cockpit-354-1.fc44

List of Findings

Error: SHELLCHECK_WARNING (CWE-569): [#def1]
/usr/libexec/cockpit-desktop:122:12: warning[SC2064]: Use single quotes, otherwise this expands now rather than when signalled.
#  120|   # start the bridge; this needs to run in the normal user session/namespace
#  121|   coproc ${2:+ssh "$2"} cockpit-bridge
#  122|-> trap "kill $COPROC_PID; wait $COPROC_PID || true" EXIT INT QUIT PIPE
#  123|   
#  124|   # start ws and browser in a detached network namespace

Error: SHELLCHECK_WARNING (CWE-569): [#def2]
/usr/libexec/cockpit-desktop:122:30: warning[SC2064]: Use single quotes, otherwise this expands now rather than when signalled.
#  120|   # start the bridge; this needs to run in the normal user session/namespace
#  121|   coproc ${2:+ssh "$2"} cockpit-bridge
#  122|-> trap "kill $COPROC_PID; wait $COPROC_PID || true" EXIT INT QUIT PIPE
#  123|   
#  124|   # start ws and browser in a detached network namespace

Error: GCC_ANALYZER_WARNING (CWE-401): [#def3]
cockpit-354/src/common/cockpitauthorize.c:72:7: warning[-Wanalyzer-malloc-leak]: leak of ‘nonce’
cockpit-354/src/common/cockpitauthorize.c:506:1: enter_function: entry to ‘cockpit_authorize_build_x_conversation’
cockpit-354/src/common/cockpitauthorize.c:527:15: call_function: calling ‘cockpit_authorize_nonce’ from ‘cockpit_authorize_build_x_conversation’
cockpit-354/src/common/cockpitauthorize.c:527:15: return_function: returning to ‘cockpit_authorize_build_x_conversation’ from ‘cockpit_authorize_nonce’
cockpit-354/src/common/cockpitauthorize.c:528:10: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:536:22: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:537:10: branch_false: following ‘false’ branch (when ‘alloc’ is non-NULL)...
cockpit-354/src/common/cockpitauthorize.c:543:11: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:543:10: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:551:7: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:551:6: branch_true: following ‘true’ branch...
cockpit-354/src/common/cockpitauthorize.c:553:7: branch_true: ...to here
cockpit-354/src/common/cockpitauthorize.c:553:7: call_function: calling ‘message’ from ‘cockpit_authorize_build_x_conversation’
#   70|     if (!strchr (format, '%'))
#   71|       {
#   72|->       logger (format);
#   73|         return;
#   74|       }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def4]
cockpit-354/src/common/cockpitauthorize.c:72:7: warning[-Wanalyzer-malloc-leak]: leak of ‘type’
cockpit-354/src/common/cockpitauthorize.c:224:1: enter_function: entry to ‘cockpit_authorize_parse_basic’
cockpit-354/src/common/cockpitauthorize.c:234:15: call_function: calling ‘cockpit_authorize_type’ from ‘cockpit_authorize_parse_basic’
cockpit-354/src/common/cockpitauthorize.c:234:15: return_function: returning to ‘cockpit_authorize_parse_basic’ from ‘cockpit_authorize_type’
cockpit-354/src/common/cockpitauthorize.c:235:6: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:238:7: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:238:6: branch_true: following ‘true’ branch (when the strings are non-equal)...
cockpit-354/src/common/cockpitauthorize.c:240:7: branch_true: ...to here
cockpit-354/src/common/cockpitauthorize.c:240:7: call_function: calling ‘message’ from ‘cockpit_authorize_parse_basic’
#   70|     if (!strchr (format, '%'))
#   71|       {
#   72|->       logger (format);
#   73|         return;
#   74|       }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def5]
cockpit-354/src/common/cockpitauthorize.c:82:7: warning[-Wanalyzer-malloc-leak]: leak of ‘nonce’
cockpit-354/src/common/cockpitauthorize.c:506:1: enter_function: entry to ‘cockpit_authorize_build_x_conversation’
cockpit-354/src/common/cockpitauthorize.c:527:15: call_function: calling ‘cockpit_authorize_nonce’ from ‘cockpit_authorize_build_x_conversation’
cockpit-354/src/common/cockpitauthorize.c:527:15: return_function: returning to ‘cockpit_authorize_build_x_conversation’ from ‘cockpit_authorize_nonce’
cockpit-354/src/common/cockpitauthorize.c:528:10: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:536:22: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:537:10: branch_false: following ‘false’ branch (when ‘alloc’ is non-NULL)...
cockpit-354/src/common/cockpitauthorize.c:543:11: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:543:10: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:551:7: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:551:6: branch_true: following ‘true’ branch...
cockpit-354/src/common/cockpitauthorize.c:553:7: branch_true: ...to here
cockpit-354/src/common/cockpitauthorize.c:553:7: call_function: calling ‘message’ from ‘cockpit_authorize_build_x_conversation’
#   80|     if (res < 0)
#   81|       {
#   82|->       logger ("out of memory printing message");
#   83|         return;
#   84|       }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def6]
cockpit-354/src/common/cockpitauthorize.c:82:7: warning[-Wanalyzer-malloc-leak]: leak of ‘type’
cockpit-354/src/common/cockpitauthorize.c:224:1: enter_function: entry to ‘cockpit_authorize_parse_basic’
cockpit-354/src/common/cockpitauthorize.c:234:15: call_function: calling ‘cockpit_authorize_type’ from ‘cockpit_authorize_parse_basic’
cockpit-354/src/common/cockpitauthorize.c:234:15: return_function: returning to ‘cockpit_authorize_parse_basic’ from ‘cockpit_authorize_type’
cockpit-354/src/common/cockpitauthorize.c:235:6: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:238:7: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:238:6: branch_true: following ‘true’ branch (when the strings are non-equal)...
cockpit-354/src/common/cockpitauthorize.c:240:7: branch_true: ...to here
cockpit-354/src/common/cockpitauthorize.c:240:7: call_function: calling ‘message’ from ‘cockpit_authorize_parse_basic’
#   80|     if (res < 0)
#   81|       {
#   82|->       logger ("out of memory printing message");
#   83|         return;
#   84|       }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def7]
cockpit-354/src/common/cockpitauthorize.c:86:3: warning[-Wanalyzer-malloc-leak]: leak of ‘nonce’
cockpit-354/src/common/cockpitauthorize.c:506:1: enter_function: entry to ‘cockpit_authorize_build_x_conversation’
cockpit-354/src/common/cockpitauthorize.c:527:15: call_function: calling ‘cockpit_authorize_nonce’ from ‘cockpit_authorize_build_x_conversation’
cockpit-354/src/common/cockpitauthorize.c:527:15: return_function: returning to ‘cockpit_authorize_build_x_conversation’ from ‘cockpit_authorize_nonce’
cockpit-354/src/common/cockpitauthorize.c:528:10: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:536:22: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:537:10: branch_false: following ‘false’ branch (when ‘alloc’ is non-NULL)...
cockpit-354/src/common/cockpitauthorize.c:543:11: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:543:10: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:551:7: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:551:6: branch_true: following ‘true’ branch...
cockpit-354/src/common/cockpitauthorize.c:553:7: branch_true: ...to here
cockpit-354/src/common/cockpitauthorize.c:553:7: call_function: calling ‘message’ from ‘cockpit_authorize_build_x_conversation’
#   84|       }
#   85|   
#   86|->   logger (data);
#   87|     free (data);
#   88|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def8]
cockpit-354/src/common/cockpitauthorize.c:124:21: warning[-Wanalyzer-malloc-leak]: leak of ‘cockpit_authorize_nonce(128)’
cockpit-354/src/common/cockpitauthorize.c:506:1: enter_function: entry to ‘cockpit_authorize_build_x_conversation’
cockpit-354/src/common/cockpitauthorize.c:527:15: call_function: calling ‘cockpit_authorize_nonce’ from ‘cockpit_authorize_build_x_conversation’
cockpit-354/src/common/cockpitauthorize.c:527:15: return_function: returning to ‘cockpit_authorize_build_x_conversation’ from ‘cockpit_authorize_nonce’
cockpit-354/src/common/cockpitauthorize.c:528:10: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:536:22: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:537:10: branch_false: following ‘false’ branch (when ‘alloc’ is non-NULL)...
cockpit-354/src/common/cockpitauthorize.c:543:11: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:543:11: throw: if ‘cockpit_base64_ntop’ throws an exception...
cockpit-354/src/common/cockpitauthorize.c:124:21: danger: ‘cockpit_authorize_nonce(128)’ leaks here; was allocated at [(6)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/5)
#  122|       {
#  123|         errno = 0;
#  124|->       read_result = read (fd, key + read_bytes, length - read_bytes);
#  125|         if (read_result <= 0)
#  126|           {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def9]
cockpit-354/src/common/cockpitauthorize.c:135:3: warning[-Wanalyzer-malloc-leak]: leak of ‘key’
cockpit-354/src/common/cockpitauthorize.c:506:1: enter_function: entry to ‘cockpit_authorize_build_x_conversation’
cockpit-354/src/common/cockpitauthorize.c:527:15: call_function: calling ‘cockpit_authorize_nonce’ from ‘cockpit_authorize_build_x_conversation’
#  133|       }
#  134|     while (read_bytes < length);
#  135|->   close (fd);
#  136|   
#  137|     if (read_bytes < length)

Error: GCC_ANALYZER_WARNING (CWE-401): [#def10]
cockpit-354/src/common/cockpitauthorize.c:337:7: warning[-Wanalyzer-malloc-leak]: leak of ‘encoded’
cockpit-354/src/common/cockpitauthorize.c:321:6: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:328:10: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:330:13: acquire_memory: allocated here
cockpit-354/src/common/cockpitauthorize.c:331:6: branch_false: following ‘false’ branch (when ‘encoded’ is non-NULL)...
cockpit-354/src/common/cockpitauthorize.c:337:7: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:337:7: throw: if ‘cockpit_base64_ntop’ throws an exception...
cockpit-354/src/common/cockpitauthorize.c:337:7: danger: ‘encoded’ leaks here; was allocated at [(3)](sarif:/runs/0/results/10/codeFlows/0/threadFlows/0/locations/2)
#  335|         goto out;
#  336|       }
#  337|->   if (cockpit_base64_ntop ((unsigned char *)content, clen, encoded, elen) < 0)
#  338|       {
#  339|         errn = errno;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def11]
cockpit-354/src/common/cockpitauthorize.c:396:9: warning[-Wanalyzer-malloc-leak]: leak of ‘buf’
cockpit-354/src/common/cockpitauthorize.c:363:1: enter_function: entry to ‘cockpit_authorize_parse_negotiate’
cockpit-354/src/common/cockpitauthorize.c:372:15: call_function: calling ‘cockpit_authorize_type’ from ‘cockpit_authorize_parse_negotiate’
cockpit-354/src/common/cockpitauthorize.c:372:15: return_function: returning to ‘cockpit_authorize_parse_negotiate’ from ‘cockpit_authorize_type’
cockpit-354/src/common/cockpitauthorize.c:373:6: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:376:15: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:379:6: branch_false: following ‘false’ branch (when the strings are equal)...
cockpit-354/src/common/cockpitauthorize.c:386:9: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:387:9: acquire_memory: allocated here
cockpit-354/src/common/cockpitauthorize.c:388:6: branch_false: following ‘false’ branch (when ‘buf’ is non-NULL)...
cockpit-354/src/common/cockpitauthorize.c:396:9: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:396:9: throw: if ‘cockpit_base64_pton’ throws an exception...
cockpit-354/src/common/cockpitauthorize.c:396:9: danger: ‘buf’ leaks here; was allocated at [(19)](sarif:/runs/0/results/11/codeFlows/0/threadFlows/0/locations/18)
#  394|   
#  395|     /* Decode data */
#  396|->   res = cockpit_base64_pton (challenge, len, buf, len);
#  397|     if (res < 0)
#  398|       {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def12]
cockpit-354/src/common/cockpitauthorize.c:432:11: warning[-Wanalyzer-malloc-leak]: leak of ‘encoded’
cockpit-354/src/common/cockpitauthorize.c:419:6: branch_false: following ‘false’ branch (when ‘input’ is non-NULL)...
cockpit-354/src/common/cockpitauthorize.c:422:6: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:422:6: branch_true: following ‘true’ branch (when ‘length != 0’)...
cockpit-354/src/common/cockpitauthorize.c:424:14: branch_true: ...to here
cockpit-354/src/common/cockpitauthorize.c:425:17: acquire_memory: allocated here
cockpit-354/src/common/cockpitauthorize.c:426:10: branch_false: following ‘false’ branch (when ‘encoded’ is non-NULL)...
cockpit-354/src/common/cockpitauthorize.c:432:11: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:432:11: throw: if ‘cockpit_base64_ntop’ throws an exception...
cockpit-354/src/common/cockpitauthorize.c:432:11: danger: ‘encoded’ leaks here; was allocated at [(5)](sarif:/runs/0/results/12/codeFlows/0/threadFlows/0/locations/4)
#  430|             goto out;
#  431|           }
#  432|->       if (cockpit_base64_ntop ((unsigned char *)input, length, encoded, elen) < 0)
#  433|           {
#  434|             errn = errno;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def13]
cockpit-354/src/common/cockpitauthorize.c:543:11: warning[-Wanalyzer-malloc-leak]: leak of ‘alloc’
cockpit-354/src/common/cockpitauthorize.c:506:1: enter_function: entry to ‘cockpit_authorize_build_x_conversation’
cockpit-354/src/common/cockpitauthorize.c:527:15: call_function: calling ‘cockpit_authorize_nonce’ from ‘cockpit_authorize_build_x_conversation’
cockpit-354/src/common/cockpitauthorize.c:527:15: return_function: returning to ‘cockpit_authorize_build_x_conversation’ from ‘cockpit_authorize_nonce’
cockpit-354/src/common/cockpitauthorize.c:528:10: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:536:22: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:536:22: acquire_memory: allocated here
cockpit-354/src/common/cockpitauthorize.c:537:10: branch_false: following ‘false’ branch (when ‘alloc’ is non-NULL)...
cockpit-354/src/common/cockpitauthorize.c:543:11: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:543:11: throw: if ‘cockpit_base64_ntop’ throws an exception...
cockpit-354/src/common/cockpitauthorize.c:543:11: danger: ‘alloc’ leaks here; was allocated at [(15)](sarif:/runs/0/results/13/codeFlows/0/threadFlows/0/locations/14)
#  541|             goto out;
#  542|           }
#  543|->       if (cockpit_base64_ntop (nonce, nlen, conv, clen) < 0)
#  544|           {
#  545|             errn = errno;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def14]
cockpit-354/src/common/cockpitauthorize.c:569:11: warning[-Wanalyzer-malloc-leak]: leak of ‘encoded’
cockpit-354/src/common/cockpitauthorize.c:522:6: branch_true: following ‘true’ branch (when ‘conversation’ is non-NULL)...
cockpit-354/src/common/cockpitauthorize.c:523:5: branch_true: ...to here
cockpit-354/src/common/cockpitauthorize.c:525:6: branch_false: following ‘false’ branch (when ‘conv’ is non-NULL)...
cockpit-354/src/common/cockpitauthorize.c:551:7: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:551:6: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:558:10: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:559:6: branch_true: following ‘true’ branch (when ‘plen != 0’)...
cockpit-354/src/common/cockpitauthorize.c:561:14: branch_true: ...to here
cockpit-354/src/common/cockpitauthorize.c:562:17: acquire_memory: allocated here
cockpit-354/src/common/cockpitauthorize.c:563:10: branch_false: following ‘false’ branch (when ‘encoded’ is non-NULL)...
cockpit-354/src/common/cockpitauthorize.c:569:11: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:569:11: throw: if ‘cockpit_base64_ntop’ throws an exception...
cockpit-354/src/common/cockpitauthorize.c:569:11: danger: ‘encoded’ leaks here; was allocated at [(9)](sarif:/runs/0/results/14/codeFlows/0/threadFlows/0/locations/8)
#  567|             goto out;
#  568|           }
#  569|->       if (cockpit_base64_ntop ((unsigned char *)prompt, plen, encoded, elen) < 0)
#  570|           {
#  571|             errn = errno;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def15]
cockpit-354/src/common/cockpitauthorize.c:569:11: warning[-Wanalyzer-malloc-leak]: leak of ‘nonce’
cockpit-354/src/common/cockpitauthorize.c:506:1: enter_function: entry to ‘cockpit_authorize_build_x_conversation’
cockpit-354/src/common/cockpitauthorize.c:527:15: call_function: calling ‘cockpit_authorize_nonce’ from ‘cockpit_authorize_build_x_conversation’
cockpit-354/src/common/cockpitauthorize.c:527:15: return_function: returning to ‘cockpit_authorize_build_x_conversation’ from ‘cockpit_authorize_nonce’
cockpit-354/src/common/cockpitauthorize.c:528:10: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:536:22: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:537:10: branch_false: following ‘false’ branch (when ‘alloc’ is non-NULL)...
cockpit-354/src/common/cockpitauthorize.c:543:11: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:543:10: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:551:7: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:551:6: branch_false: following ‘false’ branch...
cockpit-354/src/common/cockpitauthorize.c:558:10: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:559:6: branch_true: following ‘true’ branch (when ‘plen != 0’)...
cockpit-354/src/common/cockpitauthorize.c:561:14: branch_true: ...to here
cockpit-354/src/common/cockpitauthorize.c:563:10: branch_false: following ‘false’ branch (when ‘encoded’ is non-NULL)...
cockpit-354/src/common/cockpitauthorize.c:569:11: branch_false: ...to here
cockpit-354/src/common/cockpitauthorize.c:569:11: throw: if ‘cockpit_base64_ntop’ throws an exception...
cockpit-354/src/common/cockpitauthorize.c:569:11: danger: ‘nonce’ leaks here; was allocated at [(6)](sarif:/runs/0/results/15/codeFlows/0/threadFlows/0/locations/5)
#  567|             goto out;
#  568|           }
#  569|->       if (cockpit_base64_ntop ((unsigned char *)prompt, plen, encoded, elen) < 0)
#  570|           {
#  571|             errn = errno;

Error: COMPILER_WARNING (CWE-704): [#def16]
cockpit-354/src/common/cockpitbase64.c: scope_hint: In function ‘cockpit_base64_pton’
cockpit-354/src/common/cockpitbase64.c:90:11: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
#   90 |       pos = strchr (Base64, ch);
#      |           ^
#   88|           break;
#   89|   
#   90|->       pos = strchr (Base64, ch);
#   91|         if (pos == 0) /* A non-base64 character */
#   92|           return (-1);

Error: COMPILER_WARNING (CWE-704): [#def17]
cockpit-354/src/common/cockpitbase64.c:90:11: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
#   88|           break;
#   89|   
#   90|->       pos = strchr (Base64, ch);
#   91|         if (pos == 0) /* A non-base64 character */
#   92|           return (-1);

Error: GCC_ANALYZER_WARNING (CWE-404): [#def18]
cockpit-354/src/common/cockpitchannel.c:838:13: warning[-Wanalyzer-va-list-leak]: missing call to ‘va_end’
cockpit-354/src/common/cockpitchannel.c:834:3: branch_true: following ‘true’ branch (when ‘problem’ is non-NULL)...
cockpit-354/src/common/cockpitchannel.c:835:3: branch_true: ...to here
cockpit-354/src/common/cockpitchannel.c:835:3: branch_true: following ‘true’ branch...
cockpit-354/src/common/cockpitchannel.c:837:3: branch_true: ...to here
cockpit-354/src/common/cockpitchannel.c:837:3: acquire_resource: ‘va_start’ called here
cockpit-354/src/common/cockpitchannel.c:838:13: throw: if ‘g_strdup_vprintf’ throws an exception...
cockpit-354/src/common/cockpitchannel.c:838:13: danger: missing call to ‘va_end’ to match ‘va_start’ at [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#  836|   
#  837|     va_start (va, format);
#  838|->   message = g_strdup_vprintf (format, va);
#  839|     va_end (va);
#  840|   

Error: GCC_ANALYZER_WARNING (CWE-775): [#def19]
cockpit-354/src/common/cockpitconf.c:66:13: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(file_path, "r")’
cockpit-354/src/common/cockpitconf.c:359:1: enter_function: entry to ‘cockpit_conf_uint’
cockpit-354/src/common/cockpitconf.c:369:22: call_function: inlined call to ‘cockpit_conf_string’ from ‘cockpit_conf_uint’
#   64|   regcompx (regex_t *preg, const char *regex, int cflags)
#   65|   {
#   66|->   int ret = regcomp (preg, regex, cflags);
#   67|     if (ret != 0)
#   68|       {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def20]
cockpit-354/src/common/cockpitconf.c:66:13: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(file_path, "r")’
cockpit-354/src/common/cockpitconf.c:359:1: enter_function: entry to ‘cockpit_conf_uint’
cockpit-354/src/common/cockpitconf.c:369:22: call_function: inlined call to ‘cockpit_conf_string’ from ‘cockpit_conf_uint’
#   64|   regcompx (regex_t *preg, const char *regex, int cflags)
#   65|   {
#   66|->   int ret = regcomp (preg, regex, cflags);
#   67|     if (ret != 0)
#   68|       {

Error: GCC_ANALYZER_WARNING (CWE-775): [#def21]
cockpit-354/src/common/cockpitconf.c:70:7: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(file_path, "r")’
cockpit-354/src/common/cockpitconf.c:359:1: enter_function: entry to ‘cockpit_conf_uint’
cockpit-354/src/common/cockpitconf.c:369:22: call_function: inlined call to ‘cockpit_conf_string’ from ‘cockpit_conf_uint’
#   68|       {
#   69|         char err[1024];
#   70|->       regerror (ret, preg, err, sizeof (err));
#   71|         fprintf (stderr, "failed to compile regular expression: %s\n", err);
#   72|         abort ();

Error: GCC_ANALYZER_WARNING (CWE-401): [#def22]
cockpit-354/src/common/cockpitconf.c:70:7: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(file_path, "r")’
cockpit-354/src/common/cockpitconf.c:359:1: enter_function: entry to ‘cockpit_conf_uint’
cockpit-354/src/common/cockpitconf.c:369:22: call_function: inlined call to ‘cockpit_conf_string’ from ‘cockpit_conf_uint’
#   68|       {
#   69|         char err[1024];
#   70|->       regerror (ret, preg, err, sizeof (err));
#   71|         fprintf (stderr, "failed to compile regular expression: %s\n", err);
#   72|         abort ();

Error: GCC_ANALYZER_WARNING (CWE-775): [#def23]
cockpit-354/src/common/cockpitpipe.c:1193:12: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘sock’
cockpit-354/src/common/cockpitpipe.c:1184:3: branch_false: following ‘false’ branch (when ‘address’ is non-NULL)...
cockpit-354/src/common/cockpitpipe.c:1184:3: branch_false: ...to here
cockpit-354/src/common/cockpitpipe.c:1186:10: acquire_resource: stream socket created here
cockpit-354/src/common/cockpitpipe.c:1187:6: branch_false: following ‘false’ branch (when ‘sock >= 0’)...
cockpit-354/src/common/cockpitpipe.c:1193:12: branch_false: ...to here
cockpit-354/src/common/cockpitpipe.c:1193:12: throw: if ‘g_unix_set_fd_nonblocking’ throws an exception...
cockpit-354/src/common/cockpitpipe.c:1193:12: danger: ‘sock’ leaks here
# 1191|     else
# 1192|       {
# 1193|->       if (!g_unix_set_fd_nonblocking (sock, TRUE, NULL))
# 1194|           {
# 1195|             close (sock);

Error: GCC_ANALYZER_WARNING (CWE-775): [#def24]
cockpit-354/src/common/cockpitpipe.c:1277:5: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘r’
cockpit-354/src/common/cockpitpipe.c:1266:1: enter_function: entry to ‘spawn_setup’
cockpit-354/src/common/cockpitpipe.c:1275:6: branch_true: following ‘true’ branch...
cockpit-354/src/common/cockpitpipe.c:1276:13: branch_true: ...to here
cockpit-354/src/common/cockpitpipe.c:1276:13: acquire_resource: opened here
cockpit-354/src/common/cockpitpipe.c:1277:5: branch_false: following ‘false’ branch (when ‘r != 2’)...
 branch_false: ...to here
 call_function: calling ‘spawn_setup’ from ‘spawn_setup’
# 1275|     if (flags & COCKPIT_PIPE_STDERR_TO_STDOUT) {
# 1276|       int r = dup2 (1, 2);
# 1277|->     g_assert (r == 2); /* that should really never fail */
# 1278|     }
# 1279|   }

Error: GCC_ANALYZER_WARNING (CWE-775): [#def25]
cockpit-354/src/common/cockpitpipe.c:1279:1: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘r’
cockpit-354/src/common/cockpitpipe.c:1275:6: branch_true: following ‘true’ branch...
cockpit-354/src/common/cockpitpipe.c:1276:13: branch_true: ...to here
cockpit-354/src/common/cockpitpipe.c:1276:13: acquire_resource: opened here
cockpit-354/src/common/cockpitpipe.c:1277:5: branch_true: following ‘true’ branch (when ‘r == 2’)...
cockpit-354/src/common/cockpitpipe.c:1279:1: branch_true: ...to here
cockpit-354/src/common/cockpitpipe.c:1279:1: danger: ‘r’ leaks here; was opened at [(3)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/2)
# 1277|       g_assert (r == 2); /* that should really never fail */
# 1278|     }
# 1279|-> }
# 1280|   
# 1281|   /**

Error: COMPILER_WARNING (CWE-704): [#def26]
cockpit-354/src/common/cockpitpipe.c: scope_hint: In function ‘environ_find’
cockpit-354/src/common/cockpitpipe.c:1716:7: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
# 1716 |   pos = strchr (variable, '=');
#      |       ^
# 1714|     gchar *pos;
# 1715|   
# 1716|->   pos = strchr (variable, '=');
# 1717|     if (pos == NULL)
# 1718|       len = strlen (variable);

Error: COMPILER_WARNING (CWE-704): [#def27]
cockpit-354/src/common/cockpitpipe.c:1716:7: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
# 1714|     gchar *pos;
# 1715|   
# 1716|->   pos = strchr (variable, '=');
# 1717|     if (pos == NULL)
# 1718|       len = strlen (variable);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def28]
cockpit-354/src/common/cockpitpipe.h:35:1: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘pipe’
cockpit-354/src/ws/main.c:140:6: branch_false: following ‘false’ branch...
cockpit-354/src/ws/main.c:144:7: branch_false: ...to here
cockpit-354/src/ws/main.c:150:6: branch_false: following ‘false’ branch...
cockpit-354/src/ws/main.c:157:6: branch_false: ...to here
cockpit-354/src/ws/main.c:220:10: branch_false: following ‘false’ branch...
cockpit-354/src/ws/main.c:227:7: branch_false: ...to here
cockpit-354/src/ws/main.c:262:6: branch_true: following ‘true’ branch...
cockpit-354/src/ws/main.c:267:11: branch_true: ...to here
cockpit-354/src/ws/main.c:283:13: throw: if ‘getpwuid’ throws an exception...
cockpit-354/src/ws/main.c:264:30: call_function: inlined call to ‘glib_autoptr_cleanup_CockpitPipe’ from ‘main’
#   33|   
#   34|   #define COCKPIT_TYPE_PIPE         (cockpit_pipe_get_type ())
#   35|-> G_DECLARE_DERIVABLE_TYPE(CockpitPipe, cockpit_pipe, COCKPIT, PIPE, GObject)
#   36|   
#   37|   struct _CockpitPipeClass {

Error: GCC_ANALYZER_WARNING (CWE-404): [#def29]
cockpit-354/src/common/cockpittransport.c:478:12: warning[-Wanalyzer-va-list-leak]: missing call to ‘va_end’
cockpit-354/src/common/cockpittransport.c:506:1: enter_function: entry to ‘cockpit_transport_build_control’
cockpit-354/src/common/cockpittransport.c:513:3: acquire_resource: ‘va_start’ called here
cockpit-354/src/common/cockpittransport.c:514:12: call_function: calling ‘build_json_va’ from ‘cockpit_transport_build_control’
#  476|     const gchar *value;
#  477|   
#  478|->   object = json_object_new ();
#  479|   
#  480|     while (name)

Error: GCC_ANALYZER_WARNING (CWE-404): [#def30]
cockpit-354/src/common/cockpittransport.c:484:9: warning[-Wanalyzer-va-list-leak]: missing call to ‘va_end’
cockpit-354/src/common/cockpittransport.c:506:1: enter_function: entry to ‘cockpit_transport_build_control’
cockpit-354/src/common/cockpittransport.c:513:3: acquire_resource: ‘va_start’ called here
cockpit-354/src/common/cockpittransport.c:514:12: call_function: calling ‘build_json_va’ from ‘cockpit_transport_build_control’
#  482|         value = va_arg (va, const gchar *);
#  483|         if (value)
#  484|->         json_object_set_string_member (object, name, value);
#  485|         name = va_arg (va, const gchar *);
#  486|       }

Error: COMPILER_WARNING (CWE-704): [#def31]
cockpit-354/src/common/cockpitwebserver.c: scope_hint: In function ‘cockpit_web_server_parse_accept_list’
cockpit-354/src/common/cockpitwebserver.c:529:12: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
#  529 |       next = strchr (accept, ',');
#      |            ^
#  527|     while (accept)
#  528|       {
#  529|->       next = strchr (accept, ',');
#  530|         if (next)
#  531|           {

Error: COMPILER_WARNING (CWE-704): [#def32]
cockpit-354/src/common/cockpitwebserver.c:529:12: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
#  527|     while (accept)
#  528|       {
#  529|->       next = strchr (accept, ',');
#  530|         if (next)
#  531|           {

Error: COMPILER_WARNING (CWE-704): [#def33]
cockpit-354/src/common/cockpitwebserver.c:539:11: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
#  539 |       pos = strchr (accept, ';');
#      |           ^
#  537|         lang->qvalue = 1;
#  538|   
#  539|->       pos = strchr (accept, ';');
#  540|         if (pos)
#  541|           {

Error: COMPILER_WARNING (CWE-704): [#def34]
cockpit-354/src/common/cockpitwebserver.c:539:11: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
#  537|         lang->qvalue = 1;
#  538|   
#  539|->       pos = strchr (accept, ';');
#  540|         if (pos)
#  541|           {

Error: COMPILER_WARNING (CWE-704): [#def35]
cockpit-354/src/common/cockpitwebserver.c:576:15: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
#  576 |           pos = strchr (lang->value, '-');
#      |               ^
#  574|         if (lang->qvalue > 0)
#  575|           {
#  576|->           pos = strchr (lang->value, '-');
#  577|             if (pos)
#  578|               {

Error: COMPILER_WARNING (CWE-704): [#def36]
cockpit-354/src/common/cockpitwebserver.c:576:15: warning[-Wdiscarded-qualifiers]: assignment discards ‘const’ qualifier from pointer target type
#  574|         if (lang->qvalue > 0)
#  575|           {
#  576|->           pos = strchr (lang->value, '-');
#  577|             if (pos)
#  578|               {

Error: GCC_ANALYZER_WARNING (CWE-457): [#def37]
cockpit-354/src/common/cockpitwebserver.h:80:1: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘server’
cockpit-354/src/ws/main.c:140:6: branch_false: following ‘false’ branch...
cockpit-354/src/ws/main.c:144:7: branch_false: ...to here
cockpit-354/src/ws/main.c:150:6: branch_false: following ‘false’ branch...
cockpit-354/src/ws/main.c:157:6: branch_false: ...to here
cockpit-354/src/ws/main.c:206:29: throw: if ‘sd_listen_fds’ throws an exception...
cockpit-354/src/ws/main.c:124:31: call_function: inlined call to ‘glib_autoptr_cleanup_CockpitWebServer’ from ‘main’
#   78|   
#   79|   #define COCKPIT_TYPE_WEB_SERVER  (cockpit_web_server_get_type ())
#   80|-> G_DECLARE_FINAL_TYPE(CockpitWebServer, cockpit_web_server, COCKPIT, WEB_SERVER, GObject)
#   81|   
#   82|   extern guint cockpit_webserver_request_timeout;

Error: GCC_ANALYZER_WARNING (CWE-404): [#def38]
cockpit-354/src/pam-ssh-add/pam-ssh-add.c:143:7: warning[-Wanalyzer-va-list-leak]: missing call to ‘va_end’
cockpit-354/src/pam-ssh-add/pam-ssh-add.c:844:1: enter_function: entry to ‘start_agent’
cockpit-354/src/pam-ssh-add/pam-ssh-add.c:852:13: call_function: calling ‘pam_ssh_add_start_agent’ from ‘start_agent’
#  141|     if (!strchr (format, '%'))
#  142|       {
#  143|->       pam_ssh_add_log_handler (level, format);
#  144|         return;
#  145|       }

Error: GCC_ANALYZER_WARNING (CWE-404): [#def39]
cockpit-354/src/pam-ssh-add/pam-ssh-add.c:152:5: warning[-Wanalyzer-va-list-leak]: missing call to ‘va_end’
cockpit-354/src/pam-ssh-add/pam-ssh-add.c:844:1: enter_function: entry to ‘start_agent’
cockpit-354/src/pam-ssh-add/pam-ssh-add.c:852:13: call_function: calling ‘pam_ssh_add_start_agent’ from ‘start_agent’
#  150|   
#  151|     if (res > 0)
#  152|->     pam_ssh_add_log_handler (level, data);
#  153|   
#  154|     if (res >= 0)

Error: GCC_ANALYZER_WARNING (CWE-401): [#def40]
cockpit-354/src/pam-ssh-add/pam-ssh-add.c:831:7: warning[-Wanalyzer-malloc-leak]: leak of ‘strdupx(password)’
/usr/include/security/pam_modules.h:34:5: enter_function: entry to ‘pam_sm_authenticate’
cockpit-354/src/pam-ssh-add/pam-ssh-add.c:1019:6: branch_true: following ‘true’ branch...
cockpit-354/src/pam-ssh-add/pam-ssh-add.c:1020:5: branch_true: ...to here
cockpit-354/src/pam-ssh-add/pam-ssh-add.c:1020:5: call_function: calling ‘stash_password_for_session’ from ‘pam_sm_authenticate’
#  829|   {
#  830|     char *password_copy = strdupx (password);
#  831|->   if (pam_set_data (pamh, STORED_AUTHTOK, password_copy,
#  832|                       cleanup_free_password) != PAM_SUCCESS)
#  833|       {

Error: GCC_ANALYZER_WARNING (CWE-775): [#def41]
cockpit-354/src/session/client-certificate.c:55:13: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open_proc_pid(pid)’
cockpit-354/src/session/client-certificate.c:178:1: enter_function: entry to ‘get_ws_proc_fd’
cockpit-354/src/session/client-certificate.c:184:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/client-certificate.c:196:7: branch_false: ...to here
cockpit-354/src/session/client-certificate.c:196:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/client-certificate.c:200:15: branch_false: ...to here
cockpit-354/src/session/client-certificate.c:201:6: branch_false: following ‘false’ branch (when ‘pid >= 0’)...
cockpit-354/src/session/client-certificate.c:210:23: branch_false: ...to here
cockpit-354/src/session/client-certificate.c:210:23: call_function: calling ‘open_proc_pid’ from ‘get_ws_proc_fd’
cockpit-354/src/session/client-certificate.c:210:23: return_function: returning to ‘get_ws_proc_fd’ from ‘open_proc_pid’
cockpit-354/src/session/client-certificate.c:55:13: danger: ‘open_proc_pid(pid)’ leaks here; was opened at [(12)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/11)
#   53|   {
#   54|       char path[100];
#   55|->     int r = snprintf (path, sizeof path, "/proc/%lu", (unsigned long) pid);
#   56|       if (r < 0 || r >= sizeof path)
#   57|           errx (EX, "memory error");

Error: GCC_ANALYZER_WARNING (CWE-775): [#def42]
cockpit-354/src/session/client-certificate.c:55:13: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open_proc_pid(ucred.pid)’
cockpit-354/src/session/client-certificate.c:137:1: enter_function: entry to ‘get_ws_proc_fd_pid_time’
cockpit-354/src/session/client-certificate.c:141:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/client-certificate.c:143:7: branch_false: ...to here
cockpit-354/src/session/client-certificate.c:141:7: branch_false: following ‘false’ branch...
cockpit-354/src/session/client-certificate.c:151:23: branch_false: ...to here
cockpit-354/src/session/client-certificate.c:151:23: call_function: calling ‘open_proc_pid’ from ‘get_ws_proc_fd_pid_time’
cockpit-354/src/session/client-certificate.c:151:23: return_function: returning to ‘get_ws_proc_fd_pid_time’ from ‘open_proc_pid’
cockpit-354/src/session/client-certificate.c:152:38: call_function: calling ‘get_proc_pid_start_time’ from ‘get_ws_proc_fd_pid_time’
#   53|   {
#   54|       char path[100];
#   55|->     int r = snprintf (path, sizeof path, "/proc/%lu", (unsigned long) pid);
#   56|       if (r < 0 || r >= sizeof path)
#   57|           errx (EX, "memory error");

Error: GCC_ANALYZER_WARNING (CWE-775): [#def43]
cockpit-354/src/session/client-certificate.c:280:12: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/run/cockpit/tls/clients", 2293760)’
cockpit-354/src/session/client-certificate.c:267:6: branch_true: following ‘true’ branch...
cockpit-354/src/session/client-certificate.c:273:11: branch_true: ...to here
cockpit-354/src/session/client-certificate.c:273:11: acquire_resource: opened here
cockpit-354/src/session/client-certificate.c:274:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/client-certificate.c:280:12: branch_false: ...to here
cockpit-354/src/session/client-certificate.c:280:12: throw: if ‘openat’ throws an exception...
cockpit-354/src/session/client-certificate.c:280:12: danger: ‘open("/run/cockpit/tls/clients", 2293760)’ leaks here; was opened at [(3)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/2)
#  278|       }
#  279|   
#  280|->   filefd = openat (dirfd, filename, O_RDONLY | O_NOFOLLOW);
#  281|     if (filefd == -1)
#  282|       {

Error: GCC_ANALYZER_WARNING (CWE-775): [#def44]
cockpit-354/src/session/session-utils.c:222:40: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/var/log/lastlog", 2)’
cockpit-354/src/session/session-utils.c:215:8: acquire_resource: opened here
cockpit-354/src/session/session-utils.c:216:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:222:40: branch_false: ...to here
cockpit-354/src/session/session-utils.c:222:7: throw: if ‘pread’ throws an exception...
cockpit-354/src/session/session-utils.c:222:40: danger: ‘open("/var/log/lastlog", 2)’ leaks here; was opened at [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  220|       }
#  221|   
#  222|->   r = pread (fd, &entry, sizeof entry, uid * sizeof entry);
#  223|     if (r == sizeof entry && entry.ll_time != 0)
#  224|       {

Error: GCC_ANALYZER_WARNING (CWE-775): [#def45]
cockpit-354/src/session/session-utils.c:354:11: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/var/log/btmp", 524288)’
cockpit-354/src/session/session-utils.c:326:8: acquire_resource: opened here
cockpit-354/src/session/session-utils.c:327:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:327:6: branch_false: ...to here
cockpit-354/src/session/session-utils.c:349:10: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:352:10: branch_false: ...to here
cockpit-354/src/session/session-utils.c:354:11: throw: if ‘warn’ throws an exception...
cockpit-354/src/session/session-utils.c:354:11: danger: ‘open("/var/log/btmp", 524288)’ leaks here; was opened at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  352|         if (r < 0)
#  353|           {
#  354|->           warn ("read(%s) failed", _PATH_BTMP);
#  355|             goto out;
#  356|           }

Error: GCC_ANALYZER_WARNING (CWE-775): [#def46]
cockpit-354/src/session/session-utils.c:359:11: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/var/log/btmp", 524288)’
cockpit-354/src/session/session-utils.c:326:8: acquire_resource: opened here
cockpit-354/src/session/session-utils.c:327:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:327:6: branch_false: ...to here
cockpit-354/src/session/session-utils.c:349:10: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:352:10: branch_false: ...to here
cockpit-354/src/session/session-utils.c:352:10: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:357:10: branch_false: ...to here
cockpit-354/src/session/session-utils.c:359:11: throw: if ‘warnx’ throws an exception...
cockpit-354/src/session/session-utils.c:359:11: danger: ‘open("/var/log/btmp", 524288)’ leaks here; was opened at [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  357|         if (r != sizeof entry)
#  358|           {
#  359|->           warnx ("read(%s) returned partial result (%zu of %zu bytes)",
#  360|                    _PATH_BTMP, r, sizeof entry);
#  361|             goto out;

Error: GCC_ANALYZER_WARNING (CWE-775): [#def47]
cockpit-354/src/session/session-utils.c:364:11: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/var/log/btmp", 524288)’
cockpit-354/src/session/session-utils.c:326:8: acquire_resource: opened here
cockpit-354/src/session/session-utils.c:327:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:327:6: branch_false: ...to here
cockpit-354/src/session/session-utils.c:352:10: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:357:10: branch_false: ...to here
cockpit-354/src/session/session-utils.c:357:10: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:364:11: branch_false: ...to here
cockpit-354/src/session/session-utils.c:372:6: branch_false: following ‘false’ branch (when ‘fail_count != 0’)...
cockpit-354/src/session/session-utils.c:379:13: branch_false: ...to here
cockpit-354/src/session/session-utils.c:379:13: throw: if ‘cockpit_json_print_integer_property’ throws an exception...
cockpit-354/src/session/session-utils.c:364:11: danger: ‘open("/var/log/btmp", 524288)’ leaks here; was opened at [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
#  362|           }
#  363|   
#  364|->       if (entry.ut_tv.tv_sec > last_success &&
#  365|             strncmp (entry.ut_user, username, sizeof entry.ut_user) == 0)
#  366|           {

Error: GCC_ANALYZER_WARNING (CWE-775): [#def48]
cockpit-354/src/session/session-utils.c:385:6: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/var/log/btmp", 524288)’
cockpit-354/src/session/session-utils.c:326:8: acquire_resource: opened here
cockpit-354/src/session/session-utils.c:327:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:327:6: branch_false: ...to here
cockpit-354/src/session/session-utils.c:372:6: branch_true: following ‘true’ branch (when ‘fail_count == 0’)...
cockpit-354/src/session/session-utils.c:375:7: branch_true: ...to here
cockpit-354/src/session/session-utils.c:385:6: danger: ‘open("/var/log/btmp", 524288)’ leaks here; was opened at [(1)](sarif:/runs/0/results/9/codeFlows/0/threadFlows/0/locations/0)
#  383|   
#  384|   out:
#  385|->   if (fd > -1)
#  386|       close (fd);
#  387|   

Error: GCC_ANALYZER_WARNING (CWE-775): [#def49]
cockpit-354/src/session/session-utils.c:386:5: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/var/log/btmp", 524288)’
cockpit-354/src/session/session-utils.c:326:8: acquire_resource: opened here
cockpit-354/src/session/session-utils.c:327:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:327:6: branch_false: ...to here
cockpit-354/src/session/session-utils.c:372:6: branch_true: following ‘true’ branch (when ‘fail_count == 0’)...
cockpit-354/src/session/session-utils.c:375:7: branch_true: ...to here
cockpit-354/src/session/session-utils.c:385:6: branch_true: following ‘true’ branch...
cockpit-354/src/session/session-utils.c:386:5: branch_true: ...to here
cockpit-354/src/session/session-utils.c:386:5: danger: ‘open("/var/log/btmp", 524288)’ leaks here; was opened at [(1)](sarif:/runs/0/results/10/codeFlows/0/threadFlows/0/locations/0)
#  384|   out:
#  385|     if (fd > -1)
#  386|->     close (fd);
#  387|   
#  388|     return success;

Error: GCC_ANALYZER_WARNING (CWE-775): [#def50]
cockpit-354/src/session/session-utils.c:479:15: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/var/log/btmp", 1025)’
cockpit-354/src/session/session-utils.c:472:12: acquire_resource: opened here
cockpit-354/src/session/session-utils.c:473:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:479:15: branch_false: ...to here
cockpit-354/src/session/session-utils.c:479:15: throw: if ‘write’ throws an exception...
cockpit-354/src/session/session-utils.c:479:15: danger: ‘open("/var/log/btmp", 1025)’ leaks here; was opened at [(3)](sarif:/runs/0/results/11/codeFlows/0/threadFlows/0/locations/2)
#  477|       }
#  478|   
#  479|->   ssize_t r = write (fd, &entry, sizeof entry);
#  480|     if (r < 0)
#  481|       {

Error: GCC_ANALYZER_WARNING (CWE-775): [#def51]
cockpit-354/src/session/session-utils.c:482:7: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/var/log/btmp", 1025)’
cockpit-354/src/session/session-utils.c:472:12: acquire_resource: opened here
cockpit-354/src/session/session-utils.c:473:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:479:15: branch_false: ...to here
cockpit-354/src/session/session-utils.c:480:6: branch_true: following ‘true’ branch...
cockpit-354/src/session/session-utils.c:482:7: branch_true: ...to here
cockpit-354/src/session/session-utils.c:482:7: throw: if ‘warn’ throws an exception...
cockpit-354/src/session/session-utils.c:482:7: danger: ‘open("/var/log/btmp", 1025)’ leaks here; was opened at [(3)](sarif:/runs/0/results/12/codeFlows/0/threadFlows/0/locations/2)
#  480|     if (r < 0)
#  481|       {
#  482|->       warn ("write() %s failed", _PATH_BTMP);
#  483|         goto out;
#  484|       }

Error: GCC_ANALYZER_WARNING (CWE-775): [#def52]
cockpit-354/src/session/session-utils.c:487:7: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/var/log/btmp", 1025)’
cockpit-354/src/session/session-utils.c:472:12: acquire_resource: opened here
cockpit-354/src/session/session-utils.c:473:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:479:15: branch_false: ...to here
cockpit-354/src/session/session-utils.c:480:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:485:11: branch_false: ...to here
cockpit-354/src/session/session-utils.c:485:11: branch_true: following ‘true’ branch...
cockpit-354/src/session/session-utils.c:487:7: branch_true: ...to here
cockpit-354/src/session/session-utils.c:487:7: throw: if ‘warnx’ throws an exception...
cockpit-354/src/session/session-utils.c:487:7: danger: ‘open("/var/log/btmp", 1025)’ leaks here; was opened at [(3)](sarif:/runs/0/results/13/codeFlows/0/threadFlows/0/locations/2)
#  485|     else if (r != sizeof entry)
#  486|       {
#  487|->       warnx ("incomplete write() %s: %zu of %zu bytes",
#  488|                _PATH_BTMP, r, sizeof entry);
#  489|         goto out;

Error: GCC_ANALYZER_WARNING (CWE-775): [#def53]
cockpit-354/src/session/session-utils.c:494:5: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/var/log/btmp", 1025)’
cockpit-354/src/session/session-utils.c:472:12: acquire_resource: opened here
cockpit-354/src/session/session-utils.c:473:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:479:15: branch_false: ...to here
cockpit-354/src/session/session-utils.c:493:6: branch_true: following ‘true’ branch...
cockpit-354/src/session/session-utils.c:494:5: branch_true: ...to here
cockpit-354/src/session/session-utils.c:494:5: danger: ‘open("/var/log/btmp", 1025)’ leaks here; was opened at [(3)](sarif:/runs/0/results/14/codeFlows/0/threadFlows/0/locations/2)
#  492|   out:
#  493|     if (fd != -1)
#  494|->     close (fd);
#  495|   }
#  496|   

Error: GCC_ANALYZER_WARNING (CWE-775): [#def54]
cockpit-354/src/session/session-utils.c:571:10: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘dup2(*<unknown>,  i)’
cockpit-354/src/session/session-utils.c:545:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/session-utils.c:548:14: branch_false: ...to here
cockpit-354/src/session/session-utils.c:569:19: branch_true: following ‘true’ branch (when ‘i < n_remap_fds’)...
cockpit-354/src/session/session-utils.c:570:12: branch_true: ...to here
cockpit-354/src/session/session-utils.c:570:8: branch_true: following ‘true’ branch...
cockpit-354/src/session/session-utils.c:571:11: branch_true: ...to here
cockpit-354/src/session/session-utils.c:571:11: acquire_resource: opened here
cockpit-354/src/session/session-utils.c:571:10: danger: ‘dup2(*<unknown>,  i)’ leaks here; was opened at [(7)](sarif:/runs/0/results/15/codeFlows/0/threadFlows/0/locations/6)
#  569|     for (int i = 0; i < n_remap_fds; i++)
#  570|       if (fds[i] != -1) /* no-op */
#  571|->       if (dup2 (fds[i], i) != i)
#  572|           abort_with_message ("dup2(%d, %d) failed: %m", fds[i], i);
#  573|   

Error: GCC_ANALYZER_WARNING (CWE-775): [#def55]
cockpit-354/src/session/session.c:871:71: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘open("/dev/null", 0)’
cockpit-354/src/session/session.c:862:3: branch_true: following ‘true’ branch...
cockpit-354/src/session/session.c:864:17: branch_true: ...to here
cockpit-354/src/session/session.c:864:17: acquire_resource: opened here
cockpit-354/src/session/session.c:865:6: branch_false: following ‘false’ branch...
cockpit-354/src/session/session.c:868:13: branch_false: ...to here
cockpit-354/src/session/session.c:871:13: throw: if ‘spawn_and_wait’ throws an exception...
cockpit-354/src/session/session.c:871:71: danger: ‘open("/dev/null", 0)’ leaks here; was opened at [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  869|     int wstatus;
#  870|   
#  871|->   wstatus = spawn_and_wait (argv, envp, remap_fds, 3, pwd->pw_uid, pwd->pw_gid);
#  872|     debug ("user_has_valid_login_shell: exited with status %x", wstatus);
#  873|     close (devnull);

Error: COMPILER_WARNING (CWE-704): [#def56]
cockpit-354/src/tls/cockpit-certificate-ensure.c: scope_hint: In function ‘certificate_and_key_split’
cockpit-354/src/tls/cockpit-certificate-ensure.c:251:21: warning[-Wdiscarded-qualifiers]: initialization discards ‘const’ qualifier from pointer target type
#  251 |       char *start = strstr ((const char *) self->certificate.data, pairs[i][0]);
#      |                     ^~~~~~
#  249|     for (int i = 0; i < N_ELEMENTS (pairs); i++)
#  250|       {
#  251|->       char *start = strstr ((const char *) self->certificate.data, pairs[i][0]);
#  252|   
#  253|         if (!start)

Error: COMPILER_WARNING (CWE-704): [#def57]
cockpit-354/src/tls/cockpit-certificate-ensure.c:251:21: warning[-Wdiscarded-qualifiers]: initialization discards ‘const’ qualifier from pointer target type
#  249|     for (int i = 0; i < N_ELEMENTS (pairs); i++)
#  250|       {
#  251|->       char *start = strstr ((const char *) self->certificate.data, pairs[i][0]);
#  252|   
#  253|         if (!start)

Error: COMPILER_WARNING (CWE-704): [#def58]
cockpit-354/src/tls/cockpit-certificate-ensure.c:256:19: warning[-Wdiscarded-qualifiers]: initialization discards ‘const’ qualifier from pointer target type
#  256 |       char *end = strstr ((const char *) self->certificate.data, pairs[i][1]);
#      |                   ^~~~~~
#  254|           continue;
#  255|   
#  256|->       char *end = strstr ((const char *) self->certificate.data, pairs[i][1]);
#  257|         if (!end)
#  258|           errx (EXIT_FAILURE, "%s: found '%s' but not '%s'",

Error: COMPILER_WARNING (CWE-704): [#def59]
cockpit-354/src/tls/cockpit-certificate-ensure.c:256:19: warning[-Wdiscarded-qualifiers]: initialization discards ‘const’ qualifier from pointer target type
#  254|           continue;
#  255|   
#  256|->       char *end = strstr ((const char *) self->certificate.data, pairs[i][1]);
#  257|         if (!end)
#  258|           errx (EXIT_FAILURE, "%s: found '%s' but not '%s'",

Error: GCC_ANALYZER_WARNING (CWE-775): [#def60]
cockpit-354/src/tls/connection.c:398:7: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘fd’
cockpit-354/src/tls/connection.c:390:8: acquire_resource: socket created here
cockpit-354/src/tls/connection.c:391:6: branch_false: following ‘false’ branch (when ‘fd != -1’)...
cockpit-354/src/tls/connection.c:398:7: branch_false: ...to here
cockpit-354/src/tls/connection.c:398:7: throw: if ‘af_unix_connectat’ throws an exception...
cockpit-354/src/tls/connection.c:398:7: danger: ‘fd’ leaks here
#  396|   
#  397|     debug (CONNECTION, "  -> connecting to https-factory.sock");
#  398|->   if (af_unix_connectat (fd, parameters.wsinstance_sockdir, "https-factory.sock") != 0)
#  399|       {
#  400|         warn ("connect(https-factory.sock) failed");

Error: GCC_ANALYZER_WARNING (CWE-775): [#def61]
cockpit-354/src/tls/server.c:243:9: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘server.first_listener’
cockpit-354/src/tls/server.c:201:3: branch_false: following ‘false’ branch...
cockpit-354/src/tls/server.c:202:3: branch_false: ...to here
cockpit-354/src/tls/server.c:229:10: branch_false: following ‘false’ branch...
cockpit-354/src/tls/server.c:231:7: branch_false: ...to here
cockpit-354/src/tls/server.c:238:10: branch_false: following ‘false’ branch...
cockpit-354/src/tls/server.c:240:11: branch_false: ...to here
cockpit-354/src/tls/server.c:240:10: branch_false: following ‘false’ branch...
cockpit-354/src/tls/server.c:242:11: branch_false: ...to here
cockpit-354/src/tls/server.c:242:10: branch_true: following ‘true’ branch...
cockpit-354/src/tls/server.c:243:9: branch_true: ...to here
cockpit-354/src/tls/server.c:243:9: danger: ‘server.first_listener’ leaks here
#  241|           err (EXIT_FAILURE, "failed to bind to port %hu", port);
#  242|         if (listen (server.first_listener, 1024) < 0)
#  243|->         err (EXIT_FAILURE, "failed to listen to server port");
#  244|         debug (SERVER, "Server ready. Listening on port %hu, fd %i", port, server.first_listener);
#  245|       }

Error: GCC_ANALYZER_WARNING (CWE-775): [#def62]
cockpit-354/src/tls/server.c:248:20: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘server.first_listener’
cockpit-354/src/tls/server.c:201:3: branch_false: following ‘false’ branch...
cockpit-354/src/tls/server.c:202:3: branch_false: ...to here
cockpit-354/src/tls/server.c:229:10: branch_false: following ‘false’ branch...
cockpit-354/src/tls/server.c:231:7: branch_false: ...to here
cockpit-354/src/tls/server.c:238:10: branch_false: following ‘false’ branch...
cockpit-354/src/tls/server.c:240:11: branch_false: ...to here
cockpit-354/src/tls/server.c:240:10: branch_false: following ‘false’ branch...
cockpit-354/src/tls/server.c:242:11: branch_false: ...to here
cockpit-354/src/tls/server.c:242:10: branch_false: following ‘false’ branch...
cockpit-354/src/tls/server.c:273:1: branch_false: ...to here
cockpit-354/src/tls/server.c:248:20: danger: ‘server.first_listener’ leaks here
#  246|   
#  247|     /* epoll the listening fds */
#  248|->   server.epollfd = epoll_create1 (EPOLL_CLOEXEC);
#  249|     if (server.epollfd < 0)
#  250|       err (EXIT_FAILURE, "Failed to create epoll fd");

Error: GCC_ANALYZER_WARNING (CWE-775): [#def63]
cockpit-354/src/ws/cockpitauth.c:464:6: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘dup2(*(ChildData *)data.io, 0)’
cockpit-354/src/ws/cockpitauth.c:464:7: acquire_resource: opened here
cockpit-354/src/ws/cockpitauth.c:464:6: danger: ‘dup2(*(ChildData *)data.io, 0)’ leaks here; was opened at [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
#  462|     ChildData *child = data;
#  463|   
#  464|->   if (dup2 (child->io, 0) < 0 || dup2 (child->io, 1) < 0)
#  465|       {
#  466|         g_printerr ("couldn't set child stdin/stout file descriptors\n");

Error: GCC_ANALYZER_WARNING (CWE-775): [#def64]
cockpit-354/src/ws/cockpitauth.c:464:7: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘dup2(*(ChildData *)data.io, 1)’
cockpit-354/src/ws/cockpitauth.c:464:6: branch_false: following ‘false’ branch...
cockpit-354/src/ws/cockpitauth.c:464:34: branch_false: ...to here
cockpit-354/src/ws/cockpitauth.c:464:34: acquire_resource: opened here
cockpit-354/src/ws/cockpitauth.c:464:7: danger: ‘dup2(*(ChildData *)data.io, 1)’ leaks here; was opened at [(3)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/2)
#  462|     ChildData *child = data;
#  463|   
#  464|->   if (dup2 (child->io, 0) < 0 || dup2 (child->io, 1) < 0)
#  465|       {
#  466|         g_printerr ("couldn't set child stdin/stout file descriptors\n");

Error: GCC_ANALYZER_WARNING (CWE-404): [#def65]
cockpit-354/src/ws/cockpitcreds.c:112:9: warning[-Wanalyzer-va-list-leak]: missing call to ‘va_end’
cockpit-354/src/ws/cockpitcreds.c:88:3: branch_true: following ‘true’ branch (when ‘application’ is non-NULL)...
cockpit-354/src/ws/cockpitcreds.c:89:3: branch_true: ...to here
cockpit-354/src/ws/cockpitcreds.c:89:3: branch_true: following ‘true’ branch...
cockpit-354/src/ws/cockpitcreds.c:91:11: branch_true: ...to here
cockpit-354/src/ws/cockpitcreds.c:95:3: acquire_resource: ‘va_start’ called here
cockpit-354/src/ws/cockpitcreds.c:99:10: branch_false: following ‘false’ branch (when ‘type’ is non-NULL)...
cockpit-354/src/ws/cockpitcreds.c:101:16: branch_false: ...to here
cockpit-354/src/ws/cockpitcreds.c:105:15: branch_false: following ‘false’ branch (when the strings are non-equal)...
cockpit-354/src/ws/cockpitcreds.c:107:16: branch_false: ...to here
cockpit-354/src/ws/cockpitcreds.c:107:15: branch_false: following ‘false’ branch (when the strings are non-equal)...
cockpit-354/src/ws/cockpitcreds.c:109:16: branch_false: ...to here
cockpit-354/src/ws/cockpitcreds.c:109:15: branch_false: following ‘false’ branch (when the strings are non-equal)...
cockpit-354/src/ws/cockpitcreds.c:112:9: branch_false: ...to here
cockpit-354/src/ws/cockpitcreds.c:112:9: throw: if ‘g_assertion_message_expr’ throws an exception...
cockpit-354/src/ws/cockpitcreds.c:112:9: danger: missing call to ‘va_end’ to match ‘va_start’ at [(5)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/4)
#  110|           creds->superuser = g_strdup (va_arg (va, const char *));
#  111|         else
#  112|->         g_assert_not_reached ();
#  113|       }
#  114|     va_end (va);

Error: GCC_ANALYZER_WARNING (CWE-404): [#def66]
cockpit-354/src/ws/cockpitcreds.c:163:7: warning[-Wanalyzer-va-list-leak]: missing call to ‘va_end’
cockpit-354/src/ws/cockpitcreds.c:80:1: enter_function: entry to ‘cockpit_creds_new’
cockpit-354/src/ws/cockpitcreds.c:88:3: branch_true: following ‘true’ branch (when ‘application’ is non-NULL)...
cockpit-354/src/ws/cockpitcreds.c:89:3: branch_true: ...to here
cockpit-354/src/ws/cockpitcreds.c:89:3: branch_true: following ‘true’ branch...
cockpit-354/src/ws/cockpitcreds.c:91:11: branch_true: ...to here
cockpit-354/src/ws/cockpitcreds.c:95:3: acquire_resource: ‘va_start’ called here
cockpit-354/src/ws/cockpitcreds.c:99:10: branch_false: following ‘false’ branch (when ‘type’ is non-NULL)...
cockpit-354/src/ws/cockpitcreds.c:101:16: branch_false: ...to here
cockpit-354/src/ws/cockpitcreds.c:101:15: branch_true: following ‘true’ branch (when the strings are equal)...
cockpit-354/src/ws/cockpitcreds.c:102:40: branch_true: ...to here
cockpit-354/src/ws/cockpitcreds.c:102:9: call_function: calling ‘cockpit_creds_set_user’ from ‘cockpit_creds_new’
#  161|     if (user != creds->user)
#  162|       {
#  163|->       g_free (creds->user);
#  164|         creds->user = g_strdup (user);
#  165|       }

Scan Properties

analyzer-version-clippy1.92.0
analyzer-version-cppcheck2.19.1
analyzer-version-gcc16.0.0
analyzer-version-gcc-analyzer16.0.0
analyzer-version-shellcheck0.11.0
analyzer-version-unicontrol0.0.2
enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
exit-code0
hostip-172-16-1-160.us-west-2.compute.internal
known-false-positives/usr/share/csmock/known-false-positives.js
known-false-positives-rpmknown-false-positives-0.0.0.20250521.132812.g8eff701.main-1.el9.noarch
mock-configfedora-rawhide-x86_64
project-namecockpit-354-1.fc44
store-results-to/tmp/tmpkm6w1tk3/cockpit-354-1.fc44.tar.xz
time-created2026-01-08 15:42:28
time-finished2026-01-08 15:45:17
toolcsmock
tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,cppcheck,clippy,shellcheck,unicontrol' '-o' '/tmp/tmpkm6w1tk3/cockpit-354-1.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpkm6w1tk3/cockpit-354-1.fc44.src.rpm'
tool-versioncsmock-3.8.3.20251215.161544.g62de9a5-1.el9