Attachment 695130 Details for Bug 909325 – Analysis log

Analysis log

finger-0.17-47.fc19.err (text/plain), 21.06 KB, created by Tomáš Hozza on 2013-02-08 15:11:01 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tomáš Hozza

Created: 2013-02-08 15:11:01 UTC

Size: 21.06 KB

patch

obsolete

>Error: DEADCODE (CWE-561):
>bsd-finger-0.17/finger/net.c:173: assignment: Assigning: "ateol" = "1".
>bsd-finger-0.17/finger/net.c:178: assignment: Assigning: "ateol" = "1".
>bsd-finger-0.17/finger/net.c:191: const: At condition "ateol", the value of "ateol" must be equal to 1.
>bsd-finger-0.17/finger/net.c:191: dead_error_condition: The condition "!ateol" cannot be true.
>bsd-finger-0.17/finger/net.c:191: dead_error_line: Execution cannot reach this statement "xputc(10);".
>
>Error: OVERRUN (CWE-119):
>bsd-finger-0.17/finger/util.c:392: cond_true: Condition "*q", taking true branch
>bsd-finger-0.17/finger/util.c:393: cond_false: Condition "!(*__ctype_b_loc()[(int)*q] & 2048 /* (unsigned short)_ISdigit */)", taking false branch
>bsd-finger-0.17/finger/util.c:394: if_end: End of if statement
>bsd-finger-0.17/finger/util.c:394: loop: Jumping back to the beginning of the loop
>bsd-finger-0.17/finger/util.c:392: loop_begin: Jumped back to beginning of loop
>bsd-finger-0.17/finger/util.c:392: cond_false: Condition "*q", taking false branch
>bsd-finger-0.17/finger/util.c:394: loop_end: Reached end of loop
>bsd-finger-0.17/finger/util.c:396: alias: Assigning: "p" = "pbuf". "p" now points to byte 0 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:397: switch: Switch case value "11"
>bsd-finger-0.17/finger/util.c:398: switch_case: Reached case "11"
>bsd-finger-0.17/finger/util.c:399: ptr_incr: Incrementing "p". "p" now points to byte 1 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:400: ptr_incr: Incrementing "p". "p" now points to byte 2 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:401: ptr_incr: Incrementing "p". "p" now points to byte 3 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:404: ptr_incr: Incrementing "p". "p" now points to byte 4 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:405: ptr_incr: Incrementing "p". "p" now points to byte 5 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:406: ptr_incr: Incrementing "p". "p" now points to byte 6 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:407: ptr_incr: Incrementing "p". "p" now points to byte 7 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:410: ptr_incr: Incrementing "p". "p" now points to byte 8 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:411: ptr_incr: Incrementing "p". "p" now points to byte 9 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:412: ptr_incr: Incrementing "p". "p" now points to byte 10 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:413: break: Breaking from switch
>bsd-finger-0.17/finger/util.c:421: switch_end: Reached end of switch
>bsd-finger-0.17/finger/util.c:422: cond_true: Condition "len != 4", taking true branch
>bsd-finger-0.17/finger/util.c:423: ptr_incr: Incrementing "p". "p" now points to byte 11 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:424: ptr_incr: Incrementing "p". "p" now points to byte 12 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:426: ptr_incr: Incrementing "p". "p" now points to byte 13 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:427: ptr_incr: Incrementing "p". "p" now points to byte 14 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:428: ptr_incr: Incrementing "p". "p" now points to byte 15 of "pbuf" (which consists of 15 bytes).
>bsd-finger-0.17/finger/util.c:429: overrun-local: Overrunning array of 15 bytes at byte offset 15 by dereferencing pointer "p".
>
>Error: RESOURCE_LEAK (CWE-772):
>bsd-finger-0.17/finger/finger.c:293: cond_false: Condition "setlocale(6, "") != NULL", taking false branch
>bsd-finger-0.17/finger/finger.c:294: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:296: alloc_fn: Storage is returned from allocation function "calloc(size_t, size_t)".
>bsd-finger-0.17/finger/finger.c:296: var_assign: Assigning: "used" = storage returned from "calloc(argc, 4UL)".
>bsd-finger-0.17/finger/finger.c:297: cond_false: Condition "!used", taking false branch
>bsd-finger-0.17/finger/finger.c:300: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:303: cond_true: Condition "i < argc", taking true branch
>bsd-finger-0.17/finger/finger.c:304: cond_true: Condition "!__coverity_strchr(argv[i], 64)", taking true branch
>bsd-finger-0.17/finger/finger.c:306: continue: Continuing loop
>bsd-finger-0.17/finger/finger.c:313: loop: Looping back
>bsd-finger-0.17/finger/finger.c:303: cond_true: Condition "i < argc", taking true branch
>bsd-finger-0.17/finger/finger.c:304: cond_true: Condition "!__coverity_strchr(argv[i], 64)", taking true branch
>bsd-finger-0.17/finger/finger.c:306: continue: Continuing loop
>bsd-finger-0.17/finger/finger.c:313: loop: Looping back
>bsd-finger-0.17/finger/finger.c:303: cond_false: Condition "i < argc", taking false branch
>bsd-finger-0.17/finger/finger.c:313: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:316: cond_true: Condition "dolocal", taking true branch
>bsd-finger-0.17/finger/finger.c:316: noescape: Resource "used" is not freed or pointed-to in function "do_local(int, char **, int *)".
>bsd-finger-0.17/finger/finger.c:251:51: noescape: "do_local(int, char **, int *)" does not free or save its pointer parameter "used".
>bsd-finger-0.17/finger/finger.c:319: cond_false: Condition "pn", taking false branch
>bsd-finger-0.17/finger/finger.c:323: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:325: cond_true: Condition "entries == 0", taking true branch
>bsd-finger-0.17/finger/finger.c:326: leaked_storage: Variable "used" going out of scope leaks the storage it points to.
>
>Error: RESOURCE_LEAK (CWE-772):
>bsd-finger-0.17/finger/finger.c:293: cond_false: Condition "setlocale(6, "") != NULL", taking false branch
>bsd-finger-0.17/finger/finger.c:294: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:296: alloc_fn: Storage is returned from allocation function "calloc(size_t, size_t)".
>bsd-finger-0.17/finger/finger.c:296: var_assign: Assigning: "used" = storage returned from "calloc(argc, 4UL)".
>bsd-finger-0.17/finger/finger.c:297: cond_false: Condition "!used", taking false branch
>bsd-finger-0.17/finger/finger.c:300: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:303: cond_true: Condition "i < argc", taking true branch
>bsd-finger-0.17/finger/finger.c:304: cond_true: Condition "!__coverity_strchr(argv[i], 64)", taking true branch
>bsd-finger-0.17/finger/finger.c:306: continue: Continuing loop
>bsd-finger-0.17/finger/finger.c:313: loop: Looping back
>bsd-finger-0.17/finger/finger.c:303: cond_true: Condition "i < argc", taking true branch
>bsd-finger-0.17/finger/finger.c:304: cond_true: Condition "!__coverity_strchr(argv[i], 64)", taking true branch
>bsd-finger-0.17/finger/finger.c:306: continue: Continuing loop
>bsd-finger-0.17/finger/finger.c:313: loop: Looping back
>bsd-finger-0.17/finger/finger.c:303: cond_false: Condition "i < argc", taking false branch
>bsd-finger-0.17/finger/finger.c:313: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:316: cond_true: Condition "dolocal", taking true branch
>bsd-finger-0.17/finger/finger.c:316: noescape: Resource "used" is not freed or pointed-to in function "do_local(int, char **, int *)".
>bsd-finger-0.17/finger/finger.c:251:51: noescape: "do_local(int, char **, int *)" does not free or save its pointer parameter "used".
>bsd-finger-0.17/finger/finger.c:319: cond_true: Condition "pn", taking true branch
>bsd-finger-0.17/finger/finger.c:321: cond_false: Condition "pn->next", taking false branch
>bsd-finger-0.17/finger/finger.c:321: cond_true: Condition "entries", taking true branch
>bsd-finger-0.17/finger/finger.c:323: loop: Jumping back to the beginning of the loop
>bsd-finger-0.17/finger/finger.c:319: loop_begin: Jumped back to beginning of loop
>bsd-finger-0.17/finger/finger.c:319: cond_false: Condition "pn", taking false branch
>bsd-finger-0.17/finger/finger.c:323: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:325: cond_false: Condition "entries == 0", taking false branch
>bsd-finger-0.17/finger/finger.c:326: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:339: cond_false: Condition "(uptr = getutent()) != NULL", taking false branch
>bsd-finger-0.17/finger/finger.c:351: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:352: cond_true: Condition "pn != NULL", taking true branch
>bsd-finger-0.17/finger/finger.c:354: loop: Jumping back to the beginning of the loop
>bsd-finger-0.17/finger/finger.c:352: loop_begin: Jumped back to beginning of loop
>bsd-finger-0.17/finger/finger.c:352: cond_false: Condition "pn != NULL", taking false branch
>bsd-finger-0.17/finger/finger.c:354: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:356: leaked_storage: Variable "used" going out of scope leaks the storage it points to.
>
>Error: RESOURCE_LEAK (CWE-772):
>bsd-finger-0.17/finger/finger.c:293: cond_false: Condition "setlocale(6, "") != NULL", taking false branch
>bsd-finger-0.17/finger/finger.c:294: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:296: alloc_fn: Storage is returned from allocation function "calloc(size_t, size_t)".
>bsd-finger-0.17/finger/finger.c:296: var_assign: Assigning: "used" = storage returned from "calloc(argc, 4UL)".
>bsd-finger-0.17/finger/finger.c:297: cond_false: Condition "!used", taking false branch
>bsd-finger-0.17/finger/finger.c:300: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:303: cond_false: Condition "i < argc", taking false branch
>bsd-finger-0.17/finger/finger.c:313: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:316: cond_false: Condition "dolocal", taking false branch
>bsd-finger-0.17/finger/finger.c:316: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:319: cond_false: Condition "pn", taking false branch
>bsd-finger-0.17/finger/finger.c:323: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:325: cond_true: Condition "entries == 0", taking true branch
>bsd-finger-0.17/finger/finger.c:326: leaked_storage: Variable "used" going out of scope leaks the storage it points to.
>
>Error: RESOURCE_LEAK (CWE-772):
>bsd-finger-0.17/finger/finger.c:293: cond_false: Condition "setlocale(6, "") != NULL", taking false branch
>bsd-finger-0.17/finger/finger.c:294: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:296: alloc_fn: Storage is returned from allocation function "calloc(size_t, size_t)".
>bsd-finger-0.17/finger/finger.c:296: var_assign: Assigning: "used" = storage returned from "calloc(argc, 4UL)".
>bsd-finger-0.17/finger/finger.c:297: cond_false: Condition "!used", taking false branch
>bsd-finger-0.17/finger/finger.c:300: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:303: cond_false: Condition "i < argc", taking false branch
>bsd-finger-0.17/finger/finger.c:313: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:316: cond_false: Condition "dolocal", taking false branch
>bsd-finger-0.17/finger/finger.c:316: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:319: cond_false: Condition "pn", taking false branch
>bsd-finger-0.17/finger/finger.c:323: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:325: cond_false: Condition "entries == 0", taking false branch
>bsd-finger-0.17/finger/finger.c:326: if_end: End of if statement
>bsd-finger-0.17/finger/finger.c:339: cond_false: Condition "(uptr = getutent()) != NULL", taking false branch
>bsd-finger-0.17/finger/finger.c:351: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:352: cond_true: Condition "pn != NULL", taking true branch
>bsd-finger-0.17/finger/finger.c:354: loop: Jumping back to the beginning of the loop
>bsd-finger-0.17/finger/finger.c:352: loop_begin: Jumped back to beginning of loop
>bsd-finger-0.17/finger/finger.c:352: cond_false: Condition "pn != NULL", taking false branch
>bsd-finger-0.17/finger/finger.c:354: loop_end: Reached end of loop
>bsd-finger-0.17/finger/finger.c:356: leaked_storage: Variable "used" going out of scope leaks the storage it points to.
>
>Error: RESOURCE_LEAK (CWE-772):
>bsd-finger-0.17/finger/sprint.c:60: alloc_fn: Storage is returned from allocation function "sort(void)".
>bsd-finger-0.17/finger/sprint.c:142:2: alloc_fn: Storage is returned from allocation function "malloc(size_t)".
>bsd-finger-0.17/finger/sprint.c:142:2: var_assign: Assigning: "list" = "malloc((u_int)(entries * 8UL))".
>bsd-finger-0.17/finger/sprint.c:142:2: cond_false: Condition "!(list = (PERSON **)malloc((u_int)(entries * 8UL /* sizeof (PERSON *) */)))", taking false branch
>bsd-finger-0.17/finger/sprint.c:145:2: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:146:7: var_assign: Assigning: "lp" = "list".
>bsd-finger-0.17/finger/sprint.c:146:2: cond_true: Condition "pn != NULL", taking true branch
>bsd-finger-0.17/finger/sprint.c:147:3: loop: Jumping back to the beginning of the loop
>bsd-finger-0.17/finger/sprint.c:146:2: loop_begin: Jumped back to beginning of loop
>bsd-finger-0.17/finger/sprint.c:146:2: cond_false: Condition "pn != NULL", taking false branch
>bsd-finger-0.17/finger/sprint.c:147:3: loop_end: Reached end of loop
>bsd-finger-0.17/finger/sprint.c:148:2: noescape: Resource "list" is not freed or pointed-to in function "qsort(void *, size_t, size_t, __compar_fn_t)".
>bsd-finger-0.17/finger/sprint.c:149:2: return_alloc: Returning allocated memory "list".
>bsd-finger-0.17/finger/sprint.c:60: var_assign: Assigning: "list" = storage returned from "sort()".
>bsd-finger-0.17/finger/sprint.c:76: cond_true: Condition "cnt < entries", taking true branch
>bsd-finger-0.17/finger/sprint.c:79: cond_true: Condition "pn->name", taking true branch
>bsd-finger-0.17/finger/sprint.c:80: cond_true: Condition "l > maxlname", taking true branch
>bsd-finger-0.17/finger/sprint.c:81: cond_true: Condition "pn->realname", taking true branch
>bsd-finger-0.17/finger/sprint.c:82: cond_true: Condition "l > maxrname", taking true branch
>bsd-finger-0.17/finger/sprint.c:83: loop: Jumping back to the beginning of the loop
>bsd-finger-0.17/finger/sprint.c:76: loop_begin: Jumped back to beginning of loop
>bsd-finger-0.17/finger/sprint.c:76: cond_true: Condition "cnt < entries", taking true branch
>bsd-finger-0.17/finger/sprint.c:79: cond_true: Condition "pn->name", taking true branch
>bsd-finger-0.17/finger/sprint.c:80: cond_true: Condition "l > maxlname", taking true branch
>bsd-finger-0.17/finger/sprint.c:81: cond_true: Condition "pn->realname", taking true branch
>bsd-finger-0.17/finger/sprint.c:82: cond_true: Condition "l > maxrname", taking true branch
>bsd-finger-0.17/finger/sprint.c:83: loop: Jumping back to the beginning of the loop
>bsd-finger-0.17/finger/sprint.c:76: loop_begin: Jumped back to beginning of loop
>bsd-finger-0.17/finger/sprint.c:76: cond_true: Condition "cnt < entries", taking true branch
>bsd-finger-0.17/finger/sprint.c:79: cond_true: Condition "pn->name", taking true branch
>bsd-finger-0.17/finger/sprint.c:80: cond_true: Condition "l > maxlname", taking true branch
>bsd-finger-0.17/finger/sprint.c:81: cond_true: Condition "pn->realname", taking true branch
>bsd-finger-0.17/finger/sprint.c:82: cond_false: Condition "l > maxrname", taking false branch
>bsd-finger-0.17/finger/sprint.c:82: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:83: loop: Jumping back to the beginning of the loop
>bsd-finger-0.17/finger/sprint.c:76: loop_begin: Jumped back to beginning of loop
>bsd-finger-0.17/finger/sprint.c:76: cond_false: Condition "cnt < entries", taking false branch
>bsd-finger-0.17/finger/sprint.c:83: loop_end: Reached end of loop
>bsd-finger-0.17/finger/sprint.c:86: cond_true: Condition "maxlname + maxrname > space", taking true branch
>bsd-finger-0.17/finger/sprint.c:89: cond_true: Condition "maxlname + maxrname < space - 2", taking true branch
>bsd-finger-0.17/finger/sprint.c:93: cond_true: Condition "cnt < entries", taking true branch
>bsd-finger-0.17/finger/sprint.c:95: cond_true: Condition "w != NULL", taking true branch
>bsd-finger-0.17/finger/sprint.c:96: cond_true: Condition "pn->realname", taking true branch
>bsd-finger-0.17/finger/sprint.c:99: cond_true: Condition "!w->loginat", taking true branch
>bsd-finger-0.17/finger/sprint.c:101: goto: Jumping to label "office"
>bsd-finger-0.17/finger/sprint.c:120: label: Reached label "office"
>bsd-finger-0.17/finger/sprint.c:121: cond_true: Condition "pn->office", taking true branch
>bsd-finger-0.17/finger/sprint.c:122: if_fallthrough: Falling through to end of if statement
>bsd-finger-0.17/finger/sprint.c:124: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:125: cond_true: Condition "pn->officephone", taking true branch
>bsd-finger-0.17/finger/sprint.c:126: if_fallthrough: Falling through to end of if statement
>bsd-finger-0.17/finger/sprint.c:129: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:131: cond_true: Condition "w->host[0] != 0", taking true branch
>bsd-finger-0.17/finger/sprint.c:134: loop: Jumping back to the beginning of the loop
>bsd-finger-0.17/finger/sprint.c:95: loop_begin: Jumped back to beginning of loop
>bsd-finger-0.17/finger/sprint.c:95: cond_false: Condition "w != NULL", taking false branch
>bsd-finger-0.17/finger/sprint.c:134: loop_end: Reached end of loop
>bsd-finger-0.17/finger/sprint.c:135: loop: Jumping back to the beginning of the loop
>bsd-finger-0.17/finger/sprint.c:93: loop_begin: Jumped back to beginning of loop
>bsd-finger-0.17/finger/sprint.c:93: cond_true: Condition "cnt < entries", taking true branch
>bsd-finger-0.17/finger/sprint.c:95: cond_true: Condition "w != NULL", taking true branch
>bsd-finger-0.17/finger/sprint.c:96: cond_true: Condition "pn->realname", taking true branch
>bsd-finger-0.17/finger/sprint.c:99: cond_true: Condition "!w->loginat", taking true branch
>bsd-finger-0.17/finger/sprint.c:101: goto: Jumping to label "office"
>bsd-finger-0.17/finger/sprint.c:120: label: Reached label "office"
>bsd-finger-0.17/finger/sprint.c:121: cond_true: Condition "pn->office", taking true branch
>bsd-finger-0.17/finger/sprint.c:122: if_fallthrough: Falling through to end of if statement
>bsd-finger-0.17/finger/sprint.c:124: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:125: cond_true: Condition "pn->officephone", taking true branch
>bsd-finger-0.17/finger/sprint.c:126: if_fallthrough: Falling through to end of if statement
>bsd-finger-0.17/finger/sprint.c:129: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:131: cond_true: Condition "w->host[0] != 0", taking true branch
>bsd-finger-0.17/finger/sprint.c:134: loop: Jumping back to the beginning of the loop
>bsd-finger-0.17/finger/sprint.c:95: loop_begin: Jumped back to beginning of loop
>bsd-finger-0.17/finger/sprint.c:95: cond_false: Condition "w != NULL", taking false branch
>bsd-finger-0.17/finger/sprint.c:134: loop_end: Reached end of loop
>bsd-finger-0.17/finger/sprint.c:135: loop: Jumping back to the beginning of the loop
>bsd-finger-0.17/finger/sprint.c:93: loop_begin: Jumped back to beginning of loop
>bsd-finger-0.17/finger/sprint.c:93: cond_true: Condition "cnt < entries", taking true branch
>bsd-finger-0.17/finger/sprint.c:95: cond_true: Condition "w != NULL", taking true branch
>bsd-finger-0.17/finger/sprint.c:96: cond_true: Condition "pn->realname", taking true branch
>bsd-finger-0.17/finger/sprint.c:99: cond_true: Condition "!w->loginat", taking true branch
>bsd-finger-0.17/finger/sprint.c:101: goto: Jumping to label "office"
>bsd-finger-0.17/finger/sprint.c:120: label: Reached label "office"
>bsd-finger-0.17/finger/sprint.c:121: cond_true: Condition "pn->office", taking true branch
>bsd-finger-0.17/finger/sprint.c:122: if_fallthrough: Falling through to end of if statement
>bsd-finger-0.17/finger/sprint.c:124: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:125: cond_true: Condition "pn->officephone", taking true branch
>bsd-finger-0.17/finger/sprint.c:126: if_fallthrough: Falling through to end of if statement
>bsd-finger-0.17/finger/sprint.c:129: if_end: End of if statement
>bsd-finger-0.17/finger/sprint.c:131: cond_true: Condition "w->host[0] != 0", taking true branch
>bsd-finger-0.17/finger/sprint.c:134: loop: Jumping back to the beginning of the loop
>bsd-finger-0.17/finger/sprint.c:95: loop_begin: Jumped back to beginning of loop
>bsd-finger-0.17/finger/sprint.c:95: cond_false: Condition "w != NULL", taking false branch
>bsd-finger-0.17/finger/sprint.c:134: loop_end: Reached end of loop
>bsd-finger-0.17/finger/sprint.c:135: loop: Jumping back to the beginning of the loop
>bsd-finger-0.17/finger/sprint.c:93: loop_begin: Jumped back to beginning of loop
>bsd-finger-0.17/finger/sprint.c:93: cond_false: Condition "cnt < entries", taking false branch
>bsd-finger-0.17/finger/sprint.c:135: loop_end: Reached end of loop
>bsd-finger-0.17/finger/sprint.c:136: leaked_storage: Variable "list" going out of scope leaks the storage it points to.
>
>Error: TOCTOU (CWE-367):
>bsd-finger-0.17/finger/lprint.c:339: fs_check_call: Calling function "lstat(char const *, struct stat *)" to perform check on "tbuf".
>bsd-finger-0.17/finger/lprint.c:339: cond_false: Condition "lstat(tbuf, &sbuf1)", taking false branch
>bsd-finger-0.17/finger/lprint.c:339: cond_false: Condition "!((sbuf1.st_mode & 61440) == 32768)", taking false branch
>bsd-finger-0.17/finger/lprint.c:339: if_end: End of if statement
>bsd-finger-0.17/finger/lprint.c:340: toctou: Calling function "open(char const *, int, ...)" that uses "tbuf" after a check function. This can cause a time-of-check, time-of-use race condition.

Actions: View

Attachments on bug 909325: 695130 | 695972 | 695973 | 695974 | 695975