Error: SHELLCHECK_WARNING (CWE-563): [#def1] /usr/libexec/cockpit-certificate-helper:6:1: warning[SC2034]: prefix appears unused. Verify use (or export if used externally). # 4| # 5| # prefix= is set because the default /etc contains "${prefix}" # 6|-> prefix="/usr" # 7| COCKPIT_CONFIG="/etc/cockpit" # 8| COCKPIT_WS_CERTS_D="${COCKPIT_CONFIG}/ws-certs.d" Error: SHELLCHECK_WARNING (CWE-563): [#def2] /usr/libexec/cockpit-desktop:40:1: warning[SC2034]: exec_prefix appears unused. Verify use (or export if used externally). # 38| # 39| # exec_prefix= is set because the default /usr/libexec contains "${exec_prefix}" # 40|-> exec_prefix="/usr" # 41| libexecdir="/usr/libexec" # 42| Error: SHELLCHECK_WARNING (CWE-563): [#def3] /usr/libexec/cockpit-desktop:41:1: warning[SC2034]: libexecdir appears unused. Verify use (or export if used externally). # 39| # exec_prefix= is set because the default /usr/libexec contains "${exec_prefix}" # 40| exec_prefix="/usr" # 41|-> libexecdir="/usr/libexec" # 42| # 43| # start browser in a temporary home dir, so that it does not interfere with your real one Error: SHELLCHECK_WARNING (CWE-569): [#def4] /usr/libexec/cockpit-desktop:123:12: warning[SC2064]: Use single quotes, otherwise this expands now rather than when signalled. # 121| # start the bridge; this needs to run in the normal user session/namespace # 122| coproc ${2:+ssh "$2"} cockpit-bridge # 123|-> trap "kill $COPROC_PID; wait $COPROC_PID || true" EXIT INT QUIT PIPE # 124| # 125| # start ws and browser in a detached network namespace Error: SHELLCHECK_WARNING (CWE-569): [#def5] /usr/libexec/cockpit-desktop:123:30: warning[SC2064]: Use single quotes, otherwise this expands now rather than when signalled. # 121| # start the bridge; this needs to run in the normal user session/namespace # 122| coproc ${2:+ssh "$2"} cockpit-bridge # 123|-> trap "kill $COPROC_PID; wait $COPROC_PID || true" EXIT INT QUIT PIPE # 124| # 125| # start ws and browser in a detached network namespace Error: GCC_ANALYZER_WARNING (CWE-775): [#def6] cockpit-336.2/src/common/cockpitpipe.c:1279:1: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘r’ cockpit-336.2/src/common/cockpitpipe.c:1275:6: branch_true: following ‘true’ branch... cockpit-336.2/src/common/cockpitpipe.c:1276:13: branch_true: ...to here cockpit-336.2/src/common/cockpitpipe.c:1276:13: acquire_resource: opened here cockpit-336.2/src/common/cockpitpipe.c:1277:5: branch_true: following ‘true’ branch (when ‘r == 2’)... cockpit-336.2/src/common/cockpitpipe.c:1279:1: branch_true: ...to here cockpit-336.2/src/common/cockpitpipe.c:1279:1: danger: ‘r’ leaks here; was opened at [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2) # 1277| g_assert (r == 2); /* that should really never fail */ # 1278| } # 1279|-> } # 1280| # 1281| /** Error: GCC_ANALYZER_WARNING (CWE-688): [#def7] cockpit-336.2/src/common/cockpitwebserver.c:817:18: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected cockpit-336.2/src/common/cockpitwebserver.c:772:1: enter_function: entry to ‘cockpit_web_request_process’ cockpit-336.2/src/common/cockpitwebserver.c:804:6: branch_false: following ‘false’ branch... cockpit-336.2/src/common/cockpitwebserver.c:810:33: call_function: inlined call to ‘g_strdup_inline’ from ‘cockpit_web_request_process’ cockpit-336.2/src/common/cockpitwebserver.c:812:3: release_memory: ‘0’ is NULL cockpit-336.2/src/common/cockpitwebserver.c:817:18: danger: argument 1 (‘<unknown>’) NULL where non-null expected #argument 1 of ‘__builtin_strchr’ must be non-null # 815| self->host = host; # 816| # 817|-> gchar *query = strchr (path_copy, '?'); # 818| if (query) # 819| { Error: GCC_ANALYZER_WARNING (CWE-688): [#def8] cockpit-336.2/src/common/cockpitwebserver.c:817:18: warning[-Wanalyzer-null-argument]: use of NULL ‘*self.original_path’ where non-null expected cockpit-336.2/src/common/cockpitwebserver.c:841:1: enter_function: entry to ‘cockpit_web_request_parse_and_process’ cockpit-336.2/src/common/cockpitwebserver.c:854:6: branch_false: following ‘false’ branch... cockpit-336.2/src/common/cockpitwebserver.c:860:10: branch_false: ...to here cockpit-336.2/src/common/cockpitwebserver.c:864:6: branch_false: following ‘false’ branch... cockpit-336.2/src/common/cockpitwebserver.c:869:6: branch_false: ...to here cockpit-336.2/src/common/cockpitwebserver.c:869:6: branch_false: following ‘false’ branch... cockpit-336.2/src/common/cockpitwebserver.c:875:7: branch_false: ...to here cockpit-336.2/src/common/cockpitwebserver.c:875:6: branch_false: following ‘false’ branch... cockpit-336.2/src/common/cockpitwebserver.c:885:6: branch_false: following ‘false’ branch... cockpit-336.2/src/common/cockpitwebserver.c:890:6: branch_false: ...to here cockpit-336.2/src/common/cockpitwebserver.c:890:6: branch_false: following ‘false’ branch... cockpit-336.2/src/common/cockpitwebserver.c:899:9: branch_false: ...to here cockpit-336.2/src/common/cockpitwebserver.c:920:6: branch_false: following ‘false’ branch... cockpit-336.2/src/common/cockpitwebserver.c:926:8: branch_false: ...to here cockpit-336.2/src/common/cockpitwebserver.c:940:3: call_function: calling ‘cockpit_web_request_process’ from ‘cockpit_web_request_parse_and_process’ #argument 1 of ‘__builtin_strchr’ must be non-null # 815| self->host = host; # 816| # 817|-> gchar *query = strchr (path_copy, '?'); # 818| if (query) # 819| { Error: GCC_ANALYZER_WARNING (CWE-775): [#def9] cockpit-336.2/src/session/client-certificate.c:55:13: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open_proc_pid(pid)’ cockpit-336.2/src/session/client-certificate.c:178:1: enter_function: entry to ‘get_ws_proc_fd’ cockpit-336.2/src/session/client-certificate.c:184:6: branch_false: following ‘false’ branch... cockpit-336.2/src/session/client-certificate.c:196:7: branch_false: ...to here cockpit-336.2/src/session/client-certificate.c:196:6: branch_false: following ‘false’ branch... cockpit-336.2/src/session/client-certificate.c:200:15: branch_false: ...to here cockpit-336.2/src/session/client-certificate.c:201:6: branch_false: following ‘false’ branch (when ‘pid >= 0’)... cockpit-336.2/src/session/client-certificate.c:210:23: branch_false: ...to here cockpit-336.2/src/session/client-certificate.c:210:23: call_function: calling ‘open_proc_pid’ from ‘get_ws_proc_fd’ cockpit-336.2/src/session/client-certificate.c:210:23: return_function: returning to ‘get_ws_proc_fd’ from ‘open_proc_pid’ cockpit-336.2/src/session/client-certificate.c:55:13: danger: ‘open_proc_pid(pid)’ leaks here; was opened at [(12)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/11) # 53| { # 54| char path[100]; # 55|-> int r = snprintf (path, sizeof path, "/proc/%lu", (unsigned long) pid); # 56| if (r < 0 || r >= sizeof path) # 57| errx (EX, "memory error"); Error: GCC_ANALYZER_WARNING (CWE-775): [#def10] cockpit-336.2/src/session/session-utils.c:364:11: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/var/log/btmp", 524288)’ cockpit-336.2/src/session/session-utils.c:326:8: acquire_resource: opened here cockpit-336.2/src/session/session-utils.c:327:6: branch_false: following ‘false’ branch... branch_false: ...to here cockpit-336.2/src/session/session-utils.c:352:10: branch_false: following ‘false’ branch... cockpit-336.2/src/session/session-utils.c:357:10: branch_false: ...to here cockpit-336.2/src/session/session-utils.c:357:10: branch_false: following ‘false’ branch... cockpit-336.2/src/session/session-utils.c:364:11: branch_false: ...to here cockpit-336.2/src/session/session-utils.c:372:6: branch_false: following ‘false’ branch (when ‘fail_count != 0’)... cockpit-336.2/src/session/session-utils.c:379:13: branch_false: ...to here cockpit-336.2/src/session/session-utils.c:364:11: danger: ‘open("/var/log/btmp", 524288)’ leaks here; was opened at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0) # 362| } # 363| # 364|-> if (entry.ut_tv.tv_sec > last_success && # 365| strncmp (entry.ut_user, username, sizeof entry.ut_user) == 0) # 366| { Error: GCC_ANALYZER_WARNING (CWE-775): [#def11] cockpit-336.2/src/session/session-utils.c:385:6: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/var/log/btmp", 524288)’ cockpit-336.2/src/session/session-utils.c:326:8: acquire_resource: opened here cockpit-336.2/src/session/session-utils.c:327:6: branch_false: following ‘false’ branch... branch_false: ...to here cockpit-336.2/src/session/session-utils.c:372:6: branch_true: following ‘true’ branch (when ‘fail_count == 0’)... cockpit-336.2/src/session/session-utils.c:375:7: branch_true: ...to here cockpit-336.2/src/session/session-utils.c:385:6: danger: ‘open("/var/log/btmp", 524288)’ leaks here; was opened at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0) # 383| # 384| out: # 385|-> if (fd > -1) # 386| close (fd); # 387| Error: GCC_ANALYZER_WARNING (CWE-775): [#def12] cockpit-336.2/src/session/session-utils.c:571:10: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘dup2(*<unknown>, i)’ cockpit-336.2/src/session/session-utils.c:545:6: branch_false: following ‘false’ branch... cockpit-336.2/src/session/session-utils.c:548:14: branch_false: ...to here cockpit-336.2/src/session/session-utils.c:569:19: branch_true: following ‘true’ branch (when ‘i < n_remap_fds’)... cockpit-336.2/src/session/session-utils.c:570:12: branch_true: ...to here cockpit-336.2/src/session/session-utils.c:570:8: branch_true: following ‘true’ branch... cockpit-336.2/src/session/session-utils.c:571:11: branch_true: ...to here cockpit-336.2/src/session/session-utils.c:571:11: acquire_resource: opened here cockpit-336.2/src/session/session-utils.c:571:10: danger: ‘dup2(*<unknown>, i)’ leaks here; was opened at [(7)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/6) # 569| for (int i = 0; i < n_remap_fds; i++) # 570| if (fds[i] != -1) /* no-op */ # 571|-> if (dup2 (fds[i], i) != i) # 572| abort_with_message ("dup2(%d, %d) failed: %m", fds[i], i); # 573| Error: GCC_ANALYZER_WARNING (CWE-775): [#def13] cockpit-336.2/src/tls/server.c:243:9: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘server.first_listener’ cockpit-336.2/src/tls/server.c:201:3: branch_false: following ‘false’ branch... cockpit-336.2/src/tls/server.c:202:3: branch_false: ...to here cockpit-336.2/src/tls/server.c:229:10: branch_false: following ‘false’ branch... cockpit-336.2/src/tls/server.c:231:7: branch_false: ...to here cockpit-336.2/src/tls/server.c:238:10: branch_false: following ‘false’ branch... cockpit-336.2/src/tls/server.c:240:11: branch_false: ...to here cockpit-336.2/src/tls/server.c:240:10: branch_false: following ‘false’ branch... cockpit-336.2/src/tls/server.c:242:11: branch_false: ...to here cockpit-336.2/src/tls/server.c:242:10: branch_true: following ‘true’ branch... cockpit-336.2/src/tls/server.c:243:9: branch_true: ...to here cockpit-336.2/src/tls/server.c:243:9: danger: ‘server.first_listener’ leaks here # 241| err (EXIT_FAILURE, "failed to bind to port %hu", port); # 242| if (listen (server.first_listener, 1024) < 0) # 243|-> err (EXIT_FAILURE, "failed to listen to server port"); # 244| debug (SERVER, "Server ready. Listening on port %hu, fd %i", port, server.first_listener); # 245| } Error: GCC_ANALYZER_WARNING (CWE-775): [#def14] cockpit-336.2/src/tls/server.c:248:20: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘server.first_listener’ cockpit-336.2/src/tls/server.c:201:3: branch_false: following ‘false’ branch... cockpit-336.2/src/tls/server.c:202:3: branch_false: ...to here cockpit-336.2/src/tls/server.c:229:10: branch_false: following ‘false’ branch... cockpit-336.2/src/tls/server.c:231:7: branch_false: ...to here cockpit-336.2/src/tls/server.c:238:10: branch_false: following ‘false’ branch... cockpit-336.2/src/tls/server.c:240:11: branch_false: ...to here cockpit-336.2/src/tls/server.c:240:10: branch_false: following ‘false’ branch... cockpit-336.2/src/tls/server.c:242:11: branch_false: ...to here cockpit-336.2/src/tls/server.c:242:10: branch_false: following ‘false’ branch... branch_false: ...to here cockpit-336.2/src/tls/server.c:248:20: danger: ‘server.first_listener’ leaks here # 246| # 247| /* epoll the listening fds */ # 248|-> server.epollfd = epoll_create1 (EPOLL_CLOEXEC); # 249| if (server.epollfd < 0) # 250| err (EXIT_FAILURE, "Failed to create epoll fd"); Error: GCC_ANALYZER_WARNING (CWE-775): [#def15] cockpit-336.2/src/ws/cockpitauth.c:464:6: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘dup2(*(ChildData *)data.io, 0)’ cockpit-336.2/src/ws/cockpitauth.c:464:7: acquire_resource: opened here cockpit-336.2/src/ws/cockpitauth.c:464:6: danger: ‘dup2(*(ChildData *)data.io, 0)’ leaks here; was opened at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0) # 462| ChildData *child = data; # 463| # 464|-> if (dup2 (child->io, 0) < 0 || dup2 (child->io, 1) < 0) # 465| { # 466| g_printerr ("couldn't set child stdin/stout file descriptors\n"); Error: GCC_ANALYZER_WARNING (CWE-775): [#def16] cockpit-336.2/src/ws/cockpitauth.c:464:7: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘dup2(*(ChildData *)data.io, 1)’ cockpit-336.2/src/ws/cockpitauth.c:464:6: branch_false: following ‘false’ branch... cockpit-336.2/src/ws/cockpitauth.c:464:34: branch_false: ...to here cockpit-336.2/src/ws/cockpitauth.c:464:34: acquire_resource: opened here cockpit-336.2/src/ws/cockpitauth.c:464:7: danger: ‘dup2(*(ChildData *)data.io, 1)’ leaks here; was opened at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2) # 462| ChildData *child = data; # 463| # 464|-> if (dup2 (child->io, 0) < 0 || dup2 (child->io, 1) < 0) # 465| { # 466| g_printerr ("couldn't set child stdin/stout file descriptors\n");
| analyzer-version-clippy | 1.86.0 |
| analyzer-version-cppcheck | 2.17.1 |
| analyzer-version-gcc | 15.0.1 |
| analyzer-version-gcc-analyzer | 15.0.1 |
| analyzer-version-shellcheck | 0.10.0 |
| analyzer-version-unicontrol | 0.0.2 |
| enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol |
| exit-code | 0 |
| host | ip-172-16-1-229.us-west-2.compute.internal |
| known-false-positives | /usr/share/csmock/known-false-positives.js |
| known-false-positives-rpm | known-false-positives-0.0.0.20250425.124705.g1c7c448.main-1.el9.noarch |
| mock-config | fedora-rawhide-x86_64 |
| project-name | cockpit-336.2-1.fc43 |
| store-results-to | /tmp/tmpx17f9i3a/cockpit-336.2-1.fc43.tar.xz |
| time-created | 2025-04-25 12:12:58 |
| time-finished | 2025-04-25 12:14:58 |
| tool | csmock |
| tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'unicontrol,cppcheck,gcc,clippy,shellcheck' '-o' '/tmp/tmpx17f9i3a/cockpit-336.2-1.fc43.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpx17f9i3a/cockpit-336.2-1.fc43.src.rpm' |
| tool-version | csmock-3.8.1.20250422.172604.g26bc3d6-1.el9 |