<?xml version="1.0" encoding="utf-8"?>
<report xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" tool_name="cppcheck" tool_version="1.60">
	<!--
		Report for "wireshark-vln" with evaluations by SATE analysts
		Date: Tue, 23 Oct 2018 18:17:50 GMT
		SATE V
	-->
	<weakness id="1" uid="209142" selected="yes">
		<name cweid="398">uselessAssignmentPtrArg</name>
		<location id="0" path="wireshark-1.8.0/epan/dissectors/dcerpc/idl2wrs.c" line="246"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[Assignment of function parameter has no effect outside the function.
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>In that case, parameter &quot;ptrs&quot; is used as another local variable of the function. The developer knows what she&#039;s doing even though it is not the best of practices.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="2" uid="209143" selected="yes">
		<name cweid="125">insecureCmdLineArgs</name>
		<location id="0" path="wireshark-1.8.0/epan/dissectors/dcerpc/idl2wrs.c" line="3191"/>
		<grade severity="1"/>
		<output>
			<textoutput><![CDATA[Buffer overrun possible for long command line arguments.
]]></textoutput>
		</output>
		<evaluation correctness="quality">
			<comments><![CDATA[<ol><li>This code is a compiler used to generate C code out of CORBA IDL files at compilation time. It takes files included in the filesystem distribution which names are short enough to not trigger an overflow. The overflow is sill possible since most filesystems allow for up to 255 characters in file names which added to the &quot;.cnf&quot; string would exceed the buffer size.</li>

<li>After quality control we decided to bump it up to &quot;quality&quot;.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="3" uid="209144" selected="yes">
		<name cweid="401">memleak</name>
		<location id="0" path="wireshark-1.8.0/epan/dissectors/dcerpc/idl2wrs.c" line="1831"/>
		<grade severity="1"/>
		<output>
			<textoutput><![CDATA[Memory leak: ptmpstr
]]></textoutput>
		</output>
		<evaluation correctness="quality">
			<comments><![CDATA[<ol><li>Memory is indeed leaked as the original pointer stored in &quot;ptmpstr&quot; is lost at every iteration of the loop.<br/><br/>I don&#039;t think the leek is significant but it is an easy fix.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="4" uid="209145" selected="yes">
		<name cweid="401">memleak</name>
		<location id="0" path="wireshark-1.8.0/epan/dissectors/dcerpc/idl2wrs.c" line="2403"/>
		<grade severity="1"/>
		<output>
			<textoutput><![CDATA[Memory leak: ptmpstr
]]></textoutput>
		</output>
		<evaluation correctness="quality">
			<comments><![CDATA[<ol><li>Memory is indeed leaked as the original pointer stored in &quot;ptmpstr&quot; is lost at every iteration of the loop. <br/><br/>I don&#039;t think the leek is significant but it is an easy fix.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="5" uid="209146" selected="yes">
		<name cweid="401">memleak</name>
		<location id="0" path="wireshark-1.8.0/epan/dissectors/dcerpc/idl2wrs.c" line="2700"/>
		<grade severity="1"/>
		<output>
			<textoutput><![CDATA[Memory leak: ptmpstr
]]></textoutput>
		</output>
		<evaluation correctness="quality">
			<comments><![CDATA[<ol><li>Memory is indeed leaked as the original pointer stored in &quot;ptmpstr&quot; is lost at every iteration of the loop. <br/><br/>I don&#039;t think the leek is significant but it is an easy fix.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="6" uid="209147" selected="yes">
		<name cweid="398">uselessAssignmentPtrArg</name>
		<location id="0" path="wireshark-1.8.0/packaging/macosx/ScriptExec/main.c" line="642"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[Assignment of function parameter has no effect outside the function.
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>Pointer &quot;resultData&quot; is a dead store. It is useless indeed to set it to NULL and it is never used anyway.</li>

<li>I should add that it is not worth fixing this issue since it has no incidence whatsoever on the execution of the program.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="7" uid="209148" selected="yes">
		<name cweid="170">uninitstring</name>
		<location id="0" path="wireshark-1.8.0/packaging/u3/win32/u3util.c" line="500"/>
		<grade severity="1"/>
		<output>
			<textoutput><![CDATA[Dangerous usage of 'dir_spec' (strncpy doesn't always null-terminate it).
]]></textoutput>
		</output>
		<evaluation correctness="quality">
			<comments><![CDATA[<ol><li>String &quot;u3_host_exec_path&quot; could potentially be as long as &quot;MAX_PATH&quot; so when concatenated to string &quot;\\*.pid&quot; would overflow buffer &quot;dir_spec&quot;.<br/><br/>As unlikely as it might seem, it is easy to fix so I rate it as quality.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="8" uid="209149" selected="yes">
		<name cweid="476">nullPointer</name>
		<location id="0" path="wireshark-1.8.0/plugins/mate/mate_util.c" line="1554"/>
		<location id="0" path="wireshark-1.8.0/plugins/mate/mate_util.c" line="1547"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[Possible null pointer dereference: loal - otherwise it is redundant to check it against null.
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>Pointer &quot;loal&quot; is never null when calling function &quot;load_loal_error()&quot; so no NPD ever occurs. It is indeed redundant to check for it but does not infer on the execution of the program.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="10" uid="209151" selected="yes">
		<name cweid="398,665">uninitMemberVar</name>
		<location id="0" path="wireshark-1.8.0/ui/qt/recent_file_status.cpp" line="30"/>
		<grade severity="5"/>
		<output>
			<textoutput><![CDATA[Member variable 'RecentFileStatus::m_size' is not initialized in the constructor.
]]></textoutput>
		</output>
		<evaluation correctness="insignificant">
			<comments><![CDATA[<ol><li>Method &quot;getSize()&quot; returning private member &quot;m_size&quot; is never used so the lack of initialization will never cause problems.<br/><br/>It would be easy to fix anyhow.</li>

</ol>]]></comments>
		</evaluation>
	</weakness>
	<weakness id="9" uid="209150" selected="no">
		<name cweid="401">memleakOnRealloc</name>
		<location id="0" path="wireshark-1.8.0/tools/lemon/lemon.c" line="3296"/>
		<grade severity="1"/>
		<output>
			<textoutput><![CDATA[Common realloc mistake: 'z' nulled but not freed upon failure
]]></textoutput>
		</output>
	</weakness>
</report>