{"thread":{"id":"48159","subject":"Fwd: New Defects reported by Coverity Scan for git","startedAt":"2018-03-26T23:39:19Z","lastAt":"2018-03-27T10:38:40Z","messageCount":2,"participants":["Stefan Beller","Jeff Hostetler"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"343091","messageId":"CAGZ79kbAOcwaRzjuMtZ_HVsYvUr_7UAPbOcnrmPgsdE19q=PrQ@mail.gmail.com","threadId":"48159","inReplyTo":null,"subject":"Fwd: New Defects reported by Coverity Scan for git","fromName":"Stefan Beller","fromEmail":"sbeller@google.com","sentAt":"2018-03-26T23:39:11Z","receivedAt":"2018-03-26T23:39:19Z","isPatch":false,"sender":{"key":"stefanbeller@gmail.com","avatar":"https://avatars.githubusercontent.com/u/455868?v=4"},"body":"coverity scan failed for the last couple month (since Nov 20th)\nwithout me noticing, I plan on running it again nightly for the\nGit project.\n\nAnyway, here are issues that piled up (in origin/pu) since then.\n\nStefan\n\n\n---------- Forwarded message ----------\nFrom:  <scan-admin@coverity.com>\nDate: Mon, Mar 26, 2018 at 4:24 PM\nSubject: New Defects reported by Coverity Scan for git\nTo: sbeller@google.com\n\n\nHi,\n\nPlease find the latest report on new defect(s) introduced to git found\nwith Coverity Scan.\n\n44 new defect(s) introduced to git found with Coverity Scan.\n32 defect(s), reported by Coverity Scan earlier, were marked fixed in\nthe recent build analyzed by Coverity Scan.\n\nNew defect(s) Reported-by: Coverity Scan\nShowing 20 of 44 defect(s)\n\n\n** CID 1433546:  Resource leaks  (RESOURCE_LEAK)\n/t/helper/test-path-utils.c: 236 in cmd__path_utils()\n\n\n________________________________________________________________________________________________________\n*** CID 1433546:  Resource leaks  (RESOURCE_LEAK)\n/t/helper/test-path-utils.c: 236 in cmd__path_utils()\n230             if (argc >= 4 && !strcmp(argv[1], \"prefix_path\")) {\n231                     const char *prefix = argv[2];\n232                     int prefix_len = strlen(prefix);\n233                     int nongit_ok;\n234                     setup_git_directory_gently(&nongit_ok);\n235                     while (argc > 3) {\n>>>     CID 1433546:  Resource leaks  (RESOURCE_LEAK)\n>>>     Failing to save or free storage allocated by \"prefix_path(prefix, prefix_len, argv[3])\" leaks it.\n236                             puts(prefix_path(prefix, prefix_len, argv[3]));\n237                             argc--;\n238                             argv++;\n239                     }\n240                     return 0;\n241             }\n\n** CID 1433545:  Security best practices violations  (STRING_OVERFLOW)\n/merge-recursive.c: 1955 in check_dir_renamed()\n\n\n________________________________________________________________________________________________________\n*** CID 1433545:  Security best practices violations  (STRING_OVERFLOW)\n/merge-recursive.c: 1955 in check_dir_renamed()\n1949                                                      struct\nhashmap *dir_renames)\n1950     {\n1951            char temp[PATH_MAX];\n1952            char *end;\n1953            struct dir_rename_entry *entry;\n1954\n>>>     CID 1433545:  Security best practices violations  (STRING_OVERFLOW)\n>>>     You might overrun the 4096-character fixed-size string \"temp\" by copying \"path\" without checking the length.\n1955            strcpy(temp, path);\n1956            while ((end = strrchr(temp, '/'))) {\n1957                    *end = '\\0';\n1958                    entry = dir_rename_find_entry(dir_renames, temp);\n1959                    if (entry)\n1960                            return entry;\n\n** CID 1433544:  Resource leaks  (RESOURCE_LEAK)\n/builtin/submodule--helper.c: 66 in print_default_remote()\n\n\n________________________________________________________________________________________________________\n*** CID 1433544:  Resource leaks  (RESOURCE_LEAK)\n/builtin/submodule--helper.c: 66 in print_default_remote()\n60              die(_(\"submodule--helper print-default-remote takes no\narguments\"));\n61\n62      remote = get_default_remote();\n63      if (remote)\n64              printf(\"%s\\n\", remote);\n65\n>>>     CID 1433544:  Resource leaks  (RESOURCE_LEAK)\n>>>     Variable \"remote\" going out of scope leaks the storage it points to.\n66      return 0;\n67     }\n68\n69     static int starts_with_dot_slash(const char *str)\n70     {\n71      return str[0] == '.' && is_dir_sep(str[1]);\n\n** CID 1433543:  Null pointer dereferences  (NULL_RETURNS)\n/merge-recursive.c: 812 in was_dirty()\n\n\n________________________________________________________________________________________________________\n*** CID 1433543:  Null pointer dereferences  (NULL_RETURNS)\n/merge-recursive.c: 812 in was_dirty()\n806             int dirty = 1;\n807\n808             if (o->call_depth || !was_tracked(path))\n809                     return !dirty;\n810\n811             ce = cache_file_exists(path, strlen(path), ignore_case);\n>>>     CID 1433543:  Null pointer dereferences  (NULL_RETURNS)\n>>>     Dereferencing a null pointer \"ce\".\n812             dirty = (ce->ce_stat_data.sd_mtime.sec > 0 &&\n813                      verify_uptodate(ce, &o->unpack_opts) != 0);\n814             return dirty;\n815     }\n816\n817     static int make_room_for_path(struct merge_options *o, const char *path)\n\n** CID 1433542:  Error handling issues  (CHECKED_RETURN)\n/merge-recursive.c: 2162 in apply_directory_rename_modifications()\n\n\n________________________________________________________________________________________________________\n*** CID 1433542:  Error handling issues  (CHECKED_RETURN)\n/merge-recursive.c: 2162 in apply_directory_rename_modifications()\n2156             * \"NOTE\" in update_stages(), doing so will modify the current\n2157             * in-memory index which will break calls to\nwould_lose_untracked()\n2158             * that we need to make.  Instead, we need to just\nmake sure that\n2159             * the various conflict_rename_*() functions update the index\n2160             * explicitly rather than relying on unpack_trees() to\nhave done it.\n2161             */\n>>>     CID 1433542:  Error handling issues  (CHECKED_RETURN)\n>>>     Calling \"get_tree_entry\" without checking return value (as is done elsewhere 13 out of 16 times).\n2162            get_tree_entry(&tree->object.oid,\n2163                           pair->two->path,\n2164                           &re->dst_entry->stages[stage].oid,\n2165                           &re->dst_entry->stages[stage].mode);\n2166\n2167            /* Update pair status */\n\n** CID 1433541:  Resource leaks  (RESOURCE_LEAK)\n/t/helper/test-path-utils.c: 246 in cmd__path_utils()\n\n\n________________________________________________________________________________________________________\n*** CID 1433541:  Resource leaks  (RESOURCE_LEAK)\n/t/helper/test-path-utils.c: 246 in cmd__path_utils()\n240                     return 0;\n241             }\n242\n243             if (argc == 4 && !strcmp(argv[1], \"strip_path_suffix\")) {\n244                     char *prefix = strip_path_suffix(argv[2], argv[3]);\n245                     printf(\"%s\\n\", prefix ? prefix : \"(null)\");\n>>>     CID 1433541:  Resource leaks  (RESOURCE_LEAK)\n>>>     Variable \"prefix\" going out of scope leaks the storage it points to.\n246                     return 0;\n247             }\n248\n249             if (argc == 3 && !strcmp(argv[1], \"print_path\")) {\n250                     puts(argv[2]);\n251                     return 0;\n\n** CID 1433540:  Null pointer dereferences  (REVERSE_INULL)\n/upload-pack.c: 834 in process_deepen_since()\n\n\n________________________________________________________________________________________________________\n*** CID 1433540:  Null pointer dereferences  (REVERSE_INULL)\n/upload-pack.c: 834 in process_deepen_since()\n828     static int process_deepen_since(const char *line, timestamp_t\n*deepen_since, int *deepen_rev_list)\n829     {\n830             const char *arg;\n831             if (skip_prefix(line, \"deepen-since \", &arg)) {\n832                     char *end = NULL;\n833                     *deepen_since = parse_timestamp(arg, &end, 0);\n>>>     CID 1433540:  Null pointer dereferences  (REVERSE_INULL)\n>>>     Null-checking \"deepen_since\" suggests that it may be null, but it has already been dereferenced on all paths leading to the check.\n834                     if (!end || *end || !deepen_since ||\n835                         /* revisions.c's max_age -1 is special */\n836                         *deepen_since == -1)\n837                             die(\"Invalid deepen-since: %s\", line);\n838                     *deepen_rev_list = 1;\n839                     return 1;\n\n** CID 1433539:  Null pointer dereferences  (FORWARD_NULL)\n\n\n________________________________________________________________________________________________________\n*** CID 1433539:  Null pointer dereferences  (FORWARD_NULL)\n/t/helper/test-json-writer.c: 278 in scripted()\n272             struct json_writer jw = JSON_WRITER_INIT;\n273             int k;\n274\n275             if (!strcmp(argv[0], \"@object\"))\n276                     jw_object_begin(&jw);\n277             else if (!strcmp(argv[0], \"@array\"))\n>>>     CID 1433539:  Null pointer dereferences  (FORWARD_NULL)\n>>>     Passing \"&jw\" to \"jw_array_begin\", which dereferences null \"jw.levels\".\n278                     jw_array_begin(&jw);\n279             else\n280                     die(\"first script term must be '@object' or\n'@array': '%s'\", argv[0]);\n281\n282             for (k = 1; k < argc; k++) {\n283                     const char *a_k = argv[k];\n\n** CID 1433538:  Null pointer dereferences  (FORWARD_NULL)\n\n\n________________________________________________________________________________________________________\n*** CID 1433538:  Null pointer dereferences  (FORWARD_NULL)\n/t/helper/test-sha1-array.c: 23 in cmd__sha1_array()\n17              const char *arg;\n18              struct object_id oid;\n19\n20              if (skip_prefix(line.buf, \"append \", &arg)) {\n21                      if (get_oid_hex(arg, &oid))\n22                              die(\"not a hexadecimal SHA1: %s\", arg);\n>>>     CID 1433538:  Null pointer dereferences  (FORWARD_NULL)\n>>>     Passing \"&array\" to \"oid_array_append\", which dereferences null \"array.oid\".\n23                      oid_array_append(&array, &oid);\n24              } else if (skip_prefix(line.buf, \"lookup \", &arg)) {\n25                      if (get_oid_hex(arg, &oid))\n26                              die(\"not a hexadecimal SHA1: %s\", arg);\n27                      printf(\"%d\\n\", oid_array_lookup(&array, &oid));\n28              } else if (!strcmp(line.buf, \"clear\"))\n\n** CID 1433537:    (FORWARD_NULL)\n/merge-recursive.c: 1796 in handle_directory_level_conflicts()\n/merge-recursive.c: 1791 in handle_directory_level_conflicts()\n\n\n________________________________________________________________________________________________________\n*** CID 1433537:    (FORWARD_NULL)\n/merge-recursive.c: 1796 in handle_directory_level_conflicts()\n1790                            strbuf_release(&head_ent->new_dir);\n1791                            string_list_append(&remove_from_merge,\n1792\nmerge_ent->dir)->util = merge_ent;\n1793                            strbuf_release(&merge_ent->new_dir);\n1794                    } else if (tree_has_path(head, head_ent->dir)) {\n1795                            /* 2. This wasn't a directory rename\nafter all */\n>>>     CID 1433537:    (FORWARD_NULL)\n>>>     Dereferencing null pointer \"string_list_append(&remove_from_head, head_ent->dir)\".\n1796                            string_list_append(&remove_from_head,\n1797\nhead_ent->dir)->util = head_ent;\n1798                            strbuf_release(&head_ent->new_dir);\n1799                    }\n1800            }\n1801\n/merge-recursive.c: 1791 in handle_directory_level_conflicts()\n1785                        !merge_ent->non_unique_new_dir &&\n1786                        !strbuf_cmp(&head_ent->new_dir,\n&merge_ent->new_dir)) {\n1787                            /* 1. Renamed identically; remove it\nfrom both sides */\n1788                            string_list_append(&remove_from_head,\n1789\nhead_ent->dir)->util = head_ent;\n1790                            strbuf_release(&head_ent->new_dir);\n>>>     CID 1433537:    (FORWARD_NULL)\n>>>     Dereferencing null pointer \"string_list_append(&remove_from_merge, merge_ent->dir)\".\n1791                            string_list_append(&remove_from_merge,\n1792\nmerge_ent->dir)->util = merge_ent;\n1793                            strbuf_release(&merge_ent->new_dir);\n1794                    } else if (tree_has_path(head, head_ent->dir)) {\n1795                            /* 2. This wasn't a directory rename\nafter all */\n1796                            string_list_append(&remove_from_head,\n\n** CID 1433536:    (RESOURCE_LEAK)\n/t/helper/test-delta.c: 34 in cmd__delta()\n/t/helper/test-delta.c: 48 in cmd__delta()\n/t/helper/test-delta.c: 75 in cmd__delta()\n/t/helper/test-delta.c: 78 in cmd__delta()\n\n\n________________________________________________________________________________________________________\n*** CID 1433536:    (RESOURCE_LEAK)\n/t/helper/test-delta.c: 34 in cmd__delta()\n28              return 1;\n29      }\n30\n31      fd = open(argv[2], O_RDONLY);\n32      if (fd < 0 || fstat(fd, &st)) {\n33              perror(argv[2]);\n>>>     CID 1433536:    (RESOURCE_LEAK)\n>>>     Handle variable \"fd\" going out of scope leaks the handle.\n34              return 1;\n35      }\n36      from_size = st.st_size;\n37      from_buf = mmap(NULL, from_size, PROT_READ, MAP_PRIVATE, fd, 0);\n38      if (from_buf == MAP_FAILED) {\n39              perror(argv[2]);\n/t/helper/test-delta.c: 48 in cmd__delta()\n42      }\n43      close(fd);\n44\n45      fd = open(argv[3], O_RDONLY);\n46      if (fd < 0 || fstat(fd, &st)) {\n47              perror(argv[3]);\n>>>     CID 1433536:    (RESOURCE_LEAK)\n>>>     Handle variable \"fd\" going out of scope leaks the handle.\n48              return 1;\n49      }\n50      data_size = st.st_size;\n51      data_buf = mmap(NULL, data_size, PROT_READ, MAP_PRIVATE, fd, 0);\n52      if (data_buf == MAP_FAILED) {\n53              perror(argv[3]);\n/t/helper/test-delta.c: 75 in cmd__delta()\n69              return 1;\n70      }\n71\n72      fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666);\n73      if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) {\n74              perror(argv[4]);\n>>>     CID 1433536:    (RESOURCE_LEAK)\n>>>     Handle variable \"fd\" going out of scope leaks the handle.\n75              return 1;\n76      }\n77\n78      return 0;\n/t/helper/test-delta.c: 78 in cmd__delta()\n72      fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666);\n73      if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) {\n74              perror(argv[4]);\n75              return 1;\n76      }\n77\n>>>     CID 1433536:    (RESOURCE_LEAK)\n>>>     Handle variable \"fd\" going out of scope leaks the handle.\n78      return 0;\n\n** CID 1433535:  Error handling issues  (CHECKED_RETURN)\n/builtin/grep.c: 491 in grep_cache()\n\n\n________________________________________________________________________________________________________\n*** CID 1433535:  Error handling issues  (CHECKED_RETURN)\n/builtin/grep.c: 491 in grep_cache()\n485             int name_base_len = 0;\n486             if (repo->submodule_prefix) {\n487                     name_base_len = strlen(repo->submodule_prefix);\n488                     strbuf_addstr(&name, repo->submodule_prefix);\n489             }\n490\n>>>     CID 1433535:  Error handling issues  (CHECKED_RETURN)\n>>>     Calling \"repo_read_index\" without checking return value (as is done elsewhere 4 out of 5 times).\n491             repo_read_index(repo);\n492\n493             for (nr = 0; nr < repo->index->cache_nr; nr++) {\n494                     const struct cache_entry *ce = repo->index->cache[nr];\n495                     strbuf_setlen(&name, name_base_len);\n496                     strbuf_addstr(&name, ce->name);\n\n** CID 1433534:  Resource leaks  (RESOURCE_LEAK)\n/t/helper/test-mktemp.c: 12 in cmd__mktemp()\n\n\n________________________________________________________________________________________________________\n*** CID 1433534:  Resource leaks  (RESOURCE_LEAK)\n/t/helper/test-mktemp.c: 12 in cmd__mktemp()\n6\n7     int cmd__mktemp(int argc, const char **argv)\n8     {\n9       if (argc != 2)\n10              usage(\"Expected 1 parameter defining the temporary\nfile template\");\n11\n>>>     CID 1433534:  Resource leaks  (RESOURCE_LEAK)\n>>>     Failing to save or free storage allocated by \"xstrdup(argv[1])\" leaks it.\n12      xmkstemp(xstrdup(argv[1]));\n13\n14      return 0;\n\n** CID 1433533:    (RESOURCE_LEAK)\n/t/helper/test-delta.c: 48 in cmd__delta()\n/t/helper/test-delta.c: 55 in cmd__delta()\n/t/helper/test-delta.c: 69 in cmd__delta()\n/t/helper/test-delta.c: 75 in cmd__delta()\n/t/helper/test-delta.c: 78 in cmd__delta()\n\n\n________________________________________________________________________________________________________\n*** CID 1433533:    (RESOURCE_LEAK)\n/t/helper/test-delta.c: 48 in cmd__delta()\n42      }\n43      close(fd);\n44\n45      fd = open(argv[3], O_RDONLY);\n46      if (fd < 0 || fstat(fd, &st)) {\n47              perror(argv[3]);\n>>>     CID 1433533:    (RESOURCE_LEAK)\n>>>     Variable \"from_buf\" going out of scope leaks the storage it points to.\n48              return 1;\n49      }\n50      data_size = st.st_size;\n51      data_buf = mmap(NULL, data_size, PROT_READ, MAP_PRIVATE, fd, 0);\n52      if (data_buf == MAP_FAILED) {\n53              perror(argv[3]);\n/t/helper/test-delta.c: 55 in cmd__delta()\n49      }\n50      data_size = st.st_size;\n51      data_buf = mmap(NULL, data_size, PROT_READ, MAP_PRIVATE, fd, 0);\n52      if (data_buf == MAP_FAILED) {\n53              perror(argv[3]);\n54              close(fd);\n>>>     CID 1433533:    (RESOURCE_LEAK)\n>>>     Variable \"from_buf\" going out of scope leaks the storage it points to.\n55              return 1;\n56      }\n57      close(fd);\n58\n59      if (argv[1][1] == 'd')\n60              out_buf = diff_delta(from_buf, from_size,\n/t/helper/test-delta.c: 69 in cmd__delta()\n63      else\n64              out_buf = patch_delta(from_buf, from_size,\n65                                    data_buf, data_size,\n66                                    &out_size);\n67      if (!out_buf) {\n68              fprintf(stderr, \"delta operation failed (returned NULL)\\n\");\n>>>     CID 1433533:    (RESOURCE_LEAK)\n>>>     Variable \"from_buf\" going out of scope leaks the storage it points to.\n69              return 1;\n70      }\n71\n72      fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666);\n73      if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) {\n74              perror(argv[4]);\n/t/helper/test-delta.c: 75 in cmd__delta()\n69              return 1;\n70      }\n71\n72      fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666);\n73      if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) {\n74              perror(argv[4]);\n>>>     CID 1433533:    (RESOURCE_LEAK)\n>>>     Variable \"from_buf\" going out of scope leaks the storage it points to.\n75              return 1;\n76      }\n77\n78      return 0;\n/t/helper/test-delta.c: 78 in cmd__delta()\n72      fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666);\n73      if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) {\n74              perror(argv[4]);\n75              return 1;\n76      }\n77\n>>>     CID 1433533:    (RESOURCE_LEAK)\n>>>     Variable \"from_buf\" going out of scope leaks the storage it points to.\n78      return 0;\n\n** CID 1433532:    (RESOURCE_LEAK)\n/t/helper/test-delta.c: 75 in cmd__delta()\n/t/helper/test-delta.c: 78 in cmd__delta()\n/t/helper/test-delta.c: 75 in cmd__delta()\n\n\n________________________________________________________________________________________________________\n*** CID 1433532:    (RESOURCE_LEAK)\n/t/helper/test-delta.c: 75 in cmd__delta()\n69              return 1;\n70      }\n71\n72      fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666);\n73      if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) {\n74              perror(argv[4]);\n>>>     CID 1433532:    (RESOURCE_LEAK)\n>>>     Variable \"out_buf\" going out of scope leaks the storage it points to.\n75              return 1;\n76      }\n77\n78      return 0;\n/t/helper/test-delta.c: 78 in cmd__delta()\n72      fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666);\n73      if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) {\n74              perror(argv[4]);\n75              return 1;\n76      }\n77\n>>>     CID 1433532:    (RESOURCE_LEAK)\n>>>     Variable \"out_buf\" going out of scope leaks the storage it points to.\n78      return 0;\n/t/helper/test-delta.c: 75 in cmd__delta()\n69              return 1;\n70      }\n71\n72      fd = open (argv[4], O_WRONLY|O_CREAT|O_TRUNC, 0666);\n73      if (fd < 0 || write_in_full(fd, out_buf, out_size) < 0) {\n74              perror(argv[4]);\n>>>     CID 1433532:    (RESOURCE_LEAK)\n>>>     Variable \"out_buf\" going out of scope leaks the storage it points to.\n75              return 1;\n76      }\n77\n78      return 0;\n\n** CID 1433531:  Null pointer dereferences  (FORWARD_NULL)\n\n\n________________________________________________________________________________________________________\n*** CID 1433531:  Null pointer dereferences  (FORWARD_NULL)\n/builtin/submodule--helper.c: 1045 in module_deinit()\n1039                                       module_deinit_options);\n1040            }\n1041\n1042            if (!argc && !all)\n1043                    die(_(\"Use '--all' if you really want to\ndeinitialize all submodules\"));\n1044\n>>>     CID 1433531:  Null pointer dereferences  (FORWARD_NULL)\n>>>     Passing \"&list\" to \"module_list_compute\", which dereferences null \"list.entries\".\n1045            if (module_list_compute(argc, argv, prefix, &pathspec,\n&list) < 0)\n1046                    BUG(\"module_list_compute should not choke on\nempty pathspec\");\n1047\n1048            info.prefix = prefix;\n1049            if (quiet)\n1050                    info.flags |= OPT_QUIET;\n\n** CID 1433530:    (FORWARD_NULL)\n\n\n________________________________________________________________________________________________________\n*** CID 1433530:    (FORWARD_NULL)\n/run-command.c: 574 in trace_add_env()\n568             for (e = deltaenv; e && *e; e++) {\n569                     struct strbuf key = STRBUF_INIT;\n570                     char *equals = strchr(*e, '=');\n571\n572                     if (equals) {\n573                             strbuf_add(&key, *e, equals - *e);\n>>>     CID 1433530:    (FORWARD_NULL)\n>>>     Passing \"&envs\" to \"string_list_insert\", which dereferences null \"envs.items\".\n574                             string_list_insert(&envs,\nkey.buf)->util = equals + 1;\n575                     } else {\n576                             string_list_insert(&envs, *e)->util = NULL;\n577                     }\n578                     strbuf_release(&key);\n579             }\n/run-command.c: 576 in trace_add_env()\n570                     char *equals = strchr(*e, '=');\n571\n572                     if (equals) {\n573                             strbuf_add(&key, *e, equals - *e);\n574                             string_list_insert(&envs,\nkey.buf)->util = equals + 1;\n575                     } else {\n>>>     CID 1433530:    (FORWARD_NULL)\n>>>     Passing \"&envs\" to \"string_list_insert\", which dereferences null \"envs.items\".\n576                             string_list_insert(&envs, *e)->util = NULL;\n577                     }\n578                     strbuf_release(&key);\n579             }\n580\n581             /* \"unset X Y...;\" */\n\n** CID 1433529:  Control flow issues  (DEADCODE)\n/upload-pack.c: 1419 in upload_pack_v2()\n\n\n________________________________________________________________________________________________________\n*** CID 1433529:  Control flow issues  (DEADCODE)\n/upload-pack.c: 1419 in upload_pack_v2()\n1413                            send_shallow_info(&data);\n1414\n1415                            packet_write_fmt(1, \"packfile\\n\");\n1416                            create_pack_file();\n1417                            state = FETCH_DONE;\n1418                            break;\n>>>     CID 1433529:  Control flow issues  (DEADCODE)\n>>>     Execution cannot reach this statement: \"case FETCH_DONE:\".\n1419                    case FETCH_DONE:\n1420                            continue;\n1421                    }\n1422            }\n1423\n1424            upload_pack_data_clear(&data);\n\n** CID 1433528:  Null pointer dereferences  (FORWARD_NULL)\n\n\n________________________________________________________________________________________________________\n*** CID 1433528:  Null pointer dereferences  (FORWARD_NULL)\n/convert.c: 411 in encode_to_git()\n405              * the content. Let's answer with \"yes\", since an encoding was\n406              * specified.\n407              */\n408             if (!buf && !src)\n409                     return 1;\n410\n>>>     CID 1433528:  Null pointer dereferences  (FORWARD_NULL)\n>>>     Passing null pointer \"src\" to \"validate_encoding\", which dereferences it.\n411             if (validate_encoding(path, enc, src, src_len, die_on_error))\n412                     return 0;\n413\n414             trace_encoding(\"source\", path, enc, src, src_len);\n415             dst = reencode_string_len(src, src_len, default_encoding, enc,\n416                                       &dst_len);\n\n** CID 1433527:  Control flow issues  (DEADCODE)\n/fetch-pack.c: 1396 in do_fetch_pack_v2()\n\n\n________________________________________________________________________________________________________\n*** CID 1433527:  Control flow issues  (DEADCODE)\n/fetch-pack.c: 1396 in do_fetch_pack_v2()\n1390                            process_section_header(&reader, \"packfile\", 0);\n1391                            if (get_pack(args, fd, pack_lockfile))\n1392                                    die(_(\"git fetch-pack: fetch failed.\"));\n1393\n1394                            state = FETCH_DONE;\n1395                            break;\n>>>     CID 1433527:  Control flow issues  (DEADCODE)\n>>>     Execution cannot reach this statement: \"case FETCH_DONE:\".\n1396                    case FETCH_DONE:\n1397                            continue;\n1398                    }\n1399            }\n1400\n1401            oidset_clear(&common);\n\n\n________________________________________________________________________________________________________\nTo view the defects in Coverity Scan visit,\nhttps://u2389337.ct.sendgrid.net/wf/click?upn=08onrYu34A-2BWcWUl-2F-2BfV0V05UPxvVjWch-2Bd2MGckcRb8HAP5hlBzHe8sORKm64S-2F81GsNbRdSrOteP-2FXoviMkw-3D-3D_PwiGIFugGOKqSZ6DZhASdI2SvWKInry4kHBXrJUc9pmXl6RPFKKio5QDumyeOncb-2B03DyHottfRb-2BR0vAZZ-2BouFuqkpeG83Y-2BMRBesAVhj5GrGot1mbZe20ytg0ii7TqV60O843zCVEbFTCr2Fj7-2Byv7sYi9qWRfEPYF5wF-2BAudpsWONlHafz3S2f-2F0Lk0mNQz1ZEGGEFx2qj7TNc4JugAxaJzb7JKTcIW0OPzH-2BQxU-3D\n"},{"id":"343120","messageId":"95add9fa-85f2-4c2b-4610-dc32edd78acf@jeffhostetler.com","threadId":"48159","inReplyTo":"CAGZ79kbAOcwaRzjuMtZ_HVsYvUr_7UAPbOcnrmPgsdE19q=PrQ@mail.gmail.com","subject":"Re: Fwd: New Defects reported by Coverity Scan for git","fromName":"Jeff Hostetler","fromEmail":"git@jeffhostetler.com","sentAt":"2018-03-27T10:38:35Z","receivedAt":"2018-03-27T10:38:40Z","isPatch":false,"sender":{"key":"git@jeffhostetler.com","avatar":null},"body":"\n\nOn 3/26/2018 7:39 PM, Stefan Beller wrote:\n> coverity scan failed for the last couple month (since Nov 20th)\n> without me noticing, I plan on running it again nightly for the\n> Git project.\n> \n> Anyway, here are issues that piled up (in origin/pu) since then.\n> \n> Stefan\n> \n> \n> ---------- Forwarded message ----------\n[...]\n________________________________________________________________________________________________________\n> *** CID 1433539:  Null pointer dereferences  (FORWARD_NULL)\n> /t/helper/test-json-writer.c: 278 in scripted()\n> 272             struct json_writer jw = JSON_WRITER_INIT;\n> 273             int k;\n> 274\n> 275             if (!strcmp(argv[0], \"@object\"))\n> 276                     jw_object_begin(&jw);\n> 277             else if (!strcmp(argv[0], \"@array\"))\n>>>>      CID 1433539:  Null pointer dereferences  (FORWARD_NULL)\n>>>>      Passing \"&jw\" to \"jw_array_begin\", which dereferences null \"jw.levels\".\n> 278                     jw_array_begin(&jw);\n> 279             else\n> 280                     die(\"first script term must be '@object' or\n> '@array': '%s'\", argv[0]);\n> 281\n> 282             for (k = 1; k < argc; k++) {\n> 283                     const char *a_k = argv[k];\n> \n> ** CID 1433538:  Null pointer dereferences  (FORWARD_NULL)\n> \n\nThe \"jw.levels\" field has been removed in the json-writer V4 reroll,\nso this isn't an issue going forward.\n\nThanks,\nJeff\n"}]}