librepo-1.19.0-1.fc42

List of Findings

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1]
librepo-1.19.0-build/librepo-1.19.0/librepo/downloader.c:1401:15: warning[-Wanalyzer-malloc-leak]: leak of ‘open_target_file(target,  err)’
librepo-1.19.0-build/librepo-1.19.0/librepo/downloader.c:26: included_from: Included from here.
# 1399|       FILE *f;
# 1400|   
# 1401|->     if (target->target->fd != -1) {
# 1402|           // Use supplied filedescriptor
# 1403|           fd = dup(target->target->fd);

Error: COMPILER_WARNING (CWE-477): [#def2]
librepo-1.19.0-build/librepo-1.19.0/librepo/downloader.c: scope_hint: In function ‘prepare_next_transfer’
librepo-1.19.0-build/librepo-1.19.0/librepo/downloader.c:1623:9: warning[-Wdeprecated-declarations]: ‘CURLOPT_PROGRESSFUNCTION’ is deprecated: since 7.32.0. Use CURLOPT_XFERINFOFUNCTION
# 1623 |         c_rc = curl_easy_setopt(h, CURLOPT_PROGRESSFUNCTION, lr_progresscb) ||
#      |         ^~~~
librepo-1.19.0-build/librepo-1.19.0/librepo/downloader.c:37: included_from: Included from here.
/usr/include/curl/curl.h:1304:3: note: declared here
# 1304 |   CURLOPTDEPRECATED(CURLOPT_PROGRESSFUNCTION, CURLOPTTYPE_FUNCTIONPOINT, 56,
#      |   ^~~~~~~~~~~~~~~~~
# 1621|       target->cb_return_code = LR_CB_OK;
# 1622|       if (target->target->progresscb) {
# 1623|->         c_rc = curl_easy_setopt(h, CURLOPT_PROGRESSFUNCTION, lr_progresscb) ||
# 1624|                  curl_easy_setopt(h, CURLOPT_NOPROGRESS, 0) ||
# 1625|                  curl_easy_setopt(h, CURLOPT_PROGRESSDATA, target);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def3]
librepo-1.19.0-build/librepo-1.19.0/librepo/gpg_rpm.c: scope_hint: In function ‘check_signature’
librepo-1.19.0-build/librepo-1.19.0/librepo/gpg_rpm.c:555:9: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘pkts’ where non-null expected
<built-in>: note: argument 1 of ‘__builtin_memcpy’ must be non-null
#  553|           pkts_len = sig_buf_len;
#  554|           pkts = malloc(sig_buf_len);
#  555|->         memcpy(pkts, sig_buf, sig_buf_len);
#  556|       }
#  557|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def4]
librepo-1.19.0-build/librepo-1.19.0/librepo/handle.c: scope_hint: In function ‘lr_handle_setopt’
librepo-1.19.0-build/librepo-1.19.0/librepo/handle.c:568:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘handle_list’
#  566|   
#  567|           // Copy the list
#  568|->         *handle_list = lr_strv_dup(list);
#  569|           break;
#  570|       }

Error: GCC_ANALYZER_WARNING (CWE-775): [#def5]
librepo-1.19.0-build/librepo-1.19.0/librepo/handle.c: scope_hint: In function ‘lr_handle_prepare_mirrorlist’
librepo-1.19.0-build/librepo-1.19.0/librepo/handle.c:1028:18: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open(lr_pathconcat(localpath, "mirrorlist", 0), 0)’
/usr/include/glib-2.0/glib.h:64: included_from: Included from here.
librepo-1.19.0-build/librepo-1.19.0/librepo/handle.c:1027:13: note: in expansion of macro ‘g_debug’
# 1026|           if (g_file_test(path, G_FILE_TEST_IS_REGULAR)) {
# 1027|               g_debug("%s: Local mirrorlist found at %s", __func__, path);
# 1028|->             fd = open(path, O_RDONLY);
# 1029|               if (fd < 0) {
# 1030|                   g_set_error(err, LR_HANDLE_ERROR, LRE_IO,

Error: GCC_ANALYZER_WARNING (CWE-775): [#def6]
librepo-1.19.0-build/librepo-1.19.0/librepo/handle.c: scope_hint: In function ‘lr_handle_prepare_metalink’
librepo-1.19.0-build/librepo-1.19.0/librepo/handle.c:1143:18: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open(lr_pathconcat(localpath, "metalink.xml", 0), 0)’
librepo-1.19.0-build/librepo-1.19.0/librepo/handle.c:1142:13: note: in expansion of macro ‘g_debug’
# 1141|           if (g_file_test(path, G_FILE_TEST_IS_REGULAR)) {
# 1142|               g_debug("%s: Local metalink.xml found at %s", __func__, path);
# 1143|->             fd = open(path, O_RDONLY);
# 1144|               if (fd < 0) {
# 1145|                   g_set_error(err, LR_HANDLE_ERROR, LRE_IO,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def7]
librepo-1.19.0-build/librepo-1.19.0/librepo/metadata_downloader.c: scope_hint: In function ‘appendFdValue’
librepo-1.19.0-build/librepo-1.19.0/librepo/metadata_downloader.c:154:19: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fd_allocated’
#  152|   {
#  153|       int *fd_allocated = malloc(sizeof(int));
#  154|->     *fd_allocated = fd;
#  155|       fd_list = g_slist_append(fd_list, fd_allocated);
#  156|       return fd_list;

Error: GCC_ANALYZER_WARNING (CWE-775): [#def8]
librepo-1.19.0-build/librepo-1.19.0/librepo/package_downloader.c: scope_hint: In function ‘lr_download_packages’
librepo-1.19.0-build/librepo-1.19.0/librepo/package_downloader.c:310:24: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open(*packagetarget.local_path, 0)’
#  308|                * completely downloaded, then the download is going to fail.
#  309|                */
#  310|->             int fd_r = open(packagetarget->local_path, O_RDONLY);
#  311|               if (fd_r != -1) {
#  312|                   gboolean matches;

Error: GCC_ANALYZER_WARNING (CWE-775): [#def9]
librepo-1.19.0-build/librepo-1.19.0/librepo/package_downloader.c: scope_hint: In function ‘lr_check_packages’
librepo-1.19.0-build/librepo-1.19.0/librepo/package_downloader.c:573:24: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open(*packagetarget.local_path, 0)’
#  571|           if (g_access(packagetarget->local_path, R_OK) == 0) {
#  572|               // If the file exists check its checksum
#  573|->             int fd_r = open(packagetarget->local_path, O_RDONLY);
#  574|               if (fd_r != -1) {
#  575|                   // File was successfully opened

Error: COMPILER_WARNING (CWE-1164): [#def10]
librepo-1.19.0-build/librepo-1.19.0/librepo/python/globalstate-py.h:60:1: warning[-Wunused-function]: ‘gil_logger_hack_begin’ defined but not used
#   60 | gil_logger_hack_begin(PyThreadState **state)
#      | ^~~~~~~~~~~~~~~~~~~~~
#   58|   
#   59|   static int
#   60|-> gil_logger_hack_begin(PyThreadState **state)
#   61|   {
#   62|       int ret = GIL_HACK_DO_NOT_CLEAR;

Error: COMPILER_WARNING (CWE-1164): [#def11]
librepo-1.19.0-build/librepo-1.19.0/librepo/python/librepomodule.c:35: included_from: Included from here.
librepo-1.19.0-build/librepo-1.19.0/librepo/python/globalstate-py.h:84:1: warning[-Wunused-function]: ‘gil_logger_hack_end’ defined but not used
#   84 | gil_logger_hack_end(int hack_begin_rc)
#      | ^~~~~~~~~~~~~~~~~~~
#   82|   
#   83|   static gboolean
#   84|-> gil_logger_hack_end(int hack_begin_rc)
#   85|   {
#   86|       int ret;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def12]
librepo-1.19.0-build/librepo-1.19.0/librepo/yum.c: scope_hint: In function ‘cbdata_new’
librepo-1.19.0-build/librepo-1.19.0/librepo/yum.c:274:20: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘data’
librepo-1.19.0-build/librepo-1.19.0/librepo/yum.c:27: included_from: Included from here.
#  272|   {
#  273|       CbData *data = calloc(1, sizeof(*data));
#  274|->     data->userdata = userdata;
#  275|       data->cbdata = cbdata;
#  276|       data->progresscb = progresscb;

Error: GCC_ANALYZER_WARNING (CWE-775): [#def13]
librepo-1.19.0-build/librepo-1.19.0/librepo/yum.c: scope_hint: In function ‘lr_yum_use_local_load_base’
librepo-1.19.0-build/librepo-1.19.0/librepo/yum.c:1151:10: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open(lr_pathconcat(baseurl, "repodata/repomd.xml", 0), 0)’
# 1149|       // Open repomd.xml
# 1150|       path = lr_pathconcat(baseurl, "repodata/repomd.xml", NULL);
# 1151|->     fd = open(path, O_RDONLY);
# 1152|       if (fd < 0) {
# 1153|           g_debug("%s: open(%s): %s", __func__, path, g_strerror(errno));

Scan Properties