libei-1.5.0-1.fc44

List of Findings

Error: GCC_ANALYZER_WARNING (CWE-457): [#def1]
libei-1.5.0/src/brei-shared.c:92:1: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘result’
libei-1.5.0/src/brei-shared.c:354:1: enter_function: entry to ‘brei_dispatch’
libei-1.5.0/src/brei-shared.c:361:18: throw: if ‘iobuf_recv_from_fd’ throws an exception...
libei-1.5.0/src/brei-shared.c:360:39: call_function: inlined call to ‘_iobuf_cleanup’ from ‘brei_dispatch’
libei-1.5.0/src/brei-shared.c:359:31: call_function: inlined call to ‘brei_result_unrefp’ from ‘brei_dispatch’
#   90|   OBJECT_IMPLEMENT_GETTER(brei_result, explanation, const char *);
#   91|   OBJECT_IMPLEMENT_REF(brei_result);
#   92|-> OBJECT_IMPLEMENT_UNREF_CLEANUP(brei_result);
#   93|   
#   94|   struct brei_result *

Error: GCC_ANALYZER_WARNING (CWE-404): [#def2]
libei-1.5.0/src/brei-shared.c:163:17: warning[-Wanalyzer-va-list-leak]: missing call to ‘va_end’
libei-1.5.0/src/brei-shared.c:168:1: enter_function: entry to ‘brei_log_msg’
libei-1.5.0/src/brei-shared.c:174:9: acquire_resource: ‘va_start’ called here
libei-1.5.0/src/brei-shared.c:175:9: call_function: calling ‘brei_log_msg_va’ from ‘brei_log_msg’
#  161|   {
#  162|   	if (brei->log_func && brei->log_context)
#  163|-> 		brei->log_func(brei->log_context, priority, file, lineno, func, format, ap);
#  164|   }
#  165|   

Error: GCC_ANALYZER_WARNING (CWE-122): [#def3]
libei-1.5.0/src/brei-shared.c:241:37: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
libei-1.5.0/src/brei-shared.c:180:1: enter_function: entry to ‘brei_demarshal’
libei-1.5.0/src/brei-shared.c:184:12: branch_false: following ‘false’ branch (when ‘nargs <= 256’)...
libei-1.5.0/src/brei-shared.c:190:54: branch_false: ...to here
libei-1.5.0/src/brei-shared.c:190:47: call_function: calling ‘xalloc’ from ‘brei_demarshal’
libei-1.5.0/src/brei-shared.c:190:47: return_function: returning to ‘brei_demarshal’ from ‘xalloc’
libei-1.5.0/src/brei-shared.c:193:48: call_function: calling ‘xalloc’ from ‘brei_demarshal’
libei-1.5.0/src/brei-shared.c:193:48: return_function: returning to ‘brei_demarshal’ from ‘xalloc’
libei-1.5.0/src/brei-shared.c:202:16: branch_true: following ‘true’ branch...
libei-1.5.0/src/brei-shared.c:203:17: branch_true: ...to here
libei-1.5.0/src/brei-shared.c:230:28: branch_false: following ‘false’ branch (when ‘remaining >= len32’)...
libei-1.5.0/src/brei-shared.c:236:28: branch_false: ...to here
libei-1.5.0/src/brei-shared.c:236:28: branch_false: following ‘false’ branch (when ‘slen != 0’)...
libei-1.5.0/src/brei-shared.c:239:60: branch_false: ...to here
libei-1.5.0/src/brei-shared.c:239:60: call_function: calling ‘xalloc’ from ‘brei_demarshal’
libei-1.5.0/src/brei-shared.c:239:60: return_function: returning to ‘brei_demarshal’ from ‘xalloc’
libei-1.5.0/src/brei-shared.c:241:37: danger: read of 1 byte at offset ‘(sizetype)(*p + 4294967295)’ exceeds the buffer
#  239|   				_cleanup_free_ char *str = xalloc(slen);
#  240|   				memcpy(str, p + 1, slen);
#  241|-> 				if (str[slen - 1] != '\0') {
#  242|   					return brei_result_new(BREI_CONNECTION_DISCONNECT_REASON_PROTOCOL,
#  243|   							       "Message string not zero-terminated");

Error: GCC_ANALYZER_WARNING (CWE-401): [#def4]
libei-1.5.0/src/libei.c:882:9: warning[-Wanalyzer-malloc-leak]: leak of ‘xalloc(24)’
libei-1.5.0/src/libei.c:874:1: enter_function: entry to ‘ei_queue_unsent’
libei-1.5.0/src/libei.c:880:36: call_function: calling ‘xalloc’ from ‘ei_queue_unsent’
libei-1.5.0/src/libei.c:880:36: return_function: returning to ‘ei_queue_unsent’ from ‘xalloc’
libei-1.5.0/src/libei.c:882:9: danger: ‘xalloc(24)’ leaks here; was allocated at [(6)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/5)
#  880|   	struct ei_unsent *unsent = xalloc(sizeof *unsent);
#  881|   	unsent->buf = buf;
#  882|-> 	list_append(&ei->unsent_queue, &unsent->node);
#  883|   }
#  884|   

Error: GCC_ANALYZER_WARNING (CWE-404): [#def5]
libei-1.5.0/src/libei.c:926:40: warning[-Wanalyzer-va-list-leak]: missing call to ‘va_end’
libei-1.5.0/src/libei.c:925:9: acquire_resource: ‘va_start’ called here
libei-1.5.0/src/libei.c:926:40: throw: if ‘brei_marshal_message’ throws an exception...
libei-1.5.0/src/libei.c:926:40: danger: missing call to ‘va_end’ to match ‘va_start’ at [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  924|   	va_list args;
#  925|   	va_start(args, nargs);
#  926|-> 	_unref_(brei_result) *result = brei_marshal_message(ei->brei,
#  927|   							    object->id,
#  928|   							    opcode, signature,

Error: GCC_ANALYZER_WARNING (CWE-401): [#def6]
libei-1.5.0/src/libeis-client.c:178:9: warning[-Wanalyzer-malloc-leak]: leak of ‘xalloc(24)’
libei-1.5.0/src/libeis-client.c:168:1: enter_function: entry to ‘eis_client_queue_unsent’
libei-1.5.0/src/libeis-client.c:176:37: call_function: calling ‘xalloc’ from ‘eis_client_queue_unsent’
libei-1.5.0/src/libeis-client.c:176:37: return_function: returning to ‘eis_client_queue_unsent’ from ‘xalloc’
libei-1.5.0/src/libeis-client.c:178:9: danger: ‘xalloc(24)’ leaks here; was allocated at [(6)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/5)
#  176|   	struct eis_unsent *unsent = xalloc(sizeof *unsent);
#  177|   	unsent->buf = buf;
#  178|-> 	list_append(&client->unsent_queue, &unsent->node);
#  179|   }
#  180|   

Error: GCC_ANALYZER_WARNING (CWE-404): [#def7]
libei-1.5.0/src/libeis-client.c:224:40: warning[-Wanalyzer-va-list-leak]: missing call to ‘va_end’
libei-1.5.0/src/libeis-client.c:223:9: acquire_resource: ‘va_start’ called here
libei-1.5.0/src/libeis-client.c:224:40: throw: if ‘brei_marshal_message’ throws an exception...
libei-1.5.0/src/libeis-client.c:224:40: danger: missing call to ‘va_end’ to match ‘va_start’ at [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  222|   	va_list args;
#  223|   	va_start(args, nargs);
#  224|-> 	_unref_(brei_result) *result = brei_marshal_message(client->brei,
#  225|   						            object->id,
#  226|   							    opcode, signature,

Error: GCC_ANALYZER_WARNING (CWE-775): [#def8]
libei-1.5.0/src/libeis-device.c:83:12: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘xdup(fd)’
libei-1.5.0/src/libeis-device.c:69:1: enter_function: entry to ‘eis_device_new_keymap’
libei-1.5.0/src/libeis-device.c:72:9: branch_true: following ‘true’ branch (when ‘type == 1’)...
libei-1.5.0/src/libeis-device.c:79:13: branch_true: ...to here
libei-1.5.0/src/libeis-device.c:79:12: branch_false: following ‘false’ branch...
libei-1.5.0/src/libeis-device.c:82:21: branch_false: ...to here
libei-1.5.0/src/libeis-device.c:82:21: call_function: calling ‘xdup’ from ‘eis_device_new_keymap’
libei-1.5.0/src/libeis-device.c:82:21: return_function: returning to ‘eis_device_new_keymap’ from ‘xdup’
libei-1.5.0/src/libeis-device.c:83:12: danger: ‘xdup(fd)’ leaks here; was opened at [(8)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/7)
#   81|   
#   82|   	int newfd = xdup(fd);
#   83|-> 	if (newfd < 0)
#   84|   		return NULL;
#   85|   

Error: GCC_ANALYZER_WARNING (CWE-775): [#def9]
libei-1.5.0/src/liboeffis.c:357:29: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘eisfd’
libei-1.5.0/src/liboeffis.c:332:1: enter_function: entry to ‘connect_to_eis_returned’
libei-1.5.0/src/liboeffis.c:344:12: branch_false: following ‘false’ branch...
libei-1.5.0/src/liboeffis.c:350:14: branch_false: ...to here
libei-1.5.0/src/liboeffis.c:350:14: call_function: calling ‘xdup’ from ‘connect_to_eis_returned’
libei-1.5.0/src/liboeffis.c:350:14: return_function: returning to ‘connect_to_eis_returned’ from ‘xdup’
libei-1.5.0/src/liboeffis.c:350:14: call_function: inlined call to ‘xerrno’ from ‘connect_to_eis_returned’
libei-1.5.0/src/liboeffis.c:356:17: branch_false: ...to here
libei-1.5.0/src/liboeffis.c:357:29: throw: if ‘fcntl’ throws an exception...
libei-1.5.0/src/liboeffis.c:357:29: danger: ‘eisfd’ leaks here; was opened at [(6)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/5)
#  355|   	} else {
#  356|   		eisfd = rc;
#  357|-> 		int flags = fcntl(eisfd, F_GETFL, 0);
#  358|   		fcntl(eisfd, F_SETFL, flags | O_NONBLOCK);
#  359|   	}

Error: GCC_ANALYZER_WARNING (CWE-775): [#def10]
libei-1.5.0/src/util-io.h:119:16: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘xdup(eisfd)’
libei-1.5.0/src/liboeffis.c:332:1: enter_function: entry to ‘connect_to_eis_returned’
libei-1.5.0/src/liboeffis.c:344:12: branch_false: following ‘false’ branch...
libei-1.5.0/src/liboeffis.c:350:14: branch_false: ...to here
libei-1.5.0/src/liboeffis.c:350:14: call_function: calling ‘xdup’ from ‘connect_to_eis_returned’
libei-1.5.0/src/liboeffis.c:350:14: return_function: returning to ‘connect_to_eis_returned’ from ‘xdup’
libei-1.5.0/src/liboeffis.c:350:14: call_function: inlined call to ‘xerrno’ from ‘connect_to_eis_returned’
#  117|   static inline int
#  118|   xerrno(int value) {
#  119|-> 	return value < 0 ? -errno : value;
#  120|   }
#  121|   

Error: GCC_ANALYZER_WARNING (CWE-775): [#def11]
libei-1.5.0/src/util-io.h:229:18: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘rc_’
libei-1.5.0/src/util-io.h:215:1: enter_function: entry to ‘xconnect’
libei-1.5.0/src/util-io.h:221:12: branch_true: following ‘true’ branch...
libei-1.5.0/src/util-io.h:221:12: branch_true: ...to here
libei-1.5.0/src/util-io.h:225:29: acquire_resource: socket created here
libei-1.5.0/src/util-io.h:225:29: branch_false: following ‘false’ branch (when ‘rc_ != -1’)...
libei-1.5.0/src/util-io.h:225:22: call_function: inlined call to ‘xerrno’ from ‘xconnect’
libei-1.5.0/src/util-io.h:229:18: branch_false: ...to here
libei-1.5.0/src/util-io.h:229:18: throw: if ‘connect’ throws an exception...
libei-1.5.0/src/util-io.h:229:18: danger: ‘rc_’ leaks here
#  227|   		return sockfd;
#  228|   
#  229|-> 	int rc = xerrno(connect(sockfd, (struct sockaddr*)&addr, sizeof(addr)));
#  230|   	if (rc < 0)
#  231|   		return rc;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def12]
libei-1.5.0/src/util-io.h:369:57: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘buf’
libei-1.5.0/src/libei.c:932:12: branch_false: following ‘false’ branch...
libei-1.5.0/src/libei.c:938:45: branch_false: ...to here
libei-1.5.0/src/libei.c:939:9: branch_true: following ‘true’ branch...
libei-1.5.0/src/libei.c:940:18: branch_true: ...to here
libei-1.5.0/src/libei.c:940:18: throw: if ‘source_get_fd’ throws an exception...
libei-1.5.0/src/libei.c:938:39: call_function: inlined call to ‘_iobuf_cleanup’ from ‘ei_send_message’
#  367|   iobuf_free(struct iobuf *buf);
#  368|   
#  369|-> static inline void _iobuf_cleanup(struct iobuf **buf) { iobuf_free(*buf); }
#  370|   /**
#  371|    * Helper macro to auto-free a iobuf struct when the variable goes out of

Error: GCC_ANALYZER_WARNING (CWE-404): [#def13]
libei-1.5.0/src/util-logger.c:75:17: warning[-Wanalyzer-va-list-leak]: missing call to ‘va_end’
libei-1.5.0/src/util-logger.c:81:1: enter_function: entry to ‘log_msg’
libei-1.5.0/src/util-logger.c:88:9: acquire_resource: ‘va_start’ called here
libei-1.5.0/src/util-logger.c:89:9: call_function: calling ‘log_msg_va’ from ‘log_msg’
#   73|   {
#   74|          if (logger->handler && logger->priority <= priority)
#   75|-> 		logger->handler(logger, logger->prefix,
#   76|   				priority, file, lineno, func,
#   77|   				format, args);

Error: CPPCHECK_WARNING (CWE-457): [#def14]
libei-1.5.0/src/util-memfile.c:74: warning[uninitvar]: Uninitialized variable: rc
#   72|   		rc = SYSCALL(posix_fallocate(fd, 0, sz));
#   73|   	}
#   74|-> 	if (rc < 0)
#   75|   		return NULL;
#   76|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def15]
libei-1.5.0/src/util-strings.c:189:30: warning[-Wanalyzer-malloc-leak]: leak of ‘xalloc(max + 1)’
libei-1.5.0/src/util-strings.c:164:1: enter_function: entry to ‘strreplace’
libei-1.5.0/src/util-strings.c:166:9: branch_true: following ‘true’ branch (when ‘string’ is non-NULL)...
libei-1.5.0/src/util-strings.c:167:9: branch_true: ...to here
libei-1.5.0/src/util-strings.c:167:9: branch_true: following ‘true’ branch...
libei-1.5.0/src/util-strings.c:173:23: branch_true: ...to here
libei-1.5.0/src/util-strings.c:180:12: branch_false: following ‘false’ branch (when ‘next’ is non-NULL)...
libei-1.5.0/src/util-strings.c:183:23: branch_false: ...to here
libei-1.5.0/src/util-strings.c:185:19: call_function: calling ‘xalloc’ from ‘strreplace’
libei-1.5.0/src/util-strings.c:185:19: return_function: returning to ‘strreplace’ from ‘xalloc’
libei-1.5.0/src/util-strings.c:188:16: branch_true: following ‘true’ branch (when ‘next’ is non-NULL)...
libei-1.5.0/src/util-strings.c:189:30: branch_true: ...to here
libei-1.5.0/src/util-strings.c:192:20: branch_false: following ‘false’ branch...
libei-1.5.0/src/util-strings.c:196:17: branch_false: ...to here
libei-1.5.0/src/util-strings.c:198:20: branch_false: following ‘false’ branch...
libei-1.5.0/src/util-strings.c:200:17: branch_false: ...to here
libei-1.5.0/src/util-strings.c:204:20: branch_false: following ‘false’ branch...
libei-1.5.0/src/util-strings.c:206:24: branch_false: ...to here
libei-1.5.0/src/util-strings.c:188:16: branch_true: following ‘true’ branch (when ‘next’ is non-NULL)...
libei-1.5.0/src/util-strings.c:189:30: branch_true: ...to here
libei-1.5.0/src/util-strings.c:192:20: branch_false: following ‘false’ branch...
libei-1.5.0/src/util-strings.c:196:17: branch_false: ...to here
libei-1.5.0/src/util-strings.c:198:20: branch_true: following ‘true’ branch...
libei-1.5.0/src/util-strings.c:210:22: branch_true: ...to here
libei-1.5.0/src/util-strings.c:213:12: branch_false: following ‘false’ branch...
libei-1.5.0/src/util-strings.c:218:32: branch_false: ...to here
libei-1.5.0/src/util-strings.c:189:30: danger: ‘xalloc(max + 1)’ leaks here; was allocated at [(13)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/12)
#  187|   
#  188|   	while (next) {
#  189|-> 		size_t len = next - current;
#  190|   		/* silently truncate because we really don't care about this
#  191|   		 * case */

Error: GCC_ANALYZER_WARNING (CWE-401): [#def16]
libei-1.5.0/src/util-strings.h:280:9: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
libei-1.5.0/src/util-strings.c:78:1: enter_function: entry to ‘strv_from_string’
libei-1.5.0/src/util-strings.c:85:9: branch_true: following ‘true’ branch (when ‘in’ is non-NULL)...
libei-1.5.0/src/util-strings.c:87:9: branch_true: ...to here
libei-1.5.0/src/util-strings.c:88:16: branch_true: following ‘true’ branch...
libei-1.5.0/src/util-strings.c:89:16: branch_true: ...to here
libei-1.5.0/src/util-strings.c:88:16: branch_false: following ‘false’ branch...
libei-1.5.0/src/util-strings.c:91:12: branch_false: ...to here
libei-1.5.0/src/util-strings.c:91:12: branch_false: following ‘false’ branch (when ‘nelems != 0’)...
libei-1.5.0/src/util-strings.c:94:9: branch_false: ...to here
libei-1.5.0/src/util-strings.c:95:16: call_function: calling ‘xalloc’ from ‘strv_from_string’
libei-1.5.0/src/util-strings.c:95:16: return_function: returning to ‘strv_from_string’ from ‘xalloc’
libei-1.5.0/src/util-strings.c:100:24: call_function: calling ‘next_word’ from ‘strv_from_string’
libei-1.5.0/src/util-strings.c:100:24: return_function: returning to ‘strv_from_string’ from ‘next_word’
libei-1.5.0/src/util-strings.c:100:16: branch_true: following ‘true’ branch...
libei-1.5.0/src/util-strings.c:101:30: branch_true: ...to here
libei-1.5.0/src/util-strings.c:102:20: branch_false: following ‘false’ branch (when ‘copy’ is non-NULL)...
libei-1.5.0/src/util-strings.c:107:22: branch_false: ...to here
libei-1.5.0/src/util-strings.c:100:24: call_function: calling ‘next_word’ from ‘strv_from_string’
libei-1.5.0/src/util-strings.c:100:24: return_function: returning to ‘strv_from_string’ from ‘next_word’
libei-1.5.0/src/util-strings.c:100:16: branch_true: following ‘true’ branch...
libei-1.5.0/src/util-strings.c:101:30: branch_true: ...to here
libei-1.5.0/src/util-strings.c:102:20: branch_false: following ‘false’ branch (when ‘copy’ is non-NULL)...
libei-1.5.0/src/util-strings.c:107:22: branch_false: ...to here
libei-1.5.0/src/util-strings.c:100:24: call_function: calling ‘next_word’ from ‘strv_from_string’
libei-1.5.0/src/util-strings.c:100:24: return_function: returning to ‘strv_from_string’ from ‘next_word’
libei-1.5.0/src/util-strings.c:100:16: branch_true: following ‘true’ branch...
libei-1.5.0/src/util-strings.c:101:30: branch_true: ...to here
libei-1.5.0/src/util-strings.c:101:30: acquire_memory: allocated here
libei-1.5.0/src/util-strings.c:102:20: branch_false: following ‘false’ branch (when ‘copy’ is non-NULL)...
libei-1.5.0/src/util-strings.c:107:22: branch_false: ...to here
libei-1.5.0/src/util-strings.c:100:24: call_function: calling ‘next_word’ from ‘strv_from_string’
libei-1.5.0/src/util-strings.c:100:24: return_function: returning to ‘strv_from_string’ from ‘next_word’
libei-1.5.0/src/util-strings.c:100:16: branch_true: following ‘true’ branch...
libei-1.5.0/src/util-strings.c:101:30: branch_true: ...to here
libei-1.5.0/src/util-strings.c:102:20: branch_true: following ‘true’ branch (when ‘copy’ is NULL)...
libei-1.5.0/src/util-strings.c:103:25: branch_true: ...to here
libei-1.5.0/src/util-strings.c:103:25: call_function: calling ‘strv_free’ from ‘strv_from_string’
#  278|   	}
#  279|   
#  280|-> 	free (strv);
#  281|   }
#  282|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def17]
libei-1.5.0/tools/ei-demo-client.c:64:1: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘ei’
libei-1.5.0/tools/ei-demo-client.c:197:5: enter_function: entry to ‘main’
libei-1.5.0/tools/ei-demo-client.c:208:40: call_function: calling ‘xstrdup’ from ‘main’
libei-1.5.0/tools/ei-demo-client.c:208:40: return_function: returning to ‘main’ from ‘xstrdup’
libei-1.5.0/tools/ei-demo-client.c:268:12: branch_true: following ‘true’ branch (when ‘receiver != 0’)...
libei-1.5.0/tools/ei-demo-client.c:269:22: branch_true: ...to here
libei-1.5.0/tools/ei-demo-client.c:272:9: branch_true: following ‘true’ branch (when ‘ei’ is non-NULL)...
libei-1.5.0/tools/ei-demo-client.c:274:12: branch_true: ...to here
libei-1.5.0/tools/ei-demo-client.c:277:9: throw: if ‘ei_configure_name’ throws an exception...
libei-1.5.0/tools/ei-demo-client.c:267:22: call_function: inlined call to ‘ei_unrefp’ from ‘main’
#   62|   #include "src/util-time.h"
#   63|   
#   64|-> DEFINE_UNREF_CLEANUP_FUNC(ei);
#   65|   DEFINE_UNREF_CLEANUP_FUNC(ei_device);
#   66|   DEFINE_UNREF_CLEANUP_FUNC(ei_event);

Scan Properties