Fixed findings

List of Findings

Error: CPPCHECK_WARNING (CWE-476): [#def1]
sratom-0.6.18/src/sratom.c:333: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: str
#  331|         const uint8_t byte = ((const uint8_t*)body)[i];
#  332|         str[2U * i]        = hex_chars[byte >> 4U];
#  333|->       str[2U * i + 1U]   = hex_chars[byte & 0x0FU];
#  334|       }
#  335|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def2]
sratom-0.6.18/src/sratom.c:679:5: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘lang_uri’ where non-null expected
sratom-0.6.18/src/sratom.c:884:1: enter_function: entry to ‘sratom_from_turtle’
sratom-0.6.18/src/sratom.c:898:6: branch_true: following ‘true’ branch...
sratom-0.6.18/src/sratom.c:899:25: branch_true: ...to here
sratom-0.6.18/src/sratom.c:902:8: branch_true: following ‘true’ branch...
sratom-0.6.18/src/sratom.c:903:27: branch_true: ...to here
sratom-0.6.18/src/sratom.c:905:10: branch_true: following ‘true’ branch...
sratom-0.6.18/src/sratom.c:906:9: branch_true: ...to here
sratom-0.6.18/src/sratom.c:906:9: call_function: calling ‘sratom_read’ from ‘sratom_from_turtle’
#  677|       char*                    lang_uri     = (char*)calloc(lang_uri_len + 1, 1);
#  678|   
#  679|->     memcpy(lang_uri, prefix, prefix_len + 1);
#  680|       memcpy(lang_uri + prefix_len, language, language_len + 1);
#  681|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def3]
sratom-0.6.18/src/sratom.c:683:27: warning[-Wanalyzer-malloc-leak]: leak of ‘lang_uri’
sratom-0.6.18/src/sratom.c:884:1: enter_function: entry to ‘sratom_from_turtle’
sratom-0.6.18/src/sratom.c:898:6: branch_true: following ‘true’ branch...
sratom-0.6.18/src/sratom.c:899:25: branch_true: ...to here
sratom-0.6.18/src/sratom.c:902:8: branch_true: following ‘true’ branch...
sratom-0.6.18/src/sratom.c:903:27: branch_true: ...to here
sratom-0.6.18/src/sratom.c:905:10: branch_true: following ‘true’ branch...
sratom-0.6.18/src/sratom.c:906:9: branch_true: ...to here
sratom-0.6.18/src/sratom.c:906:9: call_function: calling ‘sratom_read’ from ‘sratom_from_turtle’
#  681|   
#  682|       lv2_atom_forge_literal(
#  683|->       forge, str, len, 0, sratom->map->map(sratom->map->handle, lang_uri));
#  684|       free(lang_uri);
#  685|     } else {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def4]
sratom-0.6.18/test/test_sratom.c:39:29: warning[-Wanalyzer-malloc-leak]: leak of ‘copy_string(uri)’
sratom-0.6.18/test/test_sratom.c:45:1: enter_function: entry to ‘urid_map’
sratom-0.6.18/test/test_sratom.c:56:34: call_function: calling ‘copy_string’ from ‘urid_map’
sratom-0.6.18/test/test_sratom.c:56:34: return_function: returning to ‘urid_map’ from ‘copy_string’
sratom-0.6.18/test/test_sratom.c:39:29: danger: ‘copy_string(uri)’ leaks here; was allocated at [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#   37|   {
#   38|     const size_t len = strlen(str);
#   39|->   char*        dup = (char*)malloc(len + 1);
#   40|     memcpy(dup, str, len + 1);
#   41|     return dup;

Error: CPPCHECK_WARNING (CWE-476): [#def5]
sratom-0.6.18/test/test_sratom.c:40: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: dup
#   38|     const size_t len = strlen(str);
#   39|     char*        dup = (char*)malloc(len + 1);
#   40|->   memcpy(dup, str, len + 1);
#   41|     return dup;
#   42|   }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def6]
sratom-0.6.18/test/test_sratom.c:40:3: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘dup’ where non-null expected
sratom-0.6.18/test/test_sratom.c:39:29: acquire_memory: this call could return NULL
sratom-0.6.18/test/test_sratom.c:40:3: danger: argument 1 (‘dup’) from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#   38|     const size_t len = strlen(str);
#   39|     char*        dup = (char*)malloc(len + 1);
#   40|->   memcpy(dup, str, len + 1);
#   41|     return dup;
#   42|   }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def7]
sratom-0.6.18/test/test_sratom.c:55:3: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
sratom-0.6.18/test/test_sratom.c:84:1: enter_function: entry to ‘test’
sratom-0.6.18/test/test_sratom.c:90:3: call_function: calling ‘lv2_atom_forge_init’ from ‘test’
#   53|     }
#   54|   
#   55|->   uris->uris = (char**)realloc(uris->uris, ++uris->n_uris * sizeof(char*));
#   56|     uris->uris[uris->n_uris - 1] = copy_string(uri);
#   57|     return uris->n_uris;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def8]
sratom-0.6.18/test/test_sratom.c:55:3: warning[-Wanalyzer-malloc-leak]: leak of ‘uris.uris’
sratom-0.6.18/test/test_sratom.c:84:1: enter_function: entry to ‘test’
sratom-0.6.18/test/test_sratom.c:90:3: call_function: calling ‘lv2_atom_forge_init’ from ‘test’
#   53|     }
#   54|   
#   55|->   uris->uris = (char**)realloc(uris->uris, ++uris->n_uris * sizeof(char*));
#   56|     uris->uris[uris->n_uris - 1] = copy_string(uri);
#   57|     return uris->n_uris;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def9]
sratom-0.6.18/test/test_sratom.c:55:24: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
sratom-0.6.18/test/test_sratom.c:84:1: enter_function: entry to ‘test’
sratom-0.6.18/test/test_sratom.c:90:3: call_function: calling ‘lv2_atom_forge_init’ from ‘test’
#   53|     }
#   54|   
#   55|->   uris->uris = (char**)realloc(uris->uris, ++uris->n_uris * sizeof(char*));
#   56|     uris->uris[uris->n_uris - 1] = copy_string(uri);
#   57|     return uris->n_uris;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def10]
sratom-0.6.18/test/test_sratom.c:56:3: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
sratom-0.6.18/test/test_sratom.c:84:1: enter_function: entry to ‘test’
sratom-0.6.18/test/test_sratom.c:86:18: release_memory: ‘uris.uris’ is NULL
sratom-0.6.18/test/test_sratom.c:90:3: call_function: calling ‘lv2_atom_forge_init’ from ‘test’
#   54|   
#   55|     uris->uris = (char**)realloc(uris->uris, ++uris->n_uris * sizeof(char*));
#   56|->   uris->uris[uris->n_uris - 1] = copy_string(uri);
#   57|     return uris->n_uris;
#   58|   }

Scan Properties

analyzer-version-clippy1.92.0
analyzer-version-cppcheck2.19.1
analyzer-version-gcc16.0.0
analyzer-version-gcc-analyzer16.0.0
analyzer-version-shellcheck0.11.0
analyzer-version-unicontrol0.0.2
diffbase-analyzer-version-clippy1.92.0
diffbase-analyzer-version-cppcheck2.19.1
diffbase-analyzer-version-gcc16.0.0
diffbase-analyzer-version-gcc-analyzer16.0.0
diffbase-analyzer-version-shellcheck0.11.0
diffbase-analyzer-version-unicontrol0.0.2
diffbase-enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
diffbase-exit-code0
diffbase-hostip-172-16-1-127.us-west-2.compute.internal
diffbase-known-false-positives/usr/share/csmock/known-false-positives.js
diffbase-known-false-positives-rpmknown-false-positives-0.0.0.20250521.132812.g8eff701.main-1.el9.noarch
diffbase-mock-configfedora-rawhide-x86_64
diffbase-project-namesratom-0.6.20-1.fc44
diffbase-store-results-to/tmp/tmpg5a5i9i1/sratom-0.6.20-1.fc44.tar.xz
diffbase-time-created2026-01-08 21:46:39
diffbase-time-finished2026-01-08 21:48:00
diffbase-toolcsmock
diffbase-tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,cppcheck,clippy,shellcheck,unicontrol' '-o' '/tmp/tmpg5a5i9i1/sratom-0.6.20-1.fc44.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmpg5a5i9i1/sratom-0.6.20-1.fc44.src.rpm'
diffbase-tool-versioncsmock-3.8.3.20251215.161544.g62de9a5-1.el9
enabled-pluginsclippy, cppcheck, gcc, shellcheck, unicontrol
exit-code0
hostip-172-16-1-127.us-west-2.compute.internal
known-false-positives/usr/share/csmock/known-false-positives.js
known-false-positives-rpmknown-false-positives-0.0.0.20250521.132812.g8eff701.main-1.el9.noarch
mock-configfedora-rawhide-x86_64
project-namesratom-0.6.18-2.fc43
store-results-to/tmp/tmp7vze96p7/sratom-0.6.18-2.fc43.tar.xz
time-created2026-01-08 21:44:36
time-finished2026-01-08 21:46:27
titleFixed findings
toolcsmock
tool-args'/usr/bin/csmock' '-r' 'fedora-rawhide-x86_64' '-t' 'gcc,cppcheck,clippy,shellcheck,unicontrol' '-o' '/tmp/tmp7vze96p7/sratom-0.6.18-2.fc43.tar.xz' '--gcc-analyze' '--unicontrol-notests' '--unicontrol-bidi-only' '--install' 'pam' '--gcc-analyzer-bin=/usr/bin/gcc' '/tmp/tmp7vze96p7/sratom-0.6.18-2.fc43.src.rpm'
tool-versioncsmock-3.8.3.20251215.161544.g62de9a5-1.el9