patch-2.8-4.fc44

List of Findings

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1]
patch-2.8/lib/diffseq.h:242:15: warning[-Wanalyzer-malloc-leak]: leak of '<unknown>'
patch-2.8/src/merge.c:505:1: enter_function: entry to 'compute_changes'
patch-2.8/src/merge.c:513:6: branch_false: following 'false' branch...
patch-2.8/src/merge.c:522:3: call_function: calling 'compareseq' from 'compute_changes'
#  240|               big_snake = true;
#  241|             fd[d] = x;
#  242|->           if (odd && bmin <= d && d <= bmax && bd[d] <= x)
#  243|               {
#  244|                 part->xmid = x;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def2]
patch-2.8/lib/diffseq.h:275:15: warning[-Wanalyzer-malloc-leak]: leak of '<unknown>'
patch-2.8/src/merge.c:505:1: enter_function: entry to 'compute_changes'
patch-2.8/src/merge.c:513:6: branch_false: following 'false' branch...
patch-2.8/src/merge.c:522:3: call_function: calling 'compareseq' from 'compute_changes'
#  273|               big_snake = true;
#  274|             bd[d] = x;
#  275|->           if (!odd && fmin <= d && d <= fmax && x <= fd[d])
#  276|               {
#  277|                 part->xmid = x;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def3]
patch-2.8/lib/diffseq.h:406:26: warning[-Wanalyzer-malloc-leak]: leak of '<unknown>'
patch-2.8/src/merge.c:505:1: enter_function: entry to 'compute_changes'
patch-2.8/src/merge.c:513:6: branch_false: following 'false' branch...
patch-2.8/src/merge.c:522:3: call_function: calling 'compareseq' from 'compute_changes'
#  404|             /* Find backward diagonal that minimizes X + Y.  */
#  405|             OFFSET bxybest = OFFSET_MAX, bxbest;
#  406|->           for (d = bmax; d >= bmin; d -= 2)
#  407|               {
#  408|                 OFFSET x = MAX (xoff, bd[d]);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def4]
patch-2.8/lib/diffseq.h:493:15: warning[-Wanalyzer-malloc-leak]: leak of '<unknown>'
patch-2.8/src/merge.c:505:1: enter_function: entry to 'compute_changes'
patch-2.8/src/merge.c:513:6: branch_false: following 'false' branch...
patch-2.8/src/merge.c:522:3: call_function: calling 'compareseq' from 'compute_changes'
#  491|             while (yoff < ylim)
#  492|               {
#  493|->               NOTE_INSERT (ctxt, yoff);
#  494|                 if (EARLY_ABORT (ctxt))
#  495|                   return true;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def5]
patch-2.8/lib/diffseq.h:504:15: warning[-Wanalyzer-malloc-leak]: leak of '<unknown>'
patch-2.8/src/merge.c:505:1: enter_function: entry to 'compute_changes'
patch-2.8/src/merge.c:513:6: branch_false: following 'false' branch...
patch-2.8/src/merge.c:522:3: call_function: calling 'compareseq' from 'compute_changes'
#  502|             while (xoff < xlim)
#  503|               {
#  504|->               NOTE_DELETE (ctxt, xoff);
#  505|                 if (EARLY_ABORT (ctxt))
#  506|                   return true;

Error: COMPILER_WARNING: [#def6]
patch-2.8/lib/parse-datetime.c: scope_hint: In function 'yyparse'
patch-2.8/lib/parse-datetime.c:1596:9: warning[-Wunused-but-set-variable=]: variable 'yynerrs' set but not used
# 1596 |     int yynerrs = 0;
#      |         ^~~~~~~
# 1594|   
# 1595|       /* Number of syntax errors so far.  */
# 1596|->     int yynerrs = 0;
# 1597|   
# 1598|       yy_state_fast_t yystate = 0;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def7]
patch-2.8/lib/parse-datetime.c:1831:3: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value '*<unknown>'
patch-2.8/lib/parse-datetime.y:2404:1: enter_function: entry to 'parse_datetime'
patch-2.8/lib/parse-datetime.y:2409:6: branch_false: following 'false' branch...
patch-2.8/lib/parse-datetime.y:2411:13: branch_false: ...to here
patch-2.8/lib/parse-datetime.y:2411:13: call_function: calling 'parse_datetime_body' from 'parse_datetime'
# 1829|        unconditionally makes the parser a bit smaller, and it avoids a
# 1830|        GCC warning that YYVAL may be used uninitialized.  */
# 1831|->   yyval = yyvsp[1-yylen];
# 1832|   
# 1833|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def8]
patch-2.8/lib/time_rz.c:88:22: warning[-Wanalyzer-malloc-leak]: leak of 'tzalloc(getenv("TZ"))'
patch-2.8/lib/time.h:1114:1: enter_function: entry to 'mktime_z'
patch-2.8/lib/time_rz.c:282:6: branch_false: following 'false' branch (when 'tz' is non-NULL)...
patch-2.8/lib/time_rz.c:286:27: branch_false: ...to here
patch-2.8/lib/time_rz.c:286:27: call_function: calling 'set_tz' from 'mktime_z'
#   86|   {
#   87|     size_t name_size = name ? strlen (name) + 1 : 0;
#   88|->   size_t abbr_size = name_size < ABBR_SIZE_MIN ? ABBR_SIZE_MIN : name_size + 1;
#   89|     timezone_t tz = malloc (FLEXSIZEOF (struct tm_zone, abbrs, abbr_size));
#   90|     if (tz)

Error: GCC_ANALYZER_WARNING (CWE-401): [#def9]
patch-2.8/lib/time_rz.c:206:10: warning[-Wanalyzer-malloc-leak]: leak of 'set_tz(tz)'
patch-2.8/lib/time.h:1114:1: enter_function: entry to 'mktime_z'
patch-2.8/lib/time_rz.c:282:6: branch_false: following 'false' branch (when 'tz' is non-NULL)...
patch-2.8/lib/time_rz.c:286:27: branch_false: ...to here
patch-2.8/lib/time_rz.c:286:27: call_function: calling 'set_tz' from 'mktime_z'
patch-2.8/lib/time_rz.c:286:27: return_function: returning to 'mktime_z' from 'set_tz'
patch-2.8/lib/time_rz.c:287:10: branch_true: following 'true' branch...
patch-2.8/lib/time_rz.c:290:25: branch_true: ...to here
patch-2.8/lib/time_rz.c:206:10: danger: 'set_tz(tz)' leaks here; was allocated at [(10)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/9)
#  204|     if (env_tz
#  205|         ? tz->tz_is_set && strcmp (tz->abbrs, env_tz) == 0
#  206|->       : !tz->tz_is_set)
#  207|       return local_tz;
#  208|     else

Error: GCC_ANALYZER_WARNING (CWE-416): [#def10]
patch-2.8/src/list.h:53:10: warning[-Wanalyzer-use-after-free]: use after 'free' of 'entry'
patch-2.8/src/safe.c:721:1: enter_function: entry to 'safe_access'
patch-2.8/src/safe.c:723:15: call_function: inlined call to 'traverse_path' from 'safe_access'
#   51|   list_empty (const struct list_head *head)
#   52|   {
#   53|->   return head->next == head;
#   54|   }
#   55|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def11]
patch-2.8/src/merge.c:526:1: warning[-Wanalyzer-malloc-leak]: leak of '<unknown>'
patch-2.8/src/merge.c:505:1: enter_function: entry to 'compute_changes'
patch-2.8/src/merge.c:513:6: branch_false: following 'false' branch...
patch-2.8/src/merge.c:522:3: call_function: calling 'compareseq' from 'compute_changes'
patch-2.8/src/merge.c:522:3: return_function: returning to 'compute_changes' from 'compareseq'
patch-2.8/src/merge.c:526:1: danger: '<unknown>' leaks here; was allocated at [(4)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/3)
#  524|     ctxt.fdiag -= ymax + 1;
#  525|     free (ctxt.fdiag);
#  526|-> }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def12]
patch-2.8/src/patch.c:383:13: warning[-Wanalyzer-malloc-leak]: leak of 'outstate.ofp'
patch-2.8/src/patch.c:151:1: enter_function: entry to 'main'
patch-2.8/src/patch.c:200:8: branch_false: following 'false' branch...
patch-2.8/src/patch.c:201:7: branch_false: ...to here
patch-2.8/src/patch.c:206:8: branch_true: following 'true' branch...
patch-2.8/src/patch.c:207:22: branch_true: ...to here
patch-2.8/src/patch.c:207:22: call_function: calling 'open_outfile' from 'main'
patch-2.8/src/patch.c:207:22: return_function: returning to 'main' from 'open_outfile'
patch-2.8/src/patch.c:254:10: branch_false: following 'false' branch...
patch-2.8/src/patch.c:260:7: branch_false: ...to here
patch-2.8/src/patch.c:261:7: call_function: calling 'perfile_cleanup_remove' from 'main'
patch-2.8/src/patch.c:261:7: return_function: returning to 'main' from 'perfile_cleanup_remove'
patch-2.8/src/patch.c:275:10: branch_false: following 'false' branch...
patch-2.8/src/patch.c:277:15: branch_false: ...to here
patch-2.8/src/patch.c:285:10: branch_true: following 'true' branch...
patch-2.8/src/patch.c:285:11: branch_true: ...to here
patch-2.8/src/patch.c:285:11: branch_false: following 'false' branch...
patch-2.8/src/patch.c:294:17: branch_false: ...to here
patch-2.8/src/patch.c:294:14: branch_true: following 'true' branch (when the strings are equal)...
patch-2.8/src/patch.c:296:19: branch_true: ...to here
patch-2.8/src/patch.c:326:10: branch_true: following 'true' branch...
patch-2.8/src/patch.c:327:14: branch_true: ...to here
patch-2.8/src/patch.c:357:10: branch_false: following 'false' branch...
patch-2.8/src/patch.c:361:11: branch_false: ...to here
patch-2.8/src/patch.c:361:10: branch_false: following 'false' branch...
patch-2.8/src/patch.c:372:14: branch_false: ...to here
patch-2.8/src/patch.c:381:12: branch_false: following 'false' branch...
patch-2.8/src/patch.c:381:37: branch_false: ...to here
patch-2.8/src/patch.c:381:13: branch_true: following 'true' branch...
patch-2.8/src/patch.c:383:28: branch_true: ...to here
patch-2.8/src/patch.c:383:13: danger: 'outstate.ofp' leaks here; was allocated at [(12)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/11)
#  381|   	if (! skip_rest_of_patch && ! outfile)
#  382|   	  {
#  383|-> 	    outstate.ofp = fdopen (outfd, binary_transput ? "wb" : "w");
#  384|   	    if (! outstate.ofp)
#  385|   	      pfatal ("%s", tmpout.name);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def13]
patch-2.8/src/patch.c:1578:3: warning[-Wanalyzer-malloc-leak]: leak of 'outstate.ofp'
patch-2.8/src/patch.c:151:1: enter_function: entry to 'main'
patch-2.8/src/patch.c:200:8: branch_false: following 'false' branch...
patch-2.8/src/patch.c:201:7: branch_false: ...to here
patch-2.8/src/patch.c:206:8: branch_true: following 'true' branch...
patch-2.8/src/patch.c:207:22: branch_true: ...to here
patch-2.8/src/patch.c:207:22: call_function: calling 'open_outfile' from 'main'
patch-2.8/src/patch.c:207:22: return_function: returning to 'main' from 'open_outfile'
patch-2.8/src/patch.c:254:10: branch_false: following 'false' branch...
patch-2.8/src/patch.c:260:7: branch_false: ...to here
patch-2.8/src/patch.c:261:7: call_function: calling 'perfile_cleanup_remove' from 'main'
patch-2.8/src/patch.c:261:7: return_function: returning to 'main' from 'perfile_cleanup_remove'
patch-2.8/src/patch.c:275:10: branch_false: following 'false' branch...
patch-2.8/src/patch.c:277:15: branch_false: ...to here
patch-2.8/src/patch.c:285:10: branch_true: following 'true' branch...
patch-2.8/src/patch.c:285:11: branch_true: ...to here
patch-2.8/src/patch.c:285:11: branch_false: following 'false' branch...
patch-2.8/src/patch.c:294:17: branch_false: ...to here
patch-2.8/src/patch.c:294:14: branch_true: following 'true' branch (when the strings are equal)...
patch-2.8/src/patch.c:296:19: branch_true: ...to here
patch-2.8/src/patch.c:326:10: branch_true: following 'true' branch...
patch-2.8/src/patch.c:327:14: branch_true: ...to here
patch-2.8/src/patch.c:345:10: branch_false: following 'false' branch...
patch-2.8/src/patch.c:357:11: branch_false: ...to here
patch-2.8/src/patch.c:357:10: branch_true: following 'true' branch...
patch-2.8/src/patch.c:358:9: call_function: inlined call to 'init_output' from 'main'
# 1576|   init_output (struct outstate *outstate)
# 1577|   {
# 1578|->   outstate->ofp = nullptr;
# 1579|     outstate->after_newline = true;
# 1580|     outstate->zero_output = true;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def14]
patch-2.8/src/patch.c:1833:20: warning[-Wanalyzer-malloc-leak]: leak of 'ximalloc((long int)((long unsigned int)tosize + 200))'
patch-2.8/src/patch.c:1831:6: branch_true: following 'true' branch (when 'alloc' is non-NULL)...
patch-2.8/src/patch.c:1832:5: branch_true: ...to here
patch-2.8/src/patch.c:1833:20: danger: 'ximalloc((long int)((long unsigned int)tosize + 200))' leaks here; was allocated at [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
# 1831|     if (alloc)
# 1832|       from->alloc = nullptr;
# 1833|->   f->from.exists = alloc ? from->exists : volatilize (f->from.alloc);
# 1834|     f->from.temporary = from->temporary;
# 1835|     f->from_st = *from_st;

Error: CPPCHECK_WARNING (CWE-476): [#def15]
patch-2.8/src/patch.c:1835: error[ctunullpointer]: Null pointer dereference: from_st
# 1833|     f->from.exists = alloc ? from->exists : volatilize (f->from.alloc);
# 1834|     f->from.temporary = from->temporary;
# 1835|->   f->from_st = *from_st;
# 1836|     f->to = to ? memcpy (f + 1, to, tosize) : nullptr;
# 1837|     f->mode = mode;

Error: CPPCHECK_WARNING (CWE-457): [#def16]
patch-2.8/src/pch.c:986: warning[uninitvar]: Uninitialized variable: above_minimum
#  984|   		/* The best of the filenames that create the fewest
#  985|   		   directories. */
#  986|-> 		i = best_name (p_name, above_minimum);
#  987|   	      }
#  988|   	  }

Error: CPPCHECK_WARNING (CWE-457): [#def17]
patch-2.8/src/pch.c:1759: error[legacyUninitvar]: Uninitialized variable: s
# 1757|   	  for (s = patchbuf; c_isblank (*s); s++)
# 1758|   	    continue;
# 1759|-> 	if (invalid_line || !c_isdigit (*s))
# 1760|   	  {
# 1761|   	    next_intuit_at(line_beginning,p_input_line);

Error: CPPCHECK_WARNING (CWE-476): [#def18]
patch-2.8/src/pch.c:2399: warning[nullPointerOutOfResources]: If resource allocation fails, then there is a possible null pointer dereference: ifp
# 2397|   	if (!ifp)
# 2398|   	  pfatal ("can't open '%s'", output_name);
# 2399|-> 	while (0 <= (c = getc (ifp)))
# 2400|   	  Fputc (c, ofp);
# 2401|   	if (ferror (ifp) || fclose (ifp) < 0)

Error: GCC_ANALYZER_WARNING (CWE-775): [#def19]
patch-2.8/src/pch.c:2401:12: warning[-Wanalyzer-file-leak]: leak of FILE 'fopen(output_name, "r")'
patch-2.8/src/pch.c:2308:1: enter_function: entry to 'do_ed_script'
patch-2.8/src/pch.c:2315:8: branch_false: following 'false' branch...
patch-2.8/src/pch.c:2324:12: branch_false: following 'false' branch...
patch-2.8/src/pch.c:2326:17: branch_false: ...to here
patch-2.8/src/pch.c:2327:12: branch_false: following 'false' branch (when 'tmpfp' is non-NULL)...
patch-2.8/src/pch.c:2327:12: branch_false: ...to here
patch-2.8/src/pch.c:2334:28: call_function: calling 'get_line' from 'do_ed_script'
patch-2.8/src/pch.c:2334:28: return_function: returning to 'do_ed_script' from 'get_line'
patch-2.8/src/pch.c:2335:12: branch_true: following 'true' branch...
patch-2.8/src/pch.c:2336:13: branch_true: ...to here
patch-2.8/src/pch.c:2359:8: branch_false: following 'false' branch (when 'tmpfp' is non-NULL)...
patch-2.8/src/pch.c:2362:5: branch_false: ...to here
patch-2.8/src/pch.c:2365:8: branch_false: following 'false' branch...
patch-2.8/src/pch.c:2369:9: branch_false: ...to here
patch-2.8/src/pch.c:2375:8: branch_false: following 'false' branch...
patch-2.8/src/pch.c:2377:5: branch_true: following 'true' branch...
patch-2.8/src/pch.c:2378:28: branch_true: ...to here
patch-2.8/src/pch.c:2386:8: branch_false: following 'false' branch...
patch-2.8/src/pch.c:2388:9: branch_false: ...to here
patch-2.8/src/pch.c:2388:8: branch_false: following 'false' branch...
patch-2.8/src/pch.c:2393:8: branch_true: following 'true' branch (when 'ofp' is non-NULL)...
patch-2.8/src/pch.c:2395:21: branch_true: ...to here
patch-2.8/src/pch.c:2395:21: acquire_resource: opened here
patch-2.8/src/pch.c:2397:12: branch_false: following 'false' branch...
patch-2.8/src/pch.c:2397:12: branch_false: ...to here
patch-2.8/src/pch.c:2401:12: danger: 'fopen(output_name, "r")' leaks here; was opened at [(34)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/33)
# 2399|   	while (0 <= (c = getc (ifp)))
# 2400|   	  Fputc (c, ofp);
# 2401|-> 	if (ferror (ifp) || fclose (ifp) < 0)
# 2402|   	  read_fatal ();
# 2403|         }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def20]
patch-2.8/src/pch.c:2401:12: warning[-Wanalyzer-malloc-leak]: leak of 'fopen(output_name, "r")'
patch-2.8/src/pch.c:2308:1: enter_function: entry to 'do_ed_script'
patch-2.8/src/pch.c:2315:8: branch_false: following 'false' branch...
patch-2.8/src/pch.c:2324:12: branch_false: following 'false' branch...
patch-2.8/src/pch.c:2326:17: branch_false: ...to here
patch-2.8/src/pch.c:2327:12: branch_false: following 'false' branch (when 'tmpfp' is non-NULL)...
patch-2.8/src/pch.c:2327:12: branch_false: ...to here
patch-2.8/src/pch.c:2334:28: call_function: calling 'get_line' from 'do_ed_script'
patch-2.8/src/pch.c:2334:28: return_function: returning to 'do_ed_script' from 'get_line'
patch-2.8/src/pch.c:2335:12: branch_true: following 'true' branch...
patch-2.8/src/pch.c:2336:13: branch_true: ...to here
patch-2.8/src/pch.c:2359:8: branch_false: following 'false' branch (when 'tmpfp' is non-NULL)...
patch-2.8/src/pch.c:2362:5: branch_false: ...to here
patch-2.8/src/pch.c:2365:8: branch_false: following 'false' branch...
patch-2.8/src/pch.c:2369:9: branch_false: ...to here
patch-2.8/src/pch.c:2375:8: branch_false: following 'false' branch...
patch-2.8/src/pch.c:2377:5: branch_true: following 'true' branch...
patch-2.8/src/pch.c:2378:28: branch_true: ...to here
patch-2.8/src/pch.c:2386:8: branch_false: following 'false' branch...
patch-2.8/src/pch.c:2388:9: branch_false: ...to here
patch-2.8/src/pch.c:2388:8: branch_false: following 'false' branch...
patch-2.8/src/pch.c:2393:8: branch_true: following 'true' branch (when 'ofp' is non-NULL)...
patch-2.8/src/pch.c:2395:21: branch_true: ...to here
patch-2.8/src/pch.c:2395:21: acquire_memory: allocated here
patch-2.8/src/pch.c:2397:12: branch_false: following 'false' branch...
patch-2.8/src/pch.c:2397:12: branch_false: ...to here
patch-2.8/src/pch.c:2401:12: danger: 'fopen(output_name, "r")' leaks here; was allocated at [(34)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/33)
# 2399|   	while (0 <= (c = getc (ifp)))
# 2400|   	  Fputc (c, ofp);
# 2401|-> 	if (ferror (ifp) || fclose (ifp) < 0)
# 2402|   	  read_fatal ();
# 2403|         }

Error: GCC_ANALYZER_WARNING (CWE-415): [#def21]
patch-2.8/src/safe.c:100:3: warning[-Wanalyzer-double-free]: double-'free' of '((struct cached_dirfd)*((struct list_head *)entry)).name'
patch-2.8/src/safe.c:721:1: enter_function: entry to 'safe_access'
patch-2.8/src/safe.c:723:15: call_function: inlined call to 'traverse_path' from 'safe_access'
#   98|   {
#   99|     list_del (&entry->children_link);
#  100|->   free (entry->name);
#  101|     free (entry);
#  102|   }

Error: GCC_ANALYZER_WARNING (CWE-1341): [#def22]
patch-2.8/src/safe.c:154:3: warning[-Wanalyzer-fd-double-close]: double 'close' of file descriptor '((struct cached_dirfd)*((struct list_head *)entry)).fd'
patch-2.8/src/safe.c:721:1: enter_function: entry to 'safe_access'
patch-2.8/src/safe.c:723:15: call_function: inlined call to 'traverse_path' from 'safe_access'
#  152|     list_del (&entry->lru_link);
#  153|     hash_remove (cached_dirfds, entry);  /* noop when not hashed */
#  154|->   close (entry->fd);
#  155|     free_cached_dirfd (entry);
#  156|   }

Scan Properties