Fixed findings

List of Findings

Error: GCC_ANALYZER_WARNING (CWE-775): [#def1]
ppp-ppp-2.5.1/contrib/pppgetpass/pppgetpass.vt.c:36:3: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/dev/console", 2)’
ppp-ppp-2.5.1/contrib/pppgetpass/pppgetpass.vt.c:30:11: acquire_resource: opened here
ppp-ppp-2.5.1/contrib/pppgetpass/pppgetpass.vt.c:36:3: danger: ‘open("/dev/console", 2)’ leaks here; was opened at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#   34|     seteuid(uid);
#   35|   
#   36|->   openlog(argv[0], LOG_PID, LOG_DAEMON);
#   37|   
#   38|     if(argc!=4) {

Error: GCC_ANALYZER_WARNING (CWE-590): [#def2]
ppp-ppp-2.5.1/pppd/options.c:621:5: warning[-Wanalyzer-free-of-non-heap]: ‘free’ of ‘"file"’ which points to memory not on the heap
ppp-ppp-2.5.1/pppd/options.c:1631:1: enter_function: entry to ‘callfile’
ppp-ppp-2.5.1/pppd/options.c:1638:8: branch_false: following ‘false’ branch...
ppp-ppp-2.5.1/pppd/options.c:1638:8: branch_false: ...to here
ppp-ppp-2.5.1/pppd/options.c:1641:23: branch_true: following ‘true’ branch...
ppp-ppp-2.5.1/pppd/options.c:1642:16: branch_true: ...to here
ppp-ppp-2.5.1/pppd/options.c:1646:20: branch_true: following ‘true’ branch...
ppp-ppp-2.5.1/pppd/options.c:1647:17: branch_true: ...to here
ppp-ppp-2.5.1/pppd/options.c:1652:8: branch_false: following ‘false’ branch (when ‘ok != 0’)...
ppp-ppp-2.5.1/pppd/options.c:1657:9: branch_false: ...to here
ppp-ppp-2.5.1/pppd/options.c:1663:10: call_function: calling ‘ppp_options_from_file’ from ‘callfile’
#  619|   err:
#  620|       fclose(f);
#  621|->     free(option_source);
#  622|       privileged_option = oldpriv;
#  623|       option_source = oldsource;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def3]
ppp-ppp-2.5.1/pppd/peap.c:142:9: warning[-Wanalyzer-null-argument]: use of NULL ‘hash’ where non-null expected
ppp-ppp-2.5.1/pppd/peap.c:116:12: branch_false: following ‘false’ branch (when ‘buf’ is non-NULL)...
ppp-ppp-2.5.1/pppd/peap.c:118:16: branch_false: ...to here
ppp-ppp-2.5.1/pppd/peap.c:118:16: acquire_memory: allocated here
ppp-ppp-2.5.1/pppd/peap.c:119:12: release_memory: assuming ‘hash’ is NULL
ppp-ppp-2.5.1/pppd/peap.c:119:12: branch_true: following ‘true’ branch (when ‘hash’ is NULL)...
ppp-ppp-2.5.1/pppd/peap.c:120:17: branch_true: ...to here
ppp-ppp-2.5.1/pppd/peap.c:122:21: branch_false: following ‘false’ branch (when ‘i >= max_iter’)...
ppp-ppp-2.5.1/pppd/peap.c:142:9: branch_false: ...to here
ppp-ppp-2.5.1/pppd/peap.c:142:9: danger: argument 2 (‘hash’) NULL where non-null expected
#  140|   			buf[j] = hash[i * SHA_DIGEST_LENGTH + j];
#  141|   	}
#  142|-> 	BCOPY(hash, out_buf, pfr_len);
#  143|   	free(hash);
#  144|   	free(buf);

Error: COMPILER_WARNING: [#def4]
ppp-ppp-2.5.1/pppd/plugins/pppoe/common.c:16:19: warning[-Wunused-const-variable=]: 'RCSID' defined but not used
#   16 | static char const RCSID[] =
#      |                   ^~~~~
#   14|   ***********************************************************************/
#   15|   
#   16|-> static char const RCSID[] =
#   17|   "$Id: common.c,v 1.3 2008/06/09 08:34:23 paulus Exp $";
#   18|   

Error: COMPILER_WARNING: [#def5]
ppp-ppp-2.5.1/pppd/plugins/pppoe/common.c:16:19: warning[-Wunused-const-variable=]: ‘RCSID’ defined but not used
#   16 | static char const RCSID[] =
#      |                   ^~~~~
#   14|   ***********************************************************************/
#   15|   
#   16|-> static char const RCSID[] =
#   17|   "$Id: common.c,v 1.3 2008/06/09 08:34:23 paulus Exp $";
#   18|   

Error: COMPILER_WARNING: [#def6]
ppp-ppp-2.5.1/pppd/plugins/pppoe/discovery.c:11:19: warning[-Wunused-const-variable=]: 'RCSID' defined but not used
#   11 | static char const RCSID[] =
#      |                   ^~~~~
#    9|   ***********************************************************************/
#   10|   
#   11|-> static char const RCSID[] =
#   12|   "$Id: discovery.c,v 1.6 2008/06/15 04:35:50 paulus Exp $";
#   13|   

Error: COMPILER_WARNING: [#def7]
ppp-ppp-2.5.1/pppd/plugins/pppoe/discovery.c:11:19: warning[-Wunused-const-variable=]: ‘RCSID’ defined but not used
#   11 | static char const RCSID[] =
#      |                   ^~~~~
#    9|   ***********************************************************************/
#   10|   
#   11|-> static char const RCSID[] =
#   12|   "$Id: discovery.c,v 1.6 2008/06/15 04:35:50 paulus Exp $";
#   13|   

Error: COMPILER_WARNING: [#def8]
ppp-ppp-2.5.1/pppd/plugins/pppoe/if.c:16:19: warning[-Wunused-const-variable=]: 'RCSID' defined but not used
#   16 | static char const RCSID[] =
#      |                   ^~~~~
#   14|   ***********************************************************************/
#   15|   
#   16|-> static char const RCSID[] =
#   17|   "$Id: if.c,v 1.2 2008/06/09 08:34:23 paulus Exp $";
#   18|   

Error: COMPILER_WARNING: [#def9]
ppp-ppp-2.5.1/pppd/plugins/pppoe/if.c:16:19: warning[-Wunused-const-variable=]: ‘RCSID’ defined but not used
#   16 | static char const RCSID[] =
#      |                   ^~~~~
#   14|   ***********************************************************************/
#   15|   
#   16|-> static char const RCSID[] =
#   17|   "$Id: if.c,v 1.2 2008/06/09 08:34:23 paulus Exp $";
#   18|   

Error: COMPILER_WARNING: [#def10]
ppp-ppp-2.5.1/pppd/plugins/pppoe/plugin.c:25:19: warning[-Wunused-const-variable=]: 'RCSID' defined but not used
#   25 | static char const RCSID[] =
#      |                   ^~~~~
#   23|   ***********************************************************************/
#   24|   
#   25|-> static char const RCSID[] =
#   26|   "$Id: plugin.c,v 1.17 2008/06/15 04:35:50 paulus Exp $";
#   27|   

Error: COMPILER_WARNING: [#def11]
ppp-ppp-2.5.1/pppd/plugins/radius/radattr.c:17:19: warning[-Wunused-const-variable=]: 'RCSID' defined but not used
#   17 | static char const RCSID[] =
#      |                   ^~~~~
#   15|   ***********************************************************************/
#   16|   
#   17|-> static char const RCSID[] =
#   18|   "$Id: radattr.c,v 1.2 2004/10/28 00:24:40 paulus Exp $";
#   19|   

Error: COMPILER_WARNING: [#def12]
ppp-ppp-2.5.1/pppd/plugins/radius/radius.c:26:19: warning[-Wunused-const-variable=]: 'RCSID' defined but not used
#   26 | static char const RCSID[] =
#      |                   ^~~~~
#   24|   *
#   25|   ***********************************************************************/
#   26|-> static char const RCSID[] =
#   27|   "$Id: radius.c,v 1.32 2008/05/26 09:18:08 paulus Exp $";
#   28|   

Error: COMPILER_WARNING: [#def13]
ppp-ppp-2.5.1/pppd/plugins/radius/radrealms.c: scope_hint: At top level
ppp-ppp-2.5.1/pppd/plugins/radius/radrealms.c:17:19: warning[-Wunused-const-variable=]: 'RCSID' defined but not used
#   17 | static char const RCSID[] =
#      |                   ^~~~~
#   15|   */
#   16|   
#   17|-> static char const RCSID[] =
#   18|       "$Id: radrealms.c,v 1.2 2004/11/14 07:26:26 paulus Exp $";
#   19|   

Error: COMPILER_WARNING (CWE-704): [#def14]
ppp-ppp-2.5.1/pppd/plugins/radius/radrealms.c: scope_hint: In function 'lookup_realm'
ppp-ppp-2.5.1/pppd/plugins/radius/radrealms.c:63:11: warning[-Wdiscarded-qualifiers]: assignment discards 'const' qualifier from pointer target type
#   63 |     realm = strrchr(user, '@');
#      |           ^
#   61|       accts->max = 0;
#   62|       
#   63|->     realm = strrchr(user, '@');
#   64|       
#   65|       if (realm) {

Error: COMPILER_WARNING (CWE-704): [#def15]
ppp-ppp-2.5.1/pppd/plugins/radius/radrealms.c:63:11: warning[-Wdiscarded-qualifiers]: assignment discards 'const' qualifier from pointer target type
#   61|       accts->max = 0;
#   62|       
#   63|->     realm = strrchr(user, '@');
#   64|       
#   65|       if (realm) {

Error: COMPILER_WARNING (CWE-704): [#def16]
ppp-ppp-2.5.1/pppd/plugins/winbind.c: scope_hint: In function 'strhex_to_str'
ppp-ppp-2.5.1/pppd/plugins/winbind.c:178:26: warning[-Wdiscarded-qualifiers]: assignment discards 'const' qualifier from pointer target type
#  178 |                 if (!(p1 = strchr(hexchars, toupper(strhex[i]))))
#      |                          ^
#  176|   		}
#  177|   
#  178|-> 		if (!(p1 = strchr(hexchars, toupper(strhex[i]))))
#  179|   			break;
#  180|   

Error: COMPILER_WARNING (CWE-704): [#def17]
ppp-ppp-2.5.1/pppd/plugins/winbind.c:178:26: warning[-Wdiscarded-qualifiers]: assignment discards 'const' qualifier from pointer target type
#  176|   		}
#  177|   
#  178|-> 		if (!(p1 = strchr(hexchars, toupper(strhex[i]))))
#  179|   			break;
#  180|   

Error: COMPILER_WARNING (CWE-704): [#def18]
ppp-ppp-2.5.1/pppd/plugins/winbind.c:183:26: warning[-Wdiscarded-qualifiers]: assignment discards 'const' qualifier from pointer target type
#  183 |                 if (!(p2 = strchr(hexchars, toupper(strhex[i]))))
#      |                          ^
#  181|   		i++; /* next hex digit */
#  182|   
#  183|-> 		if (!(p2 = strchr(hexchars, toupper(strhex[i]))))
#  184|   			break;
#  185|   

Error: COMPILER_WARNING (CWE-704): [#def19]
ppp-ppp-2.5.1/pppd/plugins/winbind.c:183:26: warning[-Wdiscarded-qualifiers]: assignment discards 'const' qualifier from pointer target type
#  181|   		i++; /* next hex digit */
#  182|   
#  183|-> 		if (!(p2 = strchr(hexchars, toupper(strhex[i]))))
#  184|   			break;
#  185|   

Error: CPPCHECK_WARNING (CWE-476): [#def20]
ppp-ppp-2.5.1/pppd/sys-linux.c:2228: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: tmp_dev
# 2226|   		/* we need to copy rt_dev because we need it permanent too: */
# 2227|   		char * tmp_dev = malloc(strlen(old_def_rt.rt_dev)+1);
# 2228|-> 		strcpy(tmp_dev, old_def_rt.rt_dev);
# 2229|   		old_def_rt.rt_dev = tmp_dev;
# 2230|   

Error: GCC_ANALYZER_WARNING (CWE-775): [#def21]
ppp-ppp-2.5.1/pppd/sys-linux.c:2382:21: warning[-Wanalyzer-file-leak]: leak of FILE
ppp-ppp-2.5.1/pppd/sys-linux.c:2404:12: enter_function: entry to ‘defaultroute6_exists’
ppp-ppp-2.5.1/pppd/sys-linux.c:2408:10: call_function: calling ‘open_route6_table’ from ‘defaultroute6_exists’
ppp-ppp-2.5.1/pppd/sys-linux.c:2408:10: return_function: returning to ‘defaultroute6_exists’ from ‘open_route6_table’
ppp-ppp-2.5.1/pppd/sys-linux.c:2408:8: branch_false: following ‘false’ branch...
ppp-ppp-2.5.1/pppd/sys-linux.c:2408:8: branch_false: ...to here
ppp-ppp-2.5.1/pppd/sys-linux.c:2411:12: call_function: calling ‘read_route6_table’ from ‘defaultroute6_exists’
# 2380|       p = route_buffer;
# 2381|       for (col = 0; col < route_num_cols; ++col) {
# 2382|-> 	cols[col] = strtok(p, route_delims);
# 2383|   	if (cols[col] == NULL)
# 2384|   	    return 0;		/* didn't get enough columns */

Error: GCC_ANALYZER_WARNING (CWE-401): [#def22]
ppp-ppp-2.5.1/pppd/sys-linux.c:2382:21: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
ppp-ppp-2.5.1/pppd/sys-linux.c:2404:12: enter_function: entry to ‘defaultroute6_exists’
ppp-ppp-2.5.1/pppd/sys-linux.c:2408:10: call_function: calling ‘open_route6_table’ from ‘defaultroute6_exists’
ppp-ppp-2.5.1/pppd/sys-linux.c:2408:10: return_function: returning to ‘defaultroute6_exists’ from ‘open_route6_table’
ppp-ppp-2.5.1/pppd/sys-linux.c:2408:8: branch_false: following ‘false’ branch...
ppp-ppp-2.5.1/pppd/sys-linux.c:2408:8: branch_false: ...to here
ppp-ppp-2.5.1/pppd/sys-linux.c:2411:12: call_function: calling ‘read_route6_table’ from ‘defaultroute6_exists’
# 2380|       p = route_buffer;
# 2381|       for (col = 0; col < route_num_cols; ++col) {
# 2382|-> 	cols[col] = strtok(p, route_delims);
# 2383|   	if (cols[col] == NULL)
# 2384|   	    return 0;		/* didn't get enough columns */

Error: CPPCHECK_WARNING (CWE-457): [#def23]
ppp-ppp-2.5.1/pppd/sys-linux.c:2388: warning[uninitvar]: Uninitialized variable: cols
# 2386|       }
# 2387|   
# 2388|->     hex_to_in6_addr(&rt->rtmsg_dst, cols[route_dest_col]);
# 2389|       rt->rtmsg_dst_len = strtoul(cols[route_dest_plen_col], NULL, 16);
# 2390|       hex_to_in6_addr(&rt->rtmsg_gateway, cols[route_gw_col]);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def24]
ppp-ppp-2.5.1/pppd/sys-linux.c:2388:37: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘cols[<unknown>]’
ppp-ppp-2.5.1/pppd/sys-linux.c:2377:8: branch_false: following ‘false’ branch...
ppp-ppp-2.5.1/pppd/sys-linux.c:2377:8: branch_false: ...to here
ppp-ppp-2.5.1/pppd/sys-linux.c:2381:19: branch_false: following ‘false’ branch...
ppp-ppp-2.5.1/pppd/sys-linux.c:2388:5: branch_false: ...to here
ppp-ppp-2.5.1/pppd/sys-linux.c:2388:37: danger: use of uninitialized value ‘cols[<unknown>]’ here
# 2386|       }
# 2387|   
# 2388|->     hex_to_in6_addr(&rt->rtmsg_dst, cols[route_dest_col]);
# 2389|       rt->rtmsg_dst_len = strtoul(cols[route_dest_plen_col], NULL, 16);
# 2390|       hex_to_in6_addr(&rt->rtmsg_gateway, cols[route_gw_col]);

Error: COMPILER_WARNING: [#def25]
ppp-ppp-2.5.1/pppstats/pppstats.c:39:19: warning[-Wunused-const-variable=]: ‘rcsid’ defined but not used
#   39 | static const char rcsid[] = "$Id: pppstats.c,v 1.29 2002/10/27 12:56:26 fcusack Exp $";
#      |                   ^~~~~
#   37|   
#   38|   #ifndef lint
#   39|-> static const char rcsid[] = "$Id: pppstats.c,v 1.29 2002/10/27 12:56:26 fcusack Exp $";
#   40|   #endif
#   41|

Scan Properties

analyzer-version-clippy1.97.1
analyzer-version-cppcheck2.21.1
analyzer-version-gcc16.1.1
analyzer-version-gcc-analyzer16.1.1
analyzer-version-shellcheck0.11.0
analyzer-version-unicontrol0.0.2
diffbase-analyzer-version-clippy1.97.1
diffbase-analyzer-version-cppcheck2.21.1
diffbase-analyzer-version-gcc16.1.1
diffbase-analyzer-version-gcc-analyzer16.1.1
diffbase-analyzer-version-shellcheck0.11.0
diffbase-analyzer-version-unicontrol0.0.2
diffbase-enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
diffbase-exit-code0
diffbase-hostip-172-16-1-71.us-west-2.compute.internal
diffbase-known-false-positives/usr/share/csmock/known-false-positives.js
diffbase-known-false-positives-rpmknown-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch
diffbase-mock-configfedora-rawhide-x86_64
diffbase-project-nameppp-2.5.3-3.fc45
diffbase-store-results-to/tmp/tmpsramtaak/ppp-2.5.3-3.fc45.tar.xz
diffbase-time-created2026-08-03 19:39:30
diffbase-time-finished2026-08-03 19:41:10
diffbase-toolcsmock
diffbase-tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,clippy,unicontrol,shellcheck,cppcheck' '-o' '/tmp/tmpsramtaak/ppp-2.5.3-3.fc45.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpsramtaak/ppp-2.5.3-3.fc45.src.rpm'
diffbase-tool-versioncsmock-3.8.7.20260803.142340.gb75b18e-1.el9
enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
exit-code0
hostip-172-16-1-71.us-west-2.compute.internal
known-false-positives/usr/share/csmock/known-false-positives.js
known-false-positives-rpmknown-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch
mock-configfedora-rawhide-x86_64
project-nameppp-2.5.1-7.fc44
store-results-to/tmp/tmpsn7p9s1q/ppp-2.5.1-7.fc44.tar.xz
time-created2026-08-03 19:36:47
time-finished2026-08-03 19:39:18
titleFixed findings
toolcsmock
tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,clippy,unicontrol,shellcheck,cppcheck' '-o' '/tmp/tmpsn7p9s1q/ppp-2.5.1-7.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpsn7p9s1q/ppp-2.5.1-7.fc44.src.rpm'
tool-versioncsmock-3.8.7.20260803.142340.gb75b18e-1.el9