Your message dated Sat, 12 Dec 2020 11:18:51 +0000 with message-id <[email protected]> and subject line Bug#943463: fixed in cppcheck 2.3-1 has caused the Debian Bug report #943463, regarding false positive: loses track of variable modifications via pointers to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 943463: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=943463 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: cppcheck Version: 1.89-4 Severity: normal cppcheck has a couple of new false positives in one of my packages (remctl) that seem to be related to losing track of possible modifications of variables via passing a pointer to that variable to another function. First false positive: wanderer:~$ cat foo.c #include <some_header.h> #include <stdio.h> int main(void) { static char *buffer = NULL; if (some_function((LPTSTR) &buffer) != 0) { char *p; p = strchr(buffer, '\r'); printf("%p\n", p); } } wanderer:~$ cppcheck foo.c Checking foo.c ... foo.c:12:20: warning: Possible null pointer dereference: buffer [nullPointer] p = strchr(buffer, '\r'); ^ foo.c:7:27: note: Assignment 'buffer=NULL', assigned value is 0 static char *buffer = NULL; ^ foo.c:12:20: note: Null pointer dereference p = strchr(buffer, '\r'); ^ The cast to (LPTSTR) is required for it to get confused and not realize that buffer may have been modified. (This is a reduced test case from some portability code for Windows systems.) Second false positive: wanderer:~$ cat foo.c #include <php.h> int main(void) { int status; long hlen = 0; status = zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &hlen); if (status == FAILURE) RETURN_FALSE; if (hlen == 0) RETURN_FALSE; RETURN_TRUE; } wanderer:~$ cppcheck --enable=style foo.c Checking foo.c ... foo.c:12:14: style: The expression 'hlen == 0' is always true. [knownConditionTrueFalse] if (hlen == 0) ^ foo.c:7:17: note: 'hlen' is assigned value '0' here. long hlen = 0; ^ foo.c:12:14: note: The expression 'hlen == 0' is always true. if (hlen == 0) ^ This is reduced from some PHP module code. Same basic problem: cppcheck doesn't realize that zend_parse_parameters() may initialize hlen. You can get a different variation by removing the = 0 initialization, at which point cppcheck will complain that hlen is used uninitialized. -- System Information: Debian Release: bullseye/sid APT prefers unstable APT policy: (990, 'unstable'), (500, 'unstable-debug'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 5.2.0-3-amd64 (SMP w/8 CPU cores) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages cppcheck depends on: ii libc6 2.29-2 ii libgcc1 1:9.2.1-9 ii libpcre3 2:8.39-12+b1 ii libstdc++6 9.2.1-9 ii libtinyxml2-6a 7.0.0+dfsg-1+b1 ii python3 3.7.5-1 ii python3-pygments 2.3.1+dfsg-1 cppcheck recommends no packages. Versions of packages cppcheck suggests: pn cppcheck-gui <none> -- no debconf information
--- End Message ---
--- Begin Message ---Source: cppcheck Source-Version: 2.3-1 Done: Joachim Reichel <[email protected]> We believe that the bug you reported is fixed in the latest version of cppcheck, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Joachim Reichel <[email protected]> (supplier of updated cppcheck package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Sat, 12 Dec 2020 11:26:59 +0100 Source: cppcheck Architecture: source Version: 2.3-1 Distribution: unstable Urgency: medium Maintainer: Joachim Reichel <[email protected]> Changed-By: Joachim Reichel <[email protected]> Closes: 943463 Changes: cppcheck (2.3-1) unstable; urgency=medium . * New upstream release (Closes: #943463). - Removed patch use-system-tinyxml (proper cmake option now). - Remove patch fix-translation-loading (no longer necessary). * Add libz3-dev to Build-Depends:, add -DUSE_Z3=ON to cmake options. * Use debhelper compat version 13 (no changes needed). * Update Standards-Version to 4.5.1 (no changes needed). Checksums-Sha1: 3911744e08d59814badfeb2005bdd8fbb614665d 2130 cppcheck_2.3-1.dsc 551147ef28b5c3a4c20e1457d7c10a5c368015fe 3594620 cppcheck_2.3.orig.tar.gz 81bad4f09cc374fd11c771212ce4044a14cc6332 10052 cppcheck_2.3-1.debian.tar.xz 79fbc1e3e16b648ab595915f64889b4d2cb6fdf8 12789 cppcheck_2.3-1_amd64.buildinfo Checksums-Sha256: 6c2c19e8e9fa280c5e2255290f6e5a240bcfbd1bfc8d25bc329261415e2e889b 2130 cppcheck_2.3-1.dsc 695ab99ade350c89f41e730c6de87b611e5d0a0cdde5bb0abaf9241fc6d7c483 3594620 cppcheck_2.3.orig.tar.gz 618593368717221253b8d0362eeca01704fdcea4e2c7da09221ecbacc550aa5d 10052 cppcheck_2.3-1.debian.tar.xz a13fb914f87fdee9a6f3456b651e7e8d784035265dc7c45b3ce9b7214afacb1f 12789 cppcheck_2.3-1_amd64.buildinfo Files: a4bcfad3617ae65ced14d85878c32da4 2130 devel optional cppcheck_2.3-1.dsc 71e6b8b41b8ce3919f79790f0bf1a043 3594620 devel optional cppcheck_2.3.orig.tar.gz 3992441b5fcf39f19aa9577d7fc48c8f 10052 devel optional cppcheck_2.3-1.debian.tar.xz f83ed8067dc38037f4c6229a23b38515 12789 devel optional cppcheck_2.3-1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEErX6NzLwwsr4xjsEVuPr/HEOIZ3EFAl/UoX0ACgkQuPr/HEOI Z3EdpxAAgPyFmrs1swu6wJZQGcuMwVAjD+hKHvBIVmNeqIAqSzaoP4/xZYURpsFq nbC5hOyMQIZt15iGdtyj4znPfF/aRWPDa2jPjnBxyhlKgIsmdkDxa6nhRiL4Qv8k zEa9pgGzcZeEiAl5pw2/xw2PV4+j5y46TELbT/xrIG9zmzV9goF/y6JkkhgS4C11 cvSe+x7eeiKFZNW5mQRpRss5eiCnz7/x7y6S4DMj/aGtf7qfbSulRhLjNDylkhvy amvj93s+0hoqFk79ToFItTODD8oDf8cpHsXpkYN7qtzDn3tsAbqycEYkJ6Syjtu2 wW920zLggdy09jVk4km95Ropt07IyybZ3H0xPSd+qOCm+InIWZovx1naaKSzRH5B /JsDPFCj1QUrXTChtAEpx4zMUIIidpQhRsxl5QJFjk4aMUl1yyr1FAABo6a/biRf z+RbgQ0zzs6XBiiyqr4S8scuPW6BMB2CvhgY4rZinCChVCrpfDmbSQs/6NoieNEk XzOtIrBLkcv/RnwEoeBxJ7lnCgrsG4gr+uE/45xnBksb3Awv6KckEgoDmkFegYS+ 2U4TBNDZRZd1XGbsrm5HsP2HWckjy9wdKSS4gVWur/zxtfotMUMbe9w0VpQKVDZ/ IP0jS1PP1RjeXPeMbByM6djr3b6SI4CUpWu5bLSKGngzMSMkyhE= =+WcN -----END PGP SIGNATURE-----
--- End Message ---
