From: Дилян Палаузов <dilyan.palauzov@aegee.org>
Date: Sun, 07 May 2017 11:50:54 GMT
Subject: git and the Clang Static Analyzer
Message-ID: <5696a8a3-0a17-18ac-8da4-4556586acee7@aegee.org>

Hello,

I compiled git/master using the clang 4.0 static analyzer with

scan-build ./configure --with-libpcre --with-openssl
scan-build make

and here are the results:
   https://mail.aegee.org/dpa/scan-build-git-4fa66c85f11/

Please note, that the information is only about what gets actually 
compiled, code disabled by #if .. #endif is not considered (e.g. when 
determining whether a variable assignment is useless).  There are 
probably false-positives.  However in case of e.g. builtin/notes.c:1018, 
builtin/reset.c:294 or fast-import.c:2057 I consider the hints as justified.

This is for your information,  I wouldn't have a problem if you ignore 
the analysis.  When you are worried about javascript, use lynx.

Regards
   Дилян