2026-05-03 01:39
ftp://ftp.de.debian.org/debian/pool/main/l/lua-sec/lua-sec_1.3.2.orig.tar.gz
cppcheck-options: --library=posix --library=gnu --library=bsd --library=openssl --library=lua  --inconclusive --enable=style,information --inline-suppr --template=daca2 --disable=missingInclude --suppress=unmatchedSuppression --check-library --debug-warnings --suppress=autoNoType --suppress=valueFlowBailout --suppress=bailoutUninitVar --suppress=symbolDatabaseWarning --suppress=normalCheckLevelConditionExpressions -D__GNUC__ --platform=unix64 -j1
platform: Linux-6.12.85+deb13-amd64-x86_64-with-glibc2.41
python: 3.13.5
client-version: 1.3.70
compiler: g++ (20250906) 15.2.0
cppcheck: head 2.20.0
head-info: e5c4a73 (2026-05-01 11:10:43 +0200)
count: 97 94
elapsed-time: 0.4 0.3
head-timing-info:

old-timing-info:

head results:
luasec-1.3.2/src/context.c:124:14: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable SSL_VERIFY_NONE [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/context.c:152:28: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable LUA_TSTRING [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/context.c:219:26: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable LUA_TSTRING [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/context.c:258:44: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable X509_PURPOSE_SSL_SERVER [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/context.c:297:14: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable X509_V_OK [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/context.c:346:48: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable SSL_SESS_CACHE_OFF [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/context.c:403:52: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable SSL_FILETYPE_PEM [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/context.c:576:28: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable SSL_OP_SINGLE_ECDH_USE [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/context.c:609:28: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable SSL_OP_SINGLE_ECDH_USE [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/context.c:670:12: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable SSL_TLSEXT_ERR_NOACK [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/context.c:975:19: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable X509_V_FLAG_CRL_CHECK [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ec.c:18:17: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable LUA_REGISTRYINDEX [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ec.c:41:47: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable EC_builtin_curve [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ec.c:92:17: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable LUA_REGISTRYINDEX [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ec.c:44:25: warning:inconclusive: If memory allocation fails, then there is a possible null pointer dereference: curves [nullPointerOutOfMemory]
luasec-1.3.2/src/ec.c:41:39: note: Assuming allocation function fails
luasec-1.3.2/src/ec.c:41:14: note: Assignment 'curves=(EC_builtin_curve*)malloc(sizeof(EC_builtin_curve)*size)', assigned value is 0
luasec-1.3.2/src/ec.c:44:25: note: Null pointer dereference
luasec-1.3.2/src/ec.c:50:15: warning:inconclusive: If memory allocation fails, then there is a possible null pointer dereference: curves [nullPointerOutOfMemory]
luasec-1.3.2/src/ec.c:41:39: note: Assuming allocation function fails
luasec-1.3.2/src/ec.c:41:14: note: Assignment 'curves=(EC_builtin_curve*)malloc(sizeof(EC_builtin_curve)*size)', assigned value is 0
luasec-1.3.2/src/ec.c:50:15: note: Null pointer dereference
luasec-1.3.2/src/luasocket/io.c:13:43: style:inconclusive: Function 'io_init' argument 3 names different: declaration '<unnamed>' definition 'recv'. [funcArgNamesDifferentUnnamed]
luasec-1.3.2/src/luasocket/io.c:13:57: style:inconclusive: Function 'io_init' argument 4 names different: declaration '<unnamed>' definition 'error'. [funcArgNamesDifferentUnnamed]
luasec-1.3.2/src/luasocket/io.c:13:70: style:inconclusive: Function 'io_init' argument 5 names different: declaration '<unnamed>' definition 'ctx'. [funcArgNamesDifferentUnnamed]
luasec-1.3.2/src/luasocket/usocket.c:28:27: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:69:21: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable SIG_IGN [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:104:25: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:114:17: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:123:41: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:134:37: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:157:19: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:178:15: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:205:15: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:234:15: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:256:15: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:279:15: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:311:15: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:339:15: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:352:28: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable F_GETFL [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:361:28: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable F_GETFL [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:370:36: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable AF_INET [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:380:14: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable h_errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:437:42: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/usocket.c:370:11: style: Obsolescent function 'gethostbyaddr' called. It is recommended to use 'getnameinfo' instead. [prohibitedgethostbyaddrCalled]
luasec-1.3.2/src/luasocket/usocket.c:378:11: style: Obsolescent function 'gethostbyname' called. It is recommended to use 'getaddrinfo' instead. [prohibitedgethostbynameCalled]
luasec-1.3.2/src/luasocket/usocket.c:120:50: style:inconclusive: Function 'socket_bind' argument 3 names different: declaration 'addr_len' definition 'len'. [funcArgNamesDifferent]
luasec-1.3.2/src/luasocket/socket.h:56:50: note: Function 'socket_bind' argument 3 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/usocket.c:120:50: note: Function 'socket_bind' argument 3 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/usocket.c:151:53: style:inconclusive: Function 'socket_connect' argument 3 names different: declaration 'addr_len' definition 'len'. [funcArgNamesDifferent]
luasec-1.3.2/src/luasocket/socket.h:54:53: note: Function 'socket_connect' argument 3 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/usocket.c:151:53: note: Function 'socket_connect' argument 3 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/usocket.c:173:66: style:inconclusive: Function 'socket_accept' argument 4 names different: declaration 'addr_len' definition 'len'. [funcArgNamesDifferent]
luasec-1.3.2/src/luasocket/socket.h:59:20: note: Function 'socket_accept' argument 4 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/usocket.c:173:66: note: Function 'socket_accept' argument 4 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/usocket.c:223:29: style:inconclusive: Function 'socket_sendto' argument 6 names different: declaration 'addr_len' definition 'len'. [funcArgNamesDifferent]
luasec-1.3.2/src/luasocket/socket.h:43:43: note: Function 'socket_sendto' argument 6 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/usocket.c:223:29: note: Function 'socket_sendto' argument 6 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/usocket.c:269:30: style:inconclusive: Function 'socket_recvfrom' argument 6 names different: declaration 'addr_len' definition 'len'. [funcArgNamesDifferent]
luasec-1.3.2/src/luasocket/socket.h:45:43: note: Function 'socket_recvfrom' argument 6 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/usocket.c:269:30: note: Function 'socket_recvfrom' argument 6 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/usocket.c:120:34: style: Parameter 'addr' can be declared as pointer to const [constParameterPointer]
luasec-1.3.2/src/luasocket/usocket.c:151:37: style: Parameter 'addr' can be declared as pointer to const [constParameterPointer]
luasec-1.3.2/src/luasocket/usocket.c:223:13: style: Parameter 'addr' can be declared as pointer to const [constParameterPointer]
luasec-1.3.2/src/luasocket/wsocket.c:48:14: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable POLLIN [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/wsocket.c:122:41: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable WSAEINPROGRESS [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/wsocket.c:175:45: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable WSAECONNABORTED [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/wsocket.c:206:20: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable WSAEWOULDBLOCK [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/wsocket.c:228:20: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable WSAEWOULDBLOCK [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/wsocket.c:254:20: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable WSAEWOULDBLOCK [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/wsocket.c:283:20: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable WSAEWOULDBLOCK [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/wsocket.c:296:22: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable FIONBIO [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/wsocket.c:304:22: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable FIONBIO [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/wsocket.c:311:36: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable AF_INET [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/luasocket/wsocket.c:311:11: style: Obsolescent function 'gethostbyaddr' called. It is recommended to use 'getnameinfo' instead. [prohibitedgethostbyaddrCalled]
luasec-1.3.2/src/luasocket/wsocket.c:317:11: style: Obsolescent function 'gethostbyname' called. It is recommended to use 'getaddrinfo' instead. [prohibitedgethostbynameCalled]
luasec-1.3.2/src/luasocket/wsocket.c:114:53: style:inconclusive: Function 'socket_connect' argument 3 names different: declaration 'addr_len' definition 'len'. [funcArgNamesDifferent]
luasec-1.3.2/src/luasocket/socket.h:54:53: note: Function 'socket_connect' argument 3 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/wsocket.c:114:53: note: Function 'socket_connect' argument 3 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/wsocket.c:143:50: style:inconclusive: Function 'socket_bind' argument 3 names different: declaration 'addr_len' definition 'len'. [funcArgNamesDifferent]
luasec-1.3.2/src/luasocket/socket.h:56:50: note: Function 'socket_bind' argument 3 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/wsocket.c:143:50: note: Function 'socket_bind' argument 3 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/wsocket.c:165:66: style:inconclusive: Function 'socket_accept' argument 4 names different: declaration 'addr_len' definition 'len'. [funcArgNamesDifferent]
luasec-1.3.2/src/luasocket/socket.h:59:20: note: Function 'socket_accept' argument 4 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/wsocket.c:165:66: note: Function 'socket_accept' argument 4 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/wsocket.c:216:29: style:inconclusive: Function 'socket_sendto' argument 6 names different: declaration 'addr_len' definition 'len'. [funcArgNamesDifferent]
luasec-1.3.2/src/luasocket/socket.h:43:43: note: Function 'socket_sendto' argument 6 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/wsocket.c:216:29: note: Function 'socket_sendto' argument 6 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/wsocket.c:266:30: style:inconclusive: Function 'socket_recvfrom' argument 6 names different: declaration 'addr_len' definition 'len'. [funcArgNamesDifferent]
luasec-1.3.2/src/luasocket/socket.h:45:43: note: Function 'socket_recvfrom' argument 6 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/wsocket.c:266:30: note: Function 'socket_recvfrom' argument 6 names different: declaration 'addr_len' definition 'len'.
luasec-1.3.2/src/luasocket/wsocket.c:128:13: style: Local variable 'len' shadows outer argument [shadowArgument]
luasec-1.3.2/src/luasocket/wsocket.c:114:53: note: Shadowed declaration
luasec-1.3.2/src/luasocket/wsocket.c:128:13: note: Shadow variable
luasec-1.3.2/src/luasocket/wsocket.c:114:37: style: Parameter 'addr' can be declared as pointer to const [constParameterPointer]
luasec-1.3.2/src/luasocket/wsocket.c:143:34: style: Parameter 'addr' can be declared as pointer to const [constParameterPointer]
luasec-1.3.2/src/luasocket/wsocket.c:216:13: style: Parameter 'addr' can be declared as pointer to const [constParameterPointer]
luasec-1.3.2/src/ssl.c:55:10: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable errno [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:92:20: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable SOCKET_INVALID [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:121:12: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable IO_CLOSED [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:164:12: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable IO_CLOSED [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:209:12: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable IO_CLOSED [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:301:5: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable CRYPTO_LOCK_SSL [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:401:14: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable IO_DONE [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:490:12: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable X509 [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:539:12: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable X509 [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:593:12: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable X509 [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:627:12: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable X509 [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:687:14: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable X509_V_OK [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:847:58: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable L [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:895:26: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable LUA_TTABLE [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:927:51: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable TLSEXT_NAMETYPE_host_name [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:1075:22: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable SOCKET_INVALID [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/ssl.c:490:18: warning:inconclusive: Found suspicious operator '*', result is not used. [constStatement]
luasec-1.3.2/src/ssl.c:539:18: warning:inconclusive: Found suspicious operator '*', result is not used. [constStatement]
luasec-1.3.2/src/ssl.c:593:18: warning:inconclusive: Found suspicious operator '*', result is not used. [constStatement]
luasec-1.3.2/src/ssl.c:627:18: warning:inconclusive: Found suspicious operator '*', result is not used. [constStatement]
luasec-1.3.2/src/x509.c:61:64: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable cert [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/x509.c:190:12: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable INET6_ADDRSTRLEN [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/x509.c:286:12: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable GENERAL_NAME [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/x509.c:453:24: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable EVP_MAX_MD_SIZE [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/x509.c:543:12: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable X509 [valueFlowBailoutIncompleteVar]
luasec-1.3.2/src/x509.c:286:26: warning:inconclusive: Found suspicious operator '*', result is not used. [constStatement]
luasec-1.3.2/src/x509.c:191:18: style: Variable 'ip' can be declared as pointer to const [constVariablePointer]
luasec-1.3.2/src/x509.c:634:9: style: Variable 'cert' can be declared as pointer to const [constVariablePointer]
diff:
head luasec-1.3.2/src/luasocket/io.c:13:43: style:inconclusive: Function 'io_init' argument 3 names different: declaration '<unnamed>' definition 'recv'. [funcArgNamesDifferentUnnamed]
head luasec-1.3.2/src/luasocket/io.c:13:57: style:inconclusive: Function 'io_init' argument 4 names different: declaration '<unnamed>' definition 'error'. [funcArgNamesDifferentUnnamed]
head luasec-1.3.2/src/luasocket/io.c:13:70: style:inconclusive: Function 'io_init' argument 5 names different: declaration '<unnamed>' definition 'ctx'. [funcArgNamesDifferentUnnamed]


DONE