Fixed findings

List of Findings

Error: SHELLCHECK_WARNING: [#def1]
/etc/qemu-ga/fsfreeze-hook:27:18: warning[SC3020]: In POSIX sh, &> is undefined.
#   25|   [ ! -w "$LOGFILE" ] && USE_SYSLOG=1
#   26|   # try to update log file and fallback to syslog if it fails
#   27|-> touch "$LOGFILE" &>/dev/null || USE_SYSLOG=1
#   28|   
#   29|   # Ensure the log file is writable, fallback to syslog if not

Error: SHELLCHECK_WARNING: [#def2]
/etc/qemu-ga/fsfreeze-hook:31:5: warning[SC3043]: In POSIX sh, 'local' is undefined.
#   29|   # Ensure the log file is writable, fallback to syslog if not
#   30|   log_message() {
#   31|->     local message="$1"
#   32|       if [ "$USE_SYSLOG" -eq 0 ]; then
#   33|           printf "%s: %s\n" "$(date)" "$message" >>"$LOGFILE"

Error: SHELLCHECK_WARNING (CWE-138): [#def3]
/etc/qemu-ga/fsfreeze-hook:46:34: error[SC2145]: Argument mixes string and array. Use * or separate argument.
#   44|       [ -x "$file" ] || continue
#   45|   
#   46|->     log_message "Executing $file $@"
#   47|       if [ "$USE_SYSLOG" -eq 0 ]; then
#   48|           "$file" "$@" >>"$LOGFILE" 2>&1

Error: SHELLCHECK_WARNING: [#def4]
/etc/qemu-ga/fsfreeze-hook:52:16: warning[SC3028]: In POSIX sh, PIPESTATUS is undefined.
#   50|       else
#   51|           "$file" "$@" 2>&1 | logger -t qemu-ga-freeze-hook
#   52|->         STATUS=${PIPESTATUS[0]}
#   53|       fi
#   54|   

Error: SHELLCHECK_WARNING: [#def5]
/etc/qemu-ga/fsfreeze-hook:52:16: warning[SC3054]: In POSIX sh, array references are undefined.
#   50|       else
#   51|           "$file" "$@" 2>&1 | logger -t qemu-ga-freeze-hook
#   52|->         STATUS=${PIPESTATUS[0]}
#   53|       fi
#   54|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def6]
qemu-10.2.2/audio/audio.c:1565:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘drv’
qemu-10.2.2/audio/audio.c:1799:15: enter_function: entry to ‘audio_get_default_audio_be’
qemu-10.2.2/audio/audio.c:1801:8: branch_true: following ‘true’ branch...
qemu-10.2.2/audio/audio.c:1802:28: branch_true: ...to here
qemu-10.2.2/audio/audio.c:1802:28: call_function: calling ‘audio_init’ from ‘audio_get_default_audio_be’
# 1563|                                 Audiodev *dev, Error **errp)
# 1564|   {
# 1565|->     s->drv_opaque = drv->init(dev, errp);
# 1566|       if (!s->drv_opaque) {
# 1567|           return false;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def7]
qemu-10.2.2/hw/9pfs/9p.c:1440:10: warning[-Wanalyzer-null-argument]: use of NULL ‘version.data’ where non-null expected
qemu-10.2.2/hw/9pfs/9p.c:1423:26: enter_function: entry to ‘v9fs_version’
qemu-10.2.2/hw/9pfs/9p.c:1431:5: call_function: inlined call to ‘v9fs_string_init’ from ‘v9fs_version’
qemu-10.2.2/hw/9pfs/9p.c:1433:8: branch_false: following ‘false’ branch...
qemu-10.2.2/hw/9pfs/9p.c:1436:5: branch_false: ...to here
qemu-10.2.2/hw/9pfs/9p.c:1436:5: release_memory: ‘version.data’ is NULL
qemu-10.2.2/hw/9pfs/9p.c:1440:17: release_memory: ‘version.data’ is NULL
qemu-10.2.2/hw/9pfs/9p.c:1440:10: danger: argument 1 (‘version.data’) NULL where non-null expected
# 1438|       virtfs_reset(pdu);
# 1439|   
# 1440|->     if (!strcmp(version.data, "9P2000.u")) {
# 1441|           s->proto_version = V9FS_PROTO_2000U;
# 1442|       } else if (!strcmp(version.data, "9P2000.L")) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def8]
qemu-10.2.2/hw/block/xen-block.c:856:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘drive’
qemu-10.2.2/hw/block/xen-block.c:870:23: enter_function: entry to ‘xen_block_drive_create’
qemu-10.2.2/hw/block/xen-block.c:887:8: branch_false: following ‘false’ branch...
qemu-10.2.2/hw/block/xen-block.c:906:9: branch_false: ...to here
qemu-10.2.2/hw/block/xen-block.c:978:8: branch_true: following ‘true’ branch...
qemu-10.2.2/hw/block/xen-block.c:979:9: branch_true: ...to here
qemu-10.2.2/hw/block/xen-block.c:979:9: call_function: calling ‘xen_block_drive_destroy’ from ‘xen_block_drive_create’
#  854|   {
#  855|       ERRP_GUARD();
#  856|->     char *node_name = drive->node_name;
#  857|   
#  858|       if (node_name) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def9]
qemu-10.2.2/hw/core/qdev-clock.c:160:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
#  158|   {
#  159|       NamedClockList *ncl = qdev_get_clocklist(dev, name);
#  160|->     Clock *clk = ncl->clock;
#  161|   
#  162|       ncl = qdev_init_clocklist(alias_dev, alias_name, true, ncl->output, clk);

Error: COMPILER_WARNING: [#def10]
qemu-10.2.2/hw/ppc/vof.c: scope_hint: In function ‘vof_dt_memory_available’
qemu-10.2.2/hw/ppc/vof.c:642:12: warning[-Wunused-but-set-variable=]: variable ‘n’ set but not used
#  642 |     int i, n, offset, proplen = 0, sc, ac;
#      |            ^
#  640|   static void vof_dt_memory_available(void *fdt, GArray *claimed, uint64_t base)
#  641|   {
#  642|->     int i, n, offset, proplen = 0, sc, ac;
#  643|       target_ulong mem0_end;
#  644|       const uint8_t *mem0_reg;

Error: GCC_ANALYZER_WARNING (CWE-121): [#def11]
qemu-10.2.2/hw/ssi/xilinx_spips.c:631:17: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
qemu-10.2.2/hw/ssi/xilinx_spips.c:1150:13: enter_function: entry to ‘lqspi_load_cache’
qemu-10.2.2/hw/ssi/xilinx_spips.c:1198:9: call_function: calling ‘xilinx_spips_flush_txfifo’ from ‘lqspi_load_cache’
#  629|               tx = fifo8_pop(&s->tx_fifo);
#  630|               for (i = 0; i < num_effective_busses(s); ++i) {
#  631|->                 tx_rx[i] = tx;
#  632|               }
#  633|           } else {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def12]
qemu-10.2.2/hw/virtio/virtio-mmio.c:712:37: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘qdev’
qemu-10.2.2/hw/virtio/virtio-mmio.c:693:12: enter_function: entry to ‘virtio_mmio_set_config_guest_notifier’
qemu-10.2.2/hw/virtio/virtio-mmio.c:697:26: call_function: inlined call to ‘virtio_bus_get_device’ from ‘virtio_mmio_set_config_guest_notifier’
qemu-10.2.2/hw/virtio/virtio-mmio.c:698:30: branch_false: ...to here
qemu-10.2.2/hw/virtio/virtio-mmio.c:712:8: branch_true: following ‘true’ branch...
qemu-10.2.2/hw/virtio/virtio-mmio.c:712:37: branch_true: ...to here
qemu-10.2.2/hw/virtio/virtio-mmio.c:712:37: danger: dereference of NULL ‘qdev’
#  710|           event_notifier_cleanup(notifier);
#  711|       }
#  712|->     if (vdc->guest_notifier_mask && vdev->use_guest_notifier_mask) {
#  713|           vdc->guest_notifier_mask(vdev, VIRTIO_CONFIG_IRQ_IDX, !assign);
#  714|       }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def13]
qemu-10.2.2/hw/xtensa/mx_pic.c:321:5: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘mx’
qemu-10.2.2/hw/xtensa/mx_pic.c:319:23: acquire_memory: this call could return NULL
qemu-10.2.2/hw/xtensa/mx_pic.c:321:5: danger: ‘mx’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  319|       XtensaMxPic *mx = calloc(1, sizeof(XtensaMxPic));
#  320|   
#  321|->     mx->n_irq = n_irq + 1;
#  322|       mx->irq_inputs = qemu_allocate_irqs(xtensa_mx_pic_set_irq, mx,
#  323|                                           mx->n_irq);

Error: COMPILER_WARNING: [#def14]
qemu-10.2.2/linux-user/qemu.h:10: included_from: Included from here.
qemu-10.2.2/linux-user/aarch64/signal.c:20: included_from: Included from here.
qemu-10.2.2/linux-user/syscall_defs.h:2596:9: warning: ‘FUTEX_CMD_MASK’ redefined
# 2596 | #define FUTEX_CMD_MASK          ~(FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME)
#      |         ^~~~~~~~~~~~~~
qemu-10.2.2/include/qemu/futex.h:31: included_from: Included from here.
qemu-10.2.2/include/qemu/thread.h:6: included_from: Included from here.
qemu-10.2.2/include/qemu/rcu.h:27: included_from: Included from here.
qemu-10.2.2/include/hw/qdev-core.h:7: included_from: Included from here.
qemu-10.2.2/include/hw/core/cpu.h:23: included_from: Included from here.
qemu-10.2.2/target/arm/cpu-qom.h:23: included_from: Included from here.
qemu-10.2.2/target/arm/cpu.h:26: included_from: Included from here.
qemu-10.2.2/linux-user/qemu.h:4: included_from: Included from here.
/usr/include/linux/futex.h:31:9: note: this is the location of the previous definition
#   31 | #define FUTEX_CMD_MASK                  ~(FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME | \
#      |         ^~~~~~~~~~~~~~
# 2594|   #define FUTEX_PRIVATE_FLAG      128
# 2595|   #define FUTEX_CLOCK_REALTIME    256
# 2596|-> #define FUTEX_CMD_MASK          ~(FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME)
# 2597|   
# 2598|   #ifdef CONFIG_EPOLL

Error: COMPILER_WARNING: [#def15]
qemu-10.2.2/linux-user/syscall_defs.h:2596:9: warning[warning]: ‘FUTEX_CMD_MASK’ redefined
# 2594|   #define FUTEX_PRIVATE_FLAG      128
# 2595|   #define FUTEX_CLOCK_REALTIME    256
# 2596|-> #define FUTEX_CMD_MASK          ~(FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME)
# 2597|   
# 2598|   #ifdef CONFIG_EPOLL

Error: GCC_ANALYZER_WARNING (CWE-476): [#def16]
qemu-10.2.2/migration/migration.c:186:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘addr’
qemu-10.2.2/migration/migration.c:2208:6: enter_function: entry to ‘qmp_migrate’
qemu-10.2.2/migration/migration.c:2214:25: call_function: inlined call to ‘migrate_get_current’ from ‘qmp_migrate’
qemu-10.2.2/migration/migration.c:2215:33: branch_true: ...to here
qemu-10.2.2/migration/migration.c:2223:8: branch_false: following ‘false’ branch...
qemu-10.2.2/migration/migration.c:2228:8: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2228:8: branch_false: following ‘false’ branch (when ‘channels’ is NULL)...
qemu-10.2.2/migration/migration.c:2247:8: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2247:8: branch_false: following ‘false’ branch (when ‘uri’ is NULL)...
qemu-10.2.2/migration/migration.c:2256:10: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2256:10: call_function: calling ‘migration_transport_compatible’ from ‘qmp_migrate’
#  184|   static bool transport_supports_multi_channels(MigrationAddress *addr)
#  185|   {
#  186|->     if (addr->transport == MIGRATION_ADDRESS_TYPE_SOCKET) {
#  187|           SocketAddress *saddr = &addr->u.socket;
#  188|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def17]
qemu-10.2.2/migration/migration.c:216:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘addr’
qemu-10.2.2/migration/migration.c:2208:6: enter_function: entry to ‘qmp_migrate’
qemu-10.2.2/migration/migration.c:2214:25: call_function: inlined call to ‘migrate_get_current’ from ‘qmp_migrate’
qemu-10.2.2/migration/migration.c:2215:33: branch_true: ...to here
qemu-10.2.2/migration/migration.c:2223:8: branch_false: following ‘false’ branch...
qemu-10.2.2/migration/migration.c:2228:8: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2228:8: branch_false: following ‘false’ branch (when ‘channels’ is NULL)...
qemu-10.2.2/migration/migration.c:2247:8: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2247:8: branch_false: following ‘false’ branch (when ‘uri’ is NULL)...
qemu-10.2.2/migration/migration.c:2256:10: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2256:10: call_function: calling ‘migration_transport_compatible’ from ‘qmp_migrate’
#  214|   static bool transport_supports_seeking(MigrationAddress *addr)
#  215|   {
#  216|->     if (addr->transport == MIGRATION_ADDRESS_TYPE_FILE) {
#  217|           return true;
#  218|       }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def18]
qemu-10.2.2/migration/migration.c:226:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘addr’
qemu-10.2.2/migration/migration.c:2208:6: enter_function: entry to ‘qmp_migrate’
qemu-10.2.2/migration/migration.c:2214:25: call_function: inlined call to ‘migrate_get_current’ from ‘qmp_migrate’
qemu-10.2.2/migration/migration.c:2215:33: branch_true: ...to here
qemu-10.2.2/migration/migration.c:2223:8: branch_false: following ‘false’ branch...
qemu-10.2.2/migration/migration.c:2228:8: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2228:8: branch_false: following ‘false’ branch (when ‘channels’ is NULL)...
qemu-10.2.2/migration/migration.c:2247:8: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2247:8: branch_false: following ‘false’ branch (when ‘uri’ is NULL)...
qemu-10.2.2/migration/migration.c:2256:10: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2256:10: call_function: calling ‘migration_transport_compatible’ from ‘qmp_migrate’
#  224|   {
#  225|       /* file: works because QEMU can open it multiple times */
#  226|->     return addr->transport == MIGRATION_ADDRESS_TYPE_FILE;
#  227|   }
#  228|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def19]
qemu-10.2.2/migration/migration.c:253:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘addr’
qemu-10.2.2/migration/migration.c:2208:6: enter_function: entry to ‘qmp_migrate’
qemu-10.2.2/migration/migration.c:2214:25: call_function: inlined call to ‘migrate_get_current’ from ‘qmp_migrate’
qemu-10.2.2/migration/migration.c:2215:33: branch_true: ...to here
qemu-10.2.2/migration/migration.c:2223:8: branch_false: following ‘false’ branch...
qemu-10.2.2/migration/migration.c:2228:8: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2228:8: branch_false: following ‘false’ branch (when ‘channels’ is NULL)...
qemu-10.2.2/migration/migration.c:2247:8: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2247:8: branch_false: following ‘false’ branch (when ‘uri’ is NULL)...
qemu-10.2.2/migration/migration.c:2256:10: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2256:10: call_function: calling ‘migration_transport_compatible’ from ‘qmp_migrate’
#  251|   
#  252|       if (migrate_mode() == MIG_MODE_CPR_TRANSFER &&
#  253|->         addr->transport == MIGRATION_ADDRESS_TYPE_FILE) {
#  254|           error_setg(errp, "Migration requires streamable transport (eg unix)");
#  255|           return false;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def20]
qemu-10.2.2/migration/migration.c:265:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘addr’
qemu-10.2.2/migration/migration.c:2208:6: enter_function: entry to ‘qmp_migrate’
qemu-10.2.2/migration/migration.c:2214:25: call_function: inlined call to ‘migrate_get_current’ from ‘qmp_migrate’
qemu-10.2.2/migration/migration.c:2215:33: branch_true: ...to here
qemu-10.2.2/migration/migration.c:2223:8: branch_false: following ‘false’ branch...
qemu-10.2.2/migration/migration.c:2228:8: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2228:8: branch_false: following ‘false’ branch (when ‘channels’ is NULL)...
qemu-10.2.2/migration/migration.c:2247:8: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2247:8: branch_false: following ‘false’ branch (when ‘uri’ is NULL)...
qemu-10.2.2/migration/migration.c:2256:10: branch_false: ...to here
qemu-10.2.2/migration/migration.c:2256:10: call_function: calling ‘migration_transport_compatible’ from ‘qmp_migrate’
#  263|                                                   Error **errp)
#  264|   {
#  265|->     if (addr->transport == MIGRATION_ADDRESS_TYPE_RDMA) {
#  266|           return migrate_rdma_caps_check(migrate_get_current()->capabilities,
#  267|                                          errp);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def21]
qemu-10.2.2/monitor/hmp-cmds-target.c:295:5: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mr’
qemu-10.2.2/monitor/hmp-cmds-target.c:286:19: release_memory: ‘mr’ is NULL
qemu-10.2.2/monitor/hmp-cmds-target.c:290:8: branch_false: following ‘false’ branch...
qemu-10.2.2/monitor/hmp-cmds-target.c:297:28: branch_false: ...to here
qemu-10.2.2/monitor/hmp-cmds-target.c:297:28: release_memory: ‘mr’ is NULL
qemu-10.2.2/monitor/hmp-cmds-target.c:295:5: danger: dereference of NULL ‘mr’
#  293|       }
#  294|   
#  295|->     monitor_printf(mon, "Host virtual address for 0x%" HWADDR_PRIx
#  296|                      " (%s) is %p\n",
#  297|                      addr, mr->name, ptr);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def22]
qemu-10.2.2/monitor/hmp-cmds-target.c:374:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mr’
qemu-10.2.2/monitor/hmp-cmds-target.c:356:6: enter_function: entry to ‘hmp_gpa2hpa’
qemu-10.2.2/monitor/hmp-cmds-target.c:360:19: release_memory: ‘mr’ is NULL
qemu-10.2.2/monitor/hmp-cmds-target.c:365:8: branch_false: following ‘false’ branch...
qemu-10.2.2/monitor/hmp-cmds-target.c:370:16: branch_false: ...to here
qemu-10.2.2/monitor/hmp-cmds-target.c:370:16: call_function: calling ‘vtop’ from ‘hmp_gpa2hpa’
qemu-10.2.2/monitor/hmp-cmds-target.c:370:16: return_function: returning to ‘hmp_gpa2hpa’ from ‘vtop’
qemu-10.2.2/monitor/hmp-cmds-target.c:371:8: branch_false: following ‘false’ branch...
qemu-10.2.2/monitor/hmp-cmds-target.c:376:32: branch_false: ...to here
qemu-10.2.2/monitor/hmp-cmds-target.c:376:32: release_memory: ‘mr’ is NULL
qemu-10.2.2/monitor/hmp-cmds-target.c:374:9: danger: dereference of NULL ‘mr’
#  372|           error_report_err(local_err);
#  373|       } else {
#  374|->         monitor_printf(mon, "Host physical address for 0x%" HWADDR_PRIx
#  375|                          " (%s) is 0x%" PRIx64 "\n",
#  376|                          addr, mr->name, (uint64_t) physaddr);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def23]
qemu-10.2.2/net/tap.c:719:13: warning[-Wanalyzer-null-argument]: use of NULL ‘downscript’ where non-null expected
qemu-10.2.2/net/tap.c:809:5: enter_function: entry to ‘net_init_tap’
qemu-10.2.2/net/tap.c:822:5: branch_true: following ‘true’ branch...
qemu-10.2.2/net/tap.c:823:5: branch_true: ...to here
qemu-10.2.2/net/tap.c:836:8: branch_true: following ‘true’ branch...
qemu-10.2.2/net/tap.c:837:13: branch_true: ...to here
qemu-10.2.2/net/tap.c:837:12: branch_false: following ‘false’ branch...
qemu-10.2.2/net/tap.c:837:13: branch_false: following ‘false’ branch...
qemu-10.2.2/net/tap.c:837:13: branch_false: following ‘false’ branch...
qemu-10.2.2/net/tap.c:846:14: branch_false: ...to here
qemu-10.2.2/net/tap.c:847:12: branch_false: following ‘false’ branch...
qemu-10.2.2/net/tap.c:851:14: branch_false: ...to here
qemu-10.2.2/net/tap.c:851:12: branch_true: following ‘true’ branch...
qemu-10.2.2/net/tap.c:856:20: branch_true: ...to here
qemu-10.2.2/net/tap.c:857:12: branch_false: following ‘false’ branch...
qemu-10.2.2/net/tap.c:862:9: branch_false: ...to here
qemu-10.2.2/net/tap.c:862:9: call_function: calling ‘net_init_tap_one’ from ‘net_init_tap’
#  717|                             script, downscript);
#  718|   
#  719|->         if (strcmp(downscript, "no") != 0) {
#  720|               snprintf(s->down_script, sizeof(s->down_script), "%s", downscript);
#  721|               snprintf(s->down_script_arg, sizeof(s->down_script_arg),

Error: GCC_ANALYZER_WARNING (CWE-775): [#def24]
qemu-10.2.2/qemu-nbd.c:990:16: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘dup2(stderr_fd[1], 2)’
qemu-10.2.2/qemu-nbd.c:533:5: enter_function: entry to ‘main’
qemu-10.2.2/qemu-nbd.c:636:12: branch_false: following ‘false’ branch (when ‘ch == -1’)...
qemu-10.2.2/qemu-nbd.c:832:8: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:832:8: branch_false: following ‘false’ branch (when ‘list == 0’)...
qemu-10.2.2/qemu-nbd.c:847:16: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:847:15: branch_false: following ‘false’ branch...
qemu-10.2.2/qemu-nbd.c:851:15: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:851:15: branch_true: following ‘true’ branch (when ‘export_name’ is NULL)...
qemu-10.2.2/qemu-nbd.c:851:15: branch_true: ...to here
qemu-10.2.2/qemu-nbd.c:858:8: branch_false: following ‘false’ branch...
qemu-10.2.2/qemu-nbd.c:864:63: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:864:31: call_function: inlined call to ‘socket_activation_validate_opts’ from ‘main’
qemu-10.2.2/qemu-nbd.c:875:12: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:875:12: branch_false: following ‘false’ branch...
qemu-10.2.2/qemu-nbd.c:882:8: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:882:8: branch_false: following ‘false’ branch (when ‘tlscredsid’ is NULL)...
qemu-10.2.2/qemu-nbd.c:901:13: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:901:12: branch_false: following ‘false’ branch...
qemu-10.2.2/qemu-nbd.c:905:12: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:905:12: branch_false: following ‘false’ branch (when ‘tlshostname’ is NULL)...
qemu-10.2.2/qemu-nbd.c:911:8: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:911:8: branch_false: following ‘false’ branch (when ‘selinux_label’ is NULL)...
qemu-10.2.2/qemu-nbd.c:923:8: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:923:8: branch_false: following ‘false’ branch (when ‘list == 0’)...
qemu-10.2.2/qemu-nbd.c:935:8: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:935:8: branch_false: following ‘false’ branch (when ‘disconnect == 0’)...
qemu-10.2.2/qemu-nbd.c:952:10: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:952:8: branch_false: following ‘false’ branch...
qemu-10.2.2/qemu-nbd.c:952:43: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:952:9: branch_true: following ‘true’ branch...
qemu-10.2.2/qemu-nbd.c:954:27: branch_true: ...to here
qemu-10.2.2/qemu-nbd.c:958:12: branch_false: following ‘false’ branch...
qemu-10.2.2/qemu-nbd.c:967:15: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:968:12: branch_false: following ‘false’ branch (when ‘pid >= 0’)...
qemu-10.2.2/qemu-nbd.c:971:19: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:971:19: branch_true: following ‘true’ branch (when ‘pid == 0’)...
qemu-10.2.2/qemu-nbd.c:974:13: branch_true: ...to here
qemu-10.2.2/qemu-nbd.c:977:16: branch_false: following ‘false’ branch...
qemu-10.2.2/qemu-nbd.c:986:19: branch_false: ...to here
qemu-10.2.2/qemu-nbd.c:990:17: acquire_resource: opened here
qemu-10.2.2/qemu-nbd.c:990:16: danger: ‘dup2(stderr_fd[1], 2)’ leaks here; was opened at [(51)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/50)
#  988|   
#  989|               /* Temporarily redirect stderr to the parent's pipe...  */
#  990|->             if (dup2(stderr_fd[1], STDERR_FILENO) < 0) {
#  991|                   char str[256];
#  992|                   snprintf(str, sizeof(str),

Error: GCC_ANALYZER_WARNING (CWE-688): [#def25]
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:873:5: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘fopen(argv[1], "r")’ where non-null expected
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:819:8: branch_false: following ‘false’ branch (when ‘argc == 5’)...
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:836:26: branch_false: ...to here
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:855:5: branch_true: following ‘true’ branch...
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:856:5: branch_true: ...to here
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:872:24: acquire_memory: this call could return NULL
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:873:5: danger: argument 1 (‘fopen(argv[1], "r")’) from [(5)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/4) could be NULL where non-null expected
#  871|       /* Read input file */
#  872|       FILE *input_file = fopen(argv[ARG_INDEX_IDEFS], "r");
#  873|->     fseek(input_file, 0L, SEEK_END);
#  874|       long input_size = ftell(input_file);
#  875|       context.input_buffer = (char *) calloc(input_size + 1, sizeof(char));

Error: GCC_ANALYZER_WARNING (CWE-775): [#def26]
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:875:44: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(argv[1], "r")’
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:819:8: branch_false: following ‘false’ branch (when ‘argc == 5’)...
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:836:26: branch_false: ...to here
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:855:5: branch_true: following ‘true’ branch...
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:856:5: branch_true: ...to here
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:872:24: acquire_resource: opened here
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:875:44: danger: ‘fopen(argv[1], "r")’ leaks here; was opened at [(5)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/4)
#  873|       fseek(input_file, 0L, SEEK_END);
#  874|       long input_size = ftell(input_file);
#  875|->     context.input_buffer = (char *) calloc(input_size + 1, sizeof(char));
#  876|       fseek(input_file, 0L, SEEK_SET);
#  877|       size_t read_chars = fread(context.input_buffer,

Error: GCC_ANALYZER_WARNING (CWE-401): [#def27]
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:875:44: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(argv[1], "r")’
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:819:8: branch_false: following ‘false’ branch (when ‘argc == 5’)...
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:836:26: branch_false: ...to here
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:855:5: branch_true: following ‘true’ branch...
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:856:5: branch_true: ...to here
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:872:24: acquire_memory: allocated here
qemu-10.2.2/target/hexagon/idef-parser/idef-parser.y:875:44: danger: ‘fopen(argv[1], "r")’ leaks here; was allocated at [(5)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/4)
#  873|       fseek(input_file, 0L, SEEK_END);
#  874|       long input_size = ftell(input_file);
#  875|->     context.input_buffer = (char *) calloc(input_size + 1, sizeof(char));
#  876|       fseek(input_file, 0L, SEEK_SET);
#  877|       size_t read_chars = fread(context.input_buffer,

Error: COMPILER_WARNING: [#def28]
qemu-10.2.2/target/riscv/cpu.c: scope_hint: In function ‘riscv_isa_write_fdt’
qemu-10.2.2/target/riscv/cpu.c:2913:35: warning[-Wformat-truncation=]: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 5
# 2913 |     snprintf(isa_base, maxlen, "rv%di", xlen);
#      |                                   ^~
qemu-10.2.2/target/riscv/cpu.c:2913:32: note: directive argument in the range [-2147483648, 2147483632]
# 2913 |     snprintf(isa_base, maxlen, "rv%di", xlen);
#      |                                ^~~~~~~
/usr/include/bits/stdio2.h:68:10: note: ‘__builtin___snprintf_chk’ output between 5 and 15 bytes into a destination of size 7
#   68 |   return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
#      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#   69 |                                    __glibc_objsize (__s), __fmt,
#      |                                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#   70 |                                    __va_arg_pack ());
#      |                                    ~~~~~~~~~~~~~~~~~
# 2911|       qemu_fdt_setprop_string(fdt, nodename, "riscv,isa", riscv_isa);
# 2912|   
# 2913|->     snprintf(isa_base, maxlen, "rv%di", xlen);
# 2914|       qemu_fdt_setprop_string(fdt, nodename, "riscv,isa-base", isa_base);
# 2915|   

Error: COMPILER_WARNING: [#def29]
qemu-10.2.2/tests/qtest/libqtest.c: scope_hint: In function ‘qtest_qom_has_concrete_type’
qemu-10.2.2/tests/qtest/libqtest.c:1044:9: warning[-Wunused-but-set-variable=]: variable ‘idx’ set but not used
# 1044 |     int idx;
#      |         ^~~
# 1042|       QString *qstr;
# 1043|       QDict *devinfo;
# 1044|->     int idx;
# 1045|   
# 1046|       if (!list) {

Error: GCC_ANALYZER_WARNING (CWE-688): [#def30]
qemu-10.2.2/tests/qtest/migration/cpr-tests.c:168:9: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
qemu-10.2.2/tests/qtest/migration/cpr-tests.c:162:12: branch_false: following ‘false’ branch (when ‘done == 0’)...
qemu-10.2.2/tests/qtest/migration/cpr-tests.c:163:15: branch_false: ...to here
qemu-10.2.2/tests/qtest/migration/cpr-tests.c:164:9: branch_true: following ‘true’ branch...
qemu-10.2.2/tests/qtest/migration/cpr-tests.c:165:16: branch_true: ...to here
qemu-10.2.2/tests/qtest/migration/cpr-tests.c:166:9: branch_true: following ‘true’ branch...
qemu-10.2.2/tests/qtest/migration/cpr-tests.c:167:18: branch_true: ...to here
qemu-10.2.2/tests/qtest/migration/cpr-tests.c:168:9: danger: argument 1 (‘<unknown>’) NULL where non-null expected
#  166|           g_assert(qdict_haskey(data, "status"));
#  167|           status = g_strdup(qdict_get_str(data, "status"));
#  168|->         g_assert(strcmp(status, "failed"));
#  169|           done = !strcmp(status, waitfor);
#  170|           qobject_unref(rsp);

Error: COMPILER_WARNING (CWE-1164): [#def31]
qemu-10.2.2/tests/qtest/virtio-9p-test.c:510:13: warning[-Wunused-function]: ‘fs_create_dir’ defined but not used
#  510 | static void fs_create_dir(void *obj, void *data, QGuestAllocator *t_alloc)
#      |             ^~~~~~~~~~~~~
#  508|   /* tests using the 9pfs 'local' fs driver */
#  509|   
#  510|-> static void fs_create_dir(void *obj, void *data, QGuestAllocator *t_alloc)
#  511|   {
#  512|       QVirtio9P *v9p = obj;

Error: COMPILER_WARNING (CWE-1164): [#def32]
qemu-10.2.2/tests/qtest/virtio-9p-test.c:529:13: warning[-Wunused-function]: ‘fs_unlinkat_dir’ defined but not used
#  529 | static void fs_unlinkat_dir(void *obj, void *data, QGuestAllocator *t_alloc)
#      |             ^~~~~~~~~~~~~~~
#  527|   }
#  528|   
#  529|-> static void fs_unlinkat_dir(void *obj, void *data, QGuestAllocator *t_alloc)
#  530|   {
#  531|       QVirtio9P *v9p = obj;

Error: COMPILER_WARNING (CWE-1164): [#def33]
qemu-10.2.2/tests/qtest/virtio-9p-test.c:555:13: warning[-Wunused-function]: ‘fs_create_file’ defined but not used
#  555 | static void fs_create_file(void *obj, void *data, QGuestAllocator *t_alloc)
#      |             ^~~~~~~~~~~~~~
#  553|   }
#  554|   
#  555|-> static void fs_create_file(void *obj, void *data, QGuestAllocator *t_alloc)
#  556|   {
#  557|       QVirtio9P *v9p = obj;

Error: COMPILER_WARNING (CWE-1164): [#def34]
qemu-10.2.2/tests/qtest/virtio-9p-test.c:572:13: warning[-Wunused-function]: ‘fs_unlinkat_file’ defined but not used
#  572 | static void fs_unlinkat_file(void *obj, void *data, QGuestAllocator *t_alloc)
#      |             ^~~~~~~~~~~~~~~~
#  570|   }
#  571|   
#  572|-> static void fs_unlinkat_file(void *obj, void *data, QGuestAllocator *t_alloc)
#  573|   {
#  574|       QVirtio9P *v9p = obj;

Error: COMPILER_WARNING (CWE-1164): [#def35]
qemu-10.2.2/tests/qtest/virtio-9p-test.c:593:13: warning[-Wunused-function]: ‘fs_symlink_file’ defined but not used
#  593 | static void fs_symlink_file(void *obj, void *data, QGuestAllocator *t_alloc)
#      |             ^~~~~~~~~~~~~~~
#  591|   }
#  592|   
#  593|-> static void fs_symlink_file(void *obj, void *data, QGuestAllocator *t_alloc)
#  594|   {
#  595|       QVirtio9P *v9p = obj;

Error: COMPILER_WARNING (CWE-1164): [#def36]
qemu-10.2.2/tests/qtest/virtio-9p-test.c:616:13: warning[-Wunused-function]: ‘fs_unlinkat_symlink’ defined but not used
#  616 | static void fs_unlinkat_symlink(void *obj, void *data,
#      |             ^~~~~~~~~~~~~~~~~~~
#  614|   }
#  615|   
#  616|-> static void fs_unlinkat_symlink(void *obj, void *data,
#  617|                                   QGuestAllocator *t_alloc)
#  618|   {

Error: COMPILER_WARNING (CWE-1164): [#def37]
qemu-10.2.2/tests/qtest/virtio-9p-test.c:642:13: warning[-Wunused-function]: ‘fs_hardlink_file’ defined but not used
#  642 | static void fs_hardlink_file(void *obj, void *data, QGuestAllocator *t_alloc)
#      |             ^~~~~~~~~~~~~~~~
#  640|   }
#  641|   
#  642|-> static void fs_hardlink_file(void *obj, void *data, QGuestAllocator *t_alloc)
#  643|   {
#  644|       QVirtio9P *v9p = obj;

Error: COMPILER_WARNING (CWE-1164): [#def38]
qemu-10.2.2/tests/qtest/virtio-9p-test.c:669:13: warning[-Wunused-function]: ‘fs_unlinkat_hardlink’ defined but not used
#  669 | static void fs_unlinkat_hardlink(void *obj, void *data,
#      |             ^~~~~~~~~~~~~~~~~~~~
#  667|   }
#  668|   
#  669|-> static void fs_unlinkat_hardlink(void *obj, void *data,
#  670|                                    QGuestAllocator *t_alloc)
#  671|   {

Error: COMPILER_WARNING (CWE-1164): [#def39]
qemu-10.2.2/tests/qtest/virtio-9p-test.c:697:13: warning[-Wunused-function]: ‘fs_use_after_unlink’ defined but not used
#  697 | static void fs_use_after_unlink(void *obj, void *data,
#      |             ^~~~~~~~~~~~~~~~~~~
#  695|   }
#  696|   
#  697|-> static void fs_use_after_unlink(void *obj, void *data,
#  698|                                   QGuestAllocator *t_alloc)
#  699|   {

Error: COMPILER_WARNING: [#def40]
qemu-10.2.2/tests/unit/rcutorture.c: scope_hint: In function ‘rcu_read_stress_test’
qemu-10.2.2/tests/unit/rcutorture.c:251:18: warning[-Wunused-but-set-variable=]: variable ‘garbage’ set but not used
#  251 |     volatile int garbage = 0;
#      |                  ^~~~~~~
#  249|       long long n_reads_local = 0;
#  250|       long long rcu_stress_local[RCU_STRESS_PIPE_LEN + 1] = { 0 };
#  251|->     volatile int garbage = 0;
#  252|   
#  253|       rcu_register_thread();

Error: GCC_ANALYZER_WARNING (CWE-476): [#def41]
qemu-10.2.2/ui/gtk.c:358:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
qemu-10.2.2/ui/gtk.c:1842:17: enter_function: entry to ‘gd_focus_out_event’
qemu-10.2.2/ui/gtk.c:1849:5: call_function: calling ‘gtk_release_modifiers’ from ‘gd_focus_out_event’
#  356|       VirtualConsole *vc = gd_vc_find_current(s);
#  357|   
#  358|->     if (vc->type != GD_VC_GFX ||
#  359|           !qemu_console_is_graphic(vc->gfx.dcl.con)) {
#  360|           return;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def42]
qemu-10.2.2/ui/vnc-jobs.c:251:5: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
qemu-10.2.2/ui/vnc-jobs.c:240:12: branch_true: following ‘true’ branch...
qemu-10.2.2/ui/vnc-jobs.c:240:43: branch_true: ...to here
qemu-10.2.2/ui/vnc-jobs.c:247:8: branch_false: following ‘false’ branch...
qemu-10.2.2/ui/vnc-jobs.c:251:5: branch_false: ...to here
qemu-10.2.2/ui/vnc-jobs.c:251:5: danger: dereference of NULL ‘<unknown>’
#  249|       }
#  250|   
#  251|->     assert(job->vs->magic == VNC_MAGIC);
#  252|       vc = container_of(job->vs, VncConnection, vs);
#  253|

Scan Properties

analyzer-version-clippy1.97.1
analyzer-version-cppcheck2.21.1
analyzer-version-gcc16.1.1
analyzer-version-gcc-analyzer16.1.1
analyzer-version-shellcheck0.11.0
analyzer-version-unicontrol0.0.2
diffbase-analyzer-version-clippy1.97.1
diffbase-analyzer-version-cppcheck2.21.1
diffbase-analyzer-version-gcc16.1.1
diffbase-analyzer-version-gcc-analyzer16.1.1
diffbase-analyzer-version-shellcheck0.11.0
diffbase-analyzer-version-unicontrol0.0.2
diffbase-enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
diffbase-exit-code0
diffbase-hostip-172-16-1-113.us-west-2.compute.internal
diffbase-known-false-positives/usr/share/csmock/known-false-positives.js
diffbase-known-false-positives-rpmknown-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch
diffbase-mock-configfedora-rawhide-x86_64
diffbase-project-nameqemu-11.1.0-0.1.rc2.fc45
diffbase-store-results-to/tmp/tmpnh56_q61/qemu-11.1.0-0.1.rc2.fc45.tar.xz
diffbase-time-created2026-08-03 21:21:56
diffbase-time-finished2026-08-03 22:20:54
diffbase-toolcsmock
diffbase-tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,clippy,unicontrol,shellcheck,cppcheck' '-o' '/tmp/tmpnh56_q61/qemu-11.1.0-0.1.rc2.fc45.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpnh56_q61/qemu-11.1.0-0.1.rc2.fc45.src.rpm'
diffbase-tool-versioncsmock-3.8.7.20260803.142340.gb75b18e-1.el9
enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
exit-code0
hostip-172-16-1-113.us-west-2.compute.internal
known-false-positives/usr/share/csmock/known-false-positives.js
known-false-positives-rpmknown-false-positives-0.0.0.20260524.213755.g3c6d0be.main-1.el9.noarch
mock-configfedora-rawhide-x86_64
project-nameqemu-10.2.2-1.fc44
store-results-to/tmp/tmp8nk7marj/qemu-10.2.2-1.fc44.tar.xz
time-created2026-08-03 20:16:23
time-finished2026-08-03 21:20:11
titleFixed findings
toolcsmock
tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,clippy,unicontrol,shellcheck,cppcheck' '-o' '/tmp/tmp8nk7marj/qemu-10.2.2-1.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmp8nk7marj/qemu-10.2.2-1.fc44.src.rpm'
tool-versioncsmock-3.8.7.20260803.142340.gb75b18e-1.el9