Error: GCC_ANALYZER_WARNING (CWE-688): [#def1] krb5-1.21.3/src/kdc/rtest.c:88:5: warning[-Wanalyzer-null-argument]: use of NULL ‘otrans.data’ where non-null expected krb5-1.21.3/src/kdc/rtest.c:67:8: branch_false: following ‘false’ branch (when ‘argc > 3’)... krb5-1.21.3/src/kdc/rtest.c:74:12: branch_false: ...to here krb5-1.21.3/src/kdc/rtest.c:75:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/kdc/rtest.c:80:5: branch_false: ...to here krb5-1.21.3/src/kdc/rtest.c:81:5: release_memory: ‘ntrans.data’ is NULL krb5-1.21.3/src/kdc/rtest.c:84:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/kdc/rtest.c:84:8: branch_false: ...to here krb5-1.21.3/src/kdc/rtest.c:88:12: release_memory: ‘otrans.data’ is NULL krb5-1.21.3/src/kdc/rtest.c:88:5: danger: argument 1 (‘otrans.data’) NULL where non-null expected # 86| else # 87| otrans.data = 0; # 88|-> memcpy(otrans.data,argv[1], otrans.length); # 89| # 90| tgs = make_princ(ctx, argv[2], argv[0]); Error: CPPCHECK_WARNING (CWE-457): [#def2] krb5-1.21.3/src/lib/krb5/krb/fast.c:192: warning[uninitvar]: Uninitialized variable: value # 190| } # 191| # 192|-> return retval ? FALSE : value; # 193| # 194| } Error: GCC_ANALYZER_WARNING (CWE-401): [#def3] krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:142:18: warning[-Wanalyzer-malloc-leak]: leak of ‘def_rhost’ krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:39:1: enter_function: entry to ‘krb5_fwd_tgt_creds’ krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:61:8: branch_true: following ‘true’ branch (when ‘cc’ is NULL)... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:62:23: branch_true: ...to here krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:62:12: branch_false: following ‘false’ branch... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:64:9: branch_false: ...to here krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:67:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:69:9: branch_false: ...to here krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:69:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:73:15: branch_false: ...to here krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:73:15: branch_false: following ‘false’ branch (when ‘server’ is NULL)... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:96:19: branch_false: ...to here krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:96:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:99:55: branch_false: ...to here krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:101:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:105:5: branch_false: ...to here krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:109:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:113:54: branch_false: ...to here krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:113:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:118:10: branch_false: ...to here krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:118:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:123:9: branch_false: ...to here krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:123:8: branch_true: following ‘true’ branch... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:124:12: branch_true: following ‘true’ branch (when ‘rhost’ is NULL)... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:125:17: branch_true: ...to here krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:125:16: branch_false: following ‘false’ branch... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:130:17: branch_false: ...to here krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:130:16: branch_false: following ‘false’ branch... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:135:57: branch_false: ...to here krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:135:25: call_function: calling ‘k5memdup0’ from ‘krb5_fwd_tgt_creds’ krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:135:25: return_function: returning to ‘krb5_fwd_tgt_creds’ from ‘k5memdup0’ krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:137:16: branch_false: following ‘false’ branch... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:142:18: branch_false: ...to here krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:142:18: throw: if ‘k5_os_hostaddr’ throws an exception... krb5-1.21.3/src/lib/krb5/krb/fwd_tgt.c:142:18: danger: ‘def_rhost’ leaks here; was allocated at [(35)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/34) # 140| } # 141| # 142|-> retval = k5_os_hostaddr(context, rhost, &addrs); # 143| if (retval) # 144| goto errout; Error: GCC_ANALYZER_WARNING (CWE-401): [#def4] krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:256:9: warning[-Wanalyzer-malloc-leak]: leak of ‘ealloc((long unsigned int)nstrings * 4) + (long unsigned int)i * 4’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:385:1: enter_function: entry to ‘test_get_principal’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:399:10: call_function: calling ‘request_for_us’ from ‘test_get_principal’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:399:10: return_function: returning to ‘test_get_principal’ from ‘request_for_us’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:399:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:402:5: branch_false: ...to here krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:402:5: call_function: inlined call to ‘check’ from ‘test_get_principal’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:405:13: branch_false: ...to here krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:405:13: call_function: calling ‘get_string’ from ‘test_get_principal’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:405:13: return_function: returning to ‘test_get_principal’ from ‘get_string’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:406:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:439:9: branch_false: ...to here krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:439:9: call_function: inlined call to ‘check’ from ‘test_get_principal’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:440:9: branch_false: ...to here krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:446:8: branch_false: following ‘false’ branch (when ‘ret != -1429577725’)... krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:450:5: branch_false: ...to here krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:454:11: call_function: calling ‘ealloc’ from ‘test_get_principal’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:454:11: return_function: returning to ‘test_get_principal’ from ‘ealloc’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:458:15: call_function: calling ‘get_string’ from ‘test_get_principal’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:458:15: return_function: returning to ‘test_get_principal’ from ‘get_string’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:459:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:463:5: branch_false: ...to here krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:465:21: call_function: calling ‘get_duration’ from ‘test_get_principal’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:465:21: return_function: returning to ‘test_get_principal’ from ‘get_duration’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:466:31: call_function: calling ‘get_duration’ from ‘test_get_principal’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:466:31: return_function: returning to ‘test_get_principal’ from ‘get_duration’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:467:23: call_function: calling ‘get_time’ from ‘test_get_principal’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:467:23: return_function: returning to ‘test_get_principal’ from ‘get_time’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:468:26: call_function: calling ‘get_time’ from ‘test_get_principal’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:468:26: return_function: returning to ‘test_get_principal’ from ‘get_time’ krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:475:8: branch_true: following ‘true’ branch (when ‘ret != -1429577725’)... krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:476:9: branch_true: ...to here krb5-1.21.3/src/plugins/kdb/test/kdb_test.c:476:9: call_function: calling ‘make_keys’ from ‘test_get_principal’ # 254| kvnos[i] = 1; # 255| } # 256|-> check(krb5_string_to_keysalts(s, NULL, NULL, FALSE, &ks_lists[i], # 257| &ks_list_sizes[i])); # 258| nkeys += ks_list_sizes[i]; Error: GCC_ANALYZER_WARNING (CWE-401): [#def5] krb5-1.21.3/src/plugins/preauth/otp/main.c:65:14: warning[-Wanalyzer-malloc-leak]: leak of ‘plaintext.data’ krb5-1.21.3/src/plugins/preauth/otp/main.c:52:1: enter_function: entry to ‘decrypt_encdata’ krb5-1.21.3/src/plugins/preauth/otp/main.c:58:8: branch_false: following ‘false’ branch (when ‘req’ is non-NULL)... krb5-1.21.3/src/plugins/preauth/otp/main.c:61:14: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:61:14: call_function: calling ‘alloc_data’ from ‘decrypt_encdata’ krb5-1.21.3/src/plugins/preauth/otp/main.c:61:14: return_function: returning to ‘decrypt_encdata’ from ‘alloc_data’ krb5-1.21.3/src/plugins/preauth/otp/main.c:62:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:66:35: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:65:14: throw: if ‘krb5_c_decrypt’ throws an exception... krb5-1.21.3/src/plugins/preauth/otp/main.c:65:14: danger: ‘plaintext.data’ leaks here; was allocated at [(6)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/5) # 63| return retval; # 64| # 65|-> retval = krb5_c_decrypt(context, armor_key, KRB5_KEYUSAGE_PA_OTP_REQUEST, # 66| NULL, &req->enc_data, &plaintext); # 67| if (retval != 0) { Error: GCC_ANALYZER_WARNING (CWE-401): [#def6] krb5-1.21.3/src/plugins/preauth/otp/main.c:145:14: warning[-Wanalyzer-malloc-leak]: leak of ‘nonce.data’ krb5-1.21.3/src/plugins/preauth/otp/main.c:131:1: enter_function: entry to ‘nonce_generate’ krb5-1.21.3/src/plugins/preauth/otp/main.c:138:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:141:14: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:141:14: call_function: calling ‘alloc_data’ from ‘nonce_generate’ krb5-1.21.3/src/plugins/preauth/otp/main.c:141:14: return_function: returning to ‘nonce_generate’ from ‘alloc_data’ krb5-1.21.3/src/plugins/preauth/otp/main.c:142:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:145:14: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:145:14: throw: if ‘krb5_c_random_make_octets’ throws an exception... krb5-1.21.3/src/plugins/preauth/otp/main.c:145:14: danger: ‘nonce.data’ leaks here; was allocated at [(6)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/5) # 143| return retval; # 144| # 145|-> retval = krb5_c_random_make_octets(ctx, &nonce); # 146| if (retval != 0) { # 147| free(nonce.data); Error: GCC_ANALYZER_WARNING (CWE-401): [#def7] krb5-1.21.3/src/plugins/preauth/otp/main.c:343:14: warning[-Wanalyzer-malloc-leak]: leak of ‘ptr’ krb5-1.21.3/src/plugins/preauth/otp/main.c:284:1: enter_function: entry to ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:299:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:306:9: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:308:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:314:14: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:314:14: call_function: calling ‘decrypt_encdata’ from ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:314:14: return_function: returning to ‘otp_verify’ from ‘decrypt_encdata’ krb5-1.21.3/src/plugins/preauth/otp/main.c:315:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:321:14: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:321:14: call_function: calling ‘nonce_verify’ from ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:321:14: return_function: returning to ‘otp_verify’ from ‘nonce_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:325:8: branch_false: following ‘false’ branch (when ‘retval == 0’)... krb5-1.21.3/src/plugins/preauth/otp/main.c:332:10: call_function: inlined call to ‘k5alloc’ from ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:335:5: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:343:14: throw: if the called function throws an exception... krb5-1.21.3/src/plugins/preauth/otp/main.c:343:14: danger: ‘ptr’ leaks here; was allocated at [(31)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/30) # 341| # 342| /* Get the principal's OTP configuration string. */ # 343|-> retval = cb->get_string(context, rock, "otp", &config); # 344| if (retval == 0 && config == NULL) # 345| retval = KRB5_PREAUTH_FAILED; Error: GCC_ANALYZER_WARNING (CWE-401): [#def8] krb5-1.21.3/src/plugins/preauth/otp/main.c:352:5: warning[-Wanalyzer-malloc-leak]: leak of ‘ptr’ krb5-1.21.3/src/plugins/preauth/otp/main.c:284:1: enter_function: entry to ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:299:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:306:9: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:308:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:314:14: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:314:14: call_function: calling ‘decrypt_encdata’ from ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:314:14: return_function: returning to ‘otp_verify’ from ‘decrypt_encdata’ krb5-1.21.3/src/plugins/preauth/otp/main.c:315:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:321:14: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:321:14: call_function: calling ‘nonce_verify’ from ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:321:14: return_function: returning to ‘otp_verify’ from ‘nonce_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:325:8: branch_false: following ‘false’ branch (when ‘retval == 0’)... krb5-1.21.3/src/plugins/preauth/otp/main.c:332:10: call_function: inlined call to ‘k5alloc’ from ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:335:5: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:344:8: branch_true: following ‘true’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:344:24: branch_true: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:344:9: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:352:5: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:352:5: throw: if ‘otp_state_verify’ throws an exception... krb5-1.21.3/src/plugins/preauth/otp/main.c:352:5: danger: ‘ptr’ leaks here; was allocated at [(31)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/30) # 350| # 351| /* Send the request. */ # 352|-> otp_state_verify((otp_state *)moddata, cb->event_context(context, rock), # 353| cb->client_name(context, rock), config, req, on_response, # 354| rs); Error: GCC_ANALYZER_WARNING (CWE-401): [#def9] krb5-1.21.3/src/plugins/preauth/otp/main.c:352:44: warning[-Wanalyzer-malloc-leak]: leak of ‘ptr’ krb5-1.21.3/src/plugins/preauth/otp/main.c:284:1: enter_function: entry to ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:299:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:306:9: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:308:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:314:14: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:314:14: call_function: calling ‘decrypt_encdata’ from ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:314:14: return_function: returning to ‘otp_verify’ from ‘decrypt_encdata’ krb5-1.21.3/src/plugins/preauth/otp/main.c:315:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:321:14: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:321:14: call_function: calling ‘nonce_verify’ from ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:321:14: return_function: returning to ‘otp_verify’ from ‘nonce_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:325:8: branch_false: following ‘false’ branch (when ‘retval == 0’)... krb5-1.21.3/src/plugins/preauth/otp/main.c:332:10: call_function: inlined call to ‘k5alloc’ from ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:335:5: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:344:8: branch_true: following ‘true’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:344:24: branch_true: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:344:9: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:352:5: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:352:44: throw: if the called function throws an exception... krb5-1.21.3/src/plugins/preauth/otp/main.c:352:44: danger: ‘ptr’ leaks here; was allocated at [(31)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/30) # 350| # 351| /* Send the request. */ # 352|-> otp_state_verify((otp_state *)moddata, cb->event_context(context, rock), # 353| cb->client_name(context, rock), config, req, on_response, # 354| rs); Error: GCC_ANALYZER_WARNING (CWE-401): [#def10] krb5-1.21.3/src/plugins/preauth/otp/main.c:353:22: warning[-Wanalyzer-malloc-leak]: leak of ‘ptr’ krb5-1.21.3/src/plugins/preauth/otp/main.c:284:1: enter_function: entry to ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:299:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:306:9: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:308:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:314:14: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:314:14: call_function: calling ‘decrypt_encdata’ from ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:314:14: return_function: returning to ‘otp_verify’ from ‘decrypt_encdata’ krb5-1.21.3/src/plugins/preauth/otp/main.c:315:8: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:321:14: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:321:14: call_function: calling ‘nonce_verify’ from ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:321:14: return_function: returning to ‘otp_verify’ from ‘nonce_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:325:8: branch_false: following ‘false’ branch (when ‘retval == 0’)... krb5-1.21.3/src/plugins/preauth/otp/main.c:332:10: call_function: inlined call to ‘k5alloc’ from ‘otp_verify’ krb5-1.21.3/src/plugins/preauth/otp/main.c:335:5: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:344:8: branch_true: following ‘true’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:344:24: branch_true: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:344:9: branch_false: following ‘false’ branch... krb5-1.21.3/src/plugins/preauth/otp/main.c:352:5: branch_false: ...to here krb5-1.21.3/src/plugins/preauth/otp/main.c:353:22: throw: if the called function throws an exception... krb5-1.21.3/src/plugins/preauth/otp/main.c:353:22: danger: ‘ptr’ leaks here; was allocated at [(31)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/30) # 351| /* Send the request. */ # 352| otp_state_verify((otp_state *)moddata, cb->event_context(context, rock), # 353|-> cb->client_name(context, rock), config, req, on_response, # 354| rs); # 355| cb->free_string(context, rock, config);
| analyzer-version-clippy | 1.92.0 |
| analyzer-version-cppcheck | 2.19.1 |
| analyzer-version-gcc | 16.0.0 |
| analyzer-version-gcc-analyzer | 16.0.0 |
| analyzer-version-shellcheck | 0.11.0 |
| analyzer-version-unicontrol | 0.0.2 |
| diffbase-analyzer-version-clippy | 1.92.0 |
| diffbase-analyzer-version-cppcheck | 2.19.1 |
| diffbase-analyzer-version-gcc | 16.0.0 |
| diffbase-analyzer-version-gcc-analyzer | 16.0.0 |
| diffbase-analyzer-version-shellcheck | 0.11.0 |
| diffbase-analyzer-version-unicontrol | 0.0.2 |
| diffbase-enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol |
| diffbase-exit-code | 0 |
| diffbase-host | ip-172-16-1-26.us-west-2.compute.internal |
| diffbase-known-false-positives | /usr/share/csmock/known-false-positives.js |
| diffbase-known-false-positives-rpm | known-false-positives-0.0.0.20250521.132812.g8eff701.main-1.el9.noarch |
| diffbase-mock-config | fedora-rawhide-x86_64 |
| diffbase-project-name | krb5-1.21.3-7.fc43 |
| diffbase-store-results-to | /tmp/tmp2_gd08jv/krb5-1.21.3-7.fc43.tar.xz |
| diffbase-time-created | 2026-01-08 18:17:08 |
| diffbase-time-finished | 2026-01-08 18:23:35 |
| diffbase-tool | csmock |
| diffbase-tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,cppcheck,clippy,shellcheck,unicontrol' '-o' '/tmp/tmp2_gd08jv/krb5-1.21.3-7.fc43.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmp2_gd08jv/krb5-1.21.3-7.fc43.src.rpm' |
| diffbase-tool-version | csmock-3.8.3.20251215.161544.g62de9a5-1.el9 |
| enabled-plugins | clippy, cppcheck, gcc, shellcheck, unicontrol |
| exit-code | 0 |
| host | ip-172-16-1-26.us-west-2.compute.internal |
| known-false-positives | /usr/share/csmock/known-false-positives.js |
| known-false-positives-rpm | known-false-positives-0.0.0.20250521.132812.g8eff701.main-1.el9.noarch |
| mock-config | fedora-rawhide-x86_64 |
| project-name | krb5-1.21.3-11.fc44 |
| store-results-to | /tmp/tmp4x9x5gxl/krb5-1.21.3-11.fc44.tar.xz |
| time-created | 2026-01-08 18:24:40 |
| time-finished | 2026-01-08 18:30:32 |
| title | Newly introduced findings |
| tool | csmock |
| tool-args | '/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,cppcheck,clippy,shellcheck,unicontrol' '-o' '/tmp/tmp4x9x5gxl/krb5-1.21.3-11.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmp4x9x5gxl/krb5-1.21.3-11.fc44.src.rpm' |
| tool-version | csmock-3.8.3.20251215.161544.g62de9a5-1.el9 |