mirror of
https://github.com/Cacti/spine.git
synced 2026-10-23 03:27:10 +09:00
Thomas VincentandTheWitness
3570e89098
Twelve bugs found by running cppcheck 2.20 (--enable=warning,portability) and shellcheck v0.10.0.1 across the full source tree. **poller.c** - `%llu` used for `atoll()` return (signed `long long`) at line 970 — changed to `%lld` - `%lld` used for `hex2dec()` return (unsigned `long long`) at five call sites (lines 1414, 1515, 1597, 1655, 1727) — changed to `%llu` Mismatched sign in printf format specifiers is undefined behaviour under C99 §7.19.6.1. **snmp.c** - `session.localname` is `strdup()`'d at line 140 (when `SNMP_LOCALNAME == 1`) but the early-return path for an unknown SNMP version at line 190 did not free it. Added `free(session.localname)` before that return. `free(NULL)` is a no-op so the call is safe when `SNMP_LOCALNAME != 1`. - `calloc(num_oids, sizeof(*name))` at line 999 has no NULL check. If allocation fails, the immediately following `namep->name_len = MAX_OID_LEN` dereferences a null pointer. Added a NULL guard that logs via `SPINE_LOG` and returns early before the PDU is created. **sql.c** - `attempts` is `int` but printed with `%u` — changed to `%d`. - `error` is `int` but printed with `%u` — changed to `%d`. - `mysql = NULL` in `db_disconnect()` assigns to a by-value parameter; the write has no effect on the caller. Removed the dead assignment. **util.c** - `pthread_self()` is cast to `unsigned long int` then printed with `%ld` (signed) — changed to `%lu`. **copyright_year.sh / scripts/verify.sh** - `$1` unquoted in `sed` invocation in `copyright_year.sh` — word-splits on filenames with spaces. - `*.c *.h` glob in `scripts/verify.sh` passed without `--` separator — filenames starting with `-` would be misinterpreted as cppcheck options. --------- Signed-off-by: Thomas Vincent <thomasvincent@gmail.com> Co-authored-by: TheWitness <thewitness@cacti.net>