Newly introduced findings

List of Findings

Error: SHELLCHECK_WARNING: [#def1]
/usr/lib64/qemu/tests-src/tests/qemu-iotests/128:46:9: warning[SC2215]: This flag is used as a command name. Bad line break or missing [ .. ]?
#   44|   		if [ "$?" -eq 0 ]; then
#   45|   			DEV="/dev/mapper/$devname"
#   46|-> 			if ! -e $DEV
#   47|   			then
#   48|   				_notrun "Device $DEV not appearing"

Error: GCC_ANALYZER_WARNING (CWE-476): [#def2]
qemu-11.1.0-rc2/backends/igvm.c:902:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ctx.cgsc’
qemu-11.1.0-rc2/backends/igvm.c:989:5: enter_function: entry to ‘qigvm_process_file’
qemu-11.1.0-rc2/backends/igvm.c:998:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/backends/igvm.c:1002:5: branch_false: ...to here
qemu-11.1.0-rc2/backends/igvm.c:1012:16: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/backends/igvm.c:1012:5: branch_false: ...to here
qemu-11.1.0-rc2/backends/igvm.c:1020:9: call_function: calling ‘qigvm_supported_platform_compat_mask’ from ‘qigvm_process_file’
#  900|               if ((platform->platform_type == IGVM_PLATFORM_TYPE_SEV_ES) &&
#  901|                   ctx->machine_state->cgs) {
#  902|->                 if (ctx->cgsc->check_support(
#  903|                           CGS_PLATFORM_SEV_ES, platform->platform_version,
#  904|                           platform->highest_vtl, platform->shared_gpa_boundary)) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def3]
qemu-11.1.0-rc2/backends/igvm.c:909:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ctx.cgsc’
qemu-11.1.0-rc2/backends/igvm.c:989:5: enter_function: entry to ‘qigvm_process_file’
qemu-11.1.0-rc2/backends/igvm.c:998:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/backends/igvm.c:1002:5: branch_false: ...to here
qemu-11.1.0-rc2/backends/igvm.c:1012:16: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/backends/igvm.c:1012:5: branch_false: ...to here
qemu-11.1.0-rc2/backends/igvm.c:1020:9: call_function: calling ‘qigvm_supported_platform_compat_mask’ from ‘qigvm_process_file’
#  907|               } else if ((platform->platform_type == IGVM_PLATFORM_TYPE_SEV) &&
#  908|                          ctx->machine_state->cgs) {
#  909|->                 if (ctx->cgsc->check_support(
#  910|                           CGS_PLATFORM_SEV, platform->platform_version,
#  911|                           platform->highest_vtl, platform->shared_gpa_boundary)) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def4]
qemu-11.1.0-rc2/backends/igvm.c:917:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ctx.cgsc’
qemu-11.1.0-rc2/backends/igvm.c:989:5: enter_function: entry to ‘qigvm_process_file’
qemu-11.1.0-rc2/backends/igvm.c:998:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/backends/igvm.c:1002:5: branch_false: ...to here
qemu-11.1.0-rc2/backends/igvm.c:1012:16: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/backends/igvm.c:1012:5: branch_false: ...to here
qemu-11.1.0-rc2/backends/igvm.c:1020:9: call_function: calling ‘qigvm_supported_platform_compat_mask’ from ‘qigvm_process_file’
#  915|                           IGVM_PLATFORM_TYPE_SEV_SNP) &&
#  916|                          ctx->machine_state->cgs) {
#  917|->                 if (ctx->cgsc->check_support(
#  918|                           CGS_PLATFORM_SEV_SNP, platform->platform_version,
#  919|                           platform->highest_vtl, platform->shared_gpa_boundary)) {

Error: CPPCHECK_WARNING (CWE-562): [#def5]
qemu-11.1.0-rc2/disas/m68k.c:1904: error[autoVariables]: Address of local auto-variable assigned to a function parameter.
# 1902|       }
# 1903|   
# 1904|->   info->private_data = (PTR) &priv;
# 1905|     /* Tell objdump to use two bytes per chunk
# 1906|        and six bytes per line for displaying raw data.  */

Error: CPPCHECK_WARNING (CWE-758): [#def6]
qemu-11.1.0-rc2/disas/sparc.c:2518: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 2516|     for (i = 0; i < 32; ++i)
# 2517|       {
# 2518|->       unsigned long int x = 1 << i;
# 2519|         int x0 = (match0 & x) != 0;
# 2520|         int x1 = (match1 & x) != 0;

Error: CPPCHECK_WARNING (CWE-758): [#def7]
qemu-11.1.0-rc2/disas/sparc.c:2528: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 2526|     for (i = 0; i < 32; ++i)
# 2527|       {
# 2528|->       unsigned long int x = 1 << i;
# 2529|         int x0 = (lose0 & x) != 0;
# 2530|         int x1 = (lose1 & x) != 0;

Error: CPPCHECK_WARNING (CWE-476): [#def8]
qemu-11.1.0-rc2/disas/sparc.c:2691: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: sorted_opcodes
# 2689|         /* Reset the sorted table so we can resort it.  */
# 2690|         for (i = 0; i < sparc_num_opcodes; ++i)
# 2691|->         sorted_opcodes[i] = &sparc_opcodes[i];
# 2692|         qsort ((char *) sorted_opcodes, sparc_num_opcodes,
# 2693|                sizeof (sorted_opcodes[0]), compare_opcodes);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def9]
qemu-11.1.0-rc2/hw/arm/tegra241-cmdqv.c:230:5: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
qemu-11.1.0-rc2/hw/arm/tegra241-cmdqv.c:675:13: enter_function: entry to ‘tegra241_cmdqv_writel_mmio’
qemu-11.1.0-rc2/hw/arm/tegra241-cmdqv.c:710:12: branch_true: following ‘true’ branch...
qemu-11.1.0-rc2/hw/arm/tegra241-cmdqv.c:711:13: branch_true: ...to here
qemu-11.1.0-rc2/hw/arm/tegra241-cmdqv.c:711:13: call_function: calling ‘tegra241_cmdqv_setup_vcmdq’ from ‘tegra241_cmdqv_writel_mmio’
#  228|   
#  229|       ptr = tegra241_cmdqv_vintf_lvcmdq_ptr(cmdqv, index, A_VCMDQ0_PROD_INDX);
#  230|->     *ptr = cmdqv->vcmdq_prod_indx[index];
#  231|   
#  232|       ptr = tegra241_cmdqv_vintf_lvcmdq_ptr(cmdqv, index, A_VCMDQ0_CONFIG);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def10]
qemu-11.1.0-rc2/hw/arm/tegra241-cmdqv.c:233:5: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
qemu-11.1.0-rc2/hw/arm/tegra241-cmdqv.c:675:13: enter_function: entry to ‘tegra241_cmdqv_writel_mmio’
qemu-11.1.0-rc2/hw/arm/tegra241-cmdqv.c:710:12: branch_true: following ‘true’ branch...
qemu-11.1.0-rc2/hw/arm/tegra241-cmdqv.c:711:13: branch_true: ...to here
qemu-11.1.0-rc2/hw/arm/tegra241-cmdqv.c:711:13: call_function: calling ‘tegra241_cmdqv_setup_vcmdq’ from ‘tegra241_cmdqv_writel_mmio’
#  231|   
#  232|       ptr = tegra241_cmdqv_vintf_lvcmdq_ptr(cmdqv, index, A_VCMDQ0_CONFIG);
#  233|->     *ptr = cmdqv->vcmdq_config[index];
#  234|   }
#  235|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def11]
qemu-11.1.0-rc2/hw/block/xen-block.c:913:10: warning[-Wanalyzer-null-argument]: use of NULL ‘filename’ where non-null expected
qemu-11.1.0-rc2/hw/block/xen-block.c:870:23: enter_function: entry to ‘xen_block_drive_create’
qemu-11.1.0-rc2/hw/block/xen-block.c:888:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/hw/block/xen-block.c:893:9: branch_false: ...to here
qemu-11.1.0-rc2/hw/block/xen-block.c:894:8: branch_true: following ‘true’ branch...
qemu-11.1.0-rc2/hw/block/xen-block.c:895:20: branch_true: ...to here
qemu-11.1.0-rc2/hw/block/xen-block.c:913:10: danger: argument 1 (‘filename’) NULL where non-null expected
#  911|       drive->id = g_strdup(id);
#  912|   
#  913|->     rc = stat(filename, &st);
#  914|       if (rc) {
#  915|           error_setg_errno(errp, errno, "Could not stat file '%s'", filename);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def12]
qemu-11.1.0-rc2/hw/i3c/core.c:480:5: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*num_read’
qemu-11.1.0-rc2/hw/i3c/core.c:443:5: enter_function: entry to ‘i3c_recv_byte’
qemu-11.1.0-rc2/hw/i3c/core.c:450:12: call_function: calling ‘i3c_recv’ from ‘i3c_recv_byte’
#  478|       }
#  479|   
#  480|->     trace_i3c_recv(*num_read, num_to_read, ret == 0);
#  481|   
#  482|       return ret;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def13]
qemu-11.1.0-rc2/hw/uefi/var-service-pcap.c:28:5: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘fp’ where non-null expected
qemu-11.1.0-rc2/hw/uefi/var-service-pcap.c:54:6: enter_function: entry to ‘uefi_vars_pcap_init’
qemu-11.1.0-rc2/hw/uefi/var-service-pcap.c:58:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/hw/uefi/var-service-pcap.c:62:10: branch_false: ...to here
qemu-11.1.0-rc2/hw/uefi/var-service-pcap.c:65:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/hw/uefi/var-service-pcap.c:69:18: branch_false: ...to here
qemu-11.1.0-rc2/hw/uefi/var-service-pcap.c:69:18: acquire_memory: this call could return NULL
qemu-11.1.0-rc2/hw/uefi/var-service-pcap.c:70:5: call_function: calling ‘uefi_vars_pcap_header’ from ‘uefi_vars_pcap_init’
#   26|       };
#   27|   
#   28|->     fwrite(&header, sizeof(header), 1, fp);
#   29|       fflush(fp);
#   30|   }

Error: GCC_ANALYZER_WARNING (CWE-415): [#def14]
qemu-11.1.0-rc2/hw/usb/redirect.c:2200:17: warning[-Wanalyzer-double-free]: double-‘free’ of ‘data’
qemu-11.1.0-rc2/hw/usb/redirect.c:2148:13: enter_function: entry to ‘usbredir_buffered_bulk_packet’
qemu-11.1.0-rc2/hw/usb/redirect.c:2160:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/hw/usb/redirect.c:2166:9: branch_false: ...to here
qemu-11.1.0-rc2/hw/usb/redirect.c:2166:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/hw/usb/redirect.c:2173:5: branch_false: ...to here
qemu-11.1.0-rc2/hw/usb/redirect.c:2173:5: branch_true: following ‘true’ branch...
qemu-11.1.0-rc2/hw/usb/redirect.c:2174:5: branch_true: ...to here
qemu-11.1.0-rc2/hw/usb/redirect.c:2177:17: branch_true: following ‘true’ branch (when ‘i < data_len’)...
qemu-11.1.0-rc2/hw/usb/redirect.c:2179:20: branch_true: ...to here
qemu-11.1.0-rc2/hw/usb/redirect.c:2185:13: call_function: calling ‘bufp_alloc’ from ‘usbredir_buffered_bulk_packet’
qemu-11.1.0-rc2/hw/usb/redirect.c:2185:13: return_function: returning to ‘usbredir_buffered_bulk_packet’ from ‘bufp_alloc’
qemu-11.1.0-rc2/hw/usb/redirect.c:2186:12: branch_true: following ‘true’ branch...
qemu-11.1.0-rc2/hw/usb/redirect.c:2186:12: branch_true: ...to here
qemu-11.1.0-rc2/hw/usb/redirect.c:2199:16: branch_true: following ‘true’ branch (when ‘free_on_destroy’ is NULL)...
qemu-11.1.0-rc2/hw/usb/redirect.c:2200:17: branch_true: ...to here
qemu-11.1.0-rc2/hw/usb/redirect.c:2200:17: danger: second ‘free’ here; first ‘free’ was at [(16)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/15)
# 2198|               }
# 2199|               if (!free_on_destroy) {
# 2200|->                 free(data);
# 2201|               }
# 2202|               break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def15]
qemu-11.1.0-rc2/hw/virtio/virtio-pci.c:1297:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘qdev’
qemu-11.1.0-rc2/hw/virtio/virtio-pci.c:1244:12: enter_function: entry to ‘virtio_pci_set_guest_notifiers’
qemu-11.1.0-rc2/hw/virtio/virtio-pci.c:1247:26: call_function: inlined call to ‘virtio_bus_get_device’ from ‘virtio_pci_set_guest_notifiers’
qemu-11.1.0-rc2/hw/virtio/virtio-pci.c:1248:28: branch_false: ...to here
qemu-11.1.0-rc2/hw/virtio/virtio-pci.c:1268:8: branch_true: following ‘true’ branch...
qemu-11.1.0-rc2/hw/virtio/virtio-pci.c:1268:9: branch_true: ...to here
qemu-11.1.0-rc2/hw/virtio/virtio-pci.c:1290:9: call_function: calling ‘virtio_pci_set_guest_notifier’ from ‘virtio_pci_set_guest_notifiers’
qemu-11.1.0-rc2/hw/virtio/virtio-pci.c:1290:9: return_function: returning to ‘virtio_pci_set_guest_notifiers’ from ‘virtio_pci_set_guest_notifier’
qemu-11.1.0-rc2/hw/virtio/virtio-pci.c:1292:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/hw/virtio/virtio-pci.c:1296:8: branch_false: ...to here
qemu-11.1.0-rc2/hw/virtio/virtio-pci.c:1296:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/hw/virtio/virtio-pci.c:1297:11: branch_false: ...to here
qemu-11.1.0-rc2/hw/virtio/virtio-pci.c:1297:11: danger: dereference of NULL ‘qdev’
# 1295|       /* Must set vector notifier after guest notifier has been assigned */
# 1296|       if ((with_irqfd ||
# 1297|->          (vdev->use_guest_notifier_mask && k->guest_notifier_mask)) &&
# 1298|           assign) {
# 1299|           if (with_irqfd) {

Error: GCC_ANALYZER_WARNING (CWE-1335): [#def16]
qemu-11.1.0-rc2/include/fpu/softfloat-macros.h:373:32: warning[-Wanalyzer-shift-count-overflow]: shift by count (‘64’) >= precision of type (‘64’)
qemu-11.1.0-rc2/fpu/softfloat.c:5032:10: enter_function: entry to ‘normalizeRoundAndPackFloatx80’
qemu-11.1.0-rc2/fpu/softfloat.c:5039:8: branch_true: following ‘true’ branch (when ‘zSig0 == 0’)...
qemu-11.1.0-rc2/fpu/softfloat.c:5042:9: branch_true: ...to here
qemu-11.1.0-rc2/fpu/softfloat.c:5044:18: call_function: inlined call to ‘clz64’ from ‘normalizeRoundAndPackFloatx80’
qemu-11.1.0-rc2/fpu/softfloat.c:5045:5: call_function: inlined call to ‘shortShift128Left’ from ‘normalizeRoundAndPackFloatx80’
#  371|   {
#  372|       *z1Ptr = a1 << count;
#  373|->     *z0Ptr = count == 0 ? a0 : (a0 << count) | (a1 >> (-count & 63));
#  374|   }
#  375|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def17]
qemu-11.1.0-rc2/include/hw/virtio/vhost.h:206:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
qemu-11.1.0-rc2/hw/net/vhost_net.c:597:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/hw/net/vhost_net.c:601:5: branch_false: ...to here
qemu-11.1.0-rc2/hw/net/vhost_net.c:603:12: call_function: inlined call to ‘vhost_dev_set_vring_enable’ from ‘vhost_net_set_vring_enable’
#  204|   static inline int vhost_dev_set_vring_enable(struct vhost_dev *hdev, int enable)
#  205|   {
#  206|->     if (!hdev->vhost_ops->vhost_set_vring_enable) {
#  207|           return 0;
#  208|       }

Error: CPPCHECK_WARNING (CWE-476): [#def18]
qemu-11.1.0-rc2/include/qemu/bswap.h:142: error[ctunullpointer]: Null pointer dereference: p
#  140|   CPU_CONVERT(be, 64, uint64_t)
#  141|   
#  142|-> CPU_CONVERT(le, 16, uint16_t)
#  143|   CPU_CONVERT(le, 32, uint32_t)
#  144|   CPU_CONVERT(le, 64, uint64_t)

Error: CPPCHECK_WARNING (CWE-476): [#def19]
qemu-11.1.0-rc2/include/qemu/bswap.h:143: error[ctunullpointer]: Null pointer dereference: p
#  141|   
#  142|   CPU_CONVERT(le, 16, uint16_t)
#  143|-> CPU_CONVERT(le, 32, uint32_t)
#  144|   CPU_CONVERT(le, 64, uint64_t)
#  145|   

Error: CPPCHECK_WARNING (CWE-476): [#def20]
qemu-11.1.0-rc2/include/qemu/bswap.h:144: error[ctunullpointer]: Null pointer dereference: p
#  142|   CPU_CONVERT(le, 16, uint16_t)
#  143|   CPU_CONVERT(le, 32, uint32_t)
#  144|-> CPU_CONVERT(le, 64, uint64_t)
#  145|   
#  146|   #undef CPU_CONVERT

Error: GCC_ANALYZER_WARNING (CWE-476): [#def21]
qemu-11.1.0-rc2/monitor/hmp-cmds.c:759:5: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mr’
qemu-11.1.0-rc2/monitor/hmp-cmds.c:750:19: release_memory: ‘mr’ is NULL
qemu-11.1.0-rc2/monitor/hmp-cmds.c:754:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/monitor/hmp-cmds.c:761:28: branch_false: ...to here
qemu-11.1.0-rc2/monitor/hmp-cmds.c:761:28: release_memory: ‘mr’ is NULL
qemu-11.1.0-rc2/monitor/hmp-cmds.c:759:5: danger: dereference of NULL ‘mr’
#  757|       }
#  758|   
#  759|->     monitor_printf(mon, "Host virtual address for 0x%" HWADDR_PRIx
#  760|                      " (%s) is %p\n",
#  761|                      addr, mr->name, ptr);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def22]
qemu-11.1.0-rc2/monitor/hmp-cmds.c:837:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mr’
qemu-11.1.0-rc2/monitor/hmp-cmds.c:819:6: enter_function: entry to ‘hmp_gpa2hpa’
qemu-11.1.0-rc2/monitor/hmp-cmds.c:823:19: release_memory: ‘mr’ is NULL
qemu-11.1.0-rc2/monitor/hmp-cmds.c:828:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/monitor/hmp-cmds.c:833:16: branch_false: ...to here
qemu-11.1.0-rc2/monitor/hmp-cmds.c:833:16: call_function: calling ‘vtop’ from ‘hmp_gpa2hpa’
qemu-11.1.0-rc2/monitor/hmp-cmds.c:833:16: return_function: returning to ‘hmp_gpa2hpa’ from ‘vtop’
qemu-11.1.0-rc2/monitor/hmp-cmds.c:834:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/monitor/hmp-cmds.c:839:32: branch_false: ...to here
qemu-11.1.0-rc2/monitor/hmp-cmds.c:839:32: release_memory: ‘mr’ is NULL
qemu-11.1.0-rc2/monitor/hmp-cmds.c:837:9: danger: dereference of NULL ‘mr’
#  835|           error_report_err(local_err);
#  836|       } else {
#  837|->         monitor_printf(mon, "Host physical address for 0x%" HWADDR_PRIx
#  838|                          " (%s) is 0x%" PRIx64 "\n",
#  839|                          addr, mr->name, (uint64_t) physaddr);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def23]
qemu-11.1.0-rc2/net/af-xdp.c:78:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘s’
qemu-11.1.0-rc2/net/af-xdp.c:450:5: enter_function: entry to ‘net_init_af_xdp’
qemu-11.1.0-rc2/net/af-xdp.c:465:8: branch_false: following ‘false’ branch (when ‘ifindex != 0’)...
qemu-11.1.0-rc2/net/af-xdp.c:471:9: branch_false: ...to here
qemu-11.1.0-rc2/net/af-xdp.c:471:9: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/net/af-xdp.c:477:5: branch_false: ...to here
qemu-11.1.0-rc2/net/af-xdp.c:477:5: branch_true: following ‘true’ branch...
qemu-11.1.0-rc2/net/af-xdp.c:477:33: branch_true: ...to here
qemu-11.1.0-rc2/net/af-xdp.c:480:9: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/net/af-xdp.c:488:9: branch_false: ...to here
qemu-11.1.0-rc2/net/af-xdp.c:504:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/net/af-xdp.c:510:5: branch_false: ...to here
qemu-11.1.0-rc2/net/af-xdp.c:510:17: branch_false: following ‘false’ branch (when ‘i >= queues’)...
qemu-11.1.0-rc2/net/af-xdp.c:536:9: branch_false: ...to here
qemu-11.1.0-rc2/net/af-xdp.c:536:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/net/af-xdp.c:546:5: call_function: inlined call to ‘af_xdp_read_poll’ from ‘net_init_af_xdp’
#   76|   static void af_xdp_read_poll(AFXDPState *s, bool enable)
#   77|   {
#   78|->     if (s->read_poll != enable) {
#   79|           s->read_poll = enable;
#   80|           af_xdp_update_fd_handler(s);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def24]
qemu-11.1.0-rc2/subprojects/libvduse/libvduse.c:273:12: warning[-Wanalyzer-malloc-leak]: leak of ‘*vq.resubmit_list’
qemu-11.1.0-rc2/subprojects/libvduse/libvduse.c:1007:5: enter_function: entry to ‘vduse_dev_handler’
qemu-11.1.0-rc2/subprojects/libvduse/libvduse.c:1015:8: branch_false: following ‘false’ branch (when ‘ret == 152’)...
qemu-11.1.0-rc2/subprojects/libvduse/libvduse.c:1020:23: branch_false: ...to here
qemu-11.1.0-rc2/subprojects/libvduse/libvduse.c:1029:12: branch_true: following ‘true’ branch...
qemu-11.1.0-rc2/subprojects/libvduse/libvduse.c:1030:13: branch_true: ...to here
qemu-11.1.0-rc2/subprojects/libvduse/libvduse.c:1030:13: call_function: calling ‘vduse_dev_start_dataplane’ from ‘vduse_dev_handler’
#  271|           }
#  272|   
#  273|->         if (vq->resubmit_num > 1) {
#  274|               qsort(vq->resubmit_list, vq->resubmit_num,
#  275|                     sizeof(VduseVirtqInflightDesc), inflight_desc_compare);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def25]
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:876:5: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘fopen(argv[1], "rb")’ where non-null expected
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:822:8: branch_false: following ‘false’ branch (when ‘argc == 5’)...
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:839:26: branch_false: ...to here
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:858:5: branch_true: following ‘true’ branch...
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:859:5: branch_true: ...to here
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:875:24: acquire_memory: this call could return NULL
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:876:5: danger: argument 1 (‘fopen(argv[1], "rb")’) from [(5)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/4) could be NULL where non-null expected
#  874|       /* Read input file */
#  875|       FILE *input_file = fopen(argv[ARG_INDEX_IDEFS], "rb");
#  876|->     fseek(input_file, 0L, SEEK_END);
#  877|       long input_size = ftell(input_file);
#  878|       context.input_buffer = (char *) calloc(input_size + 1, sizeof(char));

Error: GCC_ANALYZER_WARNING (CWE-775): [#def26]
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:878:44: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(argv[1], "rb")’
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:822:8: branch_false: following ‘false’ branch (when ‘argc == 5’)...
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:839:26: branch_false: ...to here
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:858:5: branch_true: following ‘true’ branch...
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:859:5: branch_true: ...to here
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:875:24: acquire_resource: opened here
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:878:44: danger: ‘fopen(argv[1], "rb")’ leaks here; was opened at [(5)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/4)
#  876|       fseek(input_file, 0L, SEEK_END);
#  877|       long input_size = ftell(input_file);
#  878|->     context.input_buffer = (char *) calloc(input_size + 1, sizeof(char));
#  879|       fseek(input_file, 0L, SEEK_SET);
#  880|       size_t read_chars = fread(context.input_buffer,

Error: GCC_ANALYZER_WARNING (CWE-401): [#def27]
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:878:44: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(argv[1], "rb")’
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:822:8: branch_false: following ‘false’ branch (when ‘argc == 5’)...
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:839:26: branch_false: ...to here
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:858:5: branch_true: following ‘true’ branch...
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:859:5: branch_true: ...to here
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:875:24: acquire_memory: allocated here
qemu-11.1.0-rc2/target/hexagon/idef-parser/idef-parser.y:878:44: danger: ‘fopen(argv[1], "rb")’ leaks here; was allocated at [(5)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/4)
#  876|       fseek(input_file, 0L, SEEK_END);
#  877|       long input_size = ftell(input_file);
#  878|->     context.input_buffer = (char *) calloc(input_size + 1, sizeof(char));
#  879|       fseek(input_file, 0L, SEEK_SET);
#  880|       size_t read_chars = fread(context.input_buffer,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def28]
qemu-11.1.0-rc2/ui/gtk.c:1621:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
qemu-11.1.0-rc2/ui/gtk.c:1600:13: enter_function: entry to ‘gd_menu_full_screen’
qemu-11.1.0-rc2/ui/gtk.c:1605:8: branch_false: following ‘false’ branch...
qemu-11.1.0-rc2/ui/gtk.c:1614:33: branch_false: ...to here
qemu-11.1.0-rc2/ui/gtk.c:1615:9: call_function: calling ‘gd_menu_show_tabs’ from ‘gd_menu_full_screen’
qemu-11.1.0-rc2/ui/gtk.c:1615:9: return_function: returning to ‘gd_menu_full_screen’ from ‘gd_menu_show_tabs’
qemu-11.1.0-rc2/ui/gtk.c:1621:13: danger: dereference of NULL ‘gd_vc_find_current(opaque)’
# 1619|           }
# 1620|           s->full_screen = FALSE;
# 1621|->         if (vc->type == GD_VC_GFX) {
# 1622|               vc->gfx.scale_x = vc->gfx.preferred_scale;
# 1623|               vc->gfx.scale_y = vc->gfx.preferred_scale;

Scan Properties

analyzer-version-clippy1.97.1
analyzer-version-cppcheck2.21.1
analyzer-version-gcc16.1.1
analyzer-version-gcc-analyzer16.1.1
analyzer-version-shellcheck0.11.0
analyzer-version-unicontrol0.0.2
diffbase-analyzer-version-clippy1.97.1
diffbase-analyzer-version-cppcheck2.21.1
diffbase-analyzer-version-gcc16.1.1
diffbase-analyzer-version-gcc-analyzer16.1.1
diffbase-analyzer-version-shellcheck0.11.0
diffbase-analyzer-version-unicontrol0.0.2
diffbase-enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
diffbase-exit-code0
diffbase-hostip-172-16-1-113.us-west-2.compute.internal
diffbase-known-false-positives/usr/share/csmock/known-false-positives.js
diffbase-known-false-positives-rpmknown-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch
diffbase-mock-configfedora-rawhide-x86_64
diffbase-project-nameqemu-10.2.2-1.fc44
diffbase-store-results-to/tmp/tmp8nk7marj/qemu-10.2.2-1.fc44.tar.xz
diffbase-time-created2026-08-03 20:16:23
diffbase-time-finished2026-08-03 21:20:11
diffbase-toolcsmock
diffbase-tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,clippy,unicontrol,shellcheck,cppcheck' '-o' '/tmp/tmp8nk7marj/qemu-10.2.2-1.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmp8nk7marj/qemu-10.2.2-1.fc44.src.rpm'
diffbase-tool-versioncsmock-3.8.7.20260803.142340.gb75b18e-1.el9
enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
exit-code0
hostip-172-16-1-113.us-west-2.compute.internal
known-false-positives/usr/share/csmock/known-false-positives.js
known-false-positives-rpmknown-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch
mock-configfedora-rawhide-x86_64
project-nameqemu-11.1.0-0.1.rc2.fc45
store-results-to/tmp/tmpnh56_q61/qemu-11.1.0-0.1.rc2.fc45.tar.xz
time-created2026-08-03 21:21:56
time-finished2026-08-03 22:20:54
titleNewly introduced findings
toolcsmock
tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,clippy,unicontrol,shellcheck,cppcheck' '-o' '/tmp/tmpnh56_q61/qemu-11.1.0-0.1.rc2.fc45.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpnh56_q61/qemu-11.1.0-0.1.rc2.fc45.src.rpm'
tool-versioncsmock-3.8.7.20260803.142340.gb75b18e-1.el9