Add check-cppcheck target and fix errors

Add a check-cppcheck target for running cppcheck on all of the
code, and fix the errors it found.

diff --git a/Makefile.am b/Makefile.am
index 747984dac2b3cc170df2f040233805f90f8cbc62..a5af3267c694a7fd3e7516de0755f725d7827632 100644 (file)
--- a/Makefile.am
+++ b/Makefile.am
@@ -195,6 +195,14 @@ endif
 check-local: $(check_PROGRAMS) tests/data/dictionary.pwd
        cd tests && ./runtests -l $(abs_top_srcdir)/tests/TESTS
 
+# Used by maintainers to check the source code with cppcheck.
+check-cppcheck:
+       cd $(abs_top_srcdir) &&                                         \
+           find . -name .git -prune -o -name '*.[ch]' -print           \
+           | cppcheck -q --force --error-exitcode=2 --file-list=-      \
+               --suppressions-list=tests/data/cppcheck.supp            \
+               --enable=warning,performance,portability,style
+
 # Used by maintainers to run the main test suite under valgrind.  Suppress
 # the xmalloc and pod-spelling tests because the former won't work properly
 # under valgrind (due to increased memory usage) and the latter is pointless

diff --git a/cracklib/packlib.c b/cracklib/packlib.c
index 94964de02461b0b002ca7629630e10d1774c0c5e..e5805c46146512d3dfd685957f753e0322f3ff91 100644 (file)
--- a/cracklib/packlib.c
+++ b/cracklib/packlib.c
@@ -28,6 +28,8 @@
  *   - Close the wfp file handle on PWClose if it's open.
  * 2016-11-06  Russ Allbery <eagle@eyrie.org>
  *   - Remove unused vers_id to silence GCC warnings.
+ * 2020-05-16  Russ Allbery <eagle@eyrie.org>
+ *   - Fix types of printf formatting directives in DEBUG conditionals.
  */
 
 #include <stdio.h>
@@ -182,7 +184,7 @@ PWClose(PWDICT *pwp)
                    pwp->hwms[i] = pwp->hwms[i-1];
                }
 #ifdef DEBUG
-               printf("hwm[%02x] = %d\n", i, pwp->hwms[i]);
+               printf("hwm[%02x] = %u\n", i, pwp->hwms[i]);
 #endif
            }
            fwrite(pwp->hwms, 1, sizeof(pwp->hwms), pwp->wfp);
@@ -344,7 +346,7 @@ FindPW(PWDICT *pwp, const char *string)
     }
 
 #ifdef DEBUG
-    printf("---- %lu, %lu ----\n", lwm, hwm);
+    printf("---- %u, %u ----\n", lwm, hwm);
 #endif
 
     for (;;)
@@ -352,7 +354,7 @@ FindPW(PWDICT *pwp, const char *string)
        int cmp;
 
 #ifdef DEBUG
-       printf("%lu, %lu\n", lwm, hwm);
+       printf("%u, %u\n", lwm, hwm);
 #endif
 
        middle = lwm + ((hwm - lwm + 1) / 2);

diff --git a/plugin/config.c b/plugin/config.c
index f5f3dcfb92d3a8428b072cdf14ac08e89db1f5b7..2ce310b5a3623d18ad543284b9e88d43cf8eb4e2 100644 (file)
--- a/plugin/config.c
+++ b/plugin/config.c
@@ -68,7 +68,7 @@ default_realm(krb5_context ctx)
         return NULL;
     code = krb5_get_default_realm(ctx, &realm);
     if (code != 0) {
-        free(realm);
+        free(realm_data);
         return NULL;
     }
     realm_data->magic = KV5M_DATA;

diff --git a/tests/data/cppcheck.supp b/tests/data/cppcheck.supp
new file mode 100644 (file)
index 0000000..442c431
--- /dev/null
+++ b/tests/data/cppcheck.supp
@@ -0,0 +1,55 @@
+// Suppressions file for cppcheck.  -*- conf -*-
+//
+// This includes suppressions for all of my projects, including files that
+// aren't in rra-c-util, for ease of sharing between projects.  The ones that
+// don't apply to a particular project should hopefully be harmless.
+//
+// To determine the correct suppression to add for a new error, run cppcheck
+// with the --xml flag and then add a suppression for the error id, file
+// location, and line.
+//
+// Copyright 2018-2020 Russ Allbery <eagle@eyrie.org>
+//
+// Copying and distribution of this file, with or without modification, are
+// permitted in any medium without royalty provided the copyright notice and
+// this notice are preserved.  This file is offered as-is, without any
+// warranty.
+//
+// SPDX-License-Identifier: FSFAP
+
+// I like declaring variables at the top of a function rather than cluttering
+// every if and loop body with declarations.
+variableScope
+
+// strlen of a constant string is more maintainable code than hard-coding the
+// string length.
+constArgument:tests/runtests.c:804
+
+// False positive due to recursive function.
+knownConditionTrueFalse:portable/getopt.c:146
+
+// False positive since the string comes from a command-line define.
+knownConditionTrueFalse:tests/tap/remctl.c:79
+
+// Stored in the returned ai struct, but cppcheck can't see the assignment
+// because of the struct sockaddr * cast.
+memleak:portable/getaddrinfo.c:236
+
+// Bug in cppcheck 1.89.  The address of this variable is passed to a Windows
+// function (albeit through a cast).
+nullPointer:portable/winsock.c:61
+
+// Setting the variable to NULL explicitly after deallocation.
+redundantAssignment:tests/pam-util/options-t.c
+
+// (remctl) Bug in cppcheck 1.89.  The address of these variables are passed
+// to a PHP function.
+uninitvar:php/php_remctl.c:119
+uninitvar:php/php_remctl.c:123
+uninitvar:php/php_remctl.c:315
+uninitvar:php/php5_remctl.c:125
+uninitvar:php/php5_remctl.c:129
+uninitvar:php/php5_remctl.c:321
+
+// (pam-krb5) cppcheck doesn't recognize the unused attribute on labels.
+unusedLabel:module/auth.c:895