mod_http2-2.0.37-1.fc44

List of Findings

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1]
mod_http2-2.0.37/mod_http2/h2_bucket_beam.c:313:18: warning[-Wanalyzer-null-dereference]: dereference of NULL 'conn_ctx'
mod_http2-2.0.37/mod_http2/h2_bucket_beam.c:306:31: branch_false: following 'false' branch (when 'from' is NULL)...
mod_http2-2.0.37/mod_http2/h2_bucket_beam.c:309:12: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_bucket_beam.c:313:18: danger: dereference of NULL 'conn_ctx'
#  311|       beam->from = from;
#  312|       beam->id = id;
#  313|->     beam->name = apr_psprintf(pool, "%s-%d-%s",
#  314|                                 conn_ctx->id, id, tag);
#  315|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def2]
mod_http2-2.0.37/mod_http2/h2_c2.c:163:24: warning[-Wanalyzer-null-dereference]: dereference of NULL 'conn_ctx'
mod_http2-2.0.37/mod_http2/h2_c2.c:159:31: branch_false: following 'false' branch (when 'c2' is NULL)...
mod_http2-2.0.37/mod_http2/h2_c2.c:163:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:163:7: branch_true: following 'true' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:163:24: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:163:24: danger: dereference of NULL 'conn_ctx'
#  161|       AP_DEBUG_ASSERT(conn_ctx);
#  162|       AP_DEBUG_ASSERT(conn_ctx->stream_id);
#  163|->     if(!c2->aborted && conn_ctx->bytes_sent) {
#  164|         h2_c2_log_io(c2, conn_ctx->bytes_sent);
#  165|       }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def3]
mod_http2-2.0.37/mod_http2/h2_c2.c:167:9: warning[-Wanalyzer-null-dereference]: dereference of NULL 'conn_ctx'
mod_http2-2.0.37/mod_http2/h2_c2.c:159:31: branch_false: following 'false' branch (when 'c2' is NULL)...
mod_http2-2.0.37/mod_http2/h2_c2.c:163:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:163:7: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:167:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:167:9: danger: dereference of NULL 'conn_ctx'
#  165|       }
#  166|   
#  167|->     if (conn_ctx->beam_in) {
#  168|           h2_beam_abort(conn_ctx->beam_in, from);
#  169|       }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def4]
mod_http2-2.0.37/mod_http2/h2_c2.c:207:9: warning[-Wanalyzer-null-dereference]: dereference of NULL 'conn_ctx'
mod_http2-2.0.37/mod_http2/h2_c2.c:195:16: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:198:8: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:198:8: branch_false: following 'false' branch (when 'mode != 5')...
mod_http2-2.0.37/mod_http2/h2_c2.c:202:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:202:8: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_private.h:26:1: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:206:8: branch_true: following 'true' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:207:9: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:207:9: branch_true: following 'true' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:207:9: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:207:9: danger: dereference of NULL 'conn_ctx'
#  205|       
#  206|       if (APLOGctrace3(f->c)) {
#  207|->         ap_log_cerror(APLOG_MARK, APLOG_TRACE3, 0, f->c,
#  208|                         "h2_c2_in(%s-%d): read, mode=%d, block=%d, readbytes=%ld",
#  209|                         conn_ctx->id, conn_ctx->stream_id, mode, block,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def5]
mod_http2-2.0.37/mod_http2/h2_c2.c:217:14: warning[-Wanalyzer-null-dereference]: dereference of NULL 'conn_ctx'
mod_http2-2.0.37/mod_http2/h2_c2.c:195:16: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:198:8: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:198:8: branch_false: following 'false' branch (when 'mode != 5')...
mod_http2-2.0.37/mod_http2/h2_c2.c:202:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:202:8: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_private.h:26:1: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:213:8: branch_true: following 'true' branch (when 'fctx' is NULL)...
mod_http2-2.0.37/mod_http2/h2_c2.c:214:16: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:217:14: danger: dereference of NULL 'conn_ctx'
#  215|           f->ctx = fctx;
#  216|           fctx->bb = apr_brigade_create(f->c->pool, f->c->bucket_alloc);
#  217|->         if (!conn_ctx->beam_in) {
#  218|               b = apr_bucket_eos_create(f->c->bucket_alloc);
#  219|               APR_BRIGADE_INSERT_TAIL(fctx->bb, b);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def6]
mod_http2-2.0.37/mod_http2/h2_c2.c:236:13: warning[-Wanalyzer-null-dereference]: dereference of NULL 'conn_ctx'
mod_http2-2.0.37/mod_http2/h2_c2.c:195:16: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:198:8: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:198:8: branch_false: following 'false' branch (when 'mode != 5')...
mod_http2-2.0.37/mod_http2/h2_c2.c:202:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:202:8: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_private.h:26:1: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:213:8: branch_false: following 'false' branch (when 'fctx' is non-NULL)...
mod_http2-2.0.37/mod_http2/h2_c2.c:227:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:233:12: branch_true: following 'true' branch...
mod_http2-2.0.37/mod_http2/h2_private.h:26:1: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:235:12: branch_true: following 'true' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:236:13: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:236:13: branch_true: following 'true' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:236:13: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:236:13: danger: dereference of NULL 'conn_ctx'
#  234|           /* Get more input data for our request. */
#  235|           if (APLOGctrace2(f->c)) {
#  236|->             ap_log_cerror(APLOG_MARK, APLOG_TRACE2, status, f->c,
#  237|                             "h2_c2_in(%s-%d): get more data from mplx, block=%d, "
#  238|                             "readbytes=%ld",

Error: GCC_ANALYZER_WARNING (CWE-476): [#def7]
mod_http2-2.0.37/mod_http2/h2_c2.c:241:13: warning[-Wanalyzer-null-dereference]: dereference of NULL 'conn_ctx'
mod_http2-2.0.37/mod_http2/h2_c2.c:195:16: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:198:8: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:198:8: branch_false: following 'false' branch (when 'mode != 5')...
mod_http2-2.0.37/mod_http2/h2_c2.c:202:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:202:8: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_private.h:26:1: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:213:8: branch_false: following 'false' branch (when 'fctx' is non-NULL)...
mod_http2-2.0.37/mod_http2/h2_c2.c:227:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:233:12: branch_true: following 'true' branch...
mod_http2-2.0.37/mod_http2/h2_private.h:26:1: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:241:13: danger: dereference of NULL 'conn_ctx'
#  239|                             conn_ctx->id, conn_ctx->stream_id, block, (long)readbytes);
#  240|           }
#  241|->         if (conn_ctx->beam_in) {
#  242|               if (conn_ctx->pipe_in[H2_PIPE_OUT]) {
#  243|   receive:

Error: GCC_ANALYZER_WARNING (CWE-476): [#def8]
mod_http2-2.0.37/mod_http2/h2_c2.c:332:13: warning[-Wanalyzer-null-dereference]: dereference of NULL 'conn_ctx'
mod_http2-2.0.37/mod_http2/h2_c2.c:195:16: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:198:8: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:198:8: branch_false: following 'false' branch (when 'mode != 5')...
mod_http2-2.0.37/mod_http2/h2_c2.c:202:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:202:8: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_private.h:26:1: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:213:8: branch_false: following 'false' branch (when 'fctx' is non-NULL)...
mod_http2-2.0.37/mod_http2/h2_c2.c:227:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:233:12: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:293:8: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:293:8: branch_false: following 'false' branch (when 'status != 70014')...
mod_http2-2.0.37/mod_http2/h2_private.h:26:1: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:302:8: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:311:8: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:311:8: branch_false: following 'false' branch (when 'mode != 4')...
mod_http2-2.0.37/mod_http2/h2_c2.c:315:13: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:315:13: branch_false: following 'false' branch (when 'mode != 0')...
mod_http2-2.0.37/mod_http2/h2_c2.c:318:13: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:318:13: branch_false: following 'false' branch (when 'mode != 3')...
mod_http2-2.0.37/mod_http2/h2_c2.c:321:13: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:321:13: branch_true: following 'true' branch (when 'mode == 1')...
mod_http2-2.0.37/mod_http2/h2_c2.c:325:18: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:327:12: branch_true: following 'true' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:329:24: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:332:13: branch_true: following 'true' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:332:13: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:332:13: danger: dereference of NULL 'conn_ctx'
#  330|               apr_brigade_flatten(bb, buffer, &len);
#  331|               buffer[len] = 0;
#  332|->             ap_log_cerror(APLOG_MARK, APLOG_TRACE3, status, f->c,
#  333|                             "h2_c2_in(%s-%d): getline: %s",
#  334|                             conn_ctx->id, conn_ctx->stream_id, buffer);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def9]
mod_http2-2.0.37/mod_http2/h2_c2.c:340:9: warning[-Wanalyzer-null-dereference]: dereference of NULL 'conn_ctx'
mod_http2-2.0.37/mod_http2/h2_c2.c:195:16: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:198:8: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:198:8: branch_false: following 'false' branch (when 'mode != 5')...
mod_http2-2.0.37/mod_http2/h2_c2.c:202:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:202:8: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_private.h:26:1: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:213:8: branch_false: following 'false' branch (when 'fctx' is non-NULL)...
mod_http2-2.0.37/mod_http2/h2_c2.c:227:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:233:12: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:293:8: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:293:8: branch_false: following 'false' branch (when 'status != 70014')...
mod_http2-2.0.37/mod_http2/h2_private.h:26:1: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:302:8: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:311:8: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:311:8: branch_false: following 'false' branch (when 'mode != 4')...
mod_http2-2.0.37/mod_http2/h2_c2.c:315:13: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:315:13: branch_false: following 'false' branch (when 'mode != 0')...
mod_http2-2.0.37/mod_http2/h2_c2.c:318:13: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:318:13: branch_false: following 'false' branch (when 'mode != 3')...
mod_http2-2.0.37/mod_http2/h2_c2.c:321:13: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:321:13: branch_false: following 'false' branch (when 'mode != 1')...
mod_http2-2.0.37/mod_http2/h2_c2.c:340:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:340:9: danger: dereference of NULL 'conn_ctx'
#  338|           /* Hmm, well. There is mode AP_MODE_EATCRLF, but we chose not
#  339|            * to support it. Seems to work. */
#  340|->         ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_ENOTIMPL, f->c,
#  341|                         APLOGNO(03472) 
#  342|                         "h2_c2_in(%s-%d), unsupported READ mode %d",

Error: GCC_ANALYZER_WARNING (CWE-476): [#def10]
mod_http2-2.0.37/mod_http2/h2_c2.c:349:9: warning[-Wanalyzer-null-dereference]: dereference of NULL 'conn_ctx'
mod_http2-2.0.37/mod_http2/h2_c2.c:195:16: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:198:8: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:198:8: branch_false: following 'false' branch (when 'mode != 5')...
mod_http2-2.0.37/mod_http2/h2_c2.c:202:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:202:8: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_private.h:26:1: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:213:8: branch_false: following 'false' branch (when 'fctx' is non-NULL)...
mod_http2-2.0.37/mod_http2/h2_c2.c:227:9: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:233:12: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:293:8: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:293:8: branch_false: following 'false' branch (when 'status != 70014')...
mod_http2-2.0.37/mod_http2/h2_private.h:26:1: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:302:8: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:311:8: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:347:8: branch_true: following 'true' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:348:9: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:349:9: branch_true: following 'true' branch...
mod_http2-2.0.37/mod_http2/h2_c2.c:349:9: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2.c:349:9: danger: dereference of NULL 'conn_ctx'
#  347|       if (APLOGctrace3(f->c)) {
#  348|           apr_brigade_length(bb, 0, &bblen);
#  349|->         ap_log_cerror(APLOG_MARK, APLOG_TRACE3, status, f->c,
#  350|                         "h2_c2_in(%s-%d): %ld data bytes",
#  351|                         conn_ctx->id, conn_ctx->stream_id, (long)bblen);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def11]
mod_http2-2.0.37/mod_http2/h2_c2_filter.c:310:16: warning[-Wanalyzer-null-dereference]: dereference of NULL '*r.content_languages'
mod_http2-2.0.37/mod_http2/h2_c2_filter.c:681:14: enter_function: entry to 'h2_c2_filter_response_out'
mod_http2-2.0.37/mod_http2/h2_c2_filter.c:683:31: branch_true: following 'true' branch...
mod_http2-2.0.37/mod_http2/h2_c2_filter.c:683:31: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2_filter.c:692:8: branch_false: following 'false' branch...
mod_http2-2.0.37/mod_http2/h2_c2_filter.c:724:12: branch_false: following 'false' branch (when 'eb' is NULL)...
mod_http2-2.0.37/mod_http2/h2_c2_filter.c:736:13: branch_false: ...to here
mod_http2-2.0.37/mod_http2/h2_c2_filter.c:736:12: branch_true: following 'true' branch...
mod_http2-2.0.37/mod_http2/h2_c2_filter.c:739:24: branch_true: ...to here
mod_http2-2.0.37/mod_http2/h2_c2_filter.c:739:24: call_function: calling 'create_response' from 'h2_c2_filter_response_out'
#  308|           int i;
#  309|           char *token;
#  310|->         char **languages = (char **)(r->content_languages->elts);
#  311|           const char *field = apr_table_get(r->headers_out, "Content-Language");
#  312|   

Error: GCC_ANALYZER_WARNING (CWE-131): [#def12]
mod_http2-2.0.37/mod_http2/h2_push.c:855:18: warning[-Wanalyzer-allocation-size]: allocated buffer size is not a multiple of the pointee's size
#  853|           || !strcmp("*", authority) || !strcmp(diary->authority, authority)) {
#  854|           hash_count = diary->entries->nelts;
#  855|->         hashes = apr_pcalloc(encoder.pool, hash_count);
#  856|           for (i = 0; i < hash_count; ++i) {
#  857|               hashes[i] = ((&APR_ARRAY_IDX(diary->entries, i, h2_push_diary_entry))->hash 

Scan Properties

analyzer-version-clippy1.92.0
analyzer-version-cppcheck2.19.1
analyzer-version-gcc16.0.0
analyzer-version-gcc-analyzer16.0.0
analyzer-version-shellcheck0.11.0
analyzer-version-unicontrol0.0.2
enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
exit-code0
hostip-172-16-1-245.us-west-2.compute.internal
known-false-positives/usr/share/csmock/known-false-positives.js
known-false-positives-rpmknown-false-positives-0.0.0.20250521.132812.g8eff701.main-1.el9.noarch
mock-configfedora-rawhide-x86_64
project-namemod_http2-2.0.37-1.fc44
store-results-to/tmp/tmp2jclfbtq/mod_http2-2.0.37-1.fc44.tar.xz
time-created2026-01-08 19:34:37
time-finished2026-01-08 19:36:08
toolcsmock
tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,cppcheck,clippy,shellcheck,unicontrol' '-o' '/tmp/tmp2jclfbtq/mod_http2-2.0.37-1.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmp2jclfbtq/mod_http2-2.0.37-1.fc44.src.rpm'
tool-versioncsmock-3.8.3.20251215.161544.g62de9a5-1.el9