#  227|   		if (AAC_GET_FREQUENCY(conf) & f->config) {
#  228|   			if (i++ == 0)

Error: CPPCHECK_WARNING (CWE-190): [#def6]
pipewire-1.6.2/spa/plugins/bluez5/iso-io.c:344: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  342|   	if ((res = spa_system_timerfd_read(group->data_system, group->timerfd, &exp)) < 0) {
#  343|   		if (res != -EAGAIN)
#  344|-> 			spa_log_warn(group->log, "%p: ISO group:%u error reading timerfd: %s",
#  345|   					group, group->id, spa_strerror(res));
#  346|   		return;

Error: CPPCHECK_WARNING (CWE-190): [#def7]
pipewire-1.6.2/spa/plugins/bluez5/iso-io.c:439: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  437|   			}
#  438|   
#  439|-> 			spa_log_debug(group->log, "%p: ISO group:%u fill fd:%d",
#  440|   					group, group->id, stream->fd);
#  441|   			now = get_time_ns(group->data_system, CLOCK_REALTIME);

Error: CPPCHECK_WARNING (CWE-190): [#def8]
pipewire-1.6.2/spa/plugins/bluez5/iso-io.c:466: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  464|   		}
#  465|   		if (stream->this.size == 0) {
#  466|-> 			spa_log_debug(group->log, "%p: ISO group:%u miss fd:%d",
#  467|   					group, group->id, stream->fd);
#  468|   			stream->this.resync = true;

Error: CPPCHECK_WARNING (CWE-190): [#def9]
pipewire-1.6.2/spa/plugins/bluez5/iso-io.c:483: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  481|   		}
#  482|   
#  483|-> 		spa_log_trace(group->log, "%p: ISO group:%u sent fd:%d size:%u ts:%u idle:%d res:%d latency:%d..%d%sus queue:%u",
#  484|   				group, group->id, stream->fd, (unsigned)stream->this.size,
#  485|   				(unsigned)stream->this.timestamp, stream->idle, res,

Error: CPPCHECK_WARNING (CWE-190): [#def10]
pipewire-1.6.2/spa/plugins/bluez5/iso-io.c:495: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  493|   done:
#  494|   	if (fail) {
#  495|-> 		spa_log_debug(group->log, "%p: ISO group:%d send failure", group, group->id);
#  496|   		group->flush = FLUSH_WAIT;
#  497|   	}

Error: CPPCHECK_WARNING (CWE-190): [#def11]
pipewire-1.6.2/spa/plugins/bluez5/iso-io.c:932: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  930|   	if (SPA_ABS(err) > group->duration_rx) {
#  931|   		resync = true;
#  932|-> 		spa_log_debug(group->log, "%p: ISO rx-resync large group:%u fd:%d",
#  933|   				group, group->id, stream->fd);
#  934|   	}

Error: CPPCHECK_WARNING (CWE-190): [#def12]
pipewire-1.6.2/spa/plugins/bluez5/iso-io.c:941: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  939|   		if (SPA_ABS(now - s->source_buf->rx.nsec) < group->duration_rx / 2 &&
#  940|   				stream->rx_pos != s->rx_pos) {
#  941|-> 			spa_log_debug(group->log, "%p: ISO rx-resync balance group:%u fd:%d fd:%d",
#  942|   					group, group->id, stream->fd, s->fd);
#  943|   			resync = true;

Error: CPPCHECK_WARNING (CWE-190): [#def13]
pipewire-1.6.2/spa/plugins/bluez5/iso-io.c:952: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  950|   		t = sync->base_time + group->duration_rx * stream->rx_pos;
#  951|   		err = now - t;
#  952|-> 		spa_log_debug(group->log, "%p: ISO rx-resync group:%u fd:%d err:%"PRIi64,
#  953|   				group, group->id, stream->fd, err);
#  954|   	}

Error: CPPCHECK_WARNING (CWE-190): [#def14]
pipewire-1.6.2/spa/plugins/bluez5/iso-io.c:1005: error[integerOverflow]: Signed integer overflow for expression '0-1'.
# 1003|   			drop = SPA_MIN(drop, avail);
# 1004|   
# 1005|-> 			spa_log_debug(group->log, "%p: ISO overrun group:%u fd:%d level:%f target:%d drop:%u",
# 1006|   					group, group->id, stream->fd,
# 1007|   					stream->source_buf->level + stream->source_buf->prev_samples,

Error: CPPCHECK_WARNING (CWE-190): [#def15]
pipewire-1.6.2/spa/plugins/bluez5/iso-io.c:1033: error[integerOverflow]: Signed integer overflow for expression '0-1'.
# 1031|   		: SPA_LOG_LEVEL_TRACE;
# 1032|   	if (SPA_UNLIKELY(spa_log_level_topic_enabled(group->log, SPA_LOG_TOPIC_DEFAULT, log_level))) {
# 1033|-> 		spa_log_lev(group->log, log_level,
# 1034|   				"%p: ISO rx-sync group:%u base:%"PRIi64" avg:%g err:%"PRIi64" corr:%g",
# 1035|   				group, group->id, sync->base_time, sync->dll.avg, sync->avg_err, corr-1);

Error: COMPILER_WARNING (CWE-252): [#def16]
pipewire-1.6.2/spa/plugins/filter-graph/plugin_builtin.c: scope_hint: In function ‘do_exec’
pipewire-1.6.2/spa/plugins/filter-graph/plugin_builtin.c:2706:9: warning[-Wunused-result]: ignoring return value of ‘pipe2’ declared with attribute ‘warn_unused_result’
# 2706 |         pipe2(stdin_pipe, 0);
#      |         ^~~~~~~~~~~~~~~~~~~~
# 2704|   	argv[argc++] = NULL;
# 2705|   
# 2706|-> 	pipe2(stdin_pipe, 0);
# 2707|   	pipe2(stdout_pipe, 0);
# 2708|   

Error: COMPILER_WARNING (CWE-252): [#def17]
pipewire-1.6.2/spa/plugins/filter-graph/plugin_builtin.c:2707:9: warning[-Wunused-result]: ignoring return value of ‘pipe2’ declared with attribute ‘warn_unused_result’
# 2707 |         pipe2(stdout_pipe, 0);
#      |         ^~~~~~~~~~~~~~~~~~~~~
# 2705|   
# 2706|   	pipe2(stdin_pipe, 0);
# 2707|-> 	pipe2(stdout_pipe, 0);
# 2708|   
# 2709|   	impl->write_fd = stdin_pipe[1];

Error: GCC_ANALYZER_WARNING (CWE-688): [#def18]
pipewire-1.6.2/src/modules/module-raop/rtsp-client.c:354:17: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
pipewire-1.6.2/src/modules/module-raop/rtsp-client.c:334:12: enter_function: entry to ‘process_content’
pipewire-1.6.2/src/modules/module-raop/rtsp-client.c:338:16: branch_true: following ‘true’ branch...
pipewire-1.6.2/src/modules/module-raop/rtsp-client.c:339:41: branch_true: ...to here
pipewire-1.6.2/src/modules/module-raop/rtsp-client.c:339:41: branch_true: following ‘true’ branch...
pipewire-1.6.2/src/modules/module-raop/rtsp-client.c:341:36: branch_true: ...to here
pipewire-1.6.2/src/modules/module-raop/rtsp-client.c:342:20: branch_false: following ‘false’ branch...
pipewire-1.6.2/src/modules/module-raop/rtsp-client.c:345:20: branch_false: ...to here
pipewire-1.6.2/src/modules/module-raop/rtsp-client.c:345:20: branch_false: following ‘false’ branch...
pipewire-1.6.2/src/modules/module-raop/rtsp-client.c:353:27: branch_false: ...to here
pipewire-1.6.2/src/modules/module-raop/rtsp-client.c:353:27: call_function: calling ‘pw_array_add’ from ‘process_content’
pipewire-1.6.2/src/modules/module-raop/rtsp-client.c:353:27: return_function: returning to ‘process_content’ from ‘pw_array_add’
pipewire-1.6.2/src/modules/module-raop/rtsp-client.c:354:17: danger: argument 1 (‘pw_array_add(&*client.content, (long unsigned int)read(*client_23(D)->source.fd, & buf,  <unknown>))’) NULL where non-null expected
#  352|   
#  353|   		void *p = pw_array_add(&client->content, res);
#  354|-> 		memcpy(p, buf, res);
#  355|   
#  356|   		spa_assert((size_t) res <= client->content_length);

Error: CPPCHECK_WARNING (CWE-190): [#def19]
pipewire-1.6.2/src/modules/module-rtp/audio.c:564: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  562|   				impl->io_position->clock.rate.denom);
#  563|   
#  564|-> 		rtp_stream_emit_send_packet(impl, iov, 3);
#  565|   
#  566|   		impl->seq++;

Error: CPPCHECK_WARNING (CWE-190): [#def20]
pipewire-1.6.2/src/modules/module-rtp/midi.c:154: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  152|   	j = (struct rtp_midi_journal*)packet;
#  153|   	uint16_t seqnum = ntohs(j->checkpoint_seqnum);
#  154|-> 	rtp_stream_emit_send_feedback(impl, seqnum);
#  155|   	return 0;
#  156|   }

Error: CPPCHECK_WARNING (CWE-190): [#def21]
pipewire-1.6.2/src/modules/module-rtp/midi.c:474: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  472|   						len, timestamp + base,
#  473|   						offset, impl->psamples);
#  474|-> 				rtp_stream_emit_send_packet(impl, iov, 3);
#  475|   
#  476|   				impl->seq++;

Error: CPPCHECK_WARNING (CWE-190): [#def22]
pipewire-1.6.2/src/modules/module-rtp/midi.c:513: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  511|   
#  512|   		pw_log_trace("sending %d timestamp:%d", len, base);
#  513|-> 		rtp_stream_emit_send_packet(impl, iov, 3);
#  514|   		impl->seq++;
#  515|   	}

Error: CPPCHECK_WARNING (CWE-190): [#def23]
pipewire-1.6.2/src/modules/module-rtp/opus.c:255: error[integerOverflow]: Signed integer overflow for expression '0-1'.
#  253|   		iov[1].iov_len = res;
#  254|   
#  255|-> 		rtp_stream_emit_send_packet(impl, iov, 2);
#  256|   
#  257|   		impl->seq++;

Error: GCC_ANALYZER_WARNING: [#def24]
pipewire-1.6.2/test/test-logger.c:349:14: warning[-Wanalyzer-fd-use-without-check]: ‘dup2’ on possibly invalid file descriptor ‘open(&fname, 2)’
pipewire-1.6.2/test/test-logger.c:341:12: branch_false: following ‘false’ branch (when ‘oldenv’ is NULL)...
pipewire-1.6.2/test/test-logger.c:346:9: branch_false: ...to here
pipewire-1.6.2/test/test-logger.c:347:14: acquire_resource: opened here
pipewire-1.6.2/test/test-logger.c:348:9: branch_true: following ‘true’ branch...
pipewire-1.6.2/test/test-logger.c:348:9: branch_true: ...to here
pipewire-1.6.2/test/test-logger.c:349:14: danger: ‘open(&fname, 2)’ could be invalid: unchecked value from [(3)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/2)
#  347|   	fd = open(fname, O_RDWR);
#  348|   	pwtest_errno_ok(fd);
#  349|-> 	rc = dup2(fd, STDERR_FILENO);
#  350|   	setlinebuf(stderr);
#  351|   	pwtest_errno_ok(rc);

Scan Properties

analyzer-version-clippy1.97.1
analyzer-version-cppcheck2.21.1
analyzer-version-gcc16.1.1
analyzer-version-gcc-analyzer16.1.1
analyzer-version-shellcheck0.11.0
analyzer-version-unicontrol0.0.2
diffbase-analyzer-version-clippy1.97.1
diffbase-analyzer-version-cppcheck2.21.1
diffbase-analyzer-version-gcc16.1.1
diffbase-analyzer-version-gcc-analyzer16.1.1
diffbase-analyzer-version-shellcheck0.11.0
diffbase-analyzer-version-unicontrol0.0.2
diffbase-enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
diffbase-exit-code0
diffbase-hostip-172-16-1-147.us-west-2.compute.internal
diffbase-known-false-positives/usr/share/csmock/known-false-positives.js
diffbase-known-false-positives-rpmknown-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch
diffbase-mock-configfedora-rawhide-x86_64
diffbase-project-namepipewire-1.6.8-3.fc45
diffbase-store-results-to/tmp/tmp560w7cus/pipewire-1.6.8-3.fc45.tar.xz
diffbase-time-created2026-08-03 19:40:51
diffbase-time-finished2026-08-03 19:54:32
diffbase-toolcsmock
diffbase-tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,clippy,unicontrol,shellcheck,cppcheck' '-o' '/tmp/tmp560w7cus/pipewire-1.6.8-3.fc45.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmp560w7cus/pipewire-1.6.8-3.fc45.src.rpm'
diffbase-tool-versioncsmock-3.8.7.20260803.142340.gb75b18e-1.el9
enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
exit-code0
hostip-172-16-1-147.us-west-2.compute.internal
known-false-positives/usr/share/csmock/known-false-positives.js
known-false-positives-rpmknown-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch
mock-configfedora-rawhide-x86_64
project-namepipewire-1.6.2-1.fc44
store-results-to/tmp/tmpdso5y0fx/pipewire-1.6.2-1.fc44.tar.xz
time-created2026-08-03 19:26:03
time-finished2026-08-03 19:40:20
titleFixed findings
toolcsmock
tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,clippy,unicontrol,shellcheck,cppcheck' '-o' '/tmp/tmpdso5y0fx/pipewire-1.6.2-1.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpdso5y0fx/pipewire-1.6.2-1.fc44.src.rpm'
tool-versioncsmock-3.8.7.20260803.142340.gb75b18e-1.el9