Issues uncovered by Coverity Scan about brotli HOT 6 CLOSED

FWIW I would be willing to add someone to Squash's project on Coverity Scan so you can see the results in their interface, though I would suggest just creating a project for brotli. It has actually uncovered quite a few real issues in other compression libraries (as well as Squash itself) with surprisingly few false positives—definitely worth it, IMHO.

from brotli.

All Coverity Scan reports have been addressed =)

See https://scan.coverity.com/projects/google-brotli

Thank you for reporting about these issues.

from brotli.

I think it's time for another run; Coverity is reporting 9 high-impact issues and 4 medium-impact issues in Brotli.

from brotli.

Uninitialized variables and null-dereference are all false-positives. Usage of tainted values is natural -> almost false positive. Going to toss coda a little bit to convince Coverity Scan.

from brotli.

FWIW, cppcheck picks up a couple minor issues, too:

[brotli/enc/block_splitter_inc.h:280] -> [brotli/enc/block_splitter_inc.h:281]: (style) Variable 'pairs' is reassigned a value before the old one has been used.
[brotli/enc/write_bits.h:80]: (warning) %d in format string (no. 1) requires 'int' but the argument type is 'size_t {aka unsigned long}'.

To fix the second one, you could cast to int, or if you want to really use size_t you can do something like this (stolen from https://github.com/nemequ/munit/blob/master/munit.h#L56):

#if !defined(_WIN32)
  #define BROTLI_SIZE_SPECIFIER "zu"
#elif defined(_M_X64) || defined(__amd64__)
  #define BROTLI_SIZE_SPECIFIER "I64u"
#else
  #define BROTLI_SIZE_SPECIFIER "u"
#endif

Windows make everything harder.

from brotli.

@eustas, I see the only issue remaining is a null-pointer dereference; IIRC that can be "fixed" by adding an assert(foo != NULL). If it's a function parameter, another possibility might be to add a nonnnull attribute… Looks like it's available in GCC 3.3+.

from brotli.