Viktor Szakats 6d87eb2878 cmake: add CURL_GCC_ANALYZER option, enable in CI, fix/silence ... Enable in one existing Linux, macOS and Windows job. Cost: - Linux: +1.3 minutes. - macOS: +1.5 minutes. - Windows: +2.5 minutes. Fix or silence issues found: - conncache: silence NULL deref warning. ``` lib/conncache.c:564:18: warning: dereference of NULL '*data.multi' [CWE-476] [-Wanalyzer-null-dereference] ``` Ref: ede6a8e087 #19378 - http2: check pointer for NULL. ``` lib/http2.c:388:7: error: dereference of NULL ‘data’ [CWE-476] [-Wanalyzer-null-dereference] ``` - http2: silence potential NULL deref in `cf_h2_recv`. ``` lib/http2.c: In function 'cf_h2_recv': lib/curl_trc.h:62:15: warning: dereference of NULL 'data' [CWE-476] [-Wanalyzer-null-dereference] ``` - openldap: silence deref before NULL check. Seen in GHA/Linux. ``` lib/openldap.c: In function ‘oldap_state_mechs_resp’: lib/curl_trc.h:140:7: warning: check of ‘data’ for NULL after already dereferencing it [-Wanalyzer-deref-before-check] ``` - sendf: silence NULL deref false positive in `Curl_creader_set_fread`. It looks impossible to happen. ``` lib/sendf.c:1133:7: warning: dereference of NULL 'r' [CWE-476] [-Wanalyzer-null-dereference] ``` - ws: silence deref before NULL check. ``` lib/ws.c: In function 'ws_send_raw_blocking': lib/curl_trc.h:205:7: warning: check of 'data' for NULL after already dereferencing it [-Wanalyzer-deref-before-check] ``` - var: fix potential NULL deref ``` src/var.c:216:29: warning: dereference of NULL 'envp' [CWE-476] [-Wanalyzer-null-dereference] ``` - cli_hx_upload.c: fix NULL check after dereference. ``` tests/libtest/cli_hx_upload.c:170:7: warning: check of '*t.method' for NULL after already dereferencing it [-Wanalyzer-deref-before-check] ``` - unit1607, unit1609: fix theoretical NULL ptr dereference. ``` tests/unit/unit1607.c:211:12: warning: dereference of NULL 'addr' [CWE-476] [-Wanalyzer-null-dereference] tests/unit/unit1609.c:193:12: warning: dereference of NULL 'addr' [CWE-476] [-Wanalyzer-null-dereference] ``` - globally disable checks triggering false positives only: ``` docs/examples/externalsocket.c:135:8: warning: 'connect' on possibly invalid file descriptor 'sockfd' [-Wanalyzer-fd-use-without-check] lib/bufq.c:465:16: warning: infinite loop [CWE-835] [-Wanalyzer-infinite-loop] (gcc-15 Windows) lib/doh.c:1035:34: warning: stack-based buffer over-read [CWE-126] [-Wanalyzer-out-of-bounds] (gcc-15 macOS) lib/ftp.c:4022:20: warning: infinite loop [CWE-835] [-Wanalyzer-infinite-loop] (gcc-15 macOS) lib/http2.c:689:28: warning: buffer over-read [CWE-126] [-Wanalyzer-out-of-bounds] (gcc-15 macOS) lib/socketpair.c:195:5: warning: leak of file descriptor 'curl_dbg_socket(2, 1, 0, 192, "D:/a/curl/curl/lib/socketpair.c")' [CWE-775] [-Wanalyzer-fd-leak] src/tool_doswin.c:810:7: warning: leak of file descriptor '*tdata.socket_l' [CWE-775] [-Wanalyzer-fd-leak] src/tool_doswin.c:816:9: warning: leak of file descriptor '*tdata.socket_l' [CWE-775] [-Wanalyzer-fd-leak] src/tool_main.c:96:1: warning: leak of file descriptor 'fd[0]' [CWE-775] [-Wanalyzer-fd-leak] src/tool_main.c:96:1: warning: leak of file descriptor 'fd[1]' [CWE-775] [-Wanalyzer-fd-leak] src/tool_urlglob.c:48:17: warning: leak of 'malloc(8)' [CWE-401] [-Wanalyzer-malloc-leak] src/tool_writeout.c:870:3: warning: leak of FILE 'stream2' [CWE-775] [-Wanalyzer-file-leak] tests/libtest/lib518.c:90:1: warning: leak of FILE [CWE-775] [-Wanalyzer-file-leak] tests/libtest/lib537.c:87:1: warning: leak of FILE [CWE-775] [-Wanalyzer-file-leak] tests/server/tftpd.c:1147:10: warning: 'bind' on possibly invalid file descriptor 'sock' [-Wanalyzer-fd-use-without-check] tests/server/tftpd.c:1155:10: warning: 'bind' on possibly invalid file descriptor 'sock' [-Wanalyzer-fd-use-without-check] tests/server/tftpd.c:1259:10: warning: 'connect' on possibly invalid file descriptor '4294967295' [-Wanalyzer-fd-use-without-check] ``` Also: - cmake: update clang-tidy typecheck comment. Ref: https://gcc.gnu.org/onlinedocs/gcc/Static-Analyzer-Options.html Closes #20921		2026-03-16 11:49:34 +01:00
..
ISSUE_TEMPLATE	VULN-DISCLOSURE-POLICY.md: use hackerone	2026-02-26 07:57:19 +01:00
scripts	GHA: make typos ignore RELEASE-NOTES	2026-03-13 13:12:21 +01:00
workflows	cmake: add CURL_GCC_ANALYZER option, enable in CI, fix/silence	2026-03-16 11:49:34 +01:00
CODEOWNERS	CI: add whitespace checker	2024-06-27 13:33:30 +02:00
CONTRIBUTING.md	tidy-up: Markdown, clang-format nits	2026-01-22 23:44:47 +01:00
dependabot.yml	GHA/dependabot: tidy-ups	2025-11-02 17:45:50 +01:00
FUNDING.yml	copyright: update all copyright lines and remove year ranges	2023-01-03 09:19:21 +01:00
labeler.yml	tidy-up: merge root packages directory into projects	2026-01-12 23:49:35 +01:00
lock.yml	copyright: update all copyright lines and remove year ranges	2023-01-03 09:19:21 +01:00
stale.yml	badwords: fix issues found in scripts and other files	2025-11-17 17:18:07 +01:00