libei-1.4.1-1.fc43

List of Findings

Error: GCC_ANALYZER_WARNING (CWE-122): [#def1]
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:241:37: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:180:1: enter_function: entry to ‘brei_demarshal’
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:184:12: branch_false: following ‘false’ branch (when ‘nargs <= 256’)...
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:190:54: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:190:47: call_function: calling ‘xalloc’ from ‘brei_demarshal’
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:190:47: return_function: returning to ‘brei_demarshal’ from ‘xalloc’
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:193:48: call_function: calling ‘xalloc’ from ‘brei_demarshal’
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:193:48: return_function: returning to ‘brei_demarshal’ from ‘xalloc’
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:202:16: branch_true: following ‘true’ branch...
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:203:17: branch_true: ...to here
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:230:28: branch_false: following ‘false’ branch (when ‘remaining >= len32’)...
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:236:28: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:236:28: branch_false: following ‘false’ branch (when ‘slen != 0’)...
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:239:60: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:239:60: call_function: calling ‘xalloc’ from ‘brei_demarshal’
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:239:60: return_function: returning to ‘brei_demarshal’ from ‘xalloc’
libei-1.4.1/redhat-linux-build/../src/brei-shared.c:241:37: danger: read of 1 byte at offset ‘(sizetype)(*p + 4294967295)’ exceeds the buffer
#  239|   				_cleanup_free_ char *str = xalloc(slen);
#  240|   				memcpy(str, p + 1, slen);
#  241|-> 				if (str[slen - 1] != '\0') {
#  242|   					return brei_result_new(BREI_CONNECTION_DISCONNECT_REASON_PROTOCOL,
#  243|   							       "Message string not zero-terminated");

Error: GCC_ANALYZER_WARNING (CWE-401): [#def2]
libei-1.4.1/redhat-linux-build/../src/libei.c:879:9: warning[-Wanalyzer-malloc-leak]: leak of ‘xalloc(24)’
libei-1.4.1/redhat-linux-build/../src/libei.c:871:1: enter_function: entry to ‘ei_queue_unsent’
libei-1.4.1/redhat-linux-build/../src/libei.c:877:36: call_function: calling ‘xalloc’ from ‘ei_queue_unsent’
libei-1.4.1/redhat-linux-build/../src/libei.c:877:36: return_function: returning to ‘ei_queue_unsent’ from ‘xalloc’
libei-1.4.1/redhat-linux-build/../src/libei.c:879:9: danger: ‘xalloc(24)’ leaks here; was allocated at [(6)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/5)
#  877|   	struct ei_unsent *unsent = xalloc(sizeof *unsent);
#  878|   	unsent->buf = buf;
#  879|-> 	list_append(&ei->unsent_queue, &unsent->node);
#  880|   }
#  881|   

Error: GCC_ANALYZER_WARNING (CWE-775): [#def3]
libei-1.4.1/redhat-linux-build/../src/libeis-device.c:83:12: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘xdup(fd)’
libei-1.4.1/redhat-linux-build/../src/libeis-device.c:69:1: enter_function: entry to ‘eis_device_new_keymap’
libei-1.4.1/redhat-linux-build/../src/libeis-device.c:72:9: branch_true: following ‘true’ branch (when ‘type == 1’)...
libei-1.4.1/redhat-linux-build/../src/libeis-device.c:79:13: branch_true: ...to here
libei-1.4.1/redhat-linux-build/../src/libeis-device.c:79:12: branch_false: following ‘false’ branch...
libei-1.4.1/redhat-linux-build/../src/libeis-device.c:82:21: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../src/libeis-device.c:82:21: call_function: calling ‘xdup’ from ‘eis_device_new_keymap’
libei-1.4.1/redhat-linux-build/../src/libeis-device.c:82:21: return_function: returning to ‘eis_device_new_keymap’ from ‘xdup’
libei-1.4.1/redhat-linux-build/../src/libeis-device.c:83:12: danger: ‘xdup(fd)’ leaks here; was opened at [(8)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/7)
#   81|   
#   82|   	int newfd = xdup(fd);
#   83|-> 	if (newfd < 0)
#   84|   		return NULL;
#   85|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def4]
libei-1.4.1/redhat-linux-build/../src/liboeffis.c:297:58: warning[-Wanalyzer-malloc-leak]: leak of ‘sender_name(bus)’
libei-1.4.1/redhat-linux-build/../src/liboeffis.c:648:1: enter_function: entry to ‘portal_init’
libei-1.4.1/redhat-linux-build/../src/liboeffis.c:656:12: branch_false: following ‘false’ branch...
libei-1.4.1/redhat-linux-build/../src/liboeffis.c:661:31: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../src/liboeffis.c:661:31: call_function: calling ‘sender_name’ from ‘portal_init’
libei-1.4.1/redhat-linux-build/../src/liboeffis.c:661:31: return_function: returning to ‘portal_init’ from ‘sender_name’
libei-1.4.1/redhat-linux-build/../src/liboeffis.c:297:58: danger: ‘sender_name(bus)’ leaks here; was allocated at [(12)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/11)
#  295|   	const char *name = NULL;
#  296|   
#  297|-> 	if ((sd_bus_get_unique_name(bus, &name) != 0) || strlen(name) < 1)
#  298|   		return NULL;
#  299|   

Error: GCC_ANALYZER_WARNING (CWE-775): [#def5]
libei-1.4.1/redhat-linux-build/../src/util-io.h:119:16: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘xdup(eisfd)’
libei-1.4.1/redhat-linux-build/../src/liboeffis.c:332:1: enter_function: entry to ‘connect_to_eis_returned’
libei-1.4.1/redhat-linux-build/../src/liboeffis.c:344:12: branch_false: following ‘false’ branch...
libei-1.4.1/redhat-linux-build/../src/liboeffis.c:350:14: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../src/liboeffis.c:350:14: call_function: calling ‘xdup’ from ‘connect_to_eis_returned’
libei-1.4.1/redhat-linux-build/../src/liboeffis.c:350:14: return_function: returning to ‘connect_to_eis_returned’ from ‘xdup’
libei-1.4.1/redhat-linux-build/../src/liboeffis.c:350:14: call_function: inlined call to ‘xerrno’ from ‘connect_to_eis_returned’
#  117|   static inline int
#  118|   xerrno(int value) {
#  119|-> 	return value < 0 ? -errno : value;
#  120|   }
#  121|   

Error: GCC_ANALYZER_WARNING (CWE-416): [#def6]
libei-1.4.1/redhat-linux-build/../src/util-object.h:89:9: warning[-Wanalyzer-use-after-free]: use after ‘free’ of ‘object’
libei-1.4.1/redhat-linux-build/../src/libeis-client.c:388:1: enter_function: entry to ‘client_dispatch’
libei-1.4.1/redhat-linux-build/../src/libeis-client.c:390:39: call_function: calling ‘eis_client_ref’ from ‘client_dispatch’
libei-1.4.1/redhat-linux-build/../src/libeis-client.c:390:39: return_function: returning to ‘client_dispatch’ from ‘eis_client_ref’
libei-1.4.1/redhat-linux-build/../src/libeis-client.c:395:12: branch_true: following ‘true’ branch...
libei-1.4.1/redhat-linux-build/../src/libeis-client.c:396:20: branch_true: ...to here
libei-1.4.1/redhat-linux-build/../src/libeis-client.c:402:17: call_function: inlined call to ‘eis_client_disconnect_with_reason’ from ‘client_dispatch’
libei-1.4.1/redhat-linux-build/../src/libeis-client.c:402:17: call_function: inlined call to ‘eis_client_disconnect_with_reason’ from ‘client_dispatch’
libei-1.4.1/redhat-linux-build/../src/libeis-client.c:393:31: call_function: inlined call to ‘brei_result_unrefp’ from ‘client_dispatch’
libei-1.4.1/redhat-linux-build/../src/libeis-client.c:390:30: call_function: inlined call to ‘eis_client_unrefp’ from ‘client_dispatch’
#   87|   object_unref(struct object *object)
#   88|   {
#   89|-> 	assert(object->refcount >= 1);
#   90|   	if (--object->refcount == 0)
#   91|   		object_destroy(object);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def7]
libei-1.4.1/redhat-linux-build/../src/util-strings.h:149:9: warning[-Wanalyzer-malloc-leak]: leak of ‘xstrdup("org.freedesktop.portal.Desktop")’
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:197:5: enter_function: entry to ‘main’
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:208:40: call_function: calling ‘xstrdup’ from ‘main’
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:208:40: return_function: returning to ‘main’ from ‘xstrdup’
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:232:20: branch_false: following ‘false’ branch (when ‘c != -1’)...
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:235:17: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:247:30: call_function: inlined call to ‘xatoi’ from ‘main’
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:247:30: call_function: inlined call to ‘xatoi’ from ‘main’
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:247:28: branch_true: following ‘true’ branch...
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:210:19: branch_true: ...to here
libei-1.4.1/redhat-linux-build/../src/util-strings.h:149:9: danger: ‘xstrdup("org.freedesktop.portal.Desktop")’ leaks here; was allocated at [(6)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/5)
#  147|   	long v;
#  148|   
#  149|-> 	assert(base == 10 || base == 16 || base == 8);
#  150|   
#  151|   	errno = 0;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def8]
libei-1.4.1/redhat-linux-build/../src/util-strings.h:273:9: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
libei-1.4.1/redhat-linux-build/../src/util-strings.c:78:1: enter_function: entry to ‘strv_from_string’
libei-1.4.1/redhat-linux-build/../src/util-strings.c:85:9: branch_true: following ‘true’ branch (when ‘in’ is non-NULL)...
libei-1.4.1/redhat-linux-build/../src/util-strings.c:87:9: branch_true: ...to here
libei-1.4.1/redhat-linux-build/../src/util-strings.c:88:16: branch_true: following ‘true’ branch...
libei-1.4.1/redhat-linux-build/../src/util-strings.c:89:16: branch_true: ...to here
libei-1.4.1/redhat-linux-build/../src/util-strings.c:88:16: branch_false: following ‘false’ branch...
libei-1.4.1/redhat-linux-build/../src/util-strings.c:91:12: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../src/util-strings.c:91:12: branch_false: following ‘false’ branch (when ‘nelems != 0’)...
libei-1.4.1/redhat-linux-build/../src/util-strings.c:94:9: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../src/util-strings.c:95:16: call_function: calling ‘xalloc’ from ‘strv_from_string’
libei-1.4.1/redhat-linux-build/../src/util-strings.c:95:16: return_function: returning to ‘strv_from_string’ from ‘xalloc’
libei-1.4.1/redhat-linux-build/../src/util-strings.c:100:24: call_function: calling ‘next_word’ from ‘strv_from_string’
libei-1.4.1/redhat-linux-build/../src/util-strings.c:100:24: return_function: returning to ‘strv_from_string’ from ‘next_word’
libei-1.4.1/redhat-linux-build/../src/util-strings.c:100:16: branch_true: following ‘true’ branch...
libei-1.4.1/redhat-linux-build/../src/util-strings.c:101:30: branch_true: ...to here
libei-1.4.1/redhat-linux-build/../src/util-strings.c:102:20: branch_false: following ‘false’ branch (when ‘copy’ is non-NULL)...
libei-1.4.1/redhat-linux-build/../src/util-strings.c:107:22: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../src/util-strings.c:100:24: call_function: calling ‘next_word’ from ‘strv_from_string’
libei-1.4.1/redhat-linux-build/../src/util-strings.c:100:24: return_function: returning to ‘strv_from_string’ from ‘next_word’
libei-1.4.1/redhat-linux-build/../src/util-strings.c:100:16: branch_true: following ‘true’ branch...
libei-1.4.1/redhat-linux-build/../src/util-strings.c:101:30: branch_true: ...to here
libei-1.4.1/redhat-linux-build/../src/util-strings.c:102:20: branch_false: following ‘false’ branch (when ‘copy’ is non-NULL)...
libei-1.4.1/redhat-linux-build/../src/util-strings.c:107:22: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../src/util-strings.c:100:24: call_function: calling ‘next_word’ from ‘strv_from_string’
libei-1.4.1/redhat-linux-build/../src/util-strings.c:100:24: return_function: returning to ‘strv_from_string’ from ‘next_word’
libei-1.4.1/redhat-linux-build/../src/util-strings.c:100:16: branch_true: following ‘true’ branch...
libei-1.4.1/redhat-linux-build/../src/util-strings.c:101:30: branch_true: ...to here
libei-1.4.1/redhat-linux-build/../src/util-strings.c:101:30: acquire_memory: allocated here
libei-1.4.1/redhat-linux-build/../src/util-strings.c:102:20: branch_false: following ‘false’ branch (when ‘copy’ is non-NULL)...
libei-1.4.1/redhat-linux-build/../src/util-strings.c:107:22: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../src/util-strings.c:100:24: call_function: calling ‘next_word’ from ‘strv_from_string’
libei-1.4.1/redhat-linux-build/../src/util-strings.c:100:24: return_function: returning to ‘strv_from_string’ from ‘next_word’
libei-1.4.1/redhat-linux-build/../src/util-strings.c:100:16: branch_true: following ‘true’ branch...
libei-1.4.1/redhat-linux-build/../src/util-strings.c:101:30: branch_true: ...to here
libei-1.4.1/redhat-linux-build/../src/util-strings.c:102:20: branch_true: following ‘true’ branch (when ‘copy’ is NULL)...
libei-1.4.1/redhat-linux-build/../src/util-strings.c:103:25: branch_true: ...to here
libei-1.4.1/redhat-linux-build/../src/util-strings.c:103:25: call_function: calling ‘strv_free’ from ‘strv_from_string’
#  271|   	}
#  272|   
#  273|-> 	free (strv);
#  274|   }
#  275|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def9]
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:73:9: warning[-Wanalyzer-malloc-leak]: leak of ‘xstrdup("org.freedesktop.portal.Desktop")’
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:197:5: enter_function: entry to ‘main’
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:208:40: call_function: calling ‘xstrdup’ from ‘main’
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:208:40: return_function: returning to ‘main’ from ‘xstrdup’
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:272:9: branch_true: following ‘true’ branch (when ‘ei’ is non-NULL)...
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:274:12: branch_true: ...to here
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:281:12: branch_true: following ‘true’ branch (when ‘backend == 0’)...
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:282:28: branch_true: ...to here
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:283:17: call_function: calling ‘colorprint’ from ‘main’
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:283:17: return_function: returning to ‘main’ from ‘colorprint’
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:289:12: branch_false: following ‘false’ branch (when ‘rc == 0’)...
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:295:23: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:314:16: branch_true: following ‘true’ branch...
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:315:17: branch_true: ...to here
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:318:24: branch_false: following ‘false’ branch (when ‘stop == 0’)...
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:319:48: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:320:28: branch_false: following ‘false’ branch...
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:323:32: branch_false: ...to here
libei-1.4.1/redhat-linux-build/../tools/ei-demo-client.c:73:9: danger: ‘xstrdup("org.freedesktop.portal.Desktop")’ leaks here; was allocated at [(6)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/5)
#   71|   {
#   72|   	static uint64_t color = 0;
#   73|-> 	run_only_once {
#   74|   		color = rgb(1, 1, 1) | rgb_bg(230, 0, 230);
#   75|   	}

Error: CPPCHECK_WARNING (CWE-457): [#def10]
libei-1.4.1/src/util-memfile.c:74: warning[uninitvar]: Uninitialized variable: rc
#   72|   		rc = SYSCALL(posix_fallocate(fd, 0, sz));
#   73|   	}
#   74|-> 	if (rc < 0)
#   75|   		return NULL;
#   76|   

Scan Properties