[libvirt] Coverity automatic detection

Thu Jun 28 06:46:05 UTC 2012

This email is automatically generated.

The test result is based on the following git commit:
cd15303 events: Don't fail on registering events for two different domains

Analysis summary report:
------------------------
Files analyzed                 : 314
Total LoC input to cov-analyze : 371998
Functions analyzed             : 9054
Paths analyzed                 : 1066057
Defect occurrences found       : 136 Total
                                   7 ATOMICITY
                                   9 CHECKED_RETURN
                                   6 DEADCODE
                                   9 FORWARD_NULL
                                  13 LOCK
                                   5 NEGATIVE_RETURNS
                                   3 NO_EFFECT
                                   2 NULL_RETURNS
                                   1 OVERRUN_STATIC
                                  15 RESOURCE_LEAK
                                   1 RETURN_LOCAL
                                  14 REVERSE_INULL
                                   3 SECURE_TEMP
                                   1 SIZEOF_MISMATCH
                                   1 STRING_NULL
                                  13 TAINTED_SCALAR
                                   3 TAINTED_STRING
                                  18 TOCTOU
                                  10 UNINIT
                                   2 UNUSED_VALUE

Exceeded path limit of 5000 paths in 0.59% of functions (normally up to 5% of functions encounter this limitation)

For details, please see attachment.

Regards,
Alex
-------------- next part --------------
Error: ATOMICITY:
/libvirt/src/util/event_poll.c:603:
lock: Locking "eventLoop.lock.lock".
/libvirt/src/util/event_poll.c:610:
def: Assigning: "fds" = data that might be protected by the lock.
/libvirt/src/util/event_poll.c:614:
unlock: Unlocking "eventLoop.lock.lock". "fds" might now be unreliable because other threads can now change the data that it depends on.
/libvirt/src/util/event_poll.c:632:
lockagain: Locking "eventLoop.lock.lock" again.
/libvirt/src/util/event_poll.c:636:
use: Using an unreliable value of "fds" inside the second locked section.  If the data that "fds" depends on was changed by another thread, this use might be incorrect.

Error: ATOMICITY:
/libvirt/src/rpc/virnetclientstream.c:386:
lock: Locking "st->lock.lock".
/libvirt/src/rpc/virnetclientstream.c:397:
def: Assigning: "msg" = data that might be protected by the lock.
/libvirt/src/rpc/virnetclientstream.c:410:
unlock: Unlocking "st->lock.lock". "msg" might now be unreliable because other threads can now change the data that it depends on.
/libvirt/src/rpc/virnetclientstream.c:412:
lockagain: Locking "st->lock.lock" again.
/libvirt/src/rpc/virnetclientstream.c:413:
use: Using an unreliable value of "msg" inside the second locked section.  If the data that "msg" depends on was changed by another thread, this use might be incorrect.

Error: ATOMICITY:
/libvirt/src/fdstream.c:159:
lock: Locking "fdst->lock.lock".
/libvirt/src/fdstream.c:166:
def: Assigning: "cbopaque" = data that might be protected by the lock.
/libvirt/src/fdstream.c:169:
unlock: Unlocking "fdst->lock.lock". "cbopaque" might now be unreliable because other threads can now change the data that it depends on.
/libvirt/src/fdstream.c:173:
lockagain: Locking "fdst->lock.lock" again.
/libvirt/src/fdstream.c:176:
use: Using an unreliable value of "cbopaque" inside the second locked section.  If the data that "cbopaque" depends on was changed by another thread, this use might be incorrect.

Error: ATOMICITY:
/libvirt/src/rpc/virnetclientstream.c:96:
lock: Locking "st->lock.lock".
/libvirt/src/rpc/virnetclientstream.c:109:
def: Assigning: "cbOpaque" = data that might be protected by the lock.
/libvirt/src/rpc/virnetclientstream.c:113:
unlock: Unlocking "st->lock.lock". "cbOpaque" might now be unreliable because other threads can now change the data that it depends on.
/libvirt/src/rpc/virnetclientstream.c:115:
lockagain: Locking "st->lock.lock" again.
/libvirt/src/rpc/virnetclientstream.c:119:
use: Using an unreliable value of "cbOpaque" inside the second locked section.  If the data that "cbOpaque" depends on was changed by another thread, this use might be incorrect.

Error: ATOMICITY:
/libvirt/src/util/threadpool.c:95:
lock: Locking "pool->mutex.lock".
/libvirt/src/util/threadpool.c:129:
def: Assigning: "pool->jobList.firstPrio" = data that might be protected by the lock.
/libvirt/src/util/threadpool.c:143:
unlock: Unlocking "pool->mutex.lock". "pool->jobList.firstPrio" might now be unreliable because other threads can now change the data that it depends on.
/libvirt/src/util/threadpool.c:146:
lockagain: Locking "pool->mutex.lock" again.
/libvirt/src/util/threadpool.c:116:
use: Using an unreliable value of "pool->jobList.firstPrio" inside the second locked section.  If the data that "pool->jobList.firstPrio" depends on was changed by another thread, this use might be incorrect.

Error: ATOMICITY:
/libvirt/src/util/threadpool.c:146:
lock: Locking "pool->mutex.lock".
/libvirt/src/util/threadpool.c:129:
def: Assigning: "pool->jobList.firstPrio" = data that might be protected by the lock.
/libvirt/src/util/threadpool.c:143:
unlock: Unlocking "pool->mutex.lock". "pool->jobList.firstPrio" might now be unreliable because other threads can now change the data that it depends on.
/libvirt/src/util/threadpool.c:146:
lockagain: Locking "pool->mutex.lock" again.
/libvirt/src/util/threadpool.c:116:
use: Using an unreliable value of "pool->jobList.firstPrio" inside the second locked section.  If the data that "pool->jobList.firstPrio" depends on was changed by another thread, this use might be incorrect.

Error: ATOMICITY:
/libvirt/src/util/threadpool.c:146:
lock: Locking "pool->mutex.lock".
/libvirt/src/util/threadpool.c:135:
def: Assigning: "pool->jobList.head" = data that might be protected by the lock.
/libvirt/src/util/threadpool.c:143:
unlock: Unlocking "pool->mutex.lock". "pool->jobList.head" might now be unreliable because other threads can now change the data that it depends on.
/libvirt/src/util/threadpool.c:146:
lockagain: Locking "pool->mutex.lock" again.
/libvirt/src/util/threadpool.c:118:
use: Using an unreliable value of "pool->jobList.head" inside the second locked section.  If the data that "pool->jobList.head" depends on was changed by another thread, this use might be incorrect.

Error: CHECKED_RETURN:
/libvirt/src/qemu/qemu_hostdev.c:104:
example_checked: "pciDeviceListAdd(list, activeDev)" has its value checked in "pciDeviceListAdd(list, activeDev) < 0".
/libvirt/src/qemu/qemu_hostdev.c:61:
example_checked: "pciDeviceListAdd(list, dev)" has its value checked in "pciDeviceListAdd(list, dev) < 0".
/libvirt/src/qemu/qemu_hostdev.c:463:
example_checked: "pciDeviceListAdd(driver->activePciHostdevs, dev)" has its value checked in "pciDeviceListAdd(driver->activePciHostdevs, dev) < 0".
/libvirt/src/qemu/qemu_hostdev.c:151:
example_checked: "pciDeviceListAdd(driver->activePciHostdevs, dev)" has its value checked in "pciDeviceListAdd(driver->activePciHostdevs, dev) < 0".
/libvirt/src/util/pci.c:1137:
example_checked: "pciDeviceListAdd(inactiveDevs, dev)" has its value checked in "pciDeviceListAdd(inactiveDevs, dev) < 0".
/libvirt/src/qemu/qemu_hostdev.c:729:
check_return: Calling function "pciDeviceListAdd" without checking return value (as is done elsewhere 5 out of 6 times).
/libvirt/src/qemu/qemu_hostdev.c:729:
unchecked_value: No check of the return value of "pciDeviceListAdd(driver->inactivePciHostdevs, dev)".

Error: CHECKED_RETURN:
/libvirt/tests/virbuftest.c:167:
example_checked: "virBufferTrim(buf, NULL, -1)" has its value checked in "virBufferTrim(buf, NULL, -1) != -1".
/libvirt/tests/virbuftest.c:174:
example_checked: "virBufferTrim(buf, "", -1)" has its value checked in "virBufferTrim(buf, "", -1) != 1".
/libvirt/tests/virbuftest.c:180:
example_checked: "virBufferTrim(buf, "b", -1)" has its value checked in "virBufferTrim(buf, "b", -1) != 0".
/libvirt/tests/virbuftest.c:182:
example_checked: "virBufferTrim(buf, ",", -1)" has its value checked in "virBufferTrim(buf, ",", -1) != 1".
/libvirt/tools/virsh.c:13458:
check_return: Calling function "virBufferTrim" without checking return value (as is done elsewhere 4 out of 5 times).
/libvirt/tools/virsh.c:13458:
unchecked_value: No check of the return value of "virBufferTrim(indent, "  ", -1)".

Error: CHECKED_RETURN:
/libvirt/tools/virsh.c:4251:
example_checked: "pthread_sigmask(0, &sigmask, &oldsigmask)" has its value checked in "pthread_sigmask(0, &sigmask, &oldsigmask) < 0".
/libvirt/tools/virsh.c:3781:
example_checked: "pthread_sigmask(0, &sigmask, &oldsigmask)" has its value checked in "pthread_sigmask(0, &sigmask, &oldsigmask) < 0".
/libvirt/tools/virsh.c:7368:
example_checked: "pthread_sigmask(0, &sigmask, &oldsigmask)" has its value checked in "pthread_sigmask(0, &sigmask, &oldsigmask) < 0".
/libvirt/tools/virsh.c:3488:
example_checked: "pthread_sigmask(0, &sigmask, &oldsigmask)" has its value checked in "pthread_sigmask(0, &sigmask, &oldsigmask) < 0".
/libvirt/tools/virsh.c:7570:
check_return: Calling function "pthread_sigmask" without checking return value (as is done elsewhere 4 out of 5 times).
/libvirt/tools/virsh.c:7570:
unchecked_value: No check of the return value of "pthread_sigmask(0, &sigmask, &oldsigmask)".

Error: CHECKED_RETURN:
/libvirt/daemon/libvirtd-config.c:213:
example_checked: "virAsprintf(configfile, "%s/libvirtd.conf", configdir)" has its value checked in "virAsprintf(configfile, "%s/libvirtd.conf", configdir) < 0".
/libvirt/daemon/libvirtd-config.c:303:
example_assign: Assigning: "ret" = return value from "virAsprintf(&data->mdns_name, "Virtualization Host")".
/libvirt/daemon/libvirtd-config.c:313:
example_checked: "ret" has its value checked in "ret < 0".
/libvirt/daemon/libvirtd-config.c:309:
example_assign: Assigning: "ret" = return value from "virAsprintf(&data->mdns_name, "Virtualization Host %s", localhost)".
/libvirt/daemon/libvirtd-config.c:313:
example_checked: "ret" has its value checked in "ret < 0".
/libvirt/daemon/libvirtd.c:255:
example_checked: "virAsprintf(pidfile, "%s/libvirtd.pid", rundir)" has its value checked in "virAsprintf(pidfile, "%s/libvirtd.pid", rundir) < 0".
/libvirt/daemon/libvirtd.c:639:
example_checked: "virAsprintf(&tmp, "%d:file:%s/log/libvirt/libvirtd.log", virLogGetDefaultPriority(), "/usr/local/var")" has its value checked in "virAsprintf(&tmp, "%d:file:%s/log/libvirt/libvirtd.log", virLogGetDefaultPriority(), "/usr/local/var") == -1".
/libvirt/tests/xml2vmxtest.c:191:
check_return: Calling function "virAsprintf" without checking return value (as is done elsewhere 525 out of 556 times).
/libvirt/tests/xml2vmxtest.c:191:
unchecked_value: No check of the return value of "virAsprintf(&absolutePath, "/vmfs/volumes/%s/%s", datastoreName, directoryAndFileName)".

Error: CHECKED_RETURN:
/libvirt/daemon/libvirtd-config.c:213:
example_checked: "virAsprintf(configfile, "%s/libvirtd.conf", configdir)" has its value checked in "virAsprintf(configfile, "%s/libvirtd.conf", configdir) < 0".
/libvirt/daemon/libvirtd-config.c:303:
example_assign: Assigning: "ret" = return value from "virAsprintf(&data->mdns_name, "Virtualization Host")".
/libvirt/daemon/libvirtd-config.c:313:
example_checked: "ret" has its value checked in "ret < 0".
/libvirt/daemon/libvirtd-config.c:309:
example_assign: Assigning: "ret" = return value from "virAsprintf(&data->mdns_name, "Virtualization Host %s", localhost)".
/libvirt/daemon/libvirtd-config.c:313:
example_checked: "ret" has its value checked in "ret < 0".
/libvirt/daemon/libvirtd.c:255:
example_checked: "virAsprintf(pidfile, "%s/libvirtd.pid", rundir)" has its value checked in "virAsprintf(pidfile, "%s/libvirtd.pid", rundir) < 0".
/libvirt/daemon/libvirtd.c:639:
example_checked: "virAsprintf(&tmp, "%d:file:%s/log/libvirt/libvirtd.log", virLogGetDefaultPriority(), "/usr/local/var")" has its value checked in "virAsprintf(&tmp, "%d:file:%s/log/libvirt/libvirtd.log", virLogGetDefaultPriority(), "/usr/local/var") == -1".
/libvirt/tests/vmx2xmltest.c:177:
check_return: Calling function "virAsprintf" without checking return value (as is done elsewhere 525 out of 556 times).
/libvirt/tests/vmx2xmltest.c:177:
unchecked_value: No check of the return value of "virAsprintf(&src, "[%s] %s", datastoreName, directoryAndFileName)".

Error: CHECKED_RETURN:
/libvirt/daemon/libvirtd-config.c:213:
example_checked: "virAsprintf(configfile, "%s/libvirtd.conf", configdir)" has its value checked in "virAsprintf(configfile, "%s/libvirtd.conf", configdir) < 0".
/libvirt/daemon/libvirtd-config.c:303:
example_assign: Assigning: "ret" = return value from "virAsprintf(&data->mdns_name, "Virtualization Host")".
/libvirt/daemon/libvirtd-config.c:313:
example_checked: "ret" has its value checked in "ret < 0".
/libvirt/daemon/libvirtd-config.c:309:
example_assign: Assigning: "ret" = return value from "virAsprintf(&data->mdns_name, "Virtualization Host %s", localhost)".
/libvirt/daemon/libvirtd-config.c:313:
example_checked: "ret" has its value checked in "ret < 0".
/libvirt/daemon/libvirtd.c:255:
example_checked: "virAsprintf(pidfile, "%s/libvirtd.pid", rundir)" has its value checked in "virAsprintf(pidfile, "%s/libvirtd.pid", rundir) < 0".
/libvirt/daemon/libvirtd.c:639:
example_checked: "virAsprintf(&tmp, "%d:file:%s/log/libvirt/libvirtd.log", virLogGetDefaultPriority(), "/usr/local/var")" has its value checked in "virAsprintf(&tmp, "%d:file:%s/log/libvirt/libvirtd.log", virLogGetDefaultPriority(), "/usr/local/var") == -1".
/libvirt/tests/vmx2xmltest.c:186:
check_return: Calling function "virAsprintf" without checking return value (as is done elsewhere 525 out of 556 times).
/libvirt/tests/vmx2xmltest.c:186:
unchecked_value: No check of the return value of "virAsprintf(&src, "[datastore] directory/%s", fileName)".

Error: CHECKED_RETURN:
/libvirt/daemon/libvirtd.c:963:
example_checked: "virInitialize()" has its value checked in "virInitialize() < 0".
/libvirt/python/libvirt-override.c:5884:
example_checked: "virInitialize()" has its value checked in "virInitialize() < 0".
/libvirt/python/libvirt-qemu-override.c:109:
example_checked: "virInitialize()" has its value checked in "virInitialize() < 0".
/libvirt/src/libvirt.c:623:
example_checked: "virInitialize()" has its value checked in "virInitialize() < 0".
/libvirt/src/libvirt.c:563:
example_checked: "virInitialize()" has its value checked in "virInitialize() < 0".
/libvirt/tests/shunloadhelper.c:46:
check_return: Calling function "virInitialize" without checking return value (as is done elsewhere 19 out of 21 times).
/libvirt/tests/shunloadhelper.c:46:
unchecked_value: No check of the return value of "virInitialize()".

Error: CHECKED_RETURN:
/libvirt/daemon/libvirtd-config.c:213:
example_checked: "virAsprintf(configfile, "%s/libvirtd.conf", configdir)" has its value checked in "virAsprintf(configfile, "%s/libvirtd.conf", configdir) < 0".
/libvirt/daemon/libvirtd-config.c:303:
example_assign: Assigning: "ret" = return value from "virAsprintf(&data->mdns_name, "Virtualization Host")".
/libvirt/daemon/libvirtd-config.c:313:
example_checked: "ret" has its value checked in "ret < 0".
/libvirt/daemon/libvirtd-config.c:309:
example_assign: Assigning: "ret" = return value from "virAsprintf(&data->mdns_name, "Virtualization Host %s", localhost)".
/libvirt/daemon/libvirtd-config.c:313:
example_checked: "ret" has its value checked in "ret < 0".
/libvirt/daemon/libvirtd.c:255:
example_checked: "virAsprintf(pidfile, "%s/libvirtd.pid", rundir)" has its value checked in "virAsprintf(pidfile, "%s/libvirtd.pid", rundir) < 0".
/libvirt/daemon/libvirtd.c:639:
example_checked: "virAsprintf(&tmp, "%d:file:%s/log/libvirt/libvirtd.log", virLogGetDefaultPriority(), "/usr/local/var")" has its value checked in "virAsprintf(&tmp, "%d:file:%s/log/libvirt/libvirtd.log", virLogGetDefaultPriority(), "/usr/local/var") == -1".
/libvirt/tests/networkxml2argvtest.c:133:
check_return: Calling function "virAsprintf" without checking return value (as is done elsewhere 525 out of 556 times).
/libvirt/tests/networkxml2argvtest.c:133:
unchecked_value: No check of the return value of "virAsprintf(&leasefile, "/var/lib/libvirt/dnsmasq/%s.leases", netname)".

Error: CHECKED_RETURN:
/libvirt/daemon/libvirtd-config.c:213:
example_checked: "virAsprintf(configfile, "%s/libvirtd.conf", configdir)" has its value checked in "virAsprintf(configfile, "%s/libvirtd.conf", configdir) < 0".
/libvirt/daemon/libvirtd-config.c:303:
example_assign: Assigning: "ret" = return value from "virAsprintf(&data->mdns_name, "Virtualization Host")".
/libvirt/daemon/libvirtd-config.c:313:
example_checked: "ret" has its value checked in "ret < 0".
/libvirt/daemon/libvirtd-config.c:309:
example_assign: Assigning: "ret" = return value from "virAsprintf(&data->mdns_name, "Virtualization Host %s", localhost)".
/libvirt/daemon/libvirtd-config.c:313:
example_checked: "ret" has its value checked in "ret < 0".
/libvirt/daemon/libvirtd.c:255:
example_checked: "virAsprintf(pidfile, "%s/libvirtd.pid", rundir)" has its value checked in "virAsprintf(pidfile, "%s/libvirtd.pid", rundir) < 0".
/libvirt/daemon/libvirtd.c:639:
example_checked: "virAsprintf(&tmp, "%d:file:%s/log/libvirt/libvirtd.log", virLogGetDefaultPriority(), "/usr/local/var")" has its value checked in "virAsprintf(&tmp, "%d:file:%s/log/libvirt/libvirtd.log", virLogGetDefaultPriority(), "/usr/local/var") == -1".
/libvirt/src/security/security_selinux.c:1584:
check_return: Calling function "virAsprintf" without checking return value (as is done elsewhere 525 out of 556 times).
/libvirt/src/security/security_selinux.c:1584:
unchecked_value: No check of the return value of "virAsprintf(&opts, ",context=\"%s\"", (char const *)secdef->imagelabel)".

Error: DEADCODE:
/libvirt/gnulib/lib/strerror_r.c:154:
dead_error_condition: On this path, the condition "msg" cannot be true.
/libvirt/gnulib/lib/strerror_r.c:152:
const: After this line, the value of "msg" is equal to 0.
/libvirt/gnulib/lib/strerror_r.c:152:
assignment: Assigning: "msg" = "NULL".
/libvirt/gnulib/lib/strerror_r.c:155:
dead_error_line: Execution cannot reach this statement "return safe_copy(buf, bufle...".

Error: DEADCODE:
/libvirt/gnulib/lib/strerror.c:45:
dead_error_condition: On this path, the condition "msg" cannot be true.
/libvirt/gnulib/lib/strerror.c:44:
const: After this line, the value of "msg" is equal to 0.
/libvirt/gnulib/lib/strerror.c:44:
assignment: Assigning: "msg" = "NULL".
/libvirt/gnulib/lib/strerror.c:46:
dead_error_line: Execution cannot reach this statement "return (char *)msg;".

Error: DEADCODE:
/libvirt/src/rpc/virnetclient.c:345:
dead_error_condition: On this path, the condition "ka" cannot be true.
/libvirt/src/rpc/virnetclient.c:287:
const: After this line, the value of "ka" is equal to 0.
/libvirt/src/rpc/virnetclient.c:325:
const: After this line, the value of "ka" is equal to 0.
/libvirt/src/rpc/virnetclient.c:287:
assignment: Assigning: "ka" = "NULL".
/libvirt/src/rpc/virnetclient.c:325:
new_values: Noticing condition "ka = virKeepAliveNew(-1, 0U, client, virNetClientKeepAliveSendCB, virNetClientKeepAliveDeadCB, virNetClientEventFree)".
/libvirt/src/rpc/virnetclient.c:346:
dead_error_begin: Execution cannot reach this statement "virKeepAliveStop(ka);".

Error: DEADCODE:
/libvirt/src/rpc/virnetserverclient.c:1206:
dead_error_condition: On this path, the condition "ka" cannot be true.
/libvirt/src/rpc/virnetserverclient.c:1193:
const: After this line, the value of "ka" is equal to 0.
/libvirt/src/rpc/virnetserverclient.c:1202:
const: After this line, the value of "ka" is equal to 0.
/libvirt/src/rpc/virnetserverclient.c:1202:
assignment: Assigning: "ka" = "NULL".
/libvirt/src/rpc/virnetserverclient.c:1193:
new_values: Noticing condition "ka = virKeepAliveNew(interval, count, client, virNetServerClientKeepAliveSendCB, virNetServerClientKeepAliveDeadCB, virNetServerClientFreeCB)".
/libvirt/src/rpc/virnetserverclient.c:1207:
dead_error_line: Execution cannot reach this statement "virKeepAliveStop(ka);".

Error: DEADCODE:
/libvirt/tests/commandtest.c:669:
dead_error_condition: On this path, the condition "outbuf" cannot be true.
/libvirt/tests/commandtest.c:658:
const: After this line, the value of "outbuf" is equal to 0.
/libvirt/tests/commandtest.c:658:
new_values: Noticing condition "outbuf != NULL".
/libvirt/tests/commandtest.c:669:
dead_error_line: Execution cannot reach this expression "*outbuf" inside statement "if (!outbuf || *outbuf){
  ...".

Error: DEADCODE:
/libvirt/src/qemu/qemu_driver.c:8258:
dead_error_condition: On this path, the condition "group" cannot be true.
/libvirt/src/qemu/qemu_driver.c:8153:
const: After this line, the value of "group" is equal to 0.
/libvirt/src/qemu/qemu_driver.c:8153:
assignment: Assigning: "group" = "NULL".
/libvirt/src/qemu/qemu_driver.c:8259:
dead_error_line: Execution cannot reach this statement "virCgroupFree(&group);".

Error: FORWARD_NULL:
/libvirt/src/util/command.c:1702:
var_compare_op: Comparing "cmd->errbuf" to null implies that "cmd->errbuf" might be null.
/libvirt/src/util/command.c:1759:
alias_transfer: Assigning null: "buf" = "cmd->errbuf".
/libvirt/src/util/command.c:1781:
var_deref_model: Passing null variable "buf" to function "virReallocN", which dereferences it.
/libvirt/src/util/memory.c:161:
deref_parm: Directly dereferencing parameter "ptrptr".

Error: FORWARD_NULL:
/libvirt/src/util/command.c:1695:
var_compare_op: Comparing "cmd->outbuf" to null implies that "cmd->outbuf" might be null.
/libvirt/src/util/command.c:1756:
alias_transfer: Assigning null: "buf" = "cmd->outbuf".
/libvirt/src/util/command.c:1781:
var_deref_model: Passing null variable "buf" to function "virReallocN", which dereferences it.
/libvirt/src/util/memory.c:161:
deref_parm: Directly dereferencing parameter "ptrptr".

Error: FORWARD_NULL:
/libvirt/src/nwfilter/nwfilter_dhcpsnoop.c:574:
var_compare_op: Comparing "ifkey" to null implies that "ifkey" might be null.
/libvirt/src/nwfilter/nwfilter_dhcpsnoop.c:575:
var_deref_model: Passing null variable "ifkey" to function "strlen", which dereferences it. (The dereference is assumed on the basis of the 'nonnull' parameter attribute.)

Error: FORWARD_NULL:
/libvirt/src/conf/storage_conf.c:431:
var_compare_op: Comparing "uuid" to null implies that "uuid" might be null.
/libvirt/src/conf/storage_conf.c:437:
var_deref_model: Passing null variable "uuid" to function "virUUIDParse", which dereferences it.
/libvirt/src/util/uuid.c:138:
var_assign_parm: Assigning: "cur" = "uuidstr".
/libvirt/src/util/uuid.c:139:
deref_var: Dereferencing "cur" (which is a copy of "uuidstr").

Error: FORWARD_NULL:
/libvirt/src/lxc/lxc_container.c:1242:
assign_zero: Assigning: "dh" = 0.
/libvirt/src/lxc/lxc_container.c:1332:
var_deref_model: Passing null variable "dh" to function "closedir", which dereferences it. (The dereference is assumed on the basis of the 'nonnull' parameter attribute.)

Error: FORWARD_NULL:
/libvirt/src/lxc/lxc_container.c:1279:
var_compare_op: Comparing "dh" to null implies that "dh" might be null.
/libvirt/src/lxc/lxc_container.c:1332:
var_deref_model: Passing null variable "dh" to function "closedir", which dereferences it. (The dereference is assumed on the basis of the 'nonnull' parameter attribute.)

Error: FORWARD_NULL:
/libvirt/src/lxc/lxc_controller.c:1103:
assign_zero: Assigning: "consoles" = 0.
/libvirt/src/lxc/lxc_controller.c:1236:
var_deref_op: Dereferencing null variable "consoles".

Error: FORWARD_NULL:
/libvirt/src/rpc/virnetserver.c:703:
var_compare_op: Comparing "srv->clients" to null implies that "srv->clients" might be null.
/libvirt/src/rpc/virnetserver.c:725:
var_deref_op: Dereferencing null variable "srv->clients".

Error: FORWARD_NULL:
/libvirt/src/qemu/qemu_driver.c:6689:
assign_zero: Assigning: "group" = 0.
/libvirt/src/qemu/qemu_driver.c:6783:
var_deref_model: Passing null variable "group" to function "virCgroupGetMemoryHardLimit", which dereferences it.
/libvirt/src/util/cgroup.c:1109:
deref_parm_in_call: Function "virCgroupGetValueU64" dereferences parameter "group".
/libvirt/src/util/cgroup.c:435:
deref_parm_in_call: Function "virCgroupGetValueStr" dereferences parameter "group".
/libvirt/src/util/cgroup.c:344:
deref_parm_in_call: Function "virCgroupPathOfController" dereferences parameter "group".
/libvirt/src/util/cgroup.c:281:
deref_parm: Directly dereferencing parameter "group".

Error: LOCK:
/libvirt/src/datatypes.c:1037:
lock: "virMutexLock" locks "secret->conn->lock.lock".
/libvirt/src/util/threads-pthread.c:85:
lock: "pthread_mutex_lock" locks "m->lock".
/libvirt/src/datatypes.c:1044:
missing_unlock: Returning without unlocking "secret->conn->lock.lock".

Error: LOCK:
/libvirt/src/datatypes.c:396:
lock: "virMutexLock" locks "network->conn->lock.lock".
/libvirt/src/util/threads-pthread.c:85:
lock: "pthread_mutex_lock" locks "m->lock".
/libvirt/src/datatypes.c:403:
missing_unlock: Returning without unlocking "network->conn->lock.lock".

Error: LOCK:
/libvirt/src/nwfilter/nwfilter_learnipaddr.c:178:
lock: "virMutexLock" locks "ifaceLock->lock.lock".
/libvirt/src/util/threads-pthread.c:85:
lock: "pthread_mutex_lock" locks "m->lock".
/libvirt/src/nwfilter/nwfilter_learnipaddr.c:180:
missing_unlock: Returning without unlocking "ifaceLock->lock.lock".

Error: LOCK:
/libvirt/src/datatypes.c:144:
lock: "virMutexLock" locks "conn->lock.lock".
/libvirt/src/util/threads-pthread.c:85:
lock: "pthread_mutex_lock" locks "m->lock".
/libvirt/src/datatypes.c:151:
missing_unlock: Returning without unlocking "conn->lock.lock".

Error: LOCK:
/libvirt/src/util/event_poll.c:441:
lock: "virMutexLock" locks "eventLoop.lock.lock".
/libvirt/src/util/threads-pthread.c:85:
lock: "pthread_mutex_lock" locks "m->lock".
/libvirt/src/util/event_poll.c:444:
missing_unlock: Returning without unlocking "eventLoop.lock.lock".

Error: LOCK:
/libvirt/src/datatypes.c:270:
lock: "virMutexLock" locks "domain->conn->lock.lock".
/libvirt/src/util/threads-pthread.c:85:
lock: "pthread_mutex_lock" locks "m->lock".
/libvirt/src/datatypes.c:277:
missing_unlock: Returning without unlocking "domain->conn->lock.lock".

Error: LOCK:
/libvirt/src/datatypes.c:1095:
lock: "virMutexLock" locks "st->conn->lock.lock".
/libvirt/src/util/threads-pthread.c:85:
lock: "pthread_mutex_lock" locks "m->lock".
/libvirt/src/datatypes.c:1102:
missing_unlock: Returning without unlocking "st->conn->lock.lock".

Error: LOCK:
/libvirt/src/datatypes.c:1314:
lock: "virMutexLock" locks "snapshot->domain->conn->lock.lock".
/libvirt/src/util/threads-pthread.c:85:
lock: "pthread_mutex_lock" locks "m->lock".
/libvirt/src/datatypes.c:1321:
missing_unlock: Returning without unlocking "snapshot->domain->conn->lock.lock".

Error: LOCK:
/libvirt/src/datatypes.c:658:
lock: "virMutexLock" locks "pool->conn->lock.lock".
/libvirt/src/util/threads-pthread.c:85:
lock: "pthread_mutex_lock" locks "m->lock".
/libvirt/src/datatypes.c:665:
missing_unlock: Returning without unlocking "pool->conn->lock.lock".

Error: LOCK:
/libvirt/src/datatypes.c:797:
lock: "virMutexLock" locks "vol->conn->lock.lock".
/libvirt/src/util/threads-pthread.c:85:
lock: "pthread_mutex_lock" locks "m->lock".
/libvirt/src/datatypes.c:804:
missing_unlock: Returning without unlocking "vol->conn->lock.lock".

Error: LOCK:
/libvirt/src/datatypes.c:913:
lock: "virMutexLock" locks "dev->conn->lock.lock".
/libvirt/src/util/threads-pthread.c:85:
lock: "pthread_mutex_lock" locks "m->lock".
/libvirt/src/datatypes.c:920:
missing_unlock: Returning without unlocking "dev->conn->lock.lock".

Error: LOCK:
/libvirt/src/datatypes.c:1225:
lock: "virMutexLock" locks "nwfilter->conn->lock.lock".
/libvirt/src/util/threads-pthread.c:85:
lock: "pthread_mutex_lock" locks "m->lock".
/libvirt/src/datatypes.c:1233:
missing_unlock: Returning without unlocking "nwfilter->conn->lock.lock".

Error: LOCK:
/libvirt/src/datatypes.c:529:
lock: "virMutexLock" locks "iface->conn->lock.lock".
/libvirt/src/util/threads-pthread.c:85:
lock: "pthread_mutex_lock" locks "m->lock".
/libvirt/src/datatypes.c:536:
missing_unlock: Returning without unlocking "iface->conn->lock.lock".

Error: NEGATIVE_RETURNS:
/libvirt/src/util/buf.c:147:
negative_return_fn: Function "virBufferGetIndent(buf, true)" returns a negative number.
/libvirt/src/util/buf.c:89:
return_negative_constant: Explicitly returning negative value "-1".
/libvirt/src/util/buf.c:147:
var_assign: Assigning: signed variable "indent" = "virBufferGetIndent".
/libvirt/src/util/buf.c:157:
negative_returns: "indent" is passed to a parameter that cannot be negative.

Error: NEGATIVE_RETURNS:
/libvirt/src/util/command.c:1816:
var_tested_neg: Assigning: "infd" = a negative value.
/libvirt/src/util/command.c:1797:
negative_returns: "infd" is passed to a parameter that cannot be negative.

Error: NEGATIVE_RETURNS:
/libvirt/src/util/command.c:1718:
var_tested_neg: Variable "infd" tests negative.
/libvirt/src/util/command.c:1797:
negative_returns: "infd" is passed to a parameter that cannot be negative.

Error: NEGATIVE_RETURNS:
/libvirt/src/conf/storage_conf.c:489:
negative_return_fn: Function "virXPathNodeSet("./host", ctxt, &nodeset)" returns a negative number.
/libvirt/src/util/xml.c:567:
return_negative_constant: Explicitly returning negative value "-1".
/libvirt/src/conf/storage_conf.c:489:
var_assign: Assigning: unsigned variable "source->nhost" = "virXPathNodeSet".
/libvirt/src/conf/storage_conf.c:492:
negative_returns: "source->nhost" is passed to a parameter that cannot be negative.
/libvirt/src/util/memory.c:129:
neg_sink_parm_call: Passing "count" to "calloc", which cannot accept a negative.

Error: NEGATIVE_RETURNS:
/libvirt/src/conf/virdomainlist.c:191:
negative_return_fn: Function "virDomainSnapshotObjListNum(snapshots, from, flags)" returns a negative number.
/libvirt/src/conf/domain_conf.c:14398:
negative_return: Calling "virDomainSnapshotObjListGetNames", which might return a negative value.
/libvirt/src/conf/domain_conf.c:14376:
negative_return: Calling "virHashSize", which might return a negative value.
/libvirt/src/util/virhash.c:419:
return_negative_constant: Explicitly returning negative value "-1L".
/libvirt/src/conf/domain_conf.c:14376:
var_assign: Assigning: "data.count" = "virHashSize(snapshots->objs)", which might be negative.
/libvirt/src/conf/domain_conf.c:14390:
return_negative_variable: Explicitly returning negative variable "data.count".
/libvirt/src/conf/domain_conf.c:14398:
return_negative_fn: Returning the return value of "virDomainSnapshotObjListGetNames", which might be negative.
/libvirt/src/conf/virdomainlist.c:191:
var_assign: Assigning: signed variable "count" = "virDomainSnapshotObjListNum".
/libvirt/src/conf/virdomainlist.c:199:
negative_returns: "count" is passed to a parameter that cannot be negative.
/libvirt/src/util/memory.c:129:
neg_sink_parm_call: Passing "count" to "calloc", which cannot accept a negative.

Error: NO_EFFECT:
/libvirt/src/qemu/qemu_command.c:3605:
array_null: Comparing an array to null is not useful: ""com.redhat.spice.0"".

Error: NO_EFFECT:
/libvirt/src/conf/storage_conf.c:954:
array_null: Comparing an array to null is not useful: "src->auth.cephx.secret.uuid != NULL".

Error: NO_EFFECT:
/libvirt/src/qemu/qemu_driver.c:9719:
array_null: Comparing an array to null is not useful: ""qcow2"".

Error: NULL_RETURNS:
/libvirt/src/qemu/qemu_driver.c:9323:
example_checked: "pciDeviceListFind(driver->inactivePciHostdevs, pci)" has its value checked in "pciDeviceListFind(driver->inactivePciHostdevs, pci)".
/libvirt/src/qemu/qemu_driver.c:9353:
example_assign: Assigning: "other" = return value from "pciDeviceListFind(driver->activePciHostdevs, pci)".
/libvirt/src/qemu/qemu_driver.c:9354:
example_checked: "other" has its value checked in "other".
/libvirt/src/qemu/qemu_hostdev.c:103:
example_checked: "pciDeviceListFind(driver->activePciHostdevs, dev)" has its value checked in "activeDev = pciDeviceListFind(driver->activePciHostdevs, dev)".
/libvirt/src/qemu/qemu_hostdev.c:778:
example_assign: Assigning: "activeDev" = return value from "pciDeviceListFind(driver->activePciHostdevs, dev)".
/libvirt/src/qemu/qemu_hostdev.c:779:
example_checked: "activeDev" has its value checked in "activeDev".
/libvirt/src/qemu/qemu_hostdev.c:410:
example_checked: "pciDeviceListFind(driver->activePciHostdevs, dev)" has its value checked in "other = pciDeviceListFind(driver->activePciHostdevs, dev)".
/libvirt/src/qemu/qemu_hostdev.c:482:
returned_null: Function "pciDeviceListFind" returns null (checked 12 out of 13 times).
/libvirt/src/util/pci.c:1611:
return_null: Explicitly returning NULL.
/libvirt/src/qemu/qemu_hostdev.c:482:
var_assigned: Assigning: "activeDev" = null return value from "pciDeviceListFind".
/libvirt/src/qemu/qemu_hostdev.c:484:
dereference: Dereferencing a pointer that might be null "activeDev" when calling "pciDeviceSetUsedBy".
/libvirt/src/util/pci.c:1475:
deref_parm: Directly dereferencing parameter "dev".

Error: NULL_RETURNS:
/libvirt/src/conf/domain_conf.c:1747:
example_checked: "virDomainFindByUUID(doms, def->uuid)" has its value checked in "domain = virDomainFindByUUID(doms, def->uuid)".
/libvirt/src/conf/domain_conf.c:13306:
example_checked: "virDomainFindByUUID(doms, def->uuid)" has its value checked in "dom = virDomainFindByUUID(doms, def->uuid)".
/libvirt/src/conf/domain_conf.c:13568:
example_assign: Assigning: "vm" = return value from "virDomainFindByUUID(doms, def->uuid)".
/libvirt/src/conf/domain_conf.c:13569:
example_checked: "vm" has its value checked in "vm".
/libvirt/src/lxc/lxc_driver.c:2413:
example_assign: Assigning: "vm" = return value from "virDomainFindByUUID(&driver->domains, dom->uuid)".
/libvirt/src/lxc/lxc_driver.c:2414:
example_checked: "vm" has its value checked in "vm".
/libvirt/src/lxc/lxc_driver.c:3510:
example_assign: Assigning: "vm" = return value from "virDomainFindByUUID(&driver->domains, dom->uuid)".
/libvirt/src/lxc/lxc_driver.c:3513:
example_checked: "vm" has its value checked in "vm".
/libvirt/src/openvz/openvz_driver.c:2014:
returned_null: Function "virDomainFindByUUID" returns null (checked 177 out of 178 times).
/libvirt/src/conf/domain_conf.c:785:
var_tested_null: "obj" is null.
/libvirt/src/conf/domain_conf.c:787:
return_null_var: Returning "obj", which is null.
/libvirt/src/openvz/openvz_driver.c:2014:
var_assigned: Assigning: "vm" = null return value from "virDomainFindByUUID".
/libvirt/src/openvz/openvz_driver.c:2015:
dereference: Dereferencing a null pointer "vm".

Error: OVERRUN_STATIC:
/libvirt/src/locking/lock_driver_sanlock.c:166:
overrun-buffer-arg: Overrunning static array ""__LIBVIRT__DISKS__"" of size 19 bytes by passing it to a function which indexes it with argument "48UL" at byte position 47.

Error: RESOURCE_LEAK:
/libvirt/src/conf/domain_conf.c:6558:
alloc_arg: Calling allocation function "virXPathNodeSet" on "codecNodes".
/libvirt/src/util/xml.c:593:
alloc_arg: "virAllocN" allocates memory that is stored into "*list".
/libvirt/src/util/memory.c:129:
alloc_fn: Storage is returned from allocation function "calloc".
/libvirt/src/util/memory.c:129:
var_assign: Assigning: "*((void **)ptrptr)" = "calloc(count, size)".
/libvirt/src/util/xml.c:597:
noescape: Variable "*list" is not freed or pointed-to in function "memcpy".
/libvirt/src/conf/domain_conf.c:6574:
leaked_storage: Variable "codecNodes" going out of scope leaks the storage it points to.

Error: RESOURCE_LEAK:
/libvirt/src/conf/nwfilter_conf.c:367:
alloc_fn: Calling allocation function "virNWFilterVarAccessParse".
/libvirt/src/conf/nwfilter_params.c:947:
alloc_arg: "virAlloc" allocates memory that is stored into "dest".
/libvirt/src/util/memory.c:101:
alloc_fn: Storage is returned from allocation function "calloc".
/libvirt/src/util/memory.c:101:
var_assign: Assigning: "*((void **)ptrptr)" = "calloc(1UL, size)".
/libvirt/src/conf/nwfilter_params.c:963:
return_alloc: Returning allocated memory "dest".
/libvirt/src/conf/nwfilter_conf.c:367:
var_assign: Assigning: "varAccess" =  storage returned from "virNWFilterVarAccessParse(var)".
/libvirt/src/conf/nwfilter_conf.c:373:
noescape: Variable "varAccess" is not freed or pointed-to in function "virNWFilterVarAccessEqual".
/libvirt/src/conf/nwfilter_params.c:914:57:
noescape: "virNWFilterVarAccessEqual" does not free or save its pointer parameter "b".
/libvirt/src/conf/nwfilter_conf.c:382:
leaked_storage: Variable "varAccess" going out of scope leaks the storage it points to.

Error: RESOURCE_LEAK:
/libvirt/daemon/libvirtd.c:147:
open_fn: Calling opening function "open".
/libvirt/daemon/libvirtd.c:147:
var_assign: Assigning: "stdinfd" =  handle returned from "open("/dev/null", 0)".
/libvirt/daemon/libvirtd.c:151:
noescape: Variable "stdinfd" is not closed or saved in function "dup2".
/libvirt/daemon/libvirtd.c:168:
leaked_handle: Handle variable "stdinfd" going out of scope leaks the handle.

Error: RESOURCE_LEAK:
/libvirt/daemon/libvirtd.c:149:
open_fn: Calling opening function "open".
/libvirt/daemon/libvirtd.c:149:
var_assign: Assigning: "stdoutfd" =  handle returned from "open("/dev/null", 1)".
/libvirt/daemon/libvirtd.c:153:
noescape: Variable "stdoutfd" is not closed or saved in function "dup2".
/libvirt/daemon/libvirtd.c:155:
noescape: Variable "stdoutfd" is not closed or saved in function "dup2".
/libvirt/daemon/libvirtd.c:168:
leaked_handle: Handle variable "stdoutfd" going out of scope leaks the handle.

Error: RESOURCE_LEAK:
/libvirt/daemon/libvirtd.c:367:
alloc_fn: Calling allocation function "virDriverLoadModule".
/libvirt/src/driver.c:76:
alloc_fn: Storage is returned from allocation function "dlopen".
/libvirt/src/driver.c:76:
var_assign: Assigning: "handle" = "dlopen(modfile, 258)".
/libvirt/src/driver.c:86:
noescape: Variable "handle" is not freed or pointed-to in function "dlsym".
/libvirt/src/driver.c:99:
return_alloc: Returning allocated memory "handle".
/libvirt/daemon/libvirtd.c:367:
leaked_storage: Failing to save storage allocated by "virDriverLoadModule("network")" leaks it.

Error: RESOURCE_LEAK:
/libvirt/daemon/libvirtd.c:370:
alloc_fn: Calling allocation function "virDriverLoadModule".
/libvirt/src/driver.c:76:
alloc_fn: Storage is returned from allocation function "dlopen".
/libvirt/src/driver.c:76:
var_assign: Assigning: "handle" = "dlopen(modfile, 258)".
/libvirt/src/driver.c:86:
noescape: Variable "handle" is not freed or pointed-to in function "dlsym".
/libvirt/src/driver.c:99:
return_alloc: Returning allocated memory "handle".
/libvirt/daemon/libvirtd.c:370:
leaked_storage: Failing to save storage allocated by "virDriverLoadModule("storage")" leaks it.

Error: RESOURCE_LEAK:
/libvirt/daemon/libvirtd.c:373:
alloc_fn: Calling allocation function "virDriverLoadModule".
/libvirt/src/driver.c:76:
alloc_fn: Storage is returned from allocation function "dlopen".
/libvirt/src/driver.c:76:
var_assign: Assigning: "handle" = "dlopen(modfile, 258)".
/libvirt/src/driver.c:86:
noescape: Variable "handle" is not freed or pointed-to in function "dlsym".
/libvirt/src/driver.c:99:
return_alloc: Returning allocated memory "handle".
/libvirt/daemon/libvirtd.c:373:
leaked_storage: Failing to save storage allocated by "virDriverLoadModule("nodedev")" leaks it.

Error: RESOURCE_LEAK:
/libvirt/daemon/libvirtd.c:376:
alloc_fn: Calling allocation function "virDriverLoadModule".
/libvirt/src/driver.c:76:
alloc_fn: Storage is returned from allocation function "dlopen".
/libvirt/src/driver.c:76:
var_assign: Assigning: "handle" = "dlopen(modfile, 258)".
/libvirt/src/driver.c:86:
noescape: Variable "handle" is not freed or pointed-to in function "dlsym".
/libvirt/src/driver.c:99:
return_alloc: Returning allocated memory "handle".
/libvirt/daemon/libvirtd.c:376:
leaked_storage: Failing to save storage allocated by "virDriverLoadModule("secret")" leaks it.

Error: RESOURCE_LEAK:
/libvirt/daemon/libvirtd.c:379:
alloc_fn: Calling allocation function "virDriverLoadModule".
/libvirt/src/driver.c:76:
alloc_fn: Storage is returned from allocation function "dlopen".
/libvirt/src/driver.c:76:
var_assign: Assigning: "handle" = "dlopen(modfile, 258)".
/libvirt/src/driver.c:86:
noescape: Variable "handle" is not freed or pointed-to in function "dlsym".
/libvirt/src/driver.c:99:
return_alloc: Returning allocated memory "handle".
/libvirt/daemon/libvirtd.c:379:
leaked_storage: Failing to save storage allocated by "virDriverLoadModule("nwfilter")" leaks it.

Error: RESOURCE_LEAK:
/libvirt/daemon/libvirtd.c:385:
alloc_fn: Calling allocation function "virDriverLoadModule".
/libvirt/src/driver.c:76:
alloc_fn: Storage is returned from allocation function "dlopen".
/libvirt/src/driver.c:76:
var_assign: Assigning: "handle" = "dlopen(modfile, 258)".
/libvirt/src/driver.c:86:
noescape: Variable "handle" is not freed or pointed-to in function "dlsym".
/libvirt/src/driver.c:99:
return_alloc: Returning allocated memory "handle".
/libvirt/daemon/libvirtd.c:385:
leaked_storage: Failing to save storage allocated by "virDriverLoadModule("qemu")" leaks it.

Error: RESOURCE_LEAK:
/libvirt/daemon/libvirtd.c:388:
alloc_fn: Calling allocation function "virDriverLoadModule".
/libvirt/src/driver.c:76:
alloc_fn: Storage is returned from allocation function "dlopen".
/libvirt/src/driver.c:76:
var_assign: Assigning: "handle" = "dlopen(modfile, 258)".
/libvirt/src/driver.c:86:
noescape: Variable "handle" is not freed or pointed-to in function "dlsym".
/libvirt/src/driver.c:99:
return_alloc: Returning allocated memory "handle".
/libvirt/daemon/libvirtd.c:388:
leaked_storage: Failing to save storage allocated by "virDriverLoadModule("lxc")" leaks it.

Error: RESOURCE_LEAK:
/libvirt/daemon/libvirtd.c:391:
alloc_fn: Calling allocation function "virDriverLoadModule".
/libvirt/src/driver.c:76:
alloc_fn: Storage is returned from allocation function "dlopen".
/libvirt/src/driver.c:76:
var_assign: Assigning: "handle" = "dlopen(modfile, 258)".
/libvirt/src/driver.c:86:
noescape: Variable "handle" is not freed or pointed-to in function "dlsym".
/libvirt/src/driver.c:99:
return_alloc: Returning allocated memory "handle".
/libvirt/daemon/libvirtd.c:391:
leaked_storage: Failing to save storage allocated by "virDriverLoadModule("uml")" leaks it.

Error: RESOURCE_LEAK:
/libvirt/tests/commandtest.c:862:
open_fn: Calling opening function "open".
/libvirt/tests/commandtest.c:862:
var_assign: Assigning: "fd" =  handle returned from "open("/dev/null", 0)".
/libvirt/tests/commandtest.c:862:
noescape: Variable "fd" is not closed or saved in function "dup2".
/libvirt/tests/commandtest.c:867:
leaked_handle: Handle variable "fd" going out of scope leaks the handle.

Error: RESOURCE_LEAK:
/libvirt/tests/commandtest.c:862:
open_fn: Calling opening function "open".
/libvirt/tests/commandtest.c:862:
var_assign: Assigning: "fd" =  handle returned from "open("/dev/null", 0)".
/libvirt/tests/commandtest.c:862:
noescape: Variable "fd" is not closed or saved in function "dup2".
/libvirt/tests/commandtest.c:878:
overwrite_var: Overwriting handle "fd" in call "fd = 3" leaks the handle.

Error: RESOURCE_LEAK:
/libvirt/tests/virdrivermoduletest.c:42:
alloc_fn: Calling allocation function "virDriverLoadModule".
/libvirt/src/driver.c:76:
alloc_fn: Storage is returned from allocation function "dlopen".
/libvirt/src/driver.c:76:
var_assign: Assigning: "handle" = "dlopen(modfile, 258)".
/libvirt/src/driver.c:86:
noescape: Variable "handle" is not freed or pointed-to in function "dlsym".
/libvirt/src/driver.c:99:
return_alloc: Returning allocated memory "handle".
/libvirt/tests/virdrivermoduletest.c:42:
leaked_storage: Failing to save storage allocated by "virDriverLoadModule(data->dep1)" leaks it.

Error: RETURN_LOCAL:
/libvirt/gnulib/lib/careadlinkat.c:99:
local_ptr_assign_local: Assigning: "buffer" = "stack_buf" (address of local variable "stack_buf").
/libvirt/gnulib/lib/careadlinkat.c:103:
local_ptr_assign_ptr: Assigning: "buf" = "buffer".
/libvirt/gnulib/lib/careadlinkat.c:150:
return_local_addr_alias: Returning pointer "buf" which points to local variable "stack_buf".

Error: REVERSE_INULL:
/libvirt/src/esx/esx_vi.c:1895:
deref_ptr_in_call: Dereferencing pointer "objectSpec".
/libvirt/src/esx/esx_vi_types.generated.c:2065:
deref_parm: Directly dereferencing parameter "*ptrptr".
/libvirt/src/esx/esx_vi.c:2009:
check_after_deref: Dereferencing "objectSpec" before a null check.

Error: REVERSE_INULL:
/libvirt/src/vbox/vbox_tmpl.c:1920:
deref_ptr_in_call: Dereferencing pointer "machineName".
/libvirt/src/vbox/vbox_tmpl.c:1979:
check_after_deref: Dereferencing "machineName" before a null check.

Error: REVERSE_INULL:
/libvirt/src/vbox/vbox_tmpl.c:1384:
deref_ptr_in_call: Dereferencing pointer "machineNameUtf8".
/libvirt/src/vbox/vbox_tmpl.c:1409:
check_after_deref: Dereferencing "machineNameUtf8" before a null check.

Error: REVERSE_INULL:
/libvirt/src/vbox/vbox_tmpl.c:1920:
deref_ptr_in_call: Dereferencing pointer "machineName".
/libvirt/src/vbox/vbox_tmpl.c:1979:
check_after_deref: Dereferencing "machineName" before a null check.

Error: REVERSE_INULL:
/libvirt/src/vbox/vbox_tmpl.c:1384:
deref_ptr_in_call: Dereferencing pointer "machineNameUtf8".
/libvirt/src/vbox/vbox_tmpl.c:1409:
check_after_deref: Dereferencing "machineNameUtf8" before a null check.

Error: REVERSE_INULL:
/libvirt/src/openvz/openvz_driver.c:2015:
deref_ptr: Directly dereferencing pointer "vm".
/libvirt/src/openvz/openvz_driver.c:2017:
check_after_deref: Dereferencing "vm" before a null check.

Error: REVERSE_INULL:
/libvirt/src/vbox/vbox_tmpl.c:1384:
deref_ptr_in_call: Dereferencing pointer "machineNameUtf8".
/libvirt/src/vbox/vbox_tmpl.c:1409:
check_after_deref: Dereferencing "machineNameUtf8" before a null check.

Error: REVERSE_INULL:
/libvirt/src/vbox/vbox_tmpl.c:1920:
deref_ptr_in_call: Dereferencing pointer "machineName".
/libvirt/src/vbox/vbox_tmpl.c:1979:
check_after_deref: Dereferencing "machineName" before a null check.

Error: SECURE_TEMP:
/libvirt/src/secret/secret_driver.c:174:
secure_temp: Calling "mkstemp" without securely setting umask first.

Error: SECURE_TEMP:
/libvirt/src/qemu/qemu_driver.c:8440:
secure_temp: Calling "mkstemp" without securely setting umask first.

Error: SECURE_TEMP:
/libvirt/src/qemu/qemu_driver.c:3296:
secure_temp: Calling "mkstemp" without securely setting umask first.

Error: SIZEOF_MISMATCH:
/libvirt/tools/virsh.c:5614:
suspicious_sizeof: Passing argument "8UL /* sizeof (cpumap) */" to function "_vshCalloc" and then casting the return value to "unsigned char *" is suspicious.

Error: STRING_NULL:
/libvirt/src/node_device/node_device_linux_sysfs.c:79:
string_null_argument: Function "saferead" does not terminate string "*buf".
/libvirt/src/util/util.c:109:
string_null_argument: Function "read" fills array "*buf" with a non-terminated string.
/libvirt/src/node_device/node_device_linux_sysfs.c:86:
string_null: Passing unterminated string "buf" to a function expecting a null-terminated string.

Error: TAINTED_SCALAR:
/libvirt/src/util/pci.c:359:
tainted_data_return: Function "pciRead8" returns tainted data.
/libvirt/src/util/pci.c:223:
tainted_data_argument: Function "pciRead" taints argument "buf".
/libvirt/src/util/pci.c:209:
tainted_data_argument: Calling function "saferead" taints parameter "*buf".
/libvirt/src/util/util.c:109:
tainted_data_argument: Calling function "read" taints parameter "*buf".
/libvirt/src/util/pci.c:224:
return_tainted_data: Returning tainted variable "buf".
/libvirt/src/util/pci.c:359:
var_assign: Assigning: "pos" = "pciRead8", which taints "pos".
/libvirt/src/util/pci.c:368:
lower_bounds: Checking lower bounds of unsigned scalar "pos" by "pos >= 64".
/libvirt/src/util/pci.c:369:
tainted_data: Passing tainted variable "pos" to a tainted sink.
/libvirt/src/util/pci.c:223:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "pciRead".
/libvirt/src/util/pci.c:209:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "lseek".
/libvirt/src/util/pci.c:376:
tainted_data: Passing tainted variable "pos + 1" to a tainted sink.
/libvirt/src/util/pci.c:223:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "pciRead".
/libvirt/src/util/pci.c:209:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "lseek".

Error: TAINTED_SCALAR:
/libvirt/src/util/pci.c:368:
lower_bounds: Checking lower bounds of unsigned scalar "pos" by "pos >= 64".
/libvirt/src/util/pci.c:369:
tainted_data: Passing tainted variable "pos" to a tainted sink.
/libvirt/src/util/pci.c:223:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "pciRead".
/libvirt/src/util/pci.c:209:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "lseek".
/libvirt/src/util/pci.c:376:
tainted_data_return: Function "pciRead8" returns tainted data.
/libvirt/src/util/pci.c:223:
tainted_data_argument: Function "pciRead" taints argument "buf".
/libvirt/src/util/pci.c:209:
tainted_data_argument: Calling function "saferead" taints parameter "*buf".
/libvirt/src/util/util.c:109:
tainted_data_argument: Calling function "read" taints parameter "*buf".
/libvirt/src/util/pci.c:224:
return_tainted_data: Returning tainted variable "buf".
/libvirt/src/util/pci.c:376:
var_assign: Assigning: "pos" = "pciRead8", which taints "pos".
/libvirt/src/util/pci.c:376:
tainted_data: Passing tainted variable "pos + 1" to a tainted sink.
/libvirt/src/util/pci.c:223:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "pciRead".
/libvirt/src/util/pci.c:209:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "lseek".

Error: TAINTED_SCALAR:
/libvirt/src/util/pci.c:368:
lower_bounds: Checking lower bounds of unsigned scalar "pos" by "pos >= 64".
/libvirt/src/util/pci.c:368:
lower_bounds: Checking lower bounds of unsigned scalar "pos" by "pos >= 64".
/libvirt/src/util/pci.c:369:
tainted_data: Passing tainted variable "pos" to a tainted sink.
/libvirt/src/util/pci.c:223:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "pciRead".
/libvirt/src/util/pci.c:209:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "lseek".
/libvirt/src/util/pci.c:376:
tainted_data_return: Function "pciRead8" returns tainted data.
/libvirt/src/util/pci.c:223:
tainted_data_argument: Function "pciRead" taints argument "buf".
/libvirt/src/util/pci.c:209:
tainted_data_argument: Calling function "saferead" taints parameter "*buf".
/libvirt/src/util/util.c:109:
tainted_data_argument: Calling function "read" taints parameter "*buf".
/libvirt/src/util/pci.c:224:
return_tainted_data: Returning tainted variable "buf".
/libvirt/src/util/pci.c:376:
var_assign: Assigning: "pos" = "pciRead8", which taints "pos".
/libvirt/src/util/pci.c:376:
var_assign: Assigning: "pos" = "pciRead8", which taints "pos".

Error: TAINTED_SCALAR:
/libvirt/src/util/pci.c:437:
tainted_data_return: Function "pciFindCapabilityOffset" returns tainted data.
/libvirt/src/util/pci.c:376:
tainted_data_return: Function "pciRead8" returning tainted data.
/libvirt/src/util/pci.c:223:
tainted_data_argument: Function "pciRead" taints argument "buf".
/libvirt/src/util/pci.c:209:
tainted_data_argument: Calling function "saferead" taints parameter "*buf".
/libvirt/src/util/util.c:109:
tainted_data_argument: Calling function "read" taints parameter "*buf".
/libvirt/src/util/pci.c:224:
return_tainted_data: Returning tainted variable "buf".
/libvirt/src/util/pci.c:376:
var_assign: Assigning: "pos" = "pciRead8", which taints "pos".
/libvirt/src/util/pci.c:368:
lower_bounds: Checking lower bounds of unsigned scalar "pos" by "pos >= 64".
/libvirt/src/util/pci.c:373:
return_tainted_data: Returning tainted variable "pos".
/libvirt/src/util/pci.c:437:
var_assign: Assigning: "pos" = "pciFindCapabilityOffset", which taints "pos".
/libvirt/src/util/pci.c:439:
tainted_data: Passing tainted variable "pos + 3" to a tainted sink.
/libvirt/src/util/pci.c:231:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "pciRead".
/libvirt/src/util/pci.c:209:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "lseek".

Error: TAINTED_SCALAR:
/libvirt/src/util/pci.c:728:
tainted_data_return: Function "pciFindCapabilityOffset" returns tainted data.
/libvirt/src/util/pci.c:376:
tainted_data_return: Function "pciRead8" returning tainted data.
/libvirt/src/util/pci.c:223:
tainted_data_argument: Function "pciRead" taints argument "buf".
/libvirt/src/util/pci.c:209:
tainted_data_argument: Calling function "saferead" taints parameter "*buf".
/libvirt/src/util/util.c:109:
tainted_data_argument: Calling function "read" taints parameter "*buf".
/libvirt/src/util/pci.c:224:
return_tainted_data: Returning tainted variable "buf".
/libvirt/src/util/pci.c:376:
var_assign: Assigning: "pos" = "pciRead8", which taints "pos".
/libvirt/src/util/pci.c:368:
lower_bounds: Checking lower bounds of unsigned scalar "pos" by "pos >= 64".
/libvirt/src/util/pci.c:373:
return_tainted_data: Returning tainted variable "pos".
/libvirt/src/util/pci.c:728:
var_assign: Assigning: "dev->pcie_cap_pos" = "pciFindCapabilityOffset", which taints "dev->pcie_cap_pos".
/libvirt/src/util/pci.c:730:
tainted_data: Passing tainted variable "dev->pcie_cap_pos" to a tainted sink.
/libvirt/src/util/pci.c:426:
tainted_data_sink_lv_call: Passing tainted variable "dev->pcie_cap_pos + 4U" to tainted data sink "pciRead32".
/libvirt/src/util/pci.c:239:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "pciRead".
/libvirt/src/util/pci.c:209:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "lseek".

Error: TAINTED_SCALAR:
/libvirt/src/util/pci.c:729:
tainted_data_return: Function "pciFindCapabilityOffset" returns tainted data.
/libvirt/src/util/pci.c:376:
tainted_data_return: Function "pciRead8" returning tainted data.
/libvirt/src/util/pci.c:223:
tainted_data_argument: Function "pciRead" taints argument "buf".
/libvirt/src/util/pci.c:209:
tainted_data_argument: Calling function "saferead" taints parameter "*buf".
/libvirt/src/util/util.c:109:
tainted_data_argument: Calling function "read" taints parameter "*buf".
/libvirt/src/util/pci.c:224:
return_tainted_data: Returning tainted variable "buf".
/libvirt/src/util/pci.c:376:
var_assign: Assigning: "pos" = "pciRead8", which taints "pos".
/libvirt/src/util/pci.c:368:
lower_bounds: Checking lower bounds of unsigned scalar "pos" by "pos >= 64".
/libvirt/src/util/pci.c:373:
return_tainted_data: Returning tainted variable "pos".
/libvirt/src/util/pci.c:729:
var_assign: Assigning: "dev->pci_pm_cap_pos" = "pciFindCapabilityOffset", which taints "dev->pci_pm_cap_pos".
/libvirt/src/util/pci.c:734:
tainted_data: Passing tainted variable "dev->pci_pm_cap_pos" to a tainted sink.
/libvirt/src/util/pci.c:481:
tainted_data_sink_lv_call: Passing tainted variable "dev->pci_pm_cap_pos + 4U" to tainted data sink "pciRead32".
/libvirt/src/util/pci.c:239:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "pciRead".
/libvirt/src/util/pci.c:209:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "lseek".

Error: TAINTED_SCALAR:
/libvirt/src/util/pci.c:1674:
tainted_data_argument: Calling function "pciInitDevice" taints argument "dev->pcie_cap_pos".
/libvirt/src/util/pci.c:728:
tainted_data_return: "pciFindCapabilityOffset" returns tainted data.
/libvirt/src/util/pci.c:376:
tainted_data_return: Function "pciRead8" returning tainted data.
/libvirt/src/util/pci.c:223:
tainted_data_argument: Function "pciRead" taints argument "buf".
/libvirt/src/util/pci.c:209:
tainted_data_argument: Calling function "saferead" taints parameter "*buf".
/libvirt/src/util/util.c:109:
tainted_data_argument: Calling function "read" taints parameter "*buf".
/libvirt/src/util/pci.c:224:
return_tainted_data: Returning tainted variable "buf".
/libvirt/src/util/pci.c:376:
var_assign: Assigning: "pos" = "pciRead8", which taints "pos".
/libvirt/src/util/pci.c:368:
lower_bounds: Checking lower bounds of unsigned scalar "pos" by "pos >= 64".
/libvirt/src/util/pci.c:373:
return_tainted_data: Returning tainted variable "pos".
/libvirt/src/util/pci.c:728:
parm_assign: Assigning: "dev->pcie_cap_pos" = "pciFindCapabilityOffset(dev, 16U)", which taints "dev->pcie_cap_pos".
/libvirt/src/util/pci.c:1677:
var_assign_var: Assigning: "pos" = "dev->pcie_cap_pos". Both are now tainted.
/libvirt/src/util/pci.c:1681:
tainted_data: Passing tainted variable "pos + 2U" to a tainted sink.
/libvirt/src/util/pci.c:231:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "pciRead".
/libvirt/src/util/pci.c:209:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "lseek".

Error: TAINTED_SCALAR:
/libvirt/src/util/pci.c:1732:
tainted_data_argument: Calling function "pciDeviceDownstreamLacksACS" taints argument "parent->pcie_cap_pos".
/libvirt/src/util/pci.c:1674:
tainted_data_argument: Calling function "pciInitDevice" taints parameter "dev->pcie_cap_pos".
/libvirt/src/util/pci.c:728:
tainted_data_return: "pciFindCapabilityOffset" returns tainted data.
/libvirt/src/util/pci.c:376:
tainted_data_return: Function "pciRead8" returning tainted data.
/libvirt/src/util/pci.c:223:
tainted_data_argument: Function "pciRead" taints argument "buf".
/libvirt/src/util/pci.c:209:
tainted_data_argument: Calling function "saferead" taints parameter "*buf".
/libvirt/src/util/util.c:109:
tainted_data_argument: Calling function "read" taints parameter "*buf".
/libvirt/src/util/pci.c:224:
return_tainted_data: Returning tainted variable "buf".
/libvirt/src/util/pci.c:376:
var_assign: Assigning: "pos" = "pciRead8", which taints "pos".
/libvirt/src/util/pci.c:368:
lower_bounds: Checking lower bounds of unsigned scalar "pos" by "pos >= 64".
/libvirt/src/util/pci.c:373:
return_tainted_data: Returning tainted variable "pos".
/libvirt/src/util/pci.c:728:
parm_assign: Assigning: "dev->pcie_cap_pos" = "pciFindCapabilityOffset(dev, 16U)", which taints "dev->pcie_cap_pos".
/libvirt/src/util/pci.c:1732:
tainted_data: Passing tainted variable "parent->pcie_cap_pos" to a tainted sink.
/libvirt/src/util/pci.c:1677:
var_assign_parm: Assigning: "pos" = "dev->pcie_cap_pos". "pos" is now tainted.
/libvirt/src/util/pci.c:1681:
tainted_data_sink_lv_call: Passing tainted variable "pos + 2U" to tainted data sink "pciRead16".
/libvirt/src/util/pci.c:231:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "pciRead".
/libvirt/src/util/pci.c:209:
tainted_data_sink_lv_call: Passing tainted variable "pos" to tainted data sink "lseek".

Error: TAINTED_SCALAR:
/libvirt/src/qemu/qemu_driver.c:4097:
tainted_data_argument: Calling function "saferead" taints argument "header".
/libvirt/src/util/util.c:109:
tainted_data_argument: Calling function "read" taints parameter "*buf".
/libvirt/src/qemu/qemu_driver.c:4155:
tainted_data: Passing tainted variable "header.xml_len" to a tainted sink.
/libvirt/src/util/util.c:108:
lower_bounds: Checking lower bounds of unsigned scalar "count" by "count > 0UL".
/libvirt/src/util/util.c:109:
tainted_data_sink_lv_call: Passing tainted variable "count" to tainted data sink "read".

Error: TAINTED_SCALAR:
/libvirt/src/qemu/qemu_driver.c:4097:
tainted_data_argument: Calling function "saferead" taints argument "header".
/libvirt/src/util/util.c:109:
tainted_data_argument: Calling function "read" taints parameter "*buf".
/libvirt/src/qemu/qemu_driver.c:4144:
lower_bounds: Checking lower bounds of unsigned scalar "header.xml_len" by "header.xml_len <= 0U".
/libvirt/src/qemu/qemu_driver.c:4150:
tainted_data: Passing tainted variable "header.xml_len" to a tainted sink.
/libvirt/src/util/memory.c:129:
tainted_data_sink_lv_call: Passing tainted variable "count" to tainted data sink "calloc".

Error: TAINTED_SCALAR:
/libvirt/src/uml/uml_driver.c:910:
tainted_data_argument: Calling function "recvfrom" taints argument "res".
/libvirt/src/uml/uml_driver.c:929:
tainted_data: Passing tainted variable "res.length" to a tainted sink.

Error: TAINTED_SCALAR:
/libvirt/src/uml/uml_driver.c:910:
tainted_data_argument: Calling function "recvfrom" taints argument "res".
/libvirt/src/uml/uml_driver.c:930:
var_assign_var: Compound assignment involving tainted variable "res.length - 1U" to variable "retlen" taints "retlen".
/libvirt/src/uml/uml_driver.c:931:
tainted_data: Using tainted variable "retlen" as an index to pointer "retdata".

Error: TAINTED_SCALAR:
/libvirt/src/util/iohelper.c:255:
tainted_data_transitive: Call to function "virStrToLong_ull" with tainted argument "argv[4]" transitively taints "offset".
/libvirt/src/util/util.c:1680:
tainted_data_transitive: Calling function "strtoull" with tainted argument "s" results in tainted data.
/libvirt/src/util/util.c:1680:
var_assign: Assigning: "val" = "strtoull(s, &p, base)", which taints "val".
/libvirt/src/util/util.c:1686:
parm_assign: Assigning: "*result" = "val", which taints "*result".
/libvirt/src/util/iohelper.c:265:
tainted_data: Passing tainted variable "offset" to a tainted sink.
/libvirt/src/util/iohelper.c:63:
tainted_data_sink_lv_call: Passing tainted variable "offset" to tainted data sink "lseek".

Error: TAINTED_STRING:
/libvirt/src/util/virnetdevmacvlan.c:328:
tainted_string_argument: Call to "fscanf(file, "%d", &ifindex)" taints "ifindex".
/libvirt/src/util/virnetdevmacvlan.c:338:
vararg_transitive: Call to "snprintf" with tainted argument "ifindex" taints "tapname".
/libvirt/src/util/virnetdevmacvlan.c:348:
tainted_string: Passing tainted string "tapname" to a function that cannot accept tainted data.

Error: TAINTED_STRING:
/libvirt/gnulib/lib/localcharset.c:132:
tainted_string_return_content: "getenv" returns tainted string content.
/libvirt/gnulib/lib/localcharset.c:132:
var_assign: Assigning: "dir" = "getenv("CHARSETALIASDIR")", which taints "dir".
/libvirt/gnulib/lib/localcharset.c:144:
tainted_data_transitive: Call to function "memcpy" with tainted argument "dir" transitively taints "file_name".
/libvirt/gnulib/lib/localcharset.c:144:
tainted_data_transitive: Call to function "memcpy" with tainted argument "file_name" returns tainted data.
/libvirt/gnulib/lib/localcharset.c:165:
tainted_string: Passing tainted string "file_name" to a function that cannot accept tainted data.

Error: TAINTED_STRING:
/libvirt/src/util/iohelper.c:239:
var_assign_var: Assigning: "path" = "argv[1]". Both are now tainted.
/libvirt/src/util/iohelper.c:265:
tainted_string: Passing tainted string "path" to a function that cannot accept tainted data.
/libvirt/src/util/iohelper.c:53:
tainted_string_sink_content_lv_call: Passing tainted string "path" to "open", which depends on its content.

Error: TOCTOU:
/libvirt/src/util/util.c:1256:
fs_check_call: Calling function "stat" to perform check on "path".
/libvirt/src/util/util.c:1281:
toctou: Calling function "mkdir" that uses "path" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/util/cgroup.c:549:
fs_check_call: Calling function "access" to perform check on "path".
/libvirt/src/util/cgroup.c:550:
toctou: Calling function "mkdir" that uses "path" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/storage/storage_backend.c:1015:
fs_check_call: Calling function "lstat" to perform check on "path".
/libvirt/src/storage/storage_backend.c:1030:
toctou: Calling function "open" that uses "path" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/qemu/qemu_driver.c:2484:
fs_check_call: Calling function "stat" to perform check on "path".
/libvirt/src/qemu/qemu_driver.c:2498:
toctou: Calling function "open" that uses "path" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/lxc/lxc_container.c:660:
fs_check_call: Calling function "stat" to perform check on "fs->dst".
/libvirt/src/lxc/lxc_container.c:681:
toctou: Calling function "open" that uses "fs->dst" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/driver.c:71:
fs_check_call: Calling function "access" to perform check on "modfile".
/libvirt/src/driver.c:76:
toctou: Calling function "dlopen" that uses "modfile" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/util/util.c:1097:
fs_check_call: Calling function "stat" to perform check on "path".
/libvirt/src/util/util.c:1102:
toctou: Calling function "chown" that uses "path" after a check function. This can cause a time-of-check, time-of-use race condition.
/libvirt/src/util/util.c:1109:
toctou: Calling function "chmod" that uses "path" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/locking/lock_manager.c:144:
fs_check_call: Calling function "access" to perform check on "modfile".
/libvirt/src/locking/lock_manager.c:151:
toctou: Calling function "dlopen" that uses "modfile" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/tools/virsh.c:20336:
fs_check_call: Calling function "stat" to perform check on "ctl->logfile".
/libvirt/tools/virsh.c:20353:
toctou: Calling function "open" that uses "ctl->logfile" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/qemu/qemu_driver.c:10148:
fs_check_call: Calling function "stat" to perform check on "disk->src".
/libvirt/src/qemu/qemu_driver.c:10148:
toctou: Calling function "unlink" that uses "disk->src" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/locking/lock_driver_sanlock.c:557:
fs_check_call: Calling function "stat" to perform check on "res->disks[0].path".
/libvirt/src/locking/lock_driver_sanlock.c:559:
toctou: Calling function "open" that uses "res->disks[0].path" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/util/virfile.c:475:
fs_check_call: Calling function "stat" to perform check on "path".
/libvirt/src/util/virfile.c:488:
toctou: Calling function "chmod" that uses "path" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/util/util.c:1129:
fs_check_call: Calling function "stat" to perform check on "path".
/libvirt/src/util/util.c:1175:
toctou: Calling function "mkdir" that uses "path" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/util/util.c:1186:
fs_check_call: Calling function "stat" to perform check on "path".
/libvirt/src/util/util.c:1192:
toctou: Calling function "chown" that uses "path" after a check function. This can cause a time-of-check, time-of-use race condition.
/libvirt/src/util/util.c:1199:
toctou: Calling function "chmod" that uses "path" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/util/virpidfile.c:364:
fs_check_call: Calling function "stat" to perform check on "path".
/libvirt/src/util/virpidfile.c:330:
toctou: Calling function "open" that uses "path" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/locking/lock_driver_sanlock.c:180:
fs_check_call: Calling function "stat" to perform check on "path".
/libvirt/src/locking/lock_driver_sanlock.c:182:
toctou: Calling function "open" that uses "path" after a check function. This can cause a time-of-check, time-of-use race condition.
/libvirt/src/locking/lock_driver_sanlock.c:261:
toctou: Calling function "unlink" that uses "path" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/storage/storage_backend.c:582:
fs_check_call: Calling function "stat" to perform check on "vol->target.path".
/libvirt/src/storage/storage_backend.c:591:
toctou: Calling function "chown" that uses "vol->target.path" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: TOCTOU:
/libvirt/src/storage/storage_backend.c:571:
fs_check_call: Calling function "stat" to perform check on "vol->target.path".
/libvirt/src/storage/storage_backend.c:591:
toctou: Calling function "chown" that uses "vol->target.path" after a check function. This can cause a time-of-check, time-of-use race condition.
/libvirt/src/storage/storage_backend.c:598:
toctou: Calling function "chmod" that uses "vol->target.path" after a check function. This can cause a time-of-check, time-of-use race condition.

Error: UNINIT:
/libvirt/src/rpc/virnetmessage.c:217:
var_decl: Declaring variable "xdr" without initializer.
/libvirt/src/rpc/virnetmessage.c:261:
uninit_use: Using uninitialized value "xdr.x_ops".

Error: UNINIT:
/libvirt/src/util/command.c:246:
var_decl: Declaring variable "sig_action" without initializer.
/libvirt/src/util/command.c:326:
uninit_use_in_call: Using uninitialized value "sig_action": field "sig_action".sa_restorer is uninitialized when calling "sigaction".

Error: UNINIT:
/libvirt/src/openvz/openvz_conf.c:494:
var_decl: Declaring variable "ret" without initializer.
/libvirt/src/openvz/openvz_conf.c:556:
uninit_use: Using uninitialized value "ret".

Error: UNINIT:
/libvirt/tools/virsh.c:615:
var_decl: Declaring variable "sig_action" without initializer.
/libvirt/tools/virsh.c:621:
uninit_use_in_call: Using uninitialized value "sig_action": field "sig_action".sa_restorer is uninitialized when calling "sigaction".

Error: UNINIT:
/libvirt/src/conf/virdomainlist.c:192:
var_decl: Declaring variable "list" without initializer.
/libvirt/src/conf/virdomainlist.c:219:
uninit_use: Using uninitialized value "list".

Error: UNINIT:
/libvirt/tools/virsh.c:7506:
var_decl: Declaring variable "sig_action" without initializer.
/libvirt/tools/virsh.c:7523:
uninit_use_in_call: Using uninitialized value "sig_action": field "sig_action".sa_restorer is uninitialized when calling "sigaction".

Error: UNINIT:
/libvirt/tools/virsh.c:8039:
var_decl: Declaring variable "sig_action" without initializer.
/libvirt/tools/virsh.c:8073:
uninit_use_in_call: Using uninitialized value "sig_action": field "sig_action".sa_restorer is uninitialized when calling "sigaction".

Error: UNINIT:
/libvirt/tools/virsh.c:16744:
var_decl: Declaring variable "name" without initializer.
/libvirt/tools/virsh.c:16823:
uninit_use_in_call: Using uninitialized value "name" when calling "vshError".

Error: UNINIT:
/libvirt/tests/commandtest.c:801:
var_decl: Declaring variable "sig_action" without initializer.
/libvirt/tests/commandtest.c:807:
uninit_use_in_call: Using uninitialized value "sig_action": field "sig_action".sa_restorer is uninitialized when calling "sigaction".

Error: UNINIT:
/libvirt/tools/virsh.c:7892:
var_decl: Declaring variable "sig_action" without initializer.
/libvirt/tools/virsh.c:7930:
uninit_use_in_call: Using uninitialized value "sig_action": field "sig_action".sa_restorer is uninitialized when calling "sigaction".

Error: UNUSED_VALUE:
/libvirt/tools/virsh.c:9869:
returned_pointer: Pointer "br_node" returned by "virXPathNode("./bridge", ctxt)" is never used.

Error: UNUSED_VALUE:
/libvirt/tools/virsh.c:9874:
returned_pointer: Pointer "if_node" returned by "virXPathNode("./bridge/interface[2]", ctxt)" is never used.