git and the Clang Static Analyzer

Hello,

I compiled git/master using the clang 4.0 static analyzer with

scan-build ./configure --with-libpcre --with-openssl scan-build make

and here are the results:
   https://mail.aegee.org/dpa/scan-build-git-4fa66c85f11/

Please note, that the information is only about what gets actually compiled, code disabled by #if .. #endif is not considered (e.g. when determining whether a variable assignment is useless). There are probably false-positives. However in case of e.g. builtin/notes.c:1018, builtin/reset.c:294 or fast-import.c:2057 I consider the hints as justified.

This is for your information, I wouldn't have a problem if you ignore the analysis. When you are worried about javascript, use lynx.

Regards
   Дилян