Newly introduced findings

List of Findings

Error: GCC_ANALYZER_WARNING (CWE-401): [#def1]
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:1274:14: warning[-Wanalyzer-malloc-leak]: leak of ‘hdr’
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:1264:15: acquire_memory: allocated here
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:1266:12: branch_false: following ‘false’ branch...
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:1272:9: branch_false: ...to here
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:1274:14: throw: if ‘open’ throws an exception...
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:1274:14: danger: ‘hdr’ leaks here; was allocated at [(1)](sarif:/runs/0/results/10/codeFlows/0/threadFlows/0/locations/0)
# 1272|   	memset(hdr, 0, bs);
# 1273|   
# 1274|-> 	fd = open(output_file, O_WRONLY | O_CREAT | O_TRUNC, 0666);
# 1275|   	if (fd < 0) {
# 1276|   		fprintf(stderr, "Failed to open output file %s: %s!\n",

Error: GCC_ANALYZER_WARNING (CWE-401): [#def2]
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:1274:14: warning[-Wanalyzer-malloc-leak]: leak of ‘telemetry_log’
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:1265:25: acquire_memory: allocated here
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:1266:12: branch_false: following ‘false’ branch...
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:1272:9: branch_false: ...to here
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:1274:14: throw: if ‘open’ throws an exception...
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:1274:14: danger: ‘telemetry_log’ leaks here; was allocated at [(1)](sarif:/runs/0/results/9/codeFlows/0/threadFlows/0/locations/0)
# 1272|   	memset(hdr, 0, bs);
# 1273|   
# 1274|-> 	fd = open(output_file, O_WRONLY | O_CREAT | O_TRUNC, 0666);
# 1275|   	if (fd < 0) {
# 1276|   		fprintf(stderr, "Failed to open output file %s: %s!\n",

Error: GCC_ANALYZER_WARNING (CWE-775): [#def3]
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:3005:15: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘ffd’
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:3022:12: enter_function: entry to ‘set_error_injection’
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:3042:12: branch_false: following ‘false’ branch...
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:3051:16: branch_false: ...to here
nvme-cli-2.16/plugins/ocp/ocp-nvme.c:3052:16: call_function: calling ‘error_injection_set’ from ‘set_error_injection’
# 3003|   	args.data = entry;
# 3004|   
# 3005|-> 	err = nvme_set_features(&args);
# 3006|   	if (err) {
# 3007|   		if (err < 0)

Error: GCC_ANALYZER_WARNING (CWE-775): [#def4]
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1535:37: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(&file_path, "w")’
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1527:12: branch_true: following ‘true’ branch...
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1528:17: branch_true: ...to here
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1529:28: acquire_resource: opened here
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1531:20: branch_true: following ‘true’ branch...
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1532:25: branch_true: ...to here
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1535:28: branch_true: following ‘true’ branch (when the strings are equal)...
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1536:37: branch_true: ...to here
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1536:36: branch_false: following ‘false’ branch...
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1540:41: branch_false: ...to here
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1540:41: throw: if ‘generic_structure_parser’ throws an exception...
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1535:37: danger: ‘fopen(&file_path, "w")’ leaks here; was opened at [(3)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/2)
# 1533|   			fprintf(fp, "%s\n", STR_LOG_PAGE_HEADER);
# 1534|   			fprintf(fp, STR_LINE);
# 1535|-> 			if (!strcmp(options->telemetry_type, "host")) {
# 1536|   				if ((ptelemetry_buffer == NULL) ||
# 1537|   					(ARRAY_SIZE(host_log_page_header) == 0))

Error: GCC_ANALYZER_WARNING (CWE-401): [#def5]
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1535:37: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(&file_path, "w")’
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1527:12: branch_true: following ‘true’ branch...
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1528:17: branch_true: ...to here
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1529:28: acquire_memory: allocated here
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1531:20: branch_true: following ‘true’ branch...
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1532:25: branch_true: ...to here
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1535:28: branch_true: following ‘true’ branch (when the strings are equal)...
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1536:37: branch_true: ...to here
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1536:36: branch_false: following ‘false’ branch...
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1540:41: branch_false: ...to here
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1540:41: throw: if ‘generic_structure_parser’ throws an exception...
nvme-cli-2.16/plugins/ocp/ocp-telemetry-decode.c:1535:37: danger: ‘fopen(&file_path, "w")’ leaks here; was allocated at [(3)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/2)
# 1533|   			fprintf(fp, "%s\n", STR_LOG_PAGE_HEADER);
# 1534|   			fprintf(fp, STR_LINE);
# 1535|-> 			if (!strcmp(options->telemetry_type, "host")) {
# 1536|   				if ((ptelemetry_buffer == NULL) ||
# 1537|   					(ARRAY_SIZE(host_log_page_header) == 0))

Error: GCC_ANALYZER_WARNING (CWE-401): [#def6]
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:462:15: warning[-Wanalyzer-malloc-leak]: leak of ‘data’
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:436:24: acquire_memory: allocated here
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:437:12: branch_false: following ‘false’ branch (when ‘data’ is non-NULL)...
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:442:9: branch_false: ...to here
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:462:15: throw: if ‘nvme_get_log’ throws an exception...
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:462:15: danger: ‘data’ leaks here; was allocated at [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  460|   		.result		= NULL,
#  461|   	};
#  462|-> 	ret = nvme_get_log(&args_len);
#  463|   	if (ret) {
#  464|   		fprintf(stderr,

Error: GCC_ANALYZER_WARNING (CWE-401): [#def7]
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:500:23: warning[-Wanalyzer-malloc-leak]: leak of ‘data’
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:436:24: acquire_memory: allocated here
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:437:12: branch_false: following ‘false’ branch (when ‘data’ is non-NULL)...
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:442:9: branch_false: ...to here
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:463:12: branch_false: following ‘false’ branch...
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:471:30: branch_false: ...to here
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:473:12: branch_true: following ‘true’ branch...
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:475:17: branch_true: ...to here
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:476:24: acquire_memory: allocated here
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:477:20: branch_false: following ‘false’ branch (when ‘data’ is non-NULL)...
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:483:42: branch_false: ...to here
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:500:23: throw: if ‘nvme_get_log’ throws an exception...
nvme-cli-2.16/plugins/sandisk/sandisk-utils.c:500:23: danger: ‘data’ leaks here; was allocated at [(9)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/8)
#  498|   			.result		= NULL,
#  499|   		};
#  500|-> 		ret = nvme_get_log(&args_data);
#  501|   
#  502|   		if (ret) {

Scan Properties

analyzer-version-clippy1.92.0
analyzer-version-cppcheck2.19.1
analyzer-version-gcc16.0.0
analyzer-version-gcc-analyzer16.0.0
analyzer-version-shellcheck0.11.0
analyzer-version-unicontrol0.0.2
diffbase-analyzer-version-clippy1.92.0
diffbase-analyzer-version-cppcheck2.19.1
diffbase-analyzer-version-gcc16.0.0
diffbase-analyzer-version-gcc-analyzer16.0.0
diffbase-analyzer-version-shellcheck0.11.0
diffbase-analyzer-version-unicontrol0.0.2
diffbase-enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
diffbase-exit-code0
diffbase-hostip-172-16-1-79.us-west-2.compute.internal
diffbase-known-false-positives/usr/share/csmock/known-false-positives.js
diffbase-known-false-positives-rpmknown-false-positives-0.0.0.20250521.132812.g8eff701.main-1.el9.noarch
diffbase-mock-configfedora-rawhide-x86_64
diffbase-project-namenvme-cli-2.15-2.fc43
diffbase-store-results-to/tmp/tmpe_wrocd0/nvme-cli-2.15-2.fc43.tar.xz
diffbase-time-created2026-01-08 19:43:37
diffbase-time-finished2026-01-08 19:46:28
diffbase-toolcsmock
diffbase-tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,cppcheck,clippy,shellcheck,unicontrol' '-o' '/tmp/tmpe_wrocd0/nvme-cli-2.15-2.fc43.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpe_wrocd0/nvme-cli-2.15-2.fc43.src.rpm'
diffbase-tool-versioncsmock-3.8.3.20251215.161544.g62de9a5-1.el9
enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
exit-code0
hostip-172-16-1-79.us-west-2.compute.internal
known-false-positives/usr/share/csmock/known-false-positives.js
known-false-positives-rpmknown-false-positives-0.0.0.20250521.132812.g8eff701.main-1.el9.noarch
mock-configfedora-rawhide-x86_64
project-namenvme-cli-2.16-1.fc44
store-results-to/tmp/tmp0bc8olow/nvme-cli-2.16-1.fc44.tar.xz
time-created2026-01-08 19:47:02
time-finished2026-01-08 19:49:23
titleNewly introduced findings
toolcsmock
tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,cppcheck,clippy,shellcheck,unicontrol' '-o' '/tmp/tmp0bc8olow/nvme-cli-2.16-1.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmp0bc8olow/nvme-cli-2.16-1.fc44.src.rpm'
tool-versioncsmock-3.8.3.20251215.161544.g62de9a5-1.el9