6696b46: Clang Static Analyzer Report #9573

BRANCH: master COMMIT: 6696b4635ceb9b47aaa63244bff9032fa7b08354 ISSUE COUNT: 13 EXCLUDED: src/bench, src/test, src/qt

DISCLAIMER: These results have not been thoroughly confirmed, and may be improbable or flat out invalid, but it's worth having a list of these somewhere.

==============================================

SEMANTIC ISSUES [2 present, 0 confirmed]:

• src/init.cpp:1524:58: Variable nStart may be uninitialized when used here
• src/rpc/server.cpp:496:29: Code will never be executed

LOGIC ERROR [6 present, 0 confirmed, 1 fixed]:

• src/rpc/mining.cpp:551:20: Access to field nNonce results in a dereference of a null pointer (loaded from variable pblock)
• src/wallet/rpcdump.cpp:506:5: Access to field nHeight results in a dereference of a null pointer (loaded from variable pindex): 1 src/wallet/rpcdump.cpp:429:9: Assuming fPruneMode is 0 2 src/wallet/rpcdump.cpp:449:12: Loop body executed 0 times 3 src/wallet/rpcdump.cpp:499:27: Calling CChain::Tip 4 src/chain.h:429:5: Entered call from importwallet 5 src/wallet/rpcdump.cpp:499:27: Returning from CChain::Tip 6 src/wallet/rpcdump.cpp:499:5: pindex initialized here 7 src/wallet/rpcdump.cpp:500:12: Assuming pointer value is null 8 src/wallet/rpcdump.cpp:506:5: Access to field nHeight results in a dereference of a null pointer (loaded from variable pindex)
• #9549 fixes ~~~src/net_processing.cpp:341:14: Dereference of null pointer (loaded from variable pit)~~~ 1 src/net_processing.cpp:2265:21: Passing null pointer value via 5th parameter pit in call to MarkBlockAsInFlight 2 src/net_processing.cpp:334:1: Entered call from ProcessMessage 3 src/net_processing.cpp:341:14: Dereference of null pointer (loaded from variable pit)
• src/wallet/wallet.cpp:502:14: Called C++ object pointer is null
  • if for loop on line 486 loops zero times, or
  • if for all loops, n >= nMinOrderPos (Will add path details if desired, but it's long.)
• src/wallet/wallet.cpp:2335:49: Division by zero
  • A path going from src/wallet/wallet.cpp:2252:5wherenSubtractFeeFromAmount` is initialized to 0 leads to a division by zero. (Will add path details if desired, but it's long.)
• src/rpc/blockchain.cpp:1145:50: Access to field nHeight results in a dereference of a null pointer (loaded from variable block) 1 src/rpc/blockchain.cpp:1119:49: Assuming pindexBestHeader is null 2 src/rpc/blockchain.cpp:1139:9: Assuming fPruneMode is not equal to 0 3 src/rpc/blockchain.cpp:1141:30: Calling CChain::Tip 4 src/chain.h:429:5: Entered call from getblockchaininfo 5 src/rpc/blockchain.cpp:1141:30: Returning from CChain::Tip 6 src/rpc/blockchain.cpp:1141:9: block initialized here 7 src/rpc/blockchain.cpp:1142:16: Assuming pointer value is null 8 src/rpc/blockchain.cpp:1145:50: Access to field nHeight results in a dereference of a null pointer (loaded from variable block)

DEAD STORE [4 present, 0 confirmed, 1 fixed]:

• #9532 fixes: ~~~src/addrman.cpp:61:9: Value stored to nSinceLastSeen is never read~~~
• src/pubkey.cpp:129:5: Value stored to pos is never read
• src/policy/fees.cpp:103:18: Value stored to curFarBucket during its initialization is never read
• src/wallet/wallet.cpp:3564:18: Value stored to pindexRescan during its initialization is never read

MEMORY ERROR [1 present, 0 confirmed]:

• src/httpserver.cpp:609:15: Potential leak of memory pointed to by ev 1 src/httpserver.cpp:258:9: Calling HTTPRequest::WriteReply 2 src/httpserver.cpp:599:1: Entered call from http_request_cb 3 src/httpserver.cpp:604:5: Assuming evb is non-null 4 src/httpserver.cpp:606:21: Memory is allocated 5 src/httpserver.cpp:609:15: Potential leak of memory pointed to by ev

Thanks... and,... yes. Some things on that list can and probably should be fixed.

The unused variable nSinceLastSeen has been addressed in #9532 and the dereference of null pointer (loaded from variable pit) has been addressed in #9549 :-)

Just curious - what version/settings/scripting you are using? I am playing with scan-build-3.4 and 3.5 (packaged with debian stable) and they only report three issues - one in bench/, one in qt/, and one in secp256k1/.

@isle2983: scan-build = ANALYZER BUILD: checker-279 (2016-11-14 15:34:09)

I am doing

make clean
scan-build ./autogen.sh
scan-build ./configure
scan-build make

as they seem to recommend that you run all the tools using scan-build.

I also ended up recreating the project in Xcode to see if the results would differ by using Apple's set up with the built in analyzer (they didn't).

Anything left to do here?

I'll redo the scan-build and report back.