rsync-3.3.0-4.fc42

List of Findings

Error: SHELLCHECK_WARNING: [#def1]
/usr/share/doc/rsync/support/lsh.sh:36:11: warning[SC2294]: eval negates the benefit of arrays. Drop eval to preserve whitespace/symbols (or eval as string).
#   34|   	cd || exit 1
#   35|       fi
#   36|->     eval "${@}"
#   37|   fi

Error: SHELLCHECK_WARNING (CWE-153): [#def2]
/usr/share/doc/rsync/support/rsync-no-vanished:20:15: warning[SC2053]: Quote the right-hand side of == in [[ ]] to prevent glob matching.
#   18|   { $REAL_RSYNC "${@}" 2>&1 1>&3 3>&- | grep -E -v "$IGNOREOUT"; ret=${PIPESTATUS[0]}; } 3>&1 1>&2
#   19|   
#   20|-> if [[ $ret == $IGNOREEXIT ]]; then
#   21|       ret=0
#   22|   fi

Error: COMPILER_WARNING (CWE-457): [#def3]
rsync-3.3.0-build/rsync-3.3.0/acls.c: scope_hint: In function ‘unpack_smb_acl’
rsync-3.3.0-build/rsync-3.3.0/acls.c:319:25: warning[-Wmaybe-uninitialized]: ‘g_u_id’ may be used uninitialized
#  319 |                 ida->id = g_u_id;
#      |                         ^
rsync-3.3.0-build/rsync-3.3.0/acls.c:275:22: note: ‘g_u_id’ was declared here
#  275 |                 id_t g_u_id;
#      |                      ^
#  317|   		}
#  318|   		ida = EXPAND_ITEM_LIST(&temp_ida_list, id_access, -10);
#  319|-> 		ida->id = g_u_id;
#  320|   		ida->access = access;
#  321|   	}

Error: GCC_ANALYZER_WARNING (CWE-775): [#def4]
rsync-3.3.0-build/rsync-3.3.0/authenticate.c: scope_hint: In function ‘getpassf’
rsync-3.3.0-build/rsync-3.3.0/authenticate.c:192:20: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open(filename, 0)’
#  190|   		}
#  191|   
#  192|-> 		if (do_stat(filename, &st) == -1) {
#  193|   			rsyserr(FERROR, errno, "stat(%s)", filename);
#  194|   			exit_cleanup(RERR_SYNTAX);

Error: GCC_ANALYZER_WARNING (CWE-775): [#def5]
rsync-3.3.0-build/rsync-3.3.0/authenticate.c:196:24: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open(filename, 0)’
#  194|   			exit_cleanup(RERR_SYNTAX);
#  195|   		}
#  196|-> 		if ((st.st_mode & 06) != 0) {
#  197|   			rprintf(FERROR, "ERROR: password file must not be other-accessible\n");
#  198|   			exit_cleanup(RERR_SYNTAX);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def6]
rsync-3.3.0-build/rsync-3.3.0/authenticate.c: scope_hint: In function ‘auth_server’
rsync-3.3.0-build/rsync-3.3.0/authenticate.c:298:52: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘auth_uid_groups’
#  296|   			}
#  297|   			for (j = 0; j < auth_uid_groups_cnt; j++) {
#  298|-> 				if (auth_uid_groups[j] && wildmatch(tok+1, auth_uid_groups[j])) {
#  299|   					group_match = j;
#  300|   					break;

Error: GCC_ANALYZER_WARNING (CWE-775): [#def7]
rsync-3.3.0-build/rsync-3.3.0/clientserver.c: scope_hint: In function ‘become_daemon’
rsync-3.3.0-build/rsync-3.3.0/clientserver.c:1492:17: warning[-Wanalyzer-fd-leak]: leak of file descriptor
# 1490|   	for (i = 0; i < 3; i++) {
# 1491|   		close(i);
# 1492|-> 		open("/dev/null", O_RDWR);
# 1493|   	}
# 1494|   }

Error: GCC_ANALYZER_WARNING (CWE-775): [#def8]
rsync-3.3.0-build/rsync-3.3.0/clientserver.c: scope_hint: In function ‘daemon_main’
rsync-3.3.0-build/rsync-3.3.0/clientserver.c:1506:25: warning[-Wanalyzer-fd-leak]: leak of file descriptor
# 1504|   		for (i = 1; i < 3; i++) {
# 1505|   			close(i);
# 1506|-> 			open("/dev/null", O_RDWR);
# 1507|   		}
# 1508|   

Error: COMPILER_WARNING (CWE-697): [#def9]
rsync-3.3.0-build/rsync-3.3.0/flist.c: scope_hint: In function ‘fattr_compare’
rsync-3.3.0-build/rsync-3.3.0/flist.c:293:13: warning[-Waddress]: the comparison will always evaluate as ‘true’ for the address of ‘basename’ will never be NULL
#  293 |         if (!f1->basename || !S_ISREG(f1->mode) || !len1) {
#      |             ^
rsync-3.3.0-build/rsync-3.3.0/flist.c:23: included_from: Included from here.
rsync-3.3.0-build/rsync-3.3.0/rsync.h:808:20: note: ‘basename’ declared here
#  808 |         const char basename[];  /* The basename (AKA filename) follows */
#      |                    ^~~~~~~~
#  291|   	int diff;
#  292|   
#  293|-> 	if (!f1->basename || !S_ISREG(f1->mode) || !len1) {
#  294|   		if (!f2->basename || !S_ISREG(f2->mode) || !len2)
#  295|   			return 0;

Error: COMPILER_WARNING (CWE-697): [#def10]
rsync-3.3.0-build/rsync-3.3.0/flist.c:294:21: warning[-Waddress]: the comparison will always evaluate as ‘true’ for the address of ‘basename’ will never be NULL
#  294 |                 if (!f2->basename || !S_ISREG(f2->mode) || !len2)
#      |                     ^
rsync-3.3.0-build/rsync-3.3.0/rsync.h:808:20: note: ‘basename’ declared here
#  808 |         const char basename[];  /* The basename (AKA filename) follows */
#      |                    ^~~~~~~~
#  292|   
#  293|   	if (!f1->basename || !S_ISREG(f1->mode) || !len1) {
#  294|-> 		if (!f2->basename || !S_ISREG(f2->mode) || !len2)
#  295|   			return 0;
#  296|   		return 1;

Error: COMPILER_WARNING (CWE-697): [#def11]
rsync-3.3.0-build/rsync-3.3.0/flist.c:298:13: warning[-Waddress]: the comparison will always evaluate as ‘true’ for the address of ‘basename’ will never be NULL
#  298 |         if (!f2->basename || !S_ISREG(f2->mode) || !len2)
#      |             ^
rsync-3.3.0-build/rsync-3.3.0/rsync.h:808:20: note: ‘basename’ declared here
#  808 |         const char basename[];  /* The basename (AKA filename) follows */
#      |                    ^~~~~~~~
#  296|   		return 1;
#  297|   	}
#  298|-> 	if (!f2->basename || !S_ISREG(f2->mode) || !len2)
#  299|   		return -1;
#  300|   

Error: COMPILER_WARNING (CWE-697): [#def12]
rsync-3.3.0-build/rsync-3.3.0/flist.c: scope_hint: In function ‘recv_file_list’
rsync-3.3.0-build/rsync-3.3.0/flist.c:2778:29: warning[-Waddress]: the comparison will always evaluate as ‘true’ for the address of ‘basename’ will never be NULL
# 2778 |                         if (fp->basename && S_ISREG(fp->mode) && F_LENGTH(fp))
#      |                             ^~
rsync-3.3.0-build/rsync-3.3.0/rsync.h:808:20: note: ‘basename’ declared here
#  808 |         const char basename[];  /* The basename (AKA filename) follows */
#      |                    ^~~~~~~~
# 2776|   		while (j-- > 0) {
# 2777|   			struct file_struct *fp = the_fattr_list.files[j];
# 2778|-> 			if (fp->basename && S_ISREG(fp->mode) && F_LENGTH(fp))
# 2779|   				break;
# 2780|   		}

Error: GCC_ANALYZER_WARNING (CWE-476): [#def13]
rsync-3.3.0-build/rsync-3.3.0/rsync.h:1115: included_from: Included from here.
rsync-3.3.0-build/rsync-3.3.0/hlink.c:23: included_from: Included from here.
rsync-3.3.0-build/rsync-3.3.0/hlink.c: scope_hint: In function ‘match_gnums’
rsync-3.3.0-build/rsync-3.3.0/hlink.c:172:45: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘node’
rsync-3.3.0-build/rsync-3.3.0/byteorder.h:33:43: note: in definition of macro ‘CVAL’
rsync-3.3.0-build/rsync-3.3.0/byteorder.h:33:43: note: in definition of macro ‘CVAL’
rsync-3.3.0-build/rsync-3.3.0/byteorder.h:33:43: note: in definition of macro ‘CVAL’
#  170|   		file->flags |= FLAG_HLINK_LAST;
#  171|   		F_HL_PREV(file) = prev;
#  172|-> 		if (inc_recurse && CVAL(node->data, 0) == 0) {
#  173|   			if (unsort_ndx)
#  174|   				prev = F_NDX(file);

Error: CPPCHECK_WARNING (CWE-476): [#def14]
rsync-3.3.0-build/rsync-3.3.0/ifuncs.h:108: error[ctunullpointer]: Null pointer dereference: str
#  106|   static inline char *my_strdup(const char *str, const char *file, int line)
#  107|   {
#  108|->     int len = strlen(str)+1;
#  109|       char *buf = my_alloc(NULL, len, 1, file, line);
#  110|       memcpy(buf, str, len);

Error: CPPCHECK_WARNING (CWE-758): [#def15]
rsync-3.3.0-build/rsync-3.3.0/io.c:1817: error[overlappingWriteUnion]: Overlapping read/write of union is undefined behavior
# 1815|   		u.b[0] = ch;
# 1816|   #if CAREFUL_ALIGNMENT
# 1817|-> 	u.x = IVAL(u.b,0);
# 1818|   #endif
# 1819|   #if SIZEOF_INT32 > 4

Error: CPPCHECK_WARNING (CWE-758): [#def16]
rsync-3.3.0-build/rsync-3.3.0/io.c:1862: error[overlappingWriteUnion]: Overlapping read/write of union is undefined behavior
# 1860|   	u.x = IVAL(u.b,0);
# 1861|   #elif CAREFUL_ALIGNMENT
# 1862|-> 	u.x = IVAL64(u.b,0);
# 1863|   #endif
# 1864|   	return u.x;

Error: CPPCHECK_WARNING (CWE-401): [#def17]
rsync-3.3.0-build/rsync-3.3.0/loadparm.c:207: error[memleakOnRealloc]: Common realloc mistake: 'buf' nulled but not freed upon failure
#  205|   	}
#  206|   
#  207|-> 	if (bufsize && (buf = realloc(buf, t - buf + 1)) == NULL)
#  208|   		out_of_memory("expand_vars");
#  209|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def18]
rsync-3.3.0-build/rsync-3.3.0/loadparm.c: scope_hint: In function ‘do_parameter’
rsync-3.3.0-build/rsync-3.3.0/loadparm.c:463:20: warning[-Wanalyzer-malloc-leak]: leak of ‘parmvalue’
rsync-3.3.0-build/rsync-3.3.0/loadparm.c:458:29: note: in expansion of macro ‘strequal’
#  461|   			}
#  462|   		}
#  463|-> 		if (!parm_table[parmnum].enum_list[i].name) {
#  464|   			if (atoi(parmvalue) > 0)
#  465|   				*(int *)parm_ptr = atoi(parmvalue);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def19]
rsync-3.3.0-build/rsync-3.3.0/loadparm.c: scope_hint: In function ‘set_dparams’
rsync-3.3.0-build/rsync-3.3.0/loadparm.c:555:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘equal’
#  553|   	for (j = 0; j < dparam_list.count; j++) {
#  554|   		equal = strchr(params[j], '='); /* options.c verified this */
#  555|-> 		*equal = '\0';
#  556|   		if (syntax_check_only) {
#  557|   			if (map_parameter(params[j]) < 0) {

Error: CPPCHECK_WARNING (CWE-457): [#def20]
rsync-3.3.0-build/rsync-3.3.0/log.c:375: error[uninitvar]: Uninitialized variable: convbuf
#  373|   			if (outbuf.len) {
#  374|   				char trailing = inbuf.len ? '\0' : trailing_CR_or_NL;
#  375|-> 				filtered_fwrite(f, convbuf, outbuf.len, 0, trailing);
#  376|   				if (trailing) {
#  377|   					trailing_CR_or_NL = '\0';

Error: GCC_ANALYZER_WARNING (CWE-775): [#def21]
rsync-3.3.0-build/rsync-3.3.0/pipe.c: scope_hint: In function ‘piped_child’
rsync-3.3.0-build/rsync-3.3.0/pipe.c:69:20: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘dup2(to_child_pipe[0], 0)’
#   67|   
#   68|   	if (pid == 0) {
#   69|-> 		if (dup2(to_child_pipe[0], STDIN_FILENO) < 0
#   70|   		 || close(to_child_pipe[1]) < 0
#   71|   		 || close(from_child_pipe[0]) < 0

Error: GCC_ANALYZER_WARNING (CWE-775): [#def22]
rsync-3.3.0-build/rsync-3.3.0/pipe.c:72:18: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘dup2(from_child_pipe[1], 1)’
#   70|   		 || close(to_child_pipe[1]) < 0
#   71|   		 || close(from_child_pipe[0]) < 0
#   72|-> 		 || dup2(from_child_pipe[1], STDOUT_FILENO) < 0) {
#   73|   			rsyserr(FERROR, errno, "Failed to dup/close");
#   74|   			exit_cleanup(RERR_IPC);

Error: GCC_ANALYZER_WARNING (CWE-775): [#def23]
rsync-3.3.0-build/rsync-3.3.0/pipe.c: scope_hint: In function ‘local_child’
rsync-3.3.0-build/rsync-3.3.0/pipe.c:152:20: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘dup2(to_child_pipe[0], 0)’
rsync-3.3.0-build/rsync-3.3.0/rsync.h:533: included_from: Included from here.
rsync-3.3.0-build/rsync-3.3.0/pipe.c:23: included_from: Included from here.
#  150|   		}
#  151|   
#  152|-> 		if (dup2(to_child_pipe[0], STDIN_FILENO) < 0
#  153|   		 || close(to_child_pipe[1]) < 0
#  154|   		 || close(from_child_pipe[0]) < 0

Error: GCC_ANALYZER_WARNING (CWE-775): [#def24]
rsync-3.3.0-build/rsync-3.3.0/pipe.c:155:18: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘dup2(from_child_pipe[1], 1)’
#  153|   		 || close(to_child_pipe[1]) < 0
#  154|   		 || close(from_child_pipe[0]) < 0
#  155|-> 		 || dup2(from_child_pipe[1], STDOUT_FILENO) < 0) {
#  156|   			rsyserr(FERROR, errno, "Failed to dup/close");
#  157|   			exit_cleanup(RERR_IPC);

Error: COMPILER_WARNING (CWE-457): [#def25]
rsync-3.3.0-build/rsync-3.3.0/receiver.c: scope_hint: In function ‘receive_data’
rsync-3.3.0-build/rsync-3.3.0/receiver.c:249:15: warning[-Wmaybe-uninitialized]: ‘data’ may be used uninitialized
#  249 |         char *data;
#      |               ^
#  247|   	OFF_T offset = 0;
#  248|   	OFF_T offset2;
#  249|-> 	char *data;
#  250|   	int32 i;
#  251|   	char *map = NULL;

Error: COMPILER_WARNING (CWE-563): [#def26]
rsync-3.3.0-build/rsync-3.3.0/rounding.c:35:20: warning[-Wunused-but-set-variable]: variable ‘test_array’ set but not used
#   33|    int main(UNUSED(int argc), UNUSED(char *argv[]))
#   34|   {
#   35|-> 	static int test_array[1 - 2 * (ACTUAL_SIZE != EXPECTED_SIZE)];
#   36|   	test_array[0] = 0;
#   37|   	return 0;

Error: CPPCHECK_WARNING (CWE-823): [#def27]
rsync-3.3.0-build/rsync-3.3.0/rounding.c:36: error[arrayIndexOutOfBounds]: Array 'test_array[-1]' accessed at index 0, which is out of bounds.
#   34|   {
#   35|   	static int test_array[1 - 2 * (ACTUAL_SIZE != EXPECTED_SIZE)];
#   36|-> 	test_array[0] = 0;
#   37|   	return 0;
#   38|   }

Error: COMPILER_WARNING (CWE-1164): [#def28]
rsync-3.3.0-build/rsync-3.3.0/simd-checksum-x86_64.cpp:92:52: warning[-Wunused-function]: ‘int32_t get_checksum1_sse2_32(signed char*, int32_t, int32_t, uint32_t*, uint32_t*)’ defined but not used
#   92 | __attribute__ ((target("default"))) MVSTATIC int32 get_checksum1_sse2_32(schar* buf, int32 len, int32 i, uint32* ps1, uint32* ps2) { return i; }
#      |                                                    ^~~~~~~~~~~~~~~~~~~~~
#   90|   #endif
#   91|   __attribute__ ((target("default"))) MVSTATIC int32 get_checksum1_ssse3_32(schar* buf, int32 len, int32 i, uint32* ps1, uint32* ps2) { return i; }
#   92|-> __attribute__ ((target("default"))) MVSTATIC int32 get_checksum1_sse2_32(schar* buf, int32 len, int32 i, uint32* ps1, uint32* ps2) { return i; }
#   93|   
#   94|   /*

Error: CPPCHECK_WARNING (CWE-457): [#def29]
rsync-3.3.0-build/rsync-3.3.0/zlib/inflate.c:1425: warning[uninitvar]: Uninitialized variable: buf
# 1423|           }
# 1424|           state->have = 0;
# 1425|->         syncsearch(&(state->have), buf, len);
# 1426|       }
# 1427|   

Scan Properties