Error: COMPILER_WARNING (CWE-563): tmux-3.6a/compat/imsg-buffer.c: scope_hint: In function ‘msgbuf_clear’ tmux-3.6a/compat/imsg-buffer.c:702:26: warning[-Wunused-variable]: unused variable ‘buf’ # 702 | struct ibuf *buf; # | ^~~ # 700| msgbuf_clear(struct msgbuf *msgbuf) # 701| { # 702|-> struct ibuf *buf; # 703| # 704| /* write side */ Error: COMPILER_WARNING (CWE-681): tmux-3.6a/input.c: scope_hint: In function ‘input_exit_osc’ tmux-3.6a/input.c:2634:47: warning[-Wpointer-sign]: pointer targets in passing argument 2 of ‘screen_set_title’ differ in signedness # 2634 | screen_set_title(sctx->s, p)) { # | ^ # | | # | u_char * {aka unsigned char *} tmux-3.6a/tmux.h:3195:44: note: expected ‘const char *’ but argument is of type ‘u_char *’ {aka ‘unsigned char *’} # 3195 | int screen_set_title(struct screen *, const char *); # | ^~~~~~~~~~~~ # 2632| if (wp != NULL && # 2633| options_get_number(wp->options, "allow-set-title") && # 2634|-> screen_set_title(sctx->s, p)) { # 2635| notify_pane("pane-title-changed", wp); # 2636| server_redraw_window_borders(wp->window); Error: COMPILER_WARNING (CWE-681): tmux-3.6a/input.c:2644:34: warning[-Wpointer-sign]: pointer targets in passing argument 1 of ‘utf8_isvalid’ differ in signedness # 2644 | if (utf8_isvalid(p)) { # | ^ # | | # | u_char * {aka unsigned char *} tmux-3.6a/tmux.h:3531:31: note: expected ‘const char *’ but argument is of type ‘u_char *’ {aka ‘unsigned char *’} # 3531 | int utf8_isvalid(const char *); # | ^~~~~~~~~~~~ # 2642| break; # 2643| case 7: # 2644|-> if (utf8_isvalid(p)) { # 2645| screen_set_path(sctx->s, p); # 2646| if (wp != NULL) { Error: COMPILER_WARNING (CWE-681): tmux-3.6a/input.c:2645:50: warning[-Wpointer-sign]: pointer targets in passing argument 2 of ‘screen_set_path’ differ in signedness # 2645 | screen_set_path(sctx->s, p); # | ^ # | | # | u_char * {aka unsigned char *} tmux-3.6a/tmux.h:3196:43: note: expected ‘const char *’ but argument is of type ‘u_char *’ {aka ‘unsigned char *’} # 3196 | void screen_set_path(struct screen *, const char *); # | ^~~~~~~~~~~~ # 2643| case 7: # 2644| if (utf8_isvalid(p)) { # 2645|-> screen_set_path(sctx->s, p); # 2646| if (wp != NULL) { # 2647| server_redraw_window_borders(wp->window); Error: COMPILER_WARNING (CWE-681): tmux-3.6a/input.c: scope_hint: In function ‘input_exit_apc’ tmux-3.6a/input.c:2712:43: warning[-Wpointer-sign]: pointer targets in passing argument 2 of ‘screen_set_title’ differ in signedness # 2712 | screen_set_title(sctx->s, ictx->input_buf)) { # | ~~~~^~~~~~~~~~~ # | | # | u_char * {aka unsigned char *} tmux-3.6a/tmux.h:3195:44: note: expected ‘const char *’ but argument is of type ‘u_char *’ {aka ‘unsigned char *’} # 3195 | int screen_set_title(struct screen *, const char *); # | ^~~~~~~~~~~~ # 2710| if (wp != NULL && # 2711| options_get_number(wp->options, "allow-set-title") && # 2712|-> screen_set_title(sctx->s, ictx->input_buf)) { # 2713| notify_pane("pane-title-changed", wp); # 2714| server_redraw_window_borders(wp->window); Error: COMPILER_WARNING (CWE-681): tmux-3.6a/input.c:2758:40: warning[-Wpointer-sign]: pointer targets in passing argument 2 of ‘window_set_name’ differ in signedness # 2758 | window_set_name(w, ictx->input_buf); # | ~~~~^~~~~~~~~~~ # | | # | u_char * {aka unsigned char *} tmux-3.6a/tmux.h:3295:51: note: expected ‘const char *’ but argument is of type ‘u_char *’ {aka ‘unsigned char *’} # 3295 | void window_set_name(struct window *, const char *); # | ^~~~~~~~~~~~ # 2756| } else { # 2757| options_set_number(w->options, "automatic-rename", 0); # 2758|-> window_set_name(w, ictx->input_buf); # 2759| } # 2760| server_redraw_window_borders(w); Error: GCC_ANALYZER_WARNING (CWE-416): tmux-3.6a/mode-tree.c:1156:29: warning[-Wanalyzer-use-after-free]: use after ‘free’ of ‘mtd’ tmux-3.6a/mode-tree.c:1136:1: enter_function: entry to ‘mode_tree_key’ tmux-3.6a/mode-tree.c:1144:12: branch_true: following ‘true’ branch... tmux-3.6a/mode-tree.c:1145:20: branch_false: following ‘false’ branch... tmux-3.6a/mode-tree.c:1149:20: branch_false: ...to here tmux-3.6a/mode-tree.c:1154:28: branch_true: following ‘true’ branch... tmux-3.6a/mode-tree.c:1155:33: branch_true: ...to here tmux-3.6a/mode-tree.c:1155:33: call_function: calling ‘mode_tree_display_menu’ from ‘mode_tree_key’ tmux-3.6a/mode-tree.c:1155:33: return_function: returning to ‘mode_tree_key’ from ‘mode_tree_display_menu’ tmux-3.6a/mode-tree.c:1156:29: danger: use after ‘free’ of ‘mtd’; freed at [(19)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/18) # 1154| if (*key == KEYC_MOUSEDOWN3_PANE) # 1155| mode_tree_display_menu(mtd, c, x, y, 1); # 1156|-> if (mtd->preview == MODE_TREE_PREVIEW_OFF) # 1157| *key = KEYC_NONE; # 1158| return (0); Error: GCC_ANALYZER_WARNING (CWE-124): tmux-3.6a/screen.c:768:9: warning[-Wanalyzer-out-of-bounds]: buffer underwrite tmux-3.6a/screen.c:726:12: branch_false: following ‘false’ branch (when ‘mode != 0’)... tmux-3.6a/screen.c:728:12: branch_false: ...to here tmux-3.6a/screen.c:728:12: branch_false: following ‘false’ branch (when ‘mode != 16777215’)... tmux-3.6a/screen.c:731:9: branch_false: ...to here tmux-3.6a/screen.c:732:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:734:13: branch_false: ...to here tmux-3.6a/screen.c:734:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:736:13: branch_false: ...to here tmux-3.6a/screen.c:736:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:738:13: branch_false: ...to here tmux-3.6a/screen.c:738:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:740:13: branch_false: ...to here tmux-3.6a/screen.c:740:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:742:13: branch_false: ...to here tmux-3.6a/screen.c:742:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:744:13: branch_false: ...to here tmux-3.6a/screen.c:744:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:746:13: branch_false: ...to here tmux-3.6a/screen.c:746:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:748:13: branch_false: ...to here tmux-3.6a/screen.c:748:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:750:13: branch_false: ...to here tmux-3.6a/screen.c:750:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:752:13: branch_false: ...to here tmux-3.6a/screen.c:752:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:754:13: branch_false: ...to here tmux-3.6a/screen.c:754:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:756:13: branch_false: ...to here tmux-3.6a/screen.c:756:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:758:13: branch_false: ...to here tmux-3.6a/screen.c:758:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:760:13: branch_false: ...to here tmux-3.6a/screen.c:760:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:762:13: branch_false: ...to here tmux-3.6a/screen.c:762:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:764:13: branch_false: ...to here tmux-3.6a/screen.c:764:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:766:13: branch_false: ...to here tmux-3.6a/screen.c:766:12: branch_false: following ‘false’ branch... tmux-3.6a/screen.c:768:13: branch_false: ...to here tmux-3.6a/screen.c:768:9: danger: out-of-bounds write at byte -1 but ‘tmp’ starts at byte 0 # 766| if (mode & MODE_KEYS_EXTENDED_2) # 767| strlcat(tmp, "KEYS_EXTENDED_2,", sizeof tmp); # 768|-> tmp[strlen(tmp) - 1] = '\0'; # 769| return (tmp); # 770| } Error: GCC_ANALYZER_WARNING (CWE-457): tmux-3.6a/server-client.c:617:13: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘line’ tmux-3.6a/server-client.c:610:12: branch_false: following ‘false’ branch (when ‘pane_status != 1’)... tmux-3.6a/server-client.c:612:17: branch_false: ...to here tmux-3.6a/server-client.c:612:17: branch_false: following ‘false’ branch (when ‘pane_status != 2’)... tmux-3.6a/server-client.c:616:15: branch_false: ...to here tmux-3.6a/server-client.c:617:13: danger: use of uninitialized value ‘line’ here # 615| /* Check if point is within the pane or scrollbar. */ # 616| if (((pane_status != PANE_STATUS_OFF && # 617|-> py != line && py != wp->yoff + wp->sy) || # 618| (wp->yoff == 0 && py < wp->sy) || # 619| (py >= wp->yoff && py < wp->yoff + wp->sy)) && Error: COMPILER_WARNING (CWE-457): tmux-3.6a/server-client.c:617:16: warning[-Wmaybe-uninitialized]: ‘line’ may be used uninitialized # 617 | py != line && py != wp->yoff + wp->sy) || # | ~~~^~~~~~~ tmux-3.6a/server-client.c: scope_hint: In function ‘server_client_key_callback’ tmux-3.6a/server-client.c:597:34: note: ‘line’ was declared here # 597 | u_int line, sl_top, sl_bottom; # | ^~~~ # 615| /* Check if point is within the pane or scrollbar. */ # 616| if (((pane_status != PANE_STATUS_OFF && # 617|-> py != line && py != wp->yoff + wp->sy) || # 618| (wp->yoff == 0 && py < wp->sy) || # 619| (py >= wp->yoff && py < wp->yoff + wp->sy)) && Error: GCC_ANALYZER_WARNING (CWE-476): tmux-3.6a/server-client.c:2954:32: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘s’ tmux-3.6a/server-client.c:2902:1: enter_function: entry to ‘server_client_reset_state’ tmux-3.6a/server-client.c:2906:39: call_function: calling ‘server_client_get_pane’ from ‘server_client_reset_state’ tmux-3.6a/server-client.c:2906:39: return_function: returning to ‘server_client_reset_state’ from ‘server_client_get_pane’ tmux-3.6a/server-client.c:2912:12: branch_false: following ‘false’ branch... tmux-3.6a/server-client.c:2916:18: branch_false: ...to here tmux-3.6a/server-client.c:2939:12: branch_false: following ‘false’ branch... tmux-3.6a/server-client.c:2951:20: branch_false: ...to here tmux-3.6a/server-client.c:2951:19: branch_true: following ‘true’ branch... tmux-3.6a/server-client.c:2953:17: branch_true: ...to here tmux-3.6a/server-client.c:2954:32: danger: dereference of NULL ‘s’ # 2952| cursor = 0; # 2953| tty_window_offset(tty, &ox, &oy, &sx, &sy); # 2954|-> if (wp->xoff + s->cx >= ox && wp->xoff + s->cx <= ox + sx && # 2955| wp->yoff + s->cy >= oy && wp->yoff + s->cy <= oy + sy) { # 2956| cursor = 1; Error: COMPILER_WARNING (CWE-681): tmux-3.6a/tty-keys.c: scope_hint: In function ‘tty_keys_clipboard’ tmux-3.6a/tty-keys.c:1381:38: warning[-Wpointer-sign]: pointer targets in passing argument 2 of ‘__b64_pton’ differ in signedness # 1381 | if ((outlen = b64_pton(copy, out, len)) == -1) { # | ^~~ # | | # | char * tmux-3.6a/tty-keys.c:26: included_from: Included from here. /usr/include/resolv.h:247:41: note: expected ‘unsigned char *’ but argument is of type ‘char *’ # 247 | int b64_pton (char const *, unsigned char *, size_t) __THROW; # | ^~~~~~~~~~~~~~~ # 1379| needed = (end / 4) * 3; # 1380| out = xmalloc(needed); # 1381|-> if ((outlen = b64_pton(copy, out, len)) == -1) { # 1382| free(out); # 1383| free(copy); Error: GCC_ANALYZER_WARNING (CWE-688): tmux-3.6a/window-client.c:189:9: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected tmux-3.6a/window-client.c:172:21: branch_false: following ‘false’ branch... tmux-3.6a/window-client.c:174:14: branch_false: ...to here tmux-3.6a/window-client.c:189:15: release_memory: using NULL here tmux-3.6a/window-client.c:189:9: danger: argument 1 (‘*(struct window_client_modedata *)modedata.item_list’) NULL where non-null expected # 187| # 188| window_client_sort = sort_crit; # 189|-> qsort(data->item_list, data->item_size, sizeof *data->item_list, # 190| window_client_cmp); # 191| Error: GCC_ANALYZER_WARNING (CWE-688): tmux-3.6a/window-copy.c:3591:25: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected tmux-3.6a/window-copy.c:5957:1: enter_function: entry to ‘window_copy_acquire_cursor_down’ tmux-3.6a/window-copy.c:5972:16: branch_true: following ‘true’ branch (when ‘ny != 0’)... tmux-3.6a/window-copy.c:5973:11: branch_true: ...to here tmux-3.6a/window-copy.c:5973:11: call_function: calling ‘window_copy_cursor_down’ from ‘window_copy_acquire_cursor_down’ # 3589| buf[bx++] = *d; # 3590| else { # 3591|-> memcpy(buf + bx, d, dlen); # 3592| bx += dlen; # 3593| } Error: GCC_ANALYZER_WARNING (CWE-476): tmux-3.6a/window-tree.c:239:42: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘wla’ tmux-3.6a/window-tree.c:927:1: enter_function: entry to ‘window_tree_swap’ tmux-3.6a/window-tree.c:941:9: call_function: calling ‘window_tree_pull_item’ from ‘window_tree_swap’ tmux-3.6a/window-tree.c:941:9: return_function: returning to ‘window_tree_swap’ from ‘window_tree_pull_item’ tmux-3.6a/window-tree.c:942:9: call_function: calling ‘window_tree_pull_item’ from ‘window_tree_swap’ tmux-3.6a/window-tree.c:942:9: return_function: returning to ‘window_tree_swap’ from ‘window_tree_pull_item’ tmux-3.6a/window-tree.c:945:12: branch_false: following ‘false’ branch... tmux-3.6a/window-tree.c:948:29: branch_false: ...to here tmux-3.6a/window-tree.c:948:12: branch_true: following ‘true’ branch... tmux-3.6a/window-tree.c:949:13: branch_true: ...to here tmux-3.6a/window-tree.c:949:13: call_function: calling ‘window_tree_cmp_window’ from ‘window_tree_swap’ # 237| const struct winlink *wla = *a; # 238| const struct winlink *wlb = *b; # 239|-> struct window *wa = wla->window; # 240| struct window *wb = wlb->window; # 241| int result = 0; Error: GCC_ANALYZER_WARNING (CWE-476): tmux-3.6a/window-tree.c:240:42: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘wlb’ tmux-3.6a/window-tree.c:927:1: enter_function: entry to ‘window_tree_swap’ tmux-3.6a/window-tree.c:941:9: call_function: calling ‘window_tree_pull_item’ from ‘window_tree_swap’ tmux-3.6a/window-tree.c:941:9: return_function: returning to ‘window_tree_swap’ from ‘window_tree_pull_item’ tmux-3.6a/window-tree.c:942:9: call_function: calling ‘window_tree_pull_item’ from ‘window_tree_swap’ tmux-3.6a/window-tree.c:942:9: return_function: returning to ‘window_tree_swap’ from ‘window_tree_pull_item’ tmux-3.6a/window-tree.c:945:12: branch_false: following ‘false’ branch... tmux-3.6a/window-tree.c:948:29: branch_false: ...to here tmux-3.6a/window-tree.c:948:12: branch_true: following ‘true’ branch... tmux-3.6a/window-tree.c:949:13: branch_true: ...to here tmux-3.6a/window-tree.c:949:13: call_function: calling ‘window_tree_cmp_window’ from ‘window_tree_swap’ # 238| const struct winlink *wlb = *b; # 239| struct window *wa = wla->window; # 240|-> struct window *wb = wlb->window; # 241| int result = 0; # 242| Error: CPPCHECK_WARNING (CWE-476): tmux-3.6a/window-tree.c:450: warning[nullPointer]: Possible null pointer dereference: l # 448| } # 449| window_tree_sort = sort_crit; # 450|-> qsort(l, n, sizeof *l, window_tree_cmp_window); # 451| # 452| empty = 0; Error: GCC_ANALYZER_WARNING (CWE-688): tmux-3.6a/window-tree.c:450:9: warning[-Wanalyzer-null-argument]: use of NULL ‘l’ where non-null expected tmux-3.6a/window-tree.c:445:9: branch_false: following ‘false’ branch (when ‘wl’ is NULL)... tmux-3.6a/window-tree.c:449:9: branch_false: ...to here tmux-3.6a/window-tree.c:450:9: danger: argument 1 (‘l’) NULL where non-null expected # 448| } # 449| window_tree_sort = sort_crit; # 450|-> qsort(l, n, sizeof *l, window_tree_cmp_window); # 451| # 452| empty = 0; Error: CPPCHECK_WARNING (CWE-476): tmux-3.6a/window-tree.c:496: warning[nullPointer]: Possible null pointer dereference: l # 494| } # 495| window_tree_sort = sort_crit; # 496|-> qsort(l, n, sizeof *l, window_tree_cmp_session); # 497| # 498| for (i = 0; i < n; i++) Error: GCC_ANALYZER_WARNING (CWE-688): tmux-3.6a/window-tree.c:496:9: warning[-Wanalyzer-null-argument]: use of NULL ‘l’ where non-null expected tmux-3.6a/window-tree.c:477:21: branch_false: following ‘false’ branch... tmux-3.6a/window-tree.c:479:14: branch_false: ...to here tmux-3.6a/window-tree.c:485:9: branch_false: following ‘false’ branch (when ‘s’ is NULL)... tmux-3.6a/window-tree.c:495:9: branch_false: ...to here tmux-3.6a/window-tree.c:496:9: danger: argument 1 (‘l’) NULL where non-null expected # 494| } # 495| window_tree_sort = sort_crit; # 496|-> qsort(l, n, sizeof *l, window_tree_cmp_session); # 497| # 498| for (i = 0; i < n; i++)