Error: GCC_ANALYZER_WARNING (CWE-688): [#def1] mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:223:4: warning[-Wanalyzer-null-argument]: use of NULL ‘rt_stage_info’ where non-null expected mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:363:1: enter_function: entry to ‘radv_CreatePipelineBinariesKHR’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:370:7: branch_false: following ‘false’ branch... branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:381:13: call_function: calling ‘radv_create_pipeline_binaries’ from ‘radv_CreatePipelineBinariesKHR’ #argument 2 of ‘__builtin_memcpy’ must be non-null # 221| # 222| memcpy(header.stage_sha1, stage_sha1, sizeof(header.stage_sha1)); # 223|-> memcpy(&header.stage_info, rt_stage_info, sizeof(header.stage_info)); # 224| # 225| blob_init(&blob); Error: GCC_ANALYZER_WARNING (CWE-476): [#def2] mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:241:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:363:1: enter_function: entry to ‘radv_CreatePipelineBinariesKHR’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:370:7: branch_false: following ‘false’ branch... branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:378:4: call_function: inlined call to ‘util_dynarray_init’ from ‘radv_CreatePipelineBinariesKHR’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_pipeline_binary.c:381:13: call_function: calling ‘radv_create_pipeline_binaries’ from ‘radv_CreatePipelineBinariesKHR’ # 239| } # 240| # 241|-> util_dynarray_append(pipeline_binaries, struct radv_pipeline_binary *, pipeline_binary); # 242| return result; # 243| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def3] mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:154:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘strides’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:100:1: enter_function: entry to ‘radv_build_printf’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:102:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:105:68: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:106:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:109:30: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:111:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:114:28: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:122:20: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:122:20: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:133:24: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:135:22: call_function: inlined call to ‘nir_imm_true’ from ‘radv_build_printf’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:135:22: call_function: inlined call to ‘nir_imm_true’ from ‘radv_build_printf’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:138:25: branch_true: following ‘true’ branch (when ‘num_args > i’)... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:139:16: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:147:27: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:147:27: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:150:10: branch_false: following ‘false’ branch (when ‘divergent == 0’)... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:154:17: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:154:23: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:154:23: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:154:10: danger: ‘strides + (long unsigned int)i * 8’ could be NULL: unchecked value from [(23)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/22) # 152| format.divergence_mask |= BITFIELD_BIT(i); # 153| } else { # 154|-> strides[i] = nir_imm_int(b, arg_size); # 155| } # 156| Error: GCC_ANALYZER_WARNING (CWE-476): [#def4] mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_radeon_winsys.h:354:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bo’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2635:1: enter_function: entry to ‘radv_uvd_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2650:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2655:4: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_uvd_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2659:4: call_function: calling ‘ruvd_dec_message_decode’ from ‘radv_uvd_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2659:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘ruvd_dec_message_decode’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2663:4: call_function: calling ‘send_cmd’ from ‘radv_uvd_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2663:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘send_cmd’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2675:4: call_function: calling ‘send_cmd’ from ‘radv_uvd_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2675:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘send_cmd’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2680:4: call_function: calling ‘send_cmd’ from ‘radv_uvd_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2680:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘send_cmd’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2681:4: call_function: calling ‘send_cmd’ from ‘radv_uvd_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2681:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘send_cmd’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2682:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2683:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2683:7: call_function: calling ‘send_cmd’ from ‘radv_uvd_decode_video’ # 352| radv_buffer_is_resident(const struct radeon_winsys_bo *bo) # 353| { # 354|-> return bo->use_global_list || bo->is_local; # 355| } # 356| Error: GCC_ANALYZER_WARNING (CWE-476): [#def5] mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:1365:51: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2690:1: enter_function: entry to ‘radv_vcn_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2698:25: release_memory: ‘it_probs_ptr’ is NULL mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2698:25: release_memory: ‘it_probs_ptr’ is NULL mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2740:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’ # 1363| # 1364| const StdVideoH265SequenceParameterSet *sps = # 1365|-> vk_video_find_h265_dec_std_sps(¶ms->vk, h265_pic_info->pStdPictureInfo->pps_seq_parameter_set_id); # 1366| const StdVideoH265PictureParameterSet *pps = # 1367| vk_video_find_h265_dec_std_pps(¶ms->vk, h265_pic_info->pStdPictureInfo->pps_pic_parameter_set_id); Error: GCC_ANALYZER_WARNING (CWE-476): [#def6] mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:1365:51: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘it_ptr’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2690:1: enter_function: entry to ‘radv_vcn_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2698:25: release_memory: ‘it_probs_ptr’ is NULL mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2698:25: release_memory: ‘it_probs_ptr’ is NULL mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2725:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2728:14: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2728:14: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2733:4: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_vcn_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2736:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2740:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2740:4: release_memory: ‘it_probs_ptr’ is NULL mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2740:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’ # 1363| # 1364| const StdVideoH265SequenceParameterSet *sps = # 1365|-> vk_video_find_h265_dec_std_sps(¶ms->vk, h265_pic_info->pStdPictureInfo->pps_seq_parameter_set_id); # 1366| const StdVideoH265PictureParameterSet *pps = # 1367| vk_video_find_h265_dec_std_pps(¶ms->vk, h265_pic_info->pStdPictureInfo->pps_pic_parameter_set_id); Error: GCC_ANALYZER_WARNING (CWE-476): [#def7] mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2146:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘it_ptr’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2635:1: enter_function: entry to ‘radv_uvd_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2643:25: release_memory: ‘it_probs_ptr’ is NULL mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2643:25: release_memory: ‘it_probs_ptr’ is NULL mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2650:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2655:4: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_uvd_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2659:4: release_memory: ‘it_probs_ptr’ is NULL mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2659:4: call_function: calling ‘ruvd_dec_message_decode’ from ‘radv_uvd_decode_video’ # 2144| vk_find_struct_const(frame_info->pNext, VIDEO_DECODE_H264_PICTURE_INFO_KHR); # 2145| # 2146|-> *slice_offset = h264_pic_info->pSliceOffsets[0]; # 2147| # 2148| memset(&result, 0, sizeof(result)); Error: GCC_ANALYZER_WARNING (CWE-476): [#def8] mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2230:34: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2138:1: enter_function: entry to ‘get_uvd_h264_msg’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2144:7: call_function: inlined call to ‘__vk_find_struct’ from ‘get_uvd_h264_msg’ branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2144:7: call_function: inlined call to ‘__vk_find_struct’ from ‘get_uvd_h264_msg’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2208:4: call_function: calling ‘update_h264_scaling’ from ‘get_uvd_h264_msg’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2208:4: return_function: returning to ‘get_uvd_h264_msg’ from ‘update_h264_scaling’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2225:25: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2226:17: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2228:10: call_function: inlined call to ‘__vk_find_struct’ from ‘get_uvd_h264_msg’ branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2228:10: call_function: inlined call to ‘__vk_find_struct’ from ‘get_uvd_h264_msg’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2230:34: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2230:34: danger: dereference of NULL ‘<unknown>’ # 2228| vk_find_struct_const(frame_info->pReferenceSlots[i].pNext, VIDEO_DECODE_H264_DPB_SLOT_INFO_KHR); # 2229| # 2230|-> result.frame_num_list[i] = dpb_slot->pStdReferenceInfo->FrameNum; # 2231| result.field_order_cnt_list[i][0] = dpb_slot->pStdReferenceInfo->PicOrderCnt[0]; # 2232| result.field_order_cnt_list[i][1] = dpb_slot->pStdReferenceInfo->PicOrderCnt[1]; Error: GCC_ANALYZER_WARNING (CWE-476): [#def9] mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2259:51: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2246:1: enter_function: entry to ‘get_uvd_h265_msg’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2254:7: call_function: inlined call to ‘__vk_find_struct’ from ‘get_uvd_h265_msg’ branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2254:7: call_function: inlined call to ‘__vk_find_struct’ from ‘get_uvd_h265_msg’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2256:4: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2259:51: danger: dereference of NULL ‘<unknown>’ # 2257| # 2258| const StdVideoH265SequenceParameterSet *sps = # 2259|-> vk_video_find_h265_dec_std_sps(¶ms->vk, h265_pic_info->pStdPictureInfo->pps_seq_parameter_set_id); # 2260| const StdVideoH265PictureParameterSet *pps = # 2261| vk_video_find_h265_dec_std_pps(¶ms->vk, h265_pic_info->pStdPictureInfo->pps_pic_parameter_set_id); Error: GCC_ANALYZER_WARNING (CWE-476): [#def10] mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2259:51: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘it_ptr’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2635:1: enter_function: entry to ‘radv_uvd_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2643:25: release_memory: ‘it_probs_ptr’ is NULL mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2643:25: release_memory: ‘it_probs_ptr’ is NULL mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2650:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2655:4: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_uvd_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2659:4: release_memory: ‘it_probs_ptr’ is NULL mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2659:4: call_function: calling ‘ruvd_dec_message_decode’ from ‘radv_uvd_decode_video’ # 2257| # 2258| const StdVideoH265SequenceParameterSet *sps = # 2259|-> vk_video_find_h265_dec_std_sps(¶ms->vk, h265_pic_info->pStdPictureInfo->pps_seq_parameter_set_id); # 2260| const StdVideoH265PictureParameterSet *pps = # 2261| vk_video_find_h265_dec_std_pps(¶ms->vk, h265_pic_info->pStdPictureInfo->pps_pic_parameter_set_id); Error: GCC_ANALYZER_WARNING (CWE-457): [#def11] mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2755:4: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘slice_offset’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2690:1: enter_function: entry to ‘radv_vcn_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2725:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2728:14: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2728:14: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2733:4: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_vcn_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2740:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2740:4: return_function: returning to ‘radv_vcn_decode_video’ from ‘rvcn_dec_message_decode’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2742:4: call_function: calling ‘send_cmd’ from ‘radv_vcn_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2742:4: return_function: returning to ‘radv_vcn_decode_video’ from ‘send_cmd’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2743:4: call_function: calling ‘send_cmd’ from ‘radv_vcn_decode_video’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2743:4: return_function: returning to ‘radv_vcn_decode_video’ from ‘send_cmd’ mesa-25.0.2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2755:4: danger: use of uninitialized value ‘slice_offset’ here # 2753| send_cmd(cmd_buffer, RDECODE_CMD_CONTEXT_BUFFER, vid->ctx.mem->bo, vid->ctx.offset); # 2754| # 2755|-> send_cmd(cmd_buffer, RDECODE_CMD_BITSTREAM_BUFFER, src_buffer->bo, # 2756| src_buffer->offset + frame_info->srcBufferOffset + slice_offset); # 2757| Error: GCC_ANALYZER_WARNING (CWE-476): [#def12] mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3574:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3546:1: enter_function: entry to ‘v3dv_GetPipelineExecutableStatisticsKHR’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3560:7: call_function: inlined call to ‘pipeline_get_prog_data’ from ‘v3dv_GetPipelineExecutableStatisticsKHR’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3564:30: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3569:7: branch_true: following ‘true’ branch (when ‘qpu_inst_count != 0’)... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3570:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3570:7: call_function: calling ‘__vk_outarray_next’ from ‘v3dv_GetPipelineExecutableStatisticsKHR’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3570:7: return_function: returning to ‘v3dv_GetPipelineExecutableStatisticsKHR’ from ‘__vk_outarray_next’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3570:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3571:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3574:28: danger: dereference of NULL ‘<unknown>’ # 3572| WRITE_STR(stat->description, "Chosen compile strategy index"); # 3573| stat->format = VK_PIPELINE_EXECUTABLE_STATISTIC_FORMAT_UINT64_KHR; # 3574|-> stat->value.u64 = prog_data->compile_strategy_idx; # 3575| } # 3576| Error: GCC_ANALYZER_WARNING (CWE-1341): [#def13] mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:541:7: warning[-Wanalyzer-fd-double-close]: double ‘close’ of file descriptor ‘fd’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1243:1: enter_function: entry to ‘v3dv_queue_driver_submit’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1257:20: branch_true: following ‘true’ branch (when ‘i != 5’)... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1258:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1262:25: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1264:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1265:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1267:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:13: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1293:43: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1293:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)... branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1296:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’ # 539| fail: # 540| if (info->pool->query_type == VK_QUERY_TYPE_PERFORMANCE_QUERY_KHR) # 541|-> close(fd); # 542| # 543| cnd_broadcast(&job->device->query_ended); Error: GCC_ANALYZER_WARNING (CWE-775): [#def14] mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:547:1: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘fd’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1243:1: enter_function: entry to ‘v3dv_queue_driver_submit’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1257:20: branch_true: following ‘true’ branch (when ‘i != 5’)... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1258:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1262:25: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1264:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1265:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1267:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:13: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1293:43: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1293:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)... branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1296:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’ # 545| # 546| return result; # 547|-> } # 548| # 549| static VkResult Error: GCC_ANALYZER_WARNING (CWE-476): [#def15] mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:651:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘syncs’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1243:1: enter_function: entry to ‘v3dv_queue_driver_submit’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1257:20: branch_true: following ‘true’ branch (when ‘i != 5’)... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1258:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1262:25: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1264:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1265:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1267:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:13: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1293:43: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1293:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)... branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1296:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’ # 649| struct v3dv_query *query = &info->pool->queries[info->first + i]; # 650| # 651|-> syncs[i] = vk_sync_as_drm_syncobj(query->perf.last_job_sync)->syncobj; # 652| kperfmon_ids[i] = (uintptr_t)(void *)query->perf.kperfmon_ids; # 653| Error: GCC_ANALYZER_WARNING (CWE-476): [#def16] mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:651:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1243:1: enter_function: entry to ‘v3dv_queue_driver_submit’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1257:20: branch_true: following ‘true’ branch (when ‘i != 5’)... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1258:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1262:25: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1264:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1265:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1267:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:13: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1293:43: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1293:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)... branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1296:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’ # 649| struct v3dv_query *query = &info->pool->queries[info->first + i]; # 650| # 651|-> syncs[i] = vk_sync_as_drm_syncobj(query->perf.last_job_sync)->syncobj; # 652| kperfmon_ids[i] = (uintptr_t)(void *)query->perf.kperfmon_ids; # 653| Error: GCC_ANALYZER_WARNING (CWE-476): [#def17] mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:652:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘kperfmon_ids’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1243:1: enter_function: entry to ‘v3dv_queue_driver_submit’ mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1257:20: branch_true: following ‘true’ branch (when ‘i != 5’)... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1258:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1262:25: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1264:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1265:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1267:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:13: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1293:43: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1293:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)... branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1296:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’ # 650| # 651| syncs[i] = vk_sync_as_drm_syncobj(query->perf.last_job_sync)->syncobj; # 652|-> kperfmon_ids[i] = (uintptr_t)(void *)query->perf.kperfmon_ids; # 653| # 654| if (info->flags & VK_QUERY_RESULT_WAIT_BIT) { Error: GCC_ANALYZER_WARNING (CWE-476): [#def18] mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:99:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘producer_info.fog’ mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:449:1: enter_function: entry to ‘gl_nir_opt_dead_builtin_varyings’ mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:459:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:467:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:467:4: call_function: calling ‘initialise_varying_info’ from ‘gl_nir_opt_dead_builtin_varyings’ mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:467:4: return_function: returning to ‘gl_nir_opt_dead_builtin_varyings’ from ‘initialise_varying_info’ mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:468:4: call_function: calling ‘initialise_varying_info’ from ‘gl_nir_opt_dead_builtin_varyings’ mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:468:4: return_function: returning to ‘gl_nir_opt_dead_builtin_varyings’ from ‘initialise_varying_info’ mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:470:7: branch_true: following ‘true’ branch (when ‘producer’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:471:40: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:471:7: call_function: calling ‘get_varying_info’ from ‘gl_nir_opt_dead_builtin_varyings’ # 97| nir_variable *var = nir_deref_instr_get_variable(deref); # 98| # 99|-> if (!glsl_type_is_array(var->type) || !is_gl_identifier(var->name)) # 100| return; # 101| Error: GCC_ANALYZER_WARNING (CWE-476): [#def19] mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/list.h:145:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘cursor.<U3320>.block’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1187:1: enter_function: entry to ‘nir_opt_loop_unroll’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_loop_unroll’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: return_function: returning to ‘nir_opt_loop_unroll’ from ‘nir_foreach_function_with_impl_first’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1194:19: call_function: calling ‘nir_opt_loop_unroll_impl’ from ‘nir_opt_loop_unroll’ # 143| exec_node_get_prev(struct exec_node *n) # 144| { # 145|-> return n->prev; # 146| } # 147| Error: GCC_ANALYZER_WARNING (CWE-476): [#def20] mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir.h:1744:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir.c:2688:1: enter_function: entry to ‘nir_intrinsic_can_reorder’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir.c:2699:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir.c:2700:32: call_function: inlined call to ‘nir_src_as_deref’ from ‘nir_intrinsic_can_reorder’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir.c:2701:11: call_function: inlined call to ‘nir_deref_mode_is_in_set’ from ‘nir_intrinsic_can_reorder’ # 1742| assert(!(modes & ~nir_var_all)); # 1743| assert(deref->modes != 0); # 1744|-> return deref->modes & modes; # 1745| } # 1746| Error: GCC_ANALYZER_WARNING (CWE-476): [#def21] mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir.h:1744:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’ mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1248:1: enter_function: entry to ‘gl_nir_link_uniform_blocks’ mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1253:24: branch_true: following ‘true’ branch (when ‘stage != 6’)... mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1254:38: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1260:10: branch_false: following ‘false’ branch (when ‘linked’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1263:7: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/compiler/glsl/gl_nir_link_uniform_blocks.c:1263:7: call_function: calling ‘link_linked_shader_uniform_blocks’ from ‘gl_nir_link_uniform_blocks’ # 1742| assert(!(modes & ~nir_var_all)); # 1743| assert(deref->modes != 0); # 1744|-> return deref->modes & modes; # 1745| } # 1746| Error: GCC_ANALYZER_WARNING (CWE-476): [#def22] mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_builder.h:1449:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_lower_tex.c:1799:1: enter_function: entry to ‘nir_lower_tex’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_lower_tex.c:1807:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_lower_tex.c:1811:18: call_function: calling ‘nir_lower_tex’ from ‘nir_lower_tex’ # 1447| { # 1448| assert(src->num_components <= num_components); # 1449|-> if (src->num_components == num_components) # 1450| return src; # 1451| Error: GCC_ANALYZER_WARNING (CWE-476): [#def23] mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1174:30: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘uniform’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1233:1: enter_function: entry to ‘replace_varying_input_by_uniform_load’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1237:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘replace_varying_input_by_uniform_load’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1237:30: return_function: returning to ‘replace_varying_input_by_uniform_load’ from ‘nir_shader_get_entrypoint’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1241:28: call_function: calling ‘nir_intrinsic_get_var’ from ‘replace_varying_input_by_uniform_load’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1241:28: return_function: returning to ‘replace_varying_input_by_uniform_load’ from ‘nir_intrinsic_get_var’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1244:29: call_function: inlined call to ‘nir_src_as_deref’ from ‘replace_varying_input_by_uniform_load’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1245:28: call_function: calling ‘nir_deref_instr_get_variable’ from ‘replace_varying_input_by_uniform_load’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1245:28: return_function: returning to ‘replace_varying_input_by_uniform_load’ from ‘nir_deref_instr_get_variable’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1246:14: call_function: calling ‘nir_clone_uniform_variable’ from ‘replace_varying_input_by_uniform_load’ # 1172| if ((spirv && uniform->data.mode & nir_var_mem_ubo && # 1173| v->data.binding == uniform->data.binding) || # 1174|-> (!spirv && !strcmp(uniform->name, v->name))) { # 1175| new_var = v; # 1176| break; Error: GCC_ANALYZER_WARNING (CWE-476): [#def24] mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_lower_tex.c:442:52: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘a’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_lower_tex.c:1799:1: enter_function: entry to ‘nir_lower_tex’ mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_lower_tex.c:1807:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/compiler/nir/nir_lower_tex.c:1811:18: call_function: calling ‘nir_lower_tex’ from ‘nir_lower_tex’ # 440| nir_imm_floatN_t(b, offset_vals[0], a->bit_size), # 441| nir_imm_floatN_t(b, offset_vals[1], a->bit_size), # 442|-> nir_imm_floatN_t(b, offset_vals[2], a->bit_size), # 443| a); # 444| Error: GCC_ANALYZER_WARNING (CWE-476): [#def25] mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:198:16: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘samplers_to_restore’ mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:183:7: branch_false: following ‘false’ branch (when ‘to_remove != 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:186:7: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:186:7: branch_true: following ‘true’ branch (when ‘type == 3’)... mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:187:29: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:187:29: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:193:23: branch_true: following ‘true’ branch (when ‘i != 8’)... branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:194:26: branch_true: following ‘true’ branch (when ‘j != 32’)... mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:195:33: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:197:16: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:198:16: danger: ‘samplers_to_restore + (long unsigned int)to_restore * 8’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4) # 196| # 197| if (sampler && cso_hash_take(hash, sampler->hash_key)) # 198|-> samplers_to_restore[to_restore++] = sampler; # 199| } # 200| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def26] mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:205:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘samplers_to_restore’ mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:183:7: branch_false: following ‘false’ branch (when ‘to_remove != 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:186:7: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:186:7: branch_true: following ‘true’ branch (when ‘type == 3’)... mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:187:29: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:187:29: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:193:23: branch_true: following ‘true’ branch (when ‘i != 8’)... branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:194:26: branch_true: following ‘true’ branch (when ‘j != 32’)... mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:195:33: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:201:23: branch_true: following ‘true’ branch (when ‘j != 32’)... mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:202:30: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:204:13: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/cso_cache/cso_context.c:205:13: danger: ‘samplers_to_restore + (long unsigned int)to_restore * 8’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/4) # 203| # 204| if (sampler && cso_hash_take(hash, sampler->hash_key)) # 205|-> samplers_to_restore[to_restore++] = sampler; # 206| } # 207| for (int j = 0; j < PIPE_MAX_SAMPLERS; j++) { Error: GCC_ANALYZER_WARNING (CWE-476): [#def27] mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_state.c:114:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘texture’ mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_state.c:102:29: enter_function: entry to ‘noop_create_surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_state.c:108:7: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_state.c:110:4: call_function: inlined call to ‘pipe_reference_init’ from ‘noop_create_surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_state.c:111:4: call_function: calling ‘pipe_resource_reference’ from ‘noop_create_surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_state.c:111:4: return_function: returning to ‘noop_create_surface’ from ‘pipe_resource_reference’ mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/driver_noop/noop_state.c:114:21: danger: dereference of NULL ‘texture’ # 112| surface->context = ctx; # 113| surface->format = surf_tmpl->format; # 114|-> surface->width = texture->width0; # 115| surface->height = texture->height0; # 116| surface->texture = texture; Error: GCC_ANALYZER_WARNING (CWE-1341): [#def28] mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:305:4: warning[-Wanalyzer-fd-double-close]: double ‘close’ of file descriptor ‘*ddev.fd’ mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:289:1: enter_function: entry to ‘pipe_loader_drm_zink_probe’ mesa-25.0.2/redhat-linux-build/../src/gallium/auxiliary/pipe-loader/pipe_loader_drm.c:291:11: call_function: calling ‘pipe_loader_drm_probe_internal’ from ‘pipe_loader_drm_zink_probe’ # 303| #endif # 304| # 305|-> close(ddev->fd); # 306| FREE(ddev->base.driver_name); # 307| pipe_loader_base_release(dev); Error: GCC_ANALYZER_WARNING (CWE-476): [#def29] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:2849:32: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘crocus_create_shader_state(ctx, state)’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:2843:1: enter_function: entry to ‘crocus_create_fs_state’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:2848:43: call_function: calling ‘crocus_create_shader_state’ from ‘crocus_create_fs_state’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:2848:43: return_function: returning to ‘crocus_create_fs_state’ from ‘crocus_create_shader_state’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/crocus/crocus_program.c:2849:32: danger: dereference of NULL ‘crocus_create_shader_state(ctx, state)’ # 2847| struct crocus_screen *screen = (void *) ctx->screen; # 2848| struct crocus_uncompiled_shader *ish = crocus_create_shader_state(ctx, state); # 2849|-> struct shader_info *info = &ish->nir->info; # 2850| # 2851| ish->nos |= (1ull << CROCUS_NOS_FRAMEBUFFER) | Error: GCC_ANALYZER_WARNING (CWE-476): [#def30] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:33:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ptex’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:17:1: enter_function: entry to ‘fd_create_surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:22:7: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:26:13: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:29:4: call_function: calling ‘pipe_resource_reference’ from ‘fd_create_surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:29:4: return_function: returning to ‘fd_create_surface’ from ‘pipe_resource_reference’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:33:28: danger: dereference of NULL ‘ptex’ # 31| psurf->context = pctx; # 32| psurf->format = surf_tmpl->format; # 33|-> psurf->width = u_minify(ptex->width0, level); # 34| psurf->height = u_minify(ptex->height0, level); # 35| psurf->nr_samples = surf_tmpl->nr_samples; Error: GCC_ANALYZER_WARNING (CWE-476): [#def31] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/ppir.h:508:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘node’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:640:12: enter_function: entry to ‘ppir_node_insert_mov’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:642:22: call_function: calling ‘ppir_node_insert_mov_local’ from ‘ppir_node_insert_mov’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:642:22: return_function: returning to ‘ppir_node_insert_mov’ from ‘ppir_node_insert_mov_local’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:645:4: branch_true: following ‘true’ branch (when ‘block != comp’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:646:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:646:10: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:648:7: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:648:7: branch_true: following ‘true’ branch... branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:649:26: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:650:29: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:650:29: call_function: calling ‘ppir_node_get_src’ from ‘ppir_node_insert_mov’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:650:29: return_function: returning to ‘ppir_node_insert_mov’ from ‘ppir_node_get_src’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:651:16: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:653:17: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:653:16: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:654:16: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/node.c:654:16: call_function: calling ‘ppir_node_target_assign’ from ‘ppir_node_insert_mov’ # 506| { # 507| assert(node); # 508|-> switch (node->type) { # 509| case ppir_node_type_alu: # 510| return &ppir_node_to_alu(node)->dest; Error: GCC_ANALYZER_WARNING (CWE-476): [#def32] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/lima_blit.c:143:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/lima_blit.c:29:1: enter_function: entry to ‘lima_pack_blit_cmd’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/lima_blit.c:141:4: call_function: calling ‘util_dynarray_ensure_cap’ from ‘lima_pack_blit_cmd’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/lima_blit.c:141:4: return_function: returning to ‘lima_pack_blit_cmd’ from ‘util_dynarray_ensure_cap’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/lima_blit.c:143:4: danger: dereference of NULL ‘util_dynarray_ensure_cap(cmd_array, *cmd_array.size + (unsigned int)(max_n * 4))’ # 141| PLBU_CMD_BEGIN(cmd_array, scissor ? 22 : 20); # 142| # 143|-> PLBU_CMD_VIEWPORT_LEFT(0); # 144| PLBU_CMD_VIEWPORT_RIGHT(fui(fb_width)); # 145| PLBU_CMD_VIEWPORT_BOTTOM(0); Error: GCC_ANALYZER_WARNING (CWE-476): [#def33] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:583:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pres’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:564:1: enter_function: entry to ‘lima_surface_create’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:570:7: branch_false: following ‘false’ branch (when ‘surf’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:576:13: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:579:4: call_function: calling ‘pipe_resource_reference’ from ‘lima_surface_create’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:579:4: return_function: returning to ‘lima_surface_create’ from ‘pipe_resource_reference’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:583:28: danger: dereference of NULL ‘pres’ # 581| psurf->context = pctx; # 582| psurf->format = surf_tmpl->format; # 583|-> psurf->width = u_minify(pres->width0, level); # 584| psurf->height = u_minify(pres->height0, level); # 585| psurf->nr_samples = surf_tmpl->nr_samples; Error: GCC_ANALYZER_WARNING (CWE-401): [#def34] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:578:4: warning[-Wanalyzer-malloc-leak]: leak of ‘ns’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:545:1: enter_function: entry to ‘nv30_miptree_surface_new’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:554:9: acquire_memory: allocated here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:555:7: branch_false: following ‘false’ branch (when ‘ns’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:557:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:560:4: call_function: calling ‘pipe_resource_reference’ from ‘nv30_miptree_surface_new’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:560:4: return_function: returning to ‘nv30_miptree_surface_new’ from ‘pipe_resource_reference’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:578:4: danger: ‘ns’ leaks here; was allocated at [(2)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/1) # 576| /* comment says there are going to be removed, but they're used by the st */ # 577| ps->width = ns->width; # 578|-> ps->height = ns->height; # 579| return ps; # 580| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def35] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1601:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘*views’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1543:13: enter_function: entry to ‘r300_set_sampler_views’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1560:8: branch_false: following ‘false’ branch... branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1576:17: branch_true: following ‘true’ branch (when ‘i < count’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1577:12: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1577:12: branch_false: following ‘false’ branch (when ‘take_ownership == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1584:26: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1582:13: call_function: calling ‘pipe_sampler_view_reference’ from ‘r300_set_sampler_views’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1582:13: return_function: returning to ‘r300_set_sampler_views’ from ‘pipe_sampler_view_reference’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1587:12: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1596:19: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1597:12: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1601:9: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/r300/r300_state.c:1601:9: danger: dereference of NULL ‘*state.sampler_views[i]’ # 1599| } # 1600| # 1601|-> state->sampler_views[i]->texcache_region = # 1602| r300_assign_texture_cache_region(view_index, real_num_views); # 1603| view_index++; Error: GCC_ANALYZER_WARNING (CWE-476): [#def36] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:1366:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dynamic_dpb_t2’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2503:6: enter_function: entry to ‘send_cmd_dec’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2516:4: call_function: calling ‘map_msg_fb_it_probs_buf’ from ‘send_cmd_dec’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2516:4: return_function: returning to ‘send_cmd_dec’ from ‘map_msg_fb_it_probs_buf’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vcn_dec.c:2517:9: call_function: calling ‘rvcn_dec_message_decode’ from ‘send_cmd_dec’ # 1364| dynamic_dpb_t2->dpbAddrLo[i] = addr; # 1365| dynamic_dpb_t2->dpbAddrHi[i] = addr >> 32; # 1366|-> ++dynamic_dpb_t2->dpbArraySize; # 1367| found = true; # 1368| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def37] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:76:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘code_object’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1171:13: enter_function: entry to ‘si_launch_grid’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1178:28: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1186:8: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1246:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1254:34: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1253:9: call_function: calling ‘si_switch_compute_shader’ from ‘si_launch_grid’ # 74| { # 75| # 76|-> uint32_t rsrc1 = code_object->compute_pgm_resource_registers; # 77| uint32_t rsrc2 = code_object->compute_pgm_resource_registers >> 32; # 78| out_config->num_sgprs = code_object->wavefront_sgpr_count; Error: GCC_ANALYZER_WARNING (CWE-476): [#def38] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:661:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘code_object’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1171:13: enter_function: entry to ‘si_launch_grid’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1178:28: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1186:8: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1246:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1254:34: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1253:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1257:4: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1259:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1260:8: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_compute.c:1260:8: call_function: calling ‘si_upload_compute_input’ from ‘si_launch_grid’ # 659| # 660| unsigned i, user_sgpr = 0; # 661|-> if (AMD_HSA_BITS_GET(code_object->code_properties, # 662| AMD_CODE_PROPERTY_ENABLE_SGPR_PRIVATE_SEGMENT_BUFFER)) { # 663| if (code_object->workitem_private_segment_byte_size > 0) { Error: GCC_ANALYZER_WARNING (CWE-457): [#def39] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_lower_vs_inputs.c:259:28: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘loads[src]’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_lower_vs_inputs.c:560:1: enter_function: entry to ‘lower_vs_input_instr’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_lower_vs_inputs.c:574:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_lower_vs_inputs.c:577:59: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_nir_lower_vs_inputs.c:577:7: call_function: calling ‘load_vs_input_from_vertex_buffer’ from ‘lower_vs_input_instr’ # 257| nir_def *accum = NULL; # 258| for (unsigned i = 0; i < (1 << log_recombine); ++i, ++src) { # 259|-> nir_def *tmp = nir_u2uN(b, loads[src], dst_bitsize); # 260| if (i == 0) { # 261| accum = tmp; Error: GCC_ANALYZER_WARNING (CWE-401): [#def40] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_fs_exec.c:202:11: warning[-Wanalyzer-malloc-leak]: leak of ‘shader’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_fs_exec.c:194:13: acquire_memory: allocated here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_fs_exec.c:195:7: branch_false: following ‘false’ branch (when ‘shader’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_fs_exec.c:198:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_fs_exec.c:202:11: danger: ‘shader’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0) # 200| shader->base.delete = exec_delete; # 201| # 202|-> return &shader->base; # 203| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def41] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:378:19: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:377:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:378:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:377:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:378:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:377:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:378:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:377:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:378:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:377:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:378:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:378:19: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 376| case TGSI_OPCODE_ATOMUADD: # 377| for (c = 0; c < nc; c++) { # 378|-> unsigned temp = sdata[c]; # 379| sdata[c] += ((uint32_t *)rgba[c])[qi]; # 380| ((uint32_t *)rgba[c])[qi] = temp; Error: GCC_ANALYZER_WARNING (CWE-121): [#def42] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:379:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:377:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:378:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:377:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:378:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:377:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:378:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:377:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:378:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:377:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:378:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:379:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 377| for (c = 0; c < nc; c++) { # 378| unsigned temp = sdata[c]; # 379|-> sdata[c] += ((uint32_t *)rgba[c])[qi]; # 380| ((uint32_t *)rgba[c])[qi] = temp; # 381| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def43] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:385:19: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:384:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:385:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:384:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:385:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:384:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:385:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:384:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:385:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:384:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:385:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:385:19: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 383| case TGSI_OPCODE_ATOMXCHG: # 384| for (c = 0; c < nc; c++) { # 385|-> unsigned temp = sdata[c]; # 386| sdata[c] = ((uint32_t *)rgba[c])[qi]; # 387| ((uint32_t *)rgba[c])[qi] = temp; Error: GCC_ANALYZER_WARNING (CWE-121): [#def44] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:386:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:384:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:385:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:384:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:385:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:384:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:385:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:384:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:385:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:384:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:385:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:386:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 384| for (c = 0; c < nc; c++) { # 385| unsigned temp = sdata[c]; # 386|-> sdata[c] = ((uint32_t *)rgba[c])[qi]; # 387| ((uint32_t *)rgba[c])[qi] = temp; # 388| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def45] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:392:19: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:391:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:392:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:391:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:392:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:391:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:392:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:391:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:392:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:396:21: branch_true: following ‘true’ branch (when ‘dst_x == cmp_x’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:396:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:391:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:392:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:392:19: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 390| case TGSI_OPCODE_ATOMCAS: # 391| for (c = 0; c < nc; c++) { # 392|-> unsigned dst_x = sdata[c]; # 393| unsigned cmp_x = ((uint32_t *)rgba[c])[qi]; # 394| unsigned src_x = ((uint32_t *)rgba2[c])[qi]; Error: GCC_ANALYZER_WARNING (CWE-121): [#def46] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:396:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:391:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:392:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:391:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:392:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:391:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:392:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:391:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:392:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:396:21: branch_true: following ‘true’ branch (when ‘dst_x == cmp_x’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:396:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:391:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:392:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:396:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 394| unsigned src_x = ((uint32_t *)rgba2[c])[qi]; # 395| unsigned temp = sdata[c]; # 396|-> sdata[c] = (dst_x == cmp_x) ? src_x : dst_x; # 397| ((uint32_t *)rgba[c])[qi] = temp; # 398| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def47] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:402:19: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:401:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:402:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:401:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:402:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:401:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:402:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:401:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:402:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:401:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:402:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:402:19: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 400| case TGSI_OPCODE_ATOMAND: # 401| for (c = 0; c < nc; c++) { # 402|-> unsigned temp = sdata[c]; # 403| sdata[c] &= ((uint32_t *)rgba[c])[qi]; # 404| ((uint32_t *)rgba[c])[qi] = temp; Error: GCC_ANALYZER_WARNING (CWE-121): [#def48] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:403:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:401:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:402:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:401:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:402:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:401:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:402:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:401:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:402:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:401:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:402:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:403:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 401| for (c = 0; c < nc; c++) { # 402| unsigned temp = sdata[c]; # 403|-> sdata[c] &= ((uint32_t *)rgba[c])[qi]; # 404| ((uint32_t *)rgba[c])[qi] = temp; # 405| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def49] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:409:19: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:408:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:409:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:408:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:409:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:408:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:409:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:408:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:409:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:408:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:409:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:409:19: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 407| case TGSI_OPCODE_ATOMOR: # 408| for (c = 0; c < nc; c++) { # 409|-> unsigned temp = sdata[c]; # 410| sdata[c] |= ((uint32_t *)rgba[c])[qi]; # 411| ((uint32_t *)rgba[c])[qi] = temp; Error: GCC_ANALYZER_WARNING (CWE-121): [#def50] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:410:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:408:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:409:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:408:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:409:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:408:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:409:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:408:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:409:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:408:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:409:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:410:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 408| for (c = 0; c < nc; c++) { # 409| unsigned temp = sdata[c]; # 410|-> sdata[c] |= ((uint32_t *)rgba[c])[qi]; # 411| ((uint32_t *)rgba[c])[qi] = temp; # 412| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def51] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:416:19: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:415:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:416:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:415:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:416:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:415:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:416:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:415:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:416:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:415:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:416:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:416:19: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 414| case TGSI_OPCODE_ATOMXOR: # 415| for (c = 0; c < nc; c++) { # 416|-> unsigned temp = sdata[c]; # 417| sdata[c] ^= ((uint32_t *)rgba[c])[qi]; # 418| ((uint32_t *)rgba[c])[qi] = temp; Error: GCC_ANALYZER_WARNING (CWE-121): [#def52] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:417:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:415:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:416:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:415:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:416:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:415:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:416:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:415:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:416:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:415:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:416:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:417:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 415| for (c = 0; c < nc; c++) { # 416| unsigned temp = sdata[c]; # 417|-> sdata[c] ^= ((uint32_t *)rgba[c])[qi]; # 418| ((uint32_t *)rgba[c])[qi] = temp; # 419| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def53] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:423:19: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:422:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:423:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:422:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:423:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:422:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:423:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:422:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:423:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:422:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:423:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:423:19: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 421| case TGSI_OPCODE_ATOMUMIN: # 422| for (c = 0; c < nc; c++) { # 423|-> unsigned dst_x = sdata[c]; # 424| unsigned src_x = ((uint32_t *)rgba[c])[qi]; # 425| sdata[c] = MIN2(dst_x, src_x); Error: GCC_ANALYZER_WARNING (CWE-121): [#def54] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:425:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:422:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:423:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:422:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:423:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:422:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:423:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:422:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:423:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:422:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:423:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:425:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 423| unsigned dst_x = sdata[c]; # 424| unsigned src_x = ((uint32_t *)rgba[c])[qi]; # 425|-> sdata[c] = MIN2(dst_x, src_x); # 426| ((uint32_t *)rgba[c])[qi] = dst_x; # 427| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def55] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:431:19: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:430:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:431:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:430:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:431:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:430:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:431:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:430:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:431:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:430:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:431:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:431:19: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 429| case TGSI_OPCODE_ATOMUMAX: # 430| for (c = 0; c < nc; c++) { # 431|-> unsigned dst_x = sdata[c]; # 432| unsigned src_x = ((uint32_t *)rgba[c])[qi]; # 433| sdata[c] = MAX2(dst_x, src_x); Error: GCC_ANALYZER_WARNING (CWE-121): [#def56] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:433:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:430:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:431:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:430:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:431:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:430:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:431:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:430:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:431:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:430:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:431:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:433:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 431| unsigned dst_x = sdata[c]; # 432| unsigned src_x = ((uint32_t *)rgba[c])[qi]; # 433|-> sdata[c] = MAX2(dst_x, src_x); # 434| ((uint32_t *)rgba[c])[qi] = dst_x; # 435| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def57] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:439:22: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:438:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:439:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:438:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:439:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:438:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:439:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:438:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:439:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:438:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:439:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:439:22: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 437| case TGSI_OPCODE_ATOMIMIN: # 438| for (c = 0; c < nc; c++) { # 439|-> int dst_x = sdata[c]; # 440| int src_x = ((uint32_t *)rgba[c])[qi]; # 441| sdata[c] = MIN2(dst_x, src_x); Error: GCC_ANALYZER_WARNING (CWE-121): [#def58] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:441:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:438:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:439:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:438:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:439:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:438:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:439:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:438:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:439:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:438:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:439:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:441:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 439| int dst_x = sdata[c]; # 440| int src_x = ((uint32_t *)rgba[c])[qi]; # 441|-> sdata[c] = MIN2(dst_x, src_x); # 442| ((uint32_t *)rgba[c])[qi] = dst_x; # 443| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def59] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:447:22: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:446:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:447:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:446:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:447:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:446:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:447:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:446:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:447:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:446:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:447:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:447:22: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 445| case TGSI_OPCODE_ATOMIMAX: # 446| for (c = 0; c < nc; c++) { # 447|-> int dst_x = sdata[c]; # 448| int src_x = ((uint32_t *)rgba[c])[qi]; # 449| sdata[c] = MAX2(dst_x, src_x); Error: GCC_ANALYZER_WARNING (CWE-121): [#def60] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:449:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:369:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:375:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:446:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:447:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:446:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:447:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:446:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:447:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:446:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:447:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:446:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:447:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:449:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 447| int dst_x = sdata[c]; # 448| int src_x = ((uint32_t *)rgba[c])[qi]; # 449|-> sdata[c] = MAX2(dst_x, src_x); # 450| ((uint32_t *)rgba[c])[qi] = dst_x; # 451| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def61] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:494:14: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:493:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:494:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:493:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:494:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:493:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:494:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:493:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:494:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:493:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:494:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:494:14: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 492| case TGSI_OPCODE_ATOMUADD: # 493| for (c = 0; c < nc; c++) { # 494|-> int temp = sdata[c]; # 495| sdata[c] += ((int32_t *)rgba[c])[qi]; # 496| ((int32_t *)rgba[c])[qi] = temp; Error: GCC_ANALYZER_WARNING (CWE-121): [#def62] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:495:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:493:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:494:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:493:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:494:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:493:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:494:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:493:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:494:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:493:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:494:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:495:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 493| for (c = 0; c < nc; c++) { # 494| int temp = sdata[c]; # 495|-> sdata[c] += ((int32_t *)rgba[c])[qi]; # 496| ((int32_t *)rgba[c])[qi] = temp; # 497| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def63] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:501:14: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:500:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:501:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:500:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:501:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:500:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:501:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:500:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:501:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:500:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:501:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:501:14: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 499| case TGSI_OPCODE_ATOMXCHG: # 500| for (c = 0; c < nc; c++) { # 501|-> int temp = sdata[c]; # 502| sdata[c] = ((int32_t *)rgba[c])[qi]; # 503| ((int32_t *)rgba[c])[qi] = temp; Error: GCC_ANALYZER_WARNING (CWE-121): [#def64] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:502:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:500:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:501:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:500:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:501:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:500:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:501:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:500:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:501:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:500:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:501:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:502:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 500| for (c = 0; c < nc; c++) { # 501| int temp = sdata[c]; # 502|-> sdata[c] = ((int32_t *)rgba[c])[qi]; # 503| ((int32_t *)rgba[c])[qi] = temp; # 504| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def65] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:508:14: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:507:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:508:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:507:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:508:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:507:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:508:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:507:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:508:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:512:21: branch_true: following ‘true’ branch (when ‘dst_x == cmp_x’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:512:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:507:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:508:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:508:14: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 506| case TGSI_OPCODE_ATOMCAS: # 507| for (c = 0; c < nc; c++) { # 508|-> int dst_x = sdata[c]; # 509| int cmp_x = ((int32_t *)rgba[c])[qi]; # 510| int src_x = ((int32_t *)rgba2[c])[qi]; Error: GCC_ANALYZER_WARNING (CWE-121): [#def66] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:512:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:507:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:508:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:507:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:508:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:507:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:508:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:507:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:508:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:512:21: branch_true: following ‘true’ branch (when ‘dst_x == cmp_x’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:512:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:507:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:508:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:512:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 510| int src_x = ((int32_t *)rgba2[c])[qi]; # 511| int temp = sdata[c]; # 512|-> sdata[c] = (dst_x == cmp_x) ? src_x : dst_x; # 513| ((int32_t *)rgba[c])[qi] = temp; # 514| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def67] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:518:14: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:517:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:518:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:517:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:518:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:517:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:518:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:517:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:518:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:517:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:518:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:518:14: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 516| case TGSI_OPCODE_ATOMAND: # 517| for (c = 0; c < nc; c++) { # 518|-> int temp = sdata[c]; # 519| sdata[c] &= ((int32_t *)rgba[c])[qi]; # 520| ((int32_t *)rgba[c])[qi] = temp; Error: GCC_ANALYZER_WARNING (CWE-121): [#def68] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:519:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:517:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:518:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:517:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:518:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:517:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:518:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:517:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:518:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:517:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:518:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:519:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 517| for (c = 0; c < nc; c++) { # 518| int temp = sdata[c]; # 519|-> sdata[c] &= ((int32_t *)rgba[c])[qi]; # 520| ((int32_t *)rgba[c])[qi] = temp; # 521| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def69] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:525:14: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:524:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:525:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:524:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:525:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:524:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:525:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:524:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:525:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:524:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:525:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:525:14: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 523| case TGSI_OPCODE_ATOMOR: # 524| for (c = 0; c < nc; c++) { # 525|-> int temp = sdata[c]; # 526| sdata[c] |= ((int32_t *)rgba[c])[qi]; # 527| ((int32_t *)rgba[c])[qi] = temp; Error: GCC_ANALYZER_WARNING (CWE-121): [#def70] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:526:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:524:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:525:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:524:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:525:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:524:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:525:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:524:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:525:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:524:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:525:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:526:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 524| for (c = 0; c < nc; c++) { # 525| int temp = sdata[c]; # 526|-> sdata[c] |= ((int32_t *)rgba[c])[qi]; # 527| ((int32_t *)rgba[c])[qi] = temp; # 528| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def71] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:532:14: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:531:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:532:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:531:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:532:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:531:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:532:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:531:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:532:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:531:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:532:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:532:14: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 530| case TGSI_OPCODE_ATOMXOR: # 531| for (c = 0; c < nc; c++) { # 532|-> int temp = sdata[c]; # 533| sdata[c] ^= ((int32_t *)rgba[c])[qi]; # 534| ((int32_t *)rgba[c])[qi] = temp; Error: GCC_ANALYZER_WARNING (CWE-121): [#def72] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:533:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:531:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:532:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:531:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:532:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:531:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:532:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:531:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:532:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:531:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:532:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:533:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 531| for (c = 0; c < nc; c++) { # 532| int temp = sdata[c]; # 533|-> sdata[c] ^= ((int32_t *)rgba[c])[qi]; # 534| ((int32_t *)rgba[c])[qi] = temp; # 535| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def73] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:539:14: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:538:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:539:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:538:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:539:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:538:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:539:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:538:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:539:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:538:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:539:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:539:14: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 537| case TGSI_OPCODE_ATOMUMIN: # 538| for (c = 0; c < nc; c++) { # 539|-> int dst_x = sdata[c]; # 540| int src_x = ((int32_t *)rgba[c])[qi]; # 541| sdata[c] = MIN2(dst_x, src_x); Error: GCC_ANALYZER_WARNING (CWE-121): [#def74] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:541:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:538:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:539:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:538:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:539:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:538:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:539:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:538:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:539:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:538:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:539:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:541:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 539| int dst_x = sdata[c]; # 540| int src_x = ((int32_t *)rgba[c])[qi]; # 541|-> sdata[c] = MIN2(dst_x, src_x); # 542| ((int32_t *)rgba[c])[qi] = dst_x; # 543| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def75] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:547:14: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:546:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:547:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:546:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:547:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:546:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:547:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:546:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:547:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:546:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:547:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:547:14: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 545| case TGSI_OPCODE_ATOMUMAX: # 546| for (c = 0; c < nc; c++) { # 547|-> int dst_x = sdata[c]; # 548| int src_x = ((int32_t *)rgba[c])[qi]; # 549| sdata[c] = MAX2(dst_x, src_x); Error: GCC_ANALYZER_WARNING (CWE-121): [#def76] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:549:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:546:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:547:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:546:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:547:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:546:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:547:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:546:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:547:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:546:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:547:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:549:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 547| int dst_x = sdata[c]; # 548| int src_x = ((int32_t *)rgba[c])[qi]; # 549|-> sdata[c] = MAX2(dst_x, src_x); # 550| ((int32_t *)rgba[c])[qi] = dst_x; # 551| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def77] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:555:14: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:554:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:555:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:554:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:555:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:554:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:555:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:554:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:555:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:554:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:555:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:555:14: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 553| case TGSI_OPCODE_ATOMIMIN: # 554| for (c = 0; c < nc; c++) { # 555|-> int dst_x = sdata[c]; # 556| int src_x = ((int32_t *)rgba[c])[qi]; # 557| sdata[c] = MIN2(dst_x, src_x); Error: GCC_ANALYZER_WARNING (CWE-121): [#def78] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:557:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:554:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:555:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:554:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:555:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:554:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:555:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:554:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:555:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:554:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:555:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:557:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 555| int dst_x = sdata[c]; # 556| int src_x = ((int32_t *)rgba[c])[qi]; # 557|-> sdata[c] = MIN2(dst_x, src_x); # 558| ((int32_t *)rgba[c])[qi] = dst_x; # 559| } Error: GCC_ANALYZER_WARNING (CWE-126): [#def79] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:563:14: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:562:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:563:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:562:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:563:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:562:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:563:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:562:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:563:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:562:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:563:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:563:14: danger: out-of-bounds read from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 561| case TGSI_OPCODE_ATOMIMAX: # 562| for (c = 0; c < nc; c++) { # 563|-> int dst_x = sdata[c]; # 564| int src_x = ((int32_t *)rgba[c])[qi]; # 565| sdata[c] = MAX2(dst_x, src_x); Error: GCC_ANALYZER_WARNING (CWE-121): [#def80] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:565:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:485:7: branch_false: following ‘false’ branch (when ‘just_read == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:491:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:562:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:563:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:562:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:563:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:562:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:563:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:562:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:563:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:562:19: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:563:14: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_image.c:565:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘sdata’ ends at byte 16 # 563| int dst_x = sdata[c]; # 564| int src_x = ((int32_t *)rgba[c])[qi]; # 565|-> sdata[c] = MAX2(dst_x, src_x); # 566| ((int32_t *)rgba[c])[qi] = dst_x; # 567| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def81] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_prim_vbuf.c:668:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘cvbr’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_prim_vbuf.c:649:40: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_prim_vbuf.c:668:4: danger: ‘cvbr’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0) # 666| cvbr->base.destroy = sp_vbuf_destroy; # 667| # 668|-> cvbr->softpipe = sp; # 669| # 670| cvbr->setup = sp_setup_create_context(cvbr->softpipe); Error: GCC_ANALYZER_WARNING (CWE-401): [#def82] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_prim_vbuf.c:672:11: warning[-Wanalyzer-malloc-leak]: leak of ‘cvbr’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_prim_vbuf.c:649:40: acquire_memory: allocated here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_prim_vbuf.c:672:11: danger: ‘cvbr’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0) # 670| cvbr->setup = sp_setup_create_context(cvbr->softpipe); # 671| # 672|-> return &cvbr->base; # 673| } Error: GCC_ANALYZER_WARNING (CWE-401): [#def83] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_quad_blend.c:1312:11: warning[-Wanalyzer-malloc-leak]: leak of ‘stage’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_quad_blend.c:1302:37: acquire_memory: allocated here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_quad_blend.c:1304:7: branch_false: following ‘false’ branch (when ‘stage’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_quad_blend.c:1307:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_quad_blend.c:1312:11: danger: ‘stage’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0) # 1310| stage->base.destroy = blend_destroy; # 1311| # 1312|-> return &stage->base; # 1313| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def84] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_quad_depth_test.c:1092:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘stage’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_quad_depth_test.c:1090:31: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_quad_depth_test.c:1092:4: danger: ‘stage’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0) # 1090| struct quad_stage *stage = CALLOC_STRUCT(quad_stage); # 1091| # 1092|-> stage->softpipe = softpipe; # 1093| stage->begin = depth_test_begin; # 1094| stage->run = choose_depth_test; Error: GCC_ANALYZER_WARNING (CWE-401): [#def85] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_quad_fs.c:170:11: warning[-Wanalyzer-malloc-leak]: leak of ‘qss’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_quad_fs.c:161:35: acquire_memory: allocated here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_quad_fs.c:162:7: branch_false: following ‘false’ branch (when ‘qss’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_quad_fs.c:165:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_quad_fs.c:170:11: danger: ‘qss’ leaks here; was allocated at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0) # 168| qss->stage.destroy = shade_destroy; # 169| # 170|-> return &qss->stage; # 171| # 172| fail: Error: GCC_ANALYZER_WARNING (CWE-476): [#def86] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_query.c:76:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘sq’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_query.c:75:9: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_query.c:76:4: danger: ‘sq’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0) # 74| type == PIPE_QUERY_TIMESTAMP_DISJOINT); # 75| sq = CALLOC_STRUCT( softpipe_query ); # 76|-> sq->type = type; # 77| sq->index = index; # 78| return (struct pipe_query *)sq; Error: GCC_ANALYZER_WARNING (CWE-476): [#def87] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_setup.c:1435:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘setup’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_setup.c:1432:34: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_setup.c:1435:4: danger: ‘setup’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0) # 1433| unsigned i; # 1434| # 1435|-> setup->softpipe = softpipe; # 1436| # 1437| for (i = 0; i < MAX_QUADS; i++) { Error: GCC_ANALYZER_WARNING (CWE-476): [#def88] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_shader.c:161:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘state’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_shader.c:155:39: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_shader.c:161:4: danger: ‘state’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0) # 159| # 160| /* draw's fs state */ # 161|-> state->draw_shader = draw_create_fragment_shader(softpipe->draw, # 162| &state->shader); # 163| if (!state->draw_shader) { Error: GCC_ANALYZER_WARNING (CWE-476): [#def89] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_shader.c:412:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘state’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_shader.c:410:38: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_shader.c:412:4: danger: ‘state’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0) # 410| struct sp_compute_shader *state = CALLOC_STRUCT(sp_compute_shader); # 411| # 412|-> state->shader = *templ; # 413| # 414| if (templ->ir_type == PIPE_SHADER_IR_NIR) { Error: GCC_ANALYZER_WARNING (CWE-476): [#def90] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_so.c:77:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘*targets’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_so.c:63:1: enter_function: entry to ‘softpipe_set_so_targets’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_so.c:72:16: branch_true: following ‘true’ branch (when ‘i < num_targets’)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_so.c:73:102: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_so.c:73:7: call_function: calling ‘pipe_so_target_reference’ from ‘softpipe_set_so_targets’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_so.c:73:7: return_function: returning to ‘softpipe_set_so_targets’ from ‘pipe_so_target_reference’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_so.c:75:10: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_so.c:76:22: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_state_so.c:77:10: danger: dereference of NULL ‘*(struct softpipe_context *)pipe.so_targets[i]’ # 75| if (targets[i]) { # 76| void *buf = softpipe_resource(targets[i]->buffer)->data; # 77|-> softpipe->so_targets[i]->mapping = buf; # 78| } # 79| } Error: GCC_ANALYZER_WARNING (CWE-457): [#def91] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:2191:16: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3700:1: enter_function: entry to ‘sp_tgsi_get_samples’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3744:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3754:8: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3761:4: call_function: calling ‘compute_lambda_lod’ from ‘sp_tgsi_get_samples’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3761:4: return_function: returning to ‘sp_tgsi_get_samples’ from ‘compute_lambda_lod’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3763:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3769:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3769:7: call_function: calling ‘convert_cube’ from ‘sp_tgsi_get_samples’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3769:7: return_function: returning to ‘sp_tgsi_get_samples’ from ‘convert_cube’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3772:7: call_function: calling ‘sample_mip’ from ‘sp_tgsi_get_samples’ # 2189| # 2190| for (j = 0; j < TGSI_QUAD_SIZE; j++) { # 2191|-> args.s = s[j]; # 2192| args.t = t[j]; # 2193| args.p = p[j]; Error: GCC_ANALYZER_WARNING (CWE-476): [#def92] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:2324:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘lut’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3471:1: enter_function: entry to ‘softpipe_create_sampler_state’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3527:10: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3528:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3541:12: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3542:12: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3542:12: call_function: calling ‘create_filter_table’ from ‘softpipe_create_sampler_state’ # 2322| const float r2 = (float) i / (float) (WEIGHT_LUT_SIZE - 1); # 2323| const float weight = (float) expf(-alpha * r2); # 2324|-> lut[i] = weight; # 2325| } # 2326| weightLut = lut; Error: GCC_ANALYZER_WARNING (CWE-476): [#def93] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3476:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘samp’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3474:30: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3476:4: danger: ‘samp’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0) # 3474| struct sp_sampler *samp = CALLOC_STRUCT(sp_sampler); # 3475| # 3476|-> samp->base = *sampler; # 3477| # 3478| /* Note that (for instance) linear_texcoord_s and Error: GCC_ANALYZER_WARNING (CWE-476): [#def94] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3635:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘resource’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3584:1: enter_function: entry to ‘softpipe_create_sampler_view’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3591:7: branch_true: following ‘true’ branch (when ‘sview’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3592:33: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3596:7: call_function: calling ‘pipe_resource_reference’ from ‘softpipe_create_sampler_view’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3596:7: return_function: returning to ‘softpipe_create_sampler_view’ from ‘pipe_resource_reference’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3629:10: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3630:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_tex_sample.c:3635:22: danger: dereference of NULL ‘resource’ # 3633| sview->need_cube_convert = (view->target == PIPE_TEXTURE_CUBE || # 3634| view->target == PIPE_TEXTURE_CUBE_ARRAY); # 3635|-> sview->pot2d = spr->pot && # 3636| (view->target == PIPE_TEXTURE_2D || # 3637| view->target == PIPE_TEXTURE_RECT); Error: GCC_ANALYZER_WARNING (CWE-476): [#def95] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:303:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pt’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:291:1: enter_function: entry to ‘softpipe_create_surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:298:7: branch_true: following ‘true’ branch (when ‘ps’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:299:7: call_function: inlined call to ‘pipe_reference_init’ from ‘softpipe_create_surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:300:7: call_function: calling ‘pipe_resource_reference’ from ‘softpipe_create_surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:300:7: return_function: returning to ‘softpipe_create_surface’ from ‘pipe_resource_reference’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:303:11: danger: dereference of NULL ‘pt’ # 301| ps->context = pipe; # 302| ps->format = surf_tmpl->format; # 303|-> if (pt->target != PIPE_BUFFER) { # 304| assert(surf_tmpl->u.tex.level <= pt->last_level); # 305| ps->width = u_minify(pt->width0, surf_tmpl->u.tex.level); Error: GCC_ANALYZER_WARNING (CWE-401): [#def96] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:449:11: warning[-Wanalyzer-malloc-leak]: leak of ‘spt’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:355:1: enter_function: entry to ‘softpipe_transfer_map’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:414:10: acquire_memory: allocated here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:415:7: branch_false: following ‘false’ branch (when ‘spt’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:418:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:420:4: call_function: calling ‘pipe_resource_reference’ from ‘softpipe_transfer_map’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:420:4: return_function: returning to ‘softpipe_transfer_map’ from ‘pipe_resource_reference’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:442:7: branch_false: following ‘false’ branch (when ‘map’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:448:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:449:11: danger: ‘spt’ leaks here; was allocated at [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1) # 447| # 448| *transfer = pt; # 449|-> return map + spt->offset; # 450| } # 451| Error: GCC_ANALYZER_WARNING (CWE-401): [#def97] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:508:11: warning[-Wanalyzer-malloc-leak]: leak of ‘spr’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:484:1: enter_function: entry to ‘softpipe_user_buffer_create’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:491:10: acquire_memory: allocated here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:492:7: branch_false: following ‘false’ branch (when ‘spr’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:495:4: call_function: inlined call to ‘pipe_reference_init’ from ‘softpipe_user_buffer_create’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/softpipe/sp_texture.c:508:11: danger: ‘spr’ leaks here; was allocated at [(2)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/1) # 506| spr->data = ptr; # 507| # 508|-> return &spr->base; # 509| } # 510| Error: GCC_ANALYZER_WARNING (CWE-476): [#def98] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1098:33: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ptex’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1076:1: enter_function: entry to ‘v3d_create_surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1086:12: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1090:18: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1094:9: call_function: calling ‘pipe_resource_reference’ from ‘v3d_create_surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1094:9: return_function: returning to ‘v3d_create_surface’ from ‘pipe_resource_reference’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1098:33: danger: dereference of NULL ‘ptex’ # 1096| psurf->context = pctx; # 1097| psurf->format = surf_tmpl->format; # 1098|-> psurf->width = u_minify(ptex->width0, level); # 1099| psurf->height = u_minify(ptex->height0, level); # 1100| psurf->u.tex.level = level; Error: GCC_ANALYZER_WARNING (CWE-476): [#def99] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:559:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘vc4_resource_setup(pscreen, tmpl)’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:633:1: enter_function: entry to ‘vc4_resource_create’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:637:16: call_function: calling ‘vc4_resource_create_with_modifiers’ from ‘vc4_resource_create’ # 557| */ # 558| if ((tmpl->bind & (PIPE_BIND_SHARED | PIPE_BIND_SCANOUT)) && # 559|-> vc4_size_is_lt(prsc->width0, prsc->height0, rsc->cpp)) # 560| should_tile = false; # 561| Error: GCC_ANALYZER_WARNING (CWE-476): [#def100] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:571:17: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘vc4_resource_setup(pscreen, tmpl)’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:633:1: enter_function: entry to ‘vc4_resource_create’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:637:16: call_function: calling ‘vc4_resource_create_with_modifiers’ from ‘vc4_resource_create’ # 569| /* No user-specified modifier; determine our own. */ # 570| if (count == 1 && modifiers[0] == DRM_FORMAT_MOD_INVALID) { # 571|-> rsc->tiled = should_tile; # 572| } else if (should_tile && # 573| drm_find_modifier(DRM_FORMAT_MOD_BROADCOM_VC4_T_TILED, Error: GCC_ANALYZER_WARNING (CWE-401): [#def101] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:654:17: warning[-Wanalyzer-malloc-leak]: leak of ‘vc4_resource_setup(pscreen, tmpl)’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:641:1: enter_function: entry to ‘vc4_resource_from_handle’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:647:36: call_function: calling ‘vc4_resource_setup’ from ‘vc4_resource_from_handle’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:647:36: return_function: returning to ‘vc4_resource_from_handle’ from ‘vc4_resource_setup’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:651:12: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:654:17: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:654:17: danger: ‘vc4_resource_setup(pscreen, tmpl)’ leaks here; was allocated at [(4)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/3) # 652| return NULL; # 653| # 654|-> switch (whandle->type) { # 655| case WINSYS_HANDLE_TYPE_SHARED: # 656| rsc->bo = vc4_bo_open_name(screen, whandle->handle); Error: GCC_ANALYZER_WARNING (CWE-476): [#def102] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:781:33: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ptex’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:761:1: enter_function: entry to ‘vc4_create_surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:768:12: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:774:18: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:777:9: call_function: calling ‘pipe_resource_reference’ from ‘vc4_create_surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:777:9: return_function: returning to ‘vc4_create_surface’ from ‘pipe_resource_reference’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:781:33: danger: dereference of NULL ‘ptex’ # 779| psurf->context = pctx; # 780| psurf->format = surf_tmpl->format; # 781|-> psurf->width = u_minify(ptex->width0, level); # 782| psurf->height = u_minify(ptex->height0, level); # 783| psurf->u.tex.level = level; Error: GCC_ANALYZER_WARNING (CWE-401): [#def103] mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:790:16: warning[-Wanalyzer-malloc-leak]: leak of ‘surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:761:1: enter_function: entry to ‘vc4_create_surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:765:39: acquire_memory: allocated here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:768:12: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:774:18: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:777:9: call_function: calling ‘pipe_resource_reference’ from ‘vc4_create_surface’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:777:9: return_function: returning to ‘vc4_create_surface’ from ‘pipe_resource_reference’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/vc4/vc4_resource.c:790:16: danger: ‘surface’ leaks here; was allocated at [(2)](sarif:/runs/0/results/10/codeFlows/0/threadFlows/0/locations/1) # 788| surface->tiling = rsc->slices[level].tiling; # 789| # 790|-> return &surface->base; # 791| } # 792| Error: GCC_ANALYZER_WARNING (CWE-476): [#def104] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:314:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5351:10: enter_function: entry to ‘lvp_execute_cmds’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5394:4: call_function: calling ‘lvp_execute_cmd_buffer’ from ‘lvp_execute_cmds’ # 312| base_nir = shader->tess_ccw->nir; # 313| nir_function_impl *impl = nir_shader_get_entrypoint(base_nir); # 314|-> unsigned ssa_alloc = impl->ssa_alloc; # 315| unsigned count = shader->inlines.count[0]; # 316| if (count && pcbuf_dirty) { Error: GCC_ANALYZER_WARNING (CWE-476): [#def105] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:338:23: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5351:10: enter_function: entry to ‘lvp_execute_cmds’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5394:4: call_function: calling ‘lvp_execute_cmd_buffer’ from ‘lvp_execute_cmds’ # 336| lvp_shader_optimize(nir); # 337| impl = nir_shader_get_entrypoint(nir); # 338|-> if (ssa_alloc - impl->ssa_alloc < ssa_alloc / 2 && # 339| !shader->inlines.must_inline) { # 340| /* not enough change; don't inline further */ Error: GCC_ANALYZER_WARNING (CWE-476): [#def106] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:349:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mem_dup(&v, 528)’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5351:10: enter_function: entry to ‘lvp_execute_cmds’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_execute.c:5394:4: call_function: calling ‘lvp_execute_cmd_buffer’ from ‘lvp_execute_cmds’ # 347| shader_state = lvp_shader_compile(state->device, shader, nir, true); # 348| struct lvp_inline_variant *variant = mem_dup(&v, sizeof(v)); # 349|-> variant->cso = shader_state; # 350| entry->key = variant; # 351| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def107] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:57:59: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:80:1: enter_function: entry to ‘lvp_lower_input_attachments’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:85:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘lvp_lower_input_attachments’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:85:4: return_function: returning to ‘lvp_lower_input_attachments’ from ‘nir_foreach_function_with_impl_first’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:85:4: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:86:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:87:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:87:10: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:87:10: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘lvp_lower_input_attachments’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:87:10: branch_false: following ‘false’ branch... branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:87:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:88:17: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:88:16: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:93:17: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:93:16: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:96:25: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_input_attachments.c:96:25: call_function: calling ‘try_lower_input_load’ from ‘lvp_lower_input_attachments’ # 55| assert(glsl_type_is_image(deref->type)); # 56| # 57|-> enum glsl_sampler_dim image_dim = glsl_get_sampler_dim(deref->type); # 58| if (image_dim != GLSL_SAMPLER_DIM_SUBPASS && # 59| image_dim != GLSL_SAMPLER_DIM_SUBPASS_MS) Error: GCC_ANALYZER_WARNING (CWE-476): [#def108] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_vulkan_resource.c:95:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_vulkan_resource.c:184:17: enter_function: entry to ‘lower_vri_instr’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_vulkan_resource.c:187:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_vulkan_resource.c:189:15: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_lower_vulkan_resource.c:214:10: call_function: calling ‘lower_image_intrinsic’ from ‘lower_vri_instr’ # 93| nir_def *index = nir_imm_int(b, 0); # 94| # 95|-> while (deref->deref_type != nir_deref_type_var) { # 96| assert(deref->deref_type == nir_deref_type_array); # 97| unsigned array_size = MAX2(glsl_get_aoa_size(deref->type), 1); Error: GCC_ANALYZER_WARNING (CWE-476): [#def109] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_pipeline.c:490:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_pipeline.c:1164:1: enter_function: entry to ‘create_shader_object’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_pipeline.c:1192:10: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_pipeline.c:1194:10: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_pipeline.c:1220:9: call_function: calling ‘nir_shader_get_entrypoint’ from ‘create_shader_object’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_pipeline.c:1220:9: return_function: returning to ‘create_shader_object’ from ‘nir_shader_get_entrypoint’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_pipeline.c:1220:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_pipeline.c:1222:32: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_pipeline.c:1223:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_pipeline.c:1225:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_pipeline.c:1238:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_pipeline.c:1241:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_pipeline.c:1241:4: call_function: calling ‘lvp_shader_init’ from ‘create_shader_object’ # 488| { # 489| nir_function_impl *impl = nir_shader_get_entrypoint(nir); # 490|-> if (impl->ssa_alloc > 100) //skip for small shaders # 491| shader->inlines.must_inline = lvp_find_inlinable_uniforms(shader, nir); # 492| shader->pipeline_nir = lvp_create_pipeline_nir(nir); Error: GCC_ANALYZER_WARNING (CWE-476): [#def110] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:364:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:351:1: enter_function: entry to ‘osmesa_st_framebuffer_flush_front’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:355:27: call_function: calling ‘OSMesaGetCurrentContext’ from ‘osmesa_st_framebuffer_flush_front’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:355:27: return_function: returning to ‘osmesa_st_framebuffer_flush_front’ from ‘OSMesaGetCurrentContext’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:361:7: branch_false: following ‘false’ branch (when ‘statt == 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:364:8: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:364:8: danger: dereference of NULL ‘OSMesaGetCurrentContext()’ # 362| return false; # 363| # 364|-> if (osmesa->pp) { # 365| struct pipe_resource *zsbuf = NULL; # 366| unsigned i; Error: GCC_ANALYZER_WARNING (CWE-476): [#def111] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:777:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘osbuffer’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:738:1: enter_function: entry to ‘OSMesaMakeCurrent’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:743:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:748:8: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:748:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:753:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:759:8: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:769:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:770:32: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:770:32: call_function: calling ‘osmesa_create_buffer’ from ‘OSMesaMakeCurrent’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:770:32: return_function: returning to ‘OSMesaMakeCurrent’ from ‘osmesa_create_buffer’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:777:4: danger: dereference of NULL ‘osbuffer’ # 775| struct osmesa_buffer *osbuffer = osmesa->current_buffer; # 776| # 777|-> osbuffer->width = width; # 778| osbuffer->height = height; # 779| osbuffer->map = buffer; Error: GCC_ANALYZER_WARNING (CWE-476): [#def112] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:836:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:830:1: enter_function: entry to ‘OSMesaPixelStore’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:832:27: call_function: calling ‘OSMesaGetCurrentContext’ from ‘OSMesaPixelStore’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:832:27: return_function: returning to ‘OSMesaPixelStore’ from ‘OSMesaGetCurrentContext’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:836:7: danger: dereference of NULL ‘OSMesaGetCurrentContext()’ # 834| switch (pname) { # 835| case OSMESA_ROW_LENGTH: # 836|-> osmesa->user_row_length = value; # 837| break; # 838| case OSMESA_Y_UP: Error: GCC_ANALYZER_WARNING (CWE-476): [#def113] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:839:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:830:1: enter_function: entry to ‘OSMesaPixelStore’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:832:27: call_function: calling ‘OSMesaGetCurrentContext’ from ‘OSMesaPixelStore’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:832:27: return_function: returning to ‘OSMesaPixelStore’ from ‘OSMesaGetCurrentContext’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:839:7: danger: dereference of NULL ‘OSMesaGetCurrentContext()’ # 837| break; # 838| case OSMESA_Y_UP: # 839|-> osmesa->y_up = value ? GL_TRUE : GL_FALSE; # 840| break; # 841| default: Error: GCC_ANALYZER_WARNING (CWE-476): [#def114] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:862:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:849:1: enter_function: entry to ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: call_function: calling ‘OSMesaGetCurrentContext’ from ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: return_function: returning to ‘OSMesaGetIntegerv’ from ‘OSMesaGetCurrentContext’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:852:37: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:854:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:862:16: danger: dereference of NULL ‘OSMesaGetCurrentContext()’ # 860| return; # 861| case OSMESA_FORMAT: # 862|-> *value = osmesa->format; # 863| return; # 864| case OSMESA_TYPE: Error: GCC_ANALYZER_WARNING (CWE-476): [#def115] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:862:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘OSMesaGetCurrentContext()’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:849:1: enter_function: entry to ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: call_function: calling ‘OSMesaGetCurrentContext’ from ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: return_function: returning to ‘OSMesaGetIntegerv’ from ‘OSMesaGetCurrentContext’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:852:37: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:854:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:862:16: danger: dereference of NULL ‘OSMesaGetCurrentContext()’ # 860| return; # 861| case OSMESA_FORMAT: # 862|-> *value = osmesa->format; # 863| return; # 864| case OSMESA_TYPE: Error: GCC_ANALYZER_WARNING (CWE-476): [#def116] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:866:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:849:1: enter_function: entry to ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: call_function: calling ‘OSMesaGetCurrentContext’ from ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: return_function: returning to ‘OSMesaGetIntegerv’ from ‘OSMesaGetCurrentContext’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:852:37: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:854:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:866:16: danger: dereference of NULL ‘OSMesaGetCurrentContext()’ # 864| case OSMESA_TYPE: # 865| /* current color buffer's data type */ # 866|-> *value = osmesa->type; # 867| return; # 868| case OSMESA_ROW_LENGTH: Error: GCC_ANALYZER_WARNING (CWE-476): [#def117] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:866:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘OSMesaGetCurrentContext()’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:849:1: enter_function: entry to ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: call_function: calling ‘OSMesaGetCurrentContext’ from ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: return_function: returning to ‘OSMesaGetIntegerv’ from ‘OSMesaGetCurrentContext’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:852:37: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:854:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:866:16: danger: dereference of NULL ‘OSMesaGetCurrentContext()’ # 864| case OSMESA_TYPE: # 865| /* current color buffer's data type */ # 866|-> *value = osmesa->type; # 867| return; # 868| case OSMESA_ROW_LENGTH: Error: GCC_ANALYZER_WARNING (CWE-476): [#def118] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:869:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:849:1: enter_function: entry to ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: call_function: calling ‘OSMesaGetCurrentContext’ from ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: return_function: returning to ‘OSMesaGetIntegerv’ from ‘OSMesaGetCurrentContext’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:852:37: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:854:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:869:16: danger: dereference of NULL ‘OSMesaGetCurrentContext()’ # 867| return; # 868| case OSMESA_ROW_LENGTH: # 869|-> *value = osmesa->user_row_length; # 870| return; # 871| case OSMESA_Y_UP: Error: GCC_ANALYZER_WARNING (CWE-476): [#def119] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:869:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘OSMesaGetCurrentContext()’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:849:1: enter_function: entry to ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: call_function: calling ‘OSMesaGetCurrentContext’ from ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: return_function: returning to ‘OSMesaGetIntegerv’ from ‘OSMesaGetCurrentContext’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:852:37: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:854:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:869:16: danger: dereference of NULL ‘OSMesaGetCurrentContext()’ # 867| return; # 868| case OSMESA_ROW_LENGTH: # 869|-> *value = osmesa->user_row_length; # 870| return; # 871| case OSMESA_Y_UP: Error: GCC_ANALYZER_WARNING (CWE-476): [#def120] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:872:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:849:1: enter_function: entry to ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: call_function: calling ‘OSMesaGetCurrentContext’ from ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: return_function: returning to ‘OSMesaGetIntegerv’ from ‘OSMesaGetCurrentContext’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:852:37: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:854:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:872:16: danger: dereference of NULL ‘OSMesaGetCurrentContext()’ # 870| return; # 871| case OSMESA_Y_UP: # 872|-> *value = osmesa->y_up; # 873| return; # 874| case OSMESA_MAX_WIDTH: Error: GCC_ANALYZER_WARNING (CWE-476): [#def121] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:872:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘OSMesaGetCurrentContext()’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:849:1: enter_function: entry to ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: call_function: calling ‘OSMesaGetCurrentContext’ from ‘OSMesaGetIntegerv’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:851:27: return_function: returning to ‘OSMesaGetIntegerv’ from ‘OSMesaGetCurrentContext’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:852:37: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:854:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/osmesa/osmesa.c:872:16: danger: dereference of NULL ‘OSMesaGetCurrentContext()’ # 870| return; # 871| case OSMESA_Y_UP: # 872|-> *value = osmesa->y_up; # 873| return; # 874| case OSMESA_MAX_WIDTH: Error: GCC_ANALYZER_WARNING (CWE-476): [#def122] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:102:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘calloc((long unsigned int)(unsigned int)*node_84(D)->inputs.size, 8)’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:286:1: enter_function: entry to ‘partition_init’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:307:20: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:309:17: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:315:7: call_function: calling ‘fill_operation’ from ‘partition_init’ # 100| operation->input_tensors = calloc(operation->input_count, sizeof(void*)); # 101| for (unsigned i = 0; i < node->inputs->size; i++) # 102|-> operation->input_tensors[i] = &tensors[node->inputs->data[i]]; # 103| # 104| operation->output_count = node->outputs->size; Error: GCC_ANALYZER_WARNING (CWE-476): [#def123] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:107:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘calloc((long unsigned int)(unsigned int)*node_84(D)->outputs.size, 8)’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:286:1: enter_function: entry to ‘partition_init’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:307:20: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:309:17: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:315:7: call_function: calling ‘fill_operation’ from ‘partition_init’ # 105| operation->output_tensors = calloc(operation->output_count, sizeof(void*)); # 106| for (unsigned i = 0; i < node->outputs->size; i++) # 107|-> operation->output_tensors[i] = &tensors[node->outputs->data[i]]; # 108| # 109| switch(node_registration->builtin_code) { Error: GCC_ANALYZER_WARNING (CWE-476): [#def124] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:399:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘buffers’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:388:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:394:28: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:394:21: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:396:25: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:397:32: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:399:7: danger: ‘buffers + (long unsigned int)i * 8’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/2) # 397| TfLiteTensor tf_tensor = tf_context->tensors[tsubgraph->input_tensors[i]]; # 398| # 399|-> buffers[i] = tf_tensor.data.data; # 400| is_signed[i] = !(tf_tensor.type == kTfLiteUInt8 || # 401| tf_tensor.type == kTfLiteUInt16 || Error: GCC_ANALYZER_WARNING (CWE-476): [#def125] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:400:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘is_signed’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:388:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:394:28: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:395:22: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:396:25: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:397:32: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:400:7: danger: ‘is_signed + (long unsigned int)i’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/2) # 398| # 399| buffers[i] = tf_tensor.data.data; # 400|-> is_signed[i] = !(tf_tensor.type == kTfLiteUInt8 || # 401| tf_tensor.type == kTfLiteUInt16 || # 402| tf_tensor.type == kTfLiteUInt32 || Error: GCC_ANALYZER_WARNING (CWE-476): [#def126] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:414:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘buffers’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:394:21: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:409:14: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:411:25: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:412:32: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:414:7: danger: ‘buffers + (long unsigned int)i * 8’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/1) # 412| TfLiteTensor tf_tensor = tf_context->tensors[tsubgraph->output_tensors[i]]; # 413| # 414|-> buffers[i] = tf_tensor.data.data; # 415| is_signed[i] = !(tf_tensor.type == kTfLiteUInt8 || # 416| tf_tensor.type == kTfLiteUInt16 || Error: GCC_ANALYZER_WARNING (CWE-476): [#def127] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:415:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘is_signed’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:395:22: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:410:16: acquire_memory: this call could return NULL mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:411:25: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:412:32: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:415:7: danger: ‘is_signed + (long unsigned int)i’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/1) # 413| # 414| buffers[i] = tf_tensor.data.data; # 415|-> is_signed[i] = !(tf_tensor.type == kTfLiteUInt8 || # 416| tf_tensor.type == kTfLiteUInt16 || # 417| tf_tensor.type == kTfLiteUInt32 || Error: GCC_ANALYZER_WARNING (CWE-401): [#def128] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:496:4: warning[-Wanalyzer-malloc-leak]: leak of ‘supported_nodes’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:496:4: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:499:49: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:499:38: acquire_memory: allocated here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:502:20: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:503:11: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/teflon/tfl_device.c:496:4: danger: ‘supported_nodes’ leaks here; was allocated at [(3)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/2) # 494| TfLiteIntArray *plan; # 495| TfLiteNode *node; # 496|-> TF_LITE_ENSURE_STATUS(context->GetExecutionPlan(context, &plan)); # 497| # 498| // Get a list of supported nodes. Error: GCC_ANALYZER_WARNING (CWE-476): [#def129] mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:247:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dev’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:170:1: enter_function: entry to ‘vlVdpPresentationQueueTargetCreateX11’ mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:176:7: branch_false: following ‘false’ branch (when ‘drawable != 0’)... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:179:23: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:180:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:183:10: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:184:7: branch_false: following ‘false’ branch (when ‘pqt’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:187:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:187:4: call_function: calling ‘DeviceReference’ from ‘vlVdpPresentationQueueTargetCreateX11’ # 245| vl_compositor_cleanup(&dev->compositor); # 246| pipe_sampler_view_reference(&dev->dummy_sv, NULL); # 247|-> dev->context->destroy(dev->context); # 248| dev->vscreen->destroy(dev->vscreen); # 249| FREE(dev); Error: GCC_ANALYZER_WARNING (CWE-401): [#def130] mesa-25.0.2/redhat-linux-build/../src/gallium/include/winsys/radeon_winsys.h:779:18: warning[-Wanalyzer-malloc-leak]: leak of ‘si_vce_encode_headers(encoder)’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:261:13: enter_function: entry to ‘rvce_encode_bitstream’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:271:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:276:4: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:276:25: call_function: calling ‘si_vce_encode_headers’ from ‘rvce_encode_bitstream’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:276:25: return_function: returning to ‘rvce_encode_bitstream’ from ‘si_vce_encode_headers’ mesa-25.0.2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:278:9: call_function: inlined call to ‘radeon_emitted’ from ‘rvce_encode_bitstream’ # 777| static inline bool radeon_emitted(struct radeon_cmdbuf *cs, unsigned num_dw) # 778| { # 779|-> return cs && (cs->prev_dw + cs->current.cdw > num_dw); # 780| } # 781| Error: GCC_ANALYZER_WARNING (CWE-457): [#def131] mesa-25.0.2/redhat-linux-build/../src/intel/isl/isl.c:969:18: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘logical_el.<U80a0>.w’ mesa-25.0.2/redhat-linux-build/../src/intel/isl/isl.c:4105:1: enter_function: entry to ‘isl_tiling_get_intratile_offset_el’ mesa-25.0.2/redhat-linux-build/../src/intel/isl/isl.c:4122:7: branch_false: following ‘false’ branch (when ‘tiling != 0’)... mesa-25.0.2/redhat-linux-build/../src/intel/isl/isl.c:4136:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/intel/isl/isl.c:4136:4: call_function: calling ‘isl_tiling_get_info’ from ‘isl_tiling_get_intratile_offset_el’ # 967| #undef tile_extent3d # 968| # 969|-> phys_B.w = logical_el.w * bs; # 970| phys_B.h = 64 * 1024 / phys_B.w; # 971| break; Error: GCC_ANALYZER_WARNING (CWE-476): [#def132] mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:377:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bbo’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:589:1: enter_function: entry to ‘anv_cmd_buffer_chain_generation_batch’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:597:25: release_memory: ‘new_bbo’ is NULL mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:604:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:607:4: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:610:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:611:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:611:7: release_memory: ‘new_bbo’ is NULL mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:611:7: call_function: calling ‘anv_batch_bo_destroy’ from ‘anv_cmd_buffer_chain_generation_batch’ # 375| { # 376| anv_reloc_list_finish(&bbo->relocs); # 377|-> anv_bo_pool_free(&cmd_buffer->device->batch_bo_pool, bbo->bo); # 378| vk_free(&cmd_buffer->vk.pool->alloc, bbo); # 379| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def133] mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_image.c:2524:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘<unknown>’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_image.c:2509:1: enter_function: entry to ‘anv_image_map_aux_tt’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_image.c:2512:41: call_function: calling ‘anv_image_address’ from ‘anv_image_map_aux_tt’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_image.c:2512:41: return_function: returning to ‘anv_image_map_aux_tt’ from ‘anv_image_address’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_image.c:2512:41: release_memory: ‘main_addr.bo’ is NULL mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_image.c:2523:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_image.c:2524:9: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_image.c:2524:9: danger: dereference of NULL ‘main_addr.bo’ # 2522| */ # 2523| if (device->physical->alloc_aux_tt_mem && # 2524|-> (bo->alloc_flags & ANV_BO_ALLOC_AUX_CCS)) { # 2525| uint64_t main_aux_alignment = # 2526| intel_aux_map_get_alignment(device->aux_map_ctx); Error: GCC_ANALYZER_WARNING (CWE-476): [#def134] mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_pipeline_cache.c:377:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_pipeline_cache.c:656:1: enter_function: entry to ‘anv_device_upload_kernel’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/anv_pipeline_cache.c:665:7: call_function: calling ‘anv_shader_bin_create’ from ‘anv_device_upload_kernel’ # 375| util_dynarray_num_elements(&device->printf.prints, u_printf_info*); # 376| for (uint32_t i = 0; i < prog_data_in->printf_info_count; i++) { # 377|-> util_dynarray_append(&device->printf.prints, u_printf_info *, # 378| &printf_infos[i]); # 379| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def135] mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:891:94: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2587:1: enter_function: entry to ‘gfx9_CmdDecodeVideoKHR’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2592:7: branch_false: following ‘false’ branch... mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2596:7: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2596:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx9_CmdDecodeVideoKHR’ branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2596:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx9_CmdDecodeVideoKHR’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2600:7: call_function: calling ‘anv_h264_decode_video’ from ‘gfx9_CmdDecodeVideoKHR’ # 889| const struct VkVideoDecodeH264PictureInfoKHR *h264_pic_info = # 890| vk_find_struct_const(frame_info->pNext, VIDEO_DECODE_H264_PICTURE_INFO_KHR); # 891|-> const StdVideoH264SequenceParameterSet *sps = vk_video_find_h264_dec_std_sps(¶ms->vk, h264_pic_info->pStdPictureInfo->seq_parameter_set_id); # 892| const StdVideoH264PictureParameterSet *pps = vk_video_find_h264_dec_std_pps(¶ms->vk, h264_pic_info->pStdPictureInfo->pic_parameter_set_id); # 893| Error: GCC_ANALYZER_WARNING (CWE-476): [#def136] mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/xe/anv_batch_chain.c:46:17: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/xe/anv_batch_chain.c:252:1: enter_function: entry to ‘xe_queue_exec_locked’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan/xe/anv_batch_chain.c:268:13: call_function: calling ‘xe_exec_process_syncs’ from ‘xe_queue_exec_locked’ # 44| DRM_XE_SYNC_TYPE_SYNCOBJ, # 45| .flags = signal ? DRM_XE_SYNC_FLAG_SIGNAL : 0, # 46|-> .handle = syncobj->syncobj, # 47| .timeline_value = value, # 48| }; Error: GCC_ANALYZER_WARNING (CWE-476): [#def137] mesa-25.0.2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1727:55: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1658:6: enter_function: entry to ‘anv_UpdateDescriptorSets’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1667:25: branch_true: following ‘true’ branch (when ‘i < descriptorWriteCount’)... mesa-25.0.2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1668:61: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1720:13: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_UpdateDescriptorSets’ branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1720:13: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_UpdateDescriptorSets’ mesa-25.0.2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1727:55: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/intel/vulkan_hasvk/anv_descriptor_set.c:1727:55: danger: dereference of NULL ‘<unknown>’ # 1725| inline_write->pData, # 1726| write->dstArrayElement, # 1727|-> inline_write->dataSize); # 1728| break; # 1729| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def138] mesa-25.0.2/redhat-linux-build/../src/mesa/main/context.c:834:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘table’ mesa-25.0.2/redhat-linux-build/../src/mesa/main/context.c:819:12: acquire_memory: allocated here mesa-25.0.2/redhat-linux-build/../src/mesa/main/context.c:820:7: release_memory: assuming ‘table’ is NULL mesa-25.0.2/redhat-linux-build/../src/mesa/main/context.c:820:7: branch_false: following ‘false’ branch (when ‘table’ is NULL)... mesa-25.0.2/redhat-linux-build/../src/mesa/main/context.c:831:7: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/mesa/main/context.c:831:7: branch_true: following ‘true’ branch (when ‘glthread != 0’)... branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/mesa/main/context.c:833:28: branch_true: following ‘true’ branch (when ‘i < numEntries’)... mesa-25.0.2/redhat-linux-build/../src/mesa/main/context.c:834:15: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/mesa/main/context.c:834:10: danger: dereference of NULL ‘table + (long unsigned int)i * 8’ # 832| _glapi_proc *entry = (_glapi_proc *) table; # 833| for (unsigned i = 0; i < numEntries; i++) # 834|-> entry[i] = (_glapi_proc)glthread_nop; # 835| } # 836| Error: GCC_ANALYZER_WARNING (CWE-476): [#def139] mesa-25.0.2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:798:44: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:712:1: enter_function: entry to ‘nvk_image_init’ mesa-25.0.2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:749:22: branch_false: following ‘false’ branch... branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:773:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:778:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:778:10: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_image_init’ branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:778:10: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_image_init’ mesa-25.0.2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:780:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:780:10: branch_false: following ‘false’ branch... branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:790:13: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_image_init’ branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:790:13: call_function: inlined call to ‘__vk_find_struct’ from ‘nvk_image_init’ mesa-25.0.2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:794:39: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/nouveau/vulkan/nvk_image.c:798:44: danger: dereference of NULL ‘<unknown>’ # 796| nil_select_best_drm_format_mod(&pdev->info, nil_format(p_format), # 797| mod_list_info->drmFormatModifierCount, # 798|-> mod_list_info->pDrmFormatModifiers); # 799| assert(image->vk.drm_format_mod != DRM_FORMAT_MOD_INVALID); # 800| } Error: GCC_ANALYZER_WARNING (CWE-476): [#def140] mesa-25.0.2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:434:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:424:1: enter_function: entry to ‘panvk_GetImageMemoryRequirements2’ mesa-25.0.2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:432:7: call_function: inlined call to ‘__vk_find_struct’ from ‘panvk_GetImageMemoryRequirements2’ branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:432:7: call_function: inlined call to ‘__vk_find_struct’ from ‘panvk_GetImageMemoryRequirements2’ mesa-25.0.2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:433:26: call_function: inlined call to ‘is_disjoint’ from ‘panvk_GetImageMemoryRequirements2’ mesa-25.0.2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:435:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:434:29: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/panfrost/vulkan/panvk_image.c:434:29: danger: dereference of NULL ‘<unknown>’ # 432| vk_find_struct_const(pInfo->pNext, IMAGE_PLANE_MEMORY_REQUIREMENTS_INFO); # 433| const bool disjoint = is_disjoint(image); # 434|-> const VkImageAspectFlags aspects = # 435| disjoint ? plane_info->planeAspect : image->vk.aspects; # 436| uint8_t plane = panvk_plane_index(image->vk.format, aspects); Error: GCC_ANALYZER_WARNING (CWE-416): [#def141] mesa-25.0.2/redhat-linux-build/../src/util/list.h:103:5: warning[-Wanalyzer-use-after-free]: use after ‘free’ of ‘qinst’ mesa-25.0.2/redhat-linux-build/../src/broadcom/compiler/vir.c:2189:1: enter_function: entry to ‘vir_compile_destroy’ mesa-25.0.2/redhat-linux-build/../src/broadcom/compiler/vir.c:2195:9: branch_true: following ‘true’ branch... branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/compiler/vir.c:2196:24: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/compiler/vir.c:2200:25: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/compiler/vir.c:2200:25: call_function: calling ‘vir_remove_instruction’ from ‘vir_compile_destroy’ mesa-25.0.2/redhat-linux-build/../src/broadcom/compiler/vir.c:2200:25: return_function: returning to ‘vir_compile_destroy’ from ‘vir_remove_instruction’ mesa-25.0.2/redhat-linux-build/../src/broadcom/compiler/vir.c:2196:24: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/broadcom/compiler/vir.c:2200:25: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/broadcom/compiler/vir.c:2200:25: call_function: calling ‘vir_remove_instruction’ from ‘vir_compile_destroy’ # 101| static inline void list_del(struct list_head *item) # 102| { # 103|-> item->prev->next = item->next; # 104| item->next->prev = item->prev; # 105| item->prev = item->next = NULL; Error: GCC_ANALYZER_WARNING (CWE-476): [#def142] mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_command_buffer.c:628:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’ mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_command_buffer.c:1937:1: enter_function: entry to ‘vn_CmdBeginRenderPass2’ mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_command_buffer.c:1944:4: call_function: calling ‘vn_cmd_begin_render_pass’ from ‘vn_CmdBeginRenderPass2’ # 626| RENDER_PASS_ATTACHMENT_BEGIN_INFO); # 627| assert(imageless_info); # 628|-> views = imageless_info->pAttachments; # 629| view_count = imageless_info->attachmentCount; # 630| } Error: GCC_ANALYZER_WARNING (CWE-401): [#def143] mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1655:1: warning[-Wanalyzer-malloc-leak]: leak of ‘submit.buffer.base’ mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1710:1: enter_function: entry to ‘vn_WaitForFences’ mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1721:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1722:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1722:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1723:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1727:14: branch_true: following ‘true’ branch (when ‘result == 1’)... mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1728:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1728:19: call_function: calling ‘vn_remove_signaled_fences’ from ‘vn_WaitForFences’ # 1653| # 1654| return vn_result(dev->instance, result); # 1655|-> } # 1656| # 1657| static VkResult Error: GCC_ANALYZER_WARNING (CWE-401): [#def144] mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2159:1: warning[-Wanalyzer-malloc-leak]: leak of ‘submit.buffer.base’ mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2224:1: enter_function: entry to ‘vn_WaitSemaphores’ mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2233:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2234:10: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2233:8: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2235:16: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2236:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2237:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2237:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2238:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2238:7: branch_true: following ‘true’ branch (when ‘semaphores’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2238:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2239:7: branch_true: following ‘true’ branch (when ‘values’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2239:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2243:14: branch_true: following ‘true’ branch (when ‘result == 1’)... mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2244:19: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2244:19: call_function: calling ‘vn_remove_signaled_semaphores’ from ‘vn_WaitSemaphores’ # 2157| semaphore, pValue); # 2158| } # 2159|-> } # 2160| # 2161| VkResult Error: GCC_ANALYZER_WARNING (CWE-476): [#def145] mesa-25.0.2/redhat-linux-build/../src/vulkan/util/vk_alloc.h:79:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dev’ mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_pipeline.c:1705:1: enter_function: entry to ‘vn_DestroyPipeline’ mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_pipeline.c:1714:7: branch_false: following ‘false’ branch (when ‘_pipeline’ is non-NULL)... mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_pipeline.c:1717:8: branch_false: ...to here mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_pipeline.c:1717:7: branch_true: following ‘true’ branch... mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_pipeline.c:1718:7: branch_true: ...to here mesa-25.0.2/redhat-linux-build/../src/virtio/vulkan/vn_pipeline.c:1718:7: call_function: calling ‘vn_pipeline_layout_unref’ from ‘vn_DestroyPipeline’ # 77| return; # 78| # 79|-> alloc->pfnFree(alloc->pUserData, data); # 80| } # 81| Error: GCC_ANALYZER_WARNING (CWE-476): [#def146] mesa-25.0.2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:2008:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘tex_h’ mesa-25.0.2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:583:1: enter_function: entry to ‘nak_nir_lower_tex’ mesa-25.0.2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:585:11: call_function: calling ‘nir_shader_instructions_pass’ from ‘nak_nir_lower_tex’ # 2006| nir_u2u32(nir_builder *build, nir_def *src0) # 2007| { # 2008|-> if (src0->bit_size == 32) # 2009| return src0; # 2010| return nir_build_alu1(build, nir_op_u2u32, src0); Error: GCC_ANALYZER_WARNING (CWE-476): [#def147] mesa-25.0.2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:2015:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘data_w’ mesa-25.0.2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:583:1: enter_function: entry to ‘nak_nir_lower_tex’ mesa-25.0.2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:585:11: call_function: calling ‘nir_shader_instructions_pass’ from ‘nak_nir_lower_tex’ # 2013| nir_u2u64(nir_builder *build, nir_def *src0) # 2014| { # 2015|-> if (src0->bit_size == 64) # 2016| return src0; # 2017| return nir_build_alu1(build, nir_op_u2u64, src0); Error: COMPILER_WARNING (CWE-563): [#def148] mesa-25.0.2/redhat-linux-build/src/amd/vulkan/layers/radv_annotate_layer.c:10: included_from: Included from here. mesa-25.0.2/src/amd/vulkan/radv_cmd_buffer.h: scope_hint: In function ‘radv_emit_shader_pointer_body’ mesa-25.0.2/src/amd/vulkan/radv_cmd_buffer.h:687:39: warning[-Wunused-variable]: unused variable ‘pdev’ # 687 | const struct radv_physical_device *pdev = radv_device_physical(device); # | ^~~~ # 685| bool use_32bit_pointers) # 686| { # 687|-> const struct radv_physical_device *pdev = radv_device_physical(device); # 688| # 689| radeon_emit(cs, va); Error: COMPILER_WARNING (CWE-563): [#def149] mesa-25.0.2/src/amd/vulkan/radv_video.c: scope_hint: In function ‘rvcn_dec_message_decode’ mesa-25.0.2/src/amd/vulkan/radv_video.c:2100:15: warning[-Wunused-variable]: unused variable ‘slot_idx’ # 2100 | int32_t slot_idx = frame_info->pReferenceSlots[i].slotIndex; # | ^~~~~~~~ # 2098| # 2099| for (int i = 0; i < frame_info->referenceSlotCount; i++) { # 2100|-> int32_t slot_idx = frame_info->pReferenceSlots[i].slotIndex; # 2101| assert(slot_idx >= 0 && slot_idx < 16); # 2102| struct radv_image_view *f_dpb_iv = Error: COMPILER_WARNING (CWE-252): [#def150] mesa-25.0.2/src/compiler/spirv/vtn_bindgen.c: scope_hint: In function ‘main’ mesa-25.0.2/src/compiler/spirv/vtn_bindgen.c:46:4: warning[-Wunused-result]: ignoring return value of ‘fread’ declared with attribute ‘warn_unused_result’ # 46 | fread(map, 1, len, fin); # | ^~~~~~~~~~~~~~~~~~~~~~~ # 44| } # 45| # 46|-> fread(map, 1, len, fin); # 47| fclose(fin); # 48| Error: CPPCHECK_WARNING (CWE-476): [#def151] mesa-25.0.2/src/glx/single2.c:879: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: res4 # 877| GLboolean *res4 = malloc((n + 3) & ~3); # 878| retval = (GLboolean) __glXReadReply(dpy, 1, res4, GL_TRUE); # 879|-> memcpy(residences, res4, n); # 880| free(res4); # 881| } Error: COMPILER_WARNING (CWE-563): [#def152] mesa-25.0.2/src/intel/compiler/brw_fs_nir.cpp: scope_hint: In function ‘brw_reg emit_work_group_id_setup(nir_to_brw_state&)’ mesa-25.0.2/src/intel/compiler/brw_fs_nir.cpp:208:16: warning[-Wunused-variable]: unused variable ‘s’ # 208 | fs_visitor &s = ntb.s; # | ^ # 206| emit_work_group_id_setup(nir_to_brw_state &ntb) # 207| { # 208|-> fs_visitor &s = ntb.s; # 209| const brw_builder &bld = ntb.bld.scalar_group(); # 210| Error: COMPILER_WARNING (CWE-563): [#def153] mesa-25.0.2/src/intel/compiler/brw_fs_nir.cpp: scope_hint: In function ‘void emit_pixel_interpolater_alu_at_offset(const brw_builder&, const brw_reg&, const brw_reg&, glsl_interp_mode)’ mesa-25.0.2/src/intel/compiler/brw_fs_nir.cpp:2166:35: warning[-Wunused-variable]: unused variable ‘wm_prog_data’ # 2166 | const struct brw_wm_prog_data *wm_prog_data = # | ^~~~~~~~~~~~ # 2164| # 2165| const fs_thread_payload &payload = shader->fs_payload(); # 2166|-> const struct brw_wm_prog_data *wm_prog_data = # 2167| brw_wm_prog_data(shader->prog_data); # 2168| Error: COMPILER_WARNING (CWE-563): [#def154] mesa-25.0.2/src/intel/compiler/brw_fs_nir.cpp: scope_hint: In function ‘void emit_pixel_interpolater_alu_at_sample(const brw_builder&, const brw_reg&, const brw_reg&, glsl_interp_mode)’ mesa-25.0.2/src/intel/compiler/brw_fs_nir.cpp:2296:35: warning[-Wunused-variable]: unused variable ‘wm_prog_data’ # 2296 | const struct brw_wm_prog_data *wm_prog_data = # | ^~~~~~~~~~~~ # 2294| { # 2295| const fs_thread_payload &payload = bld.shader->fs_payload(); # 2296|-> const struct brw_wm_prog_data *wm_prog_data = # 2297| brw_wm_prog_data(bld.shader->prog_data); # 2298| const brw_builder ubld = bld.exec_all().group(16, 0); Error: COMPILER_WARNING (CWE-563): [#def155] mesa-25.0.2/src/intel/compiler/brw_fs_nir.cpp: scope_hint: In function ‘void fs_nir_emit_vs_intrinsic(nir_to_brw_state&, nir_intrinsic_instr*)’ mesa-25.0.2/src/intel/compiler/brw_fs_nir.cpp:2887:16: warning[-Wunused-variable]: unused variable ‘s’ # 2887 | fs_visitor &s = ntb.s; # | ^ # 2885| { # 2886| const brw_builder &bld = ntb.bld; # 2887|-> fs_visitor &s = ntb.s; # 2888| assert(s.stage == MESA_SHADER_VERTEX); # 2889| Error: COMPILER_WARNING (CWE-563): [#def156] mesa-25.0.2/src/intel/compiler/brw_fs_nir.cpp: scope_hint: In function ‘void emit_barrier(nir_to_brw_state&)’ mesa-25.0.2/src/intel/compiler/brw_fs_nir.cpp:3049:16: warning[-Wunused-variable]: unused variable ‘s’ # 3049 | fs_visitor &s = ntb.s; # | ^ # 3047| const brw_builder ubld = bld.exec_all(); # 3048| const brw_builder hbld = ubld.group(8 * reg_unit(devinfo), 0); # 3049|-> fs_visitor &s = ntb.s; # 3050| # 3051| /* We are getting the barrier ID from the compute shader header */ Error: COMPILER_WARNING (CWE-563): [#def157] mesa-25.0.2/src/intel/compiler/brw_fs_nir.cpp: scope_hint: In function ‘brw_reg emit_shading_rate_setup(nir_to_brw_state&)’ mesa-25.0.2/src/intel/compiler/brw_fs_nir.cpp:4092:29: warning[-Wunused-variable]: unused variable ‘devinfo’ # 4092 | const intel_device_info *devinfo = ntb.devinfo; # | ^~~~~~~ # 4090| emit_shading_rate_setup(nir_to_brw_state &ntb) # 4091| { # 4092|-> const intel_device_info *devinfo = ntb.devinfo; # 4093| const brw_builder &bld = ntb.bld; # 4094| Error: COMPILER_WARNING (CWE-563): [#def158] mesa-25.0.2/src/intel/compiler/brw_lower_regioning.cpp:743:16: warning[-Wunused-variable]: unused variable ‘mov’ # 743 | fs_inst *mov = ibld.MOV(tmp, inst->src[0]); # | ^~~ # 741| # 742| brw_reg tmp = ibld.vgrf(brw_type_with_size(inst->src[0].type, 32)); # 743|-> fs_inst *mov = ibld.MOV(tmp, inst->src[0]); # 744| # 745| inst->src[0] = component(tmp, 0); Error: COMPILER_WARNING (CWE-563): [#def159] mesa-25.0.2/src/nouveau/winsys/nouveau_bo.c: scope_hint: In function ‘nouveau_ws_bo_from_dma_buf_locked’ mesa-25.0.2/src/nouveau/winsys/nouveau_bo.c:209:13: warning[-Wunused-but-set-variable]: variable ‘align’ set but not used # 209 | uint64_t align = (1ULL << 12); # | ^~~~~ # 207| bo->refcnt = 1; # 208| # 209|-> uint64_t align = (1ULL << 12); # 210| if (info.domain & NOUVEAU_GEM_DOMAIN_VRAM) # 211| align = (1ULL << 16); Error: COMPILER_WARNING (CWE-252): [#def160] mesa-25.0.2/src/panfrost/midgard/midgard_compile.c: scope_hint: In function ‘midgard_compile_shader_nir’ mesa-25.0.2/src/panfrost/midgard/midgard_compile.c:3163:7: warning[-Wunused-result]: ignoring return value of ‘asprintf’ declared with attribute ‘warn_unused_result’ # 3163 | asprintf(&shaderdb, # | ^~~~~~~~~~~~~~~~~~~ # 3164 | "%s shader: " # | ~~~~~~~~~~~~~ # 3165 | "%u inst, %u bundles, %u quadwords, " # | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # 3166 | "%u registers, %u threads, %u loops, " # | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # 3167 | "%u:%u spills:fills", # | ~~~~~~~~~~~~~~~~~~~~~ # 3168 | ctx->inputs->is_blend ? "PAN_SHADER_BLEND" # | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # 3169 | : gl_shader_stage_name(ctx->stage), # | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # 3170 | nr_ins, nr_bundles, ctx->quadword_count, nr_registers, # | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # 3171 | nr_threads, ctx->loop_count, ctx->spills, ctx->fills); # | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # 3161| /* Dump stats */ # 3162| # 3163|-> asprintf(&shaderdb, # 3164| "%s shader: " # 3165| "%u inst, %u bundles, %u quadwords, " Error: COMPILER_WARNING (CWE-563): [#def161] mesa-25.0.2/src/panfrost/vulkan/jm/panvk_vX_queue.c: scope_hint: In function ‘panvk_signal_event_syncobjs’ mesa-25.0.2/src/panfrost/vulkan/jm/panvk_vX_queue.c:200:14: warning[-Wunused-variable]: unused variable ‘ret’ # 200 | int ret = drmIoctl(dev->vk.drm_fd, DRM_IOCTL_SYNCOBJ_RESET, &objs); # | ^~~ # 198| .count_handles = 1}; # 199| # 200|-> int ret = drmIoctl(dev->vk.drm_fd, DRM_IOCTL_SYNCOBJ_RESET, &objs); # 201| assert(!ret); # 202| break; Error: COMPILER_WARNING (CWE-563): [#def162] mesa-25.0.2/src/panfrost/vulkan/jm/panvk_vX_queue.c: scope_hint: In function ‘panvk_v6_QueueWaitIdle’ mesa-25.0.2/src/panfrost/vulkan/jm/panvk_vX_queue.c:350:8: warning[-Wunused-variable]: unused variable ‘ret’ # 350 | int ret = drmSyncobjWait(queue->vk.base.device->drm_fd, &queue->sync, 1, # | ^~~ # 348| return VK_ERROR_DEVICE_LOST; # 349| # 350|-> int ret = drmSyncobjWait(queue->vk.base.device->drm_fd, &queue->sync, 1, # 351| INT64_MAX, DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL, NULL); # 352| assert(!ret); Error: COMPILER_WARNING (CWE-563): [#def163] mesa-25.0.2/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c: scope_hint: In function ‘record_binding’ mesa-25.0.2/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:888:13: warning[-Wunused-variable]: unused variable ‘desc_stride’ # 888 | uint32_t desc_stride = panvk_get_desc_stride(binding_layout->type); # | ^~~~~~~~~~~ # 886| &set_layout->bindings[binding]; # 887| uint32_t subdesc_idx = get_subdesc_idx(binding_layout, subdesc_type); # 888|-> uint32_t desc_stride = panvk_get_desc_stride(binding_layout->type); # 889| # 890| assert(desc_stride == 1 || desc_stride == 2);
| analyzer-version-clippy | 1.86.0 |
| analyzer-version-cppcheck | 2.17.1 |
| analyzer-version-gcc | 15.0.1 |
| analyzer-version-gcc-analyzer | 15.0.1 |
| analyzer-version-shellcheck | 0.10.0 |
| analyzer-version-unicontrol | 0.0.2 |
| diffbase-analyzer-version-clippy | 1.86.0 |
| diffbase-analyzer-version-cppcheck | 2.17.1 |
| diffbase-analyzer-version-gcc | 15.0.1 |
| diffbase-analyzer-version-gcc-analyzer | 15.0.1 |
| diffbase-analyzer-version-shellcheck | 0.10.0 |
| diffbase-analyzer-version-unicontrol | 0.0.2 |
| diffbase-enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol |
| diffbase-exit-code | 0 |
| diffbase-host | ip-172-16-1-158.us-west-2.compute.internal |
| diffbase-known-false-positives | /usr/share/csmock/known-false-positives.js |
| diffbase-known-false-positives-rpm | known-false-positives-0.0.0.20250425.124705.g1c7c448.main-1.el9.noarch |
| diffbase-mock-config | fedora-rawhide-x86_64 |
| diffbase-project-name | mesa-25.1.0~rc2-2.fc43 |
| diffbase-store-results-to | /tmp/tmp6ml64bzx/mesa-25.1.0~rc2-2.fc43.tar.xz |
| diffbase-time-created | 2025-04-25 15:02:54 |
| diffbase-time-finished | 2025-04-25 15:44:51 |
| diffbase-tool | csmock |
| diffbase-tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'unicontrol,cppcheck,gcc,clippy,shellcheck' '-o' '/tmp/tmp6ml64bzx/mesa-25.1.0~rc2-2.fc43.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmp6ml64bzx/mesa-25.1.0~rc2-2.fc43.src.rpm' |
| diffbase-tool-version | csmock-3.8.1.20250422.172604.g26bc3d6-1.el9 |
| enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol |
| exit-code | 0 |
| host | ip-172-16-1-158.us-west-2.compute.internal |
| known-false-positives | /usr/share/csmock/known-false-positives.js |
| known-false-positives-rpm | known-false-positives-0.0.0.20250425.124705.g1c7c448.main-1.el9.noarch |
| mock-config | fedora-rawhide-x86_64 |
| project-name | mesa-25.0.2-3.fc42 |
| store-results-to | /tmp/tmpz_xyv1js/mesa-25.0.2-3.fc42.tar.xz |
| time-created | 2025-04-25 14:23:04 |
| time-finished | 2025-04-25 15:01:03 |
| title | Fixed findings |
| tool | csmock |
| tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'unicontrol,cppcheck,gcc,clippy,shellcheck' '-o' '/tmp/tmpz_xyv1js/mesa-25.0.2-3.fc42.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpz_xyv1js/mesa-25.0.2-3.fc42.src.rpm' |
| tool-version | csmock-3.8.1.20250422.172604.g26bc3d6-1.el9 |