sqc 0.4.84

rule,project,file,line,verdict,reason,provenance,confidence
MSC37-C,curl,lib/curl_get_line.c,35,FP,Infinite loop always returns from inside; no fallthrough to end of function.,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/curl_get_line.c,42,FP,fgets return checked via 'b ? strlen(b) : 0' and feof handling.,curl_full_audit_0.4.35,high
ERR00-C,curl,lib/curl_get_line.c,42,FP,NULL return handled; eof tracked separately. Idiomatic line reader.,curl_full_audit_0.4.35,high
FIO20-C,curl,lib/curl_get_line.c,42,FP,Truncation handled: loops to append until newline or EOF.,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/curl_get_line.c,56,FP,b[rlen-1] guarded by 'rlen &&'; b is dyn buffer ptr.,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_sasl.h,131,FP,sasl_mech_equal is standard predicate macro; multiple-eval advisory only.,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_sasl.h,131,FP,wordlen multiple-eval on side-effect-free arg; idiomatic macro.,curl_full_audit_0.4.35,high
API02-C,curl,lib/curl_sasl.h,136,FP,maxlen already bounds ptr; advisory size-param noise.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sasl.h,136,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sasl.h,141,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strparse.h,46,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strparse.h,53,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strparse.h,57,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strparse.h,62,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strparse.h,67,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API01-C,curl,lib/doh.h,85,FP,"Fixed DNS req buffer in internal struct; bounds-checked encoder, not overflowable string.",curl_full_audit_0.4.35,med
API02-C,curl,lib/doh.h,162,FP,olen already bounds output; advisory size-param noise.,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.h,162,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.h,164,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.h,167,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API02-C,curl,lib/escape.h,35,FP,length param already bounds string; advisory size-param noise.,curl_full_audit_0.4.35,high
API05-C,curl,lib/escape.h,35,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/escape.h,36,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/escape.h,39,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/escape.h,40,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip6.c,65,FP,Internal resolver; data always valid handle from callers. Not exported NULL-deref risk.,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip6.c,65,FP,hostname always supplied by internal callers; not user-facing entrypoint.,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/hostip6.c,95,FP,inet_pton documented to return exactly 1 on success; '==1' is correct idiom.,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/hostip6.c,96,FP,inet_pton documented to return exactly 1 on success; '==1' is correct idiom.,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/hostip6.c,117,FP,"res is a pointer to heap addrinfo from Curl_getaddrinfo_ex, not local auto storage.",curl_full_audit_0.4.35,high
API02-C,curl,lib/http1.h,50,FP,"Parser API; advisory size-param noise, callee bounds internally.",curl_full_audit_0.4.35,high
API05-C,curl,lib/http1.h,51,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/http1.h,52,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/http1.h,53,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http1.h,54,FP,pnread is out-param written by callee; cannot be const.,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/select.h,83,FP,ufds[] is array param decaying to pointer; nfds gives count. Valid prototype.,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/select.h,105,FP,VERIFY_SOCK control-flow macro (do/while with return); needs multiple eval intentionally.,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/select.h,105,FP,"x evaluated twice on side-effect-free socket arg; control macro, not inlinable.",curl_full_audit_0.4.35,high
PRE02-C,curl,lib/select.h,171,FP,"Replacement is single function call expression; parens unnecessary, advisory.",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/select.h,192,FP,pwant_read is out-param written by Curl_pollset_check; cannot be const.,curl_full_audit_0.4.35,high
API02-C,curl,lib/setup-os400.h,61,FP,OS400 getnameinfo shim; signature fixed by platform API. Advisory noise.,curl_full_audit_0.4.35,high
API02-C,curl,lib/setup-os400.h,61,FP,OS400 getnameinfo shim; signature fixed by platform API. Advisory noise.,curl_full_audit_0.4.35,high
API02-C,curl,lib/setup-os400.h,125,FP,recvfrom shim; buflen already present. Signature fixed by socket API.,curl_full_audit_0.4.35,high
API02-C,curl,lib/setup-os400.h,127,FP,getpeername shim; addrlen is in/out len. Signature fixed by socket API.,curl_full_audit_0.4.35,high
API02-C,curl,lib/setup-os400.h,128,FP,getsockname shim; addrlen is in/out len. Signature fixed by socket API.,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/vquic/vquic_int.h,80,FP,H3_STREAM_CTX accessor macro; idiomatic single-arg lookup.,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/vquic/vquic_int.h,80,FP,data used as member-access base in macro; parenthesization not needed there.,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/vquic/vquic_int.h,80,FP,Accessor macro evaluates data twice on side-effect-free arg; idiomatic.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic_int.h,95,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic_int.h,121,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_writeout_json.h,30,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_writeout_json.h,32,FP,mappings[] is NUL-sentinel-terminated table; no count param needed.,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_writeout_json.h,32,FP,mappings[] array param decays to pointer; sentinel-terminated. Valid prototype.,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_writeout_json.h,35,FP,FILE* and per_transfer struct ptrs; not array buffers. Advisory noise.,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_writeout_json.h,36,FP,in is NUL-terminated C string; no count param needed.,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/easyoptions.c,32,FP,Curl_easyopts is intentionally exported (used across translation units/tests).,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/easyoptions.c,32,FP,Generated global option table; must be file-scope and exported.,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/easyoptions.c,32,FP,Sentinel-terminated initializer table; implicit bounds idiomatic and valid.,curl_full_audit_0.4.35,high
INT10-C,curl,lib/easyoptions.c,388,FP,CURLOPT_LASTENTRY is positive enum constant; modulo never sees negative operand.,curl_full_audit_0.4.35,high
DCL38-C,curl,lib/hostip.h,68,TP,hostname[1] struct-hack; CERT DCL38 prefers []. Intentional portability idiom though.,curl_full_audit_0.4.35,low
STR31-C,curl,lib/hostip.h,68,FP,hostname[1] is flexible struct-hack member allocated larger; not undersized buffer.,curl_full_audit_0.4.35,high
API05-C,curl,lib/hostip.h,144,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/hostip.h,162,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API02-C,curl,lib/http_proxy.h,38,FP,"pport is int out-param, not array; advisory noise.",curl_full_audit_0.4.35,high
API02-C,curl,lib/http_proxy.h,50,FP,"pres1 is int out-param, not array; advisory noise.",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/http_proxy.h,61,FP,"IS_HTTPS_PROXY predicate macro; idiomatic comparison, side-effect-free arg.",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/http_proxy.h,61,FP,t evaluated twice on enum value; idiomatic predicate macro.,curl_full_audit_0.4.35,high
API00-C,curl,lib/psl.c,42,FP,Internal API; easy always valid handle. Sibling fns also deref unchecked.,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/psl.c,70,FP,psl assigned via psl_latest() at line 69 before use; #ifdef branch sqc can't connect.,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/psl.c,94,FP,"psl is const pointer aliasing pslcache->psl (heap/static), not local auto address.",curl_full_audit_0.4.35,high
API00-C,curl,lib/psl.c,97,FP,Thin wrapper to Curl_share_unlock; does not itself deref easy in unsafe way.,curl_full_audit_0.4.35,high
API05-C,curl,lib/rand.h,30,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/rand.h,43,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/rand.h,49,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/rand.h,55,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi-int.h,28,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi-int.h,28,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API02-C,curl,lib/urlapi-int.h,33,FP,urllen already bounds url; advisory size-param noise.,curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi-int.h,33,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.h,34,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API02-C,curl,lib/vquic/vquic.h,37,FP,"qlogfdp is int* out-param, not array; advisory noise.",curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.h,38,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.h,40,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.h,76,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.h,113,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.h,116,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.h,117,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.h,92,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.h,140,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.h,143,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.h,144,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/wolfssl.h,52,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/wolfssl.h,81,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/wolfssl.h,84,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/wolfssl.h,85,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_doswin.h,33,FP,sanitized is char** out-param allocated by callee; not input array.,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_doswin.h,37,FP,DJGPP crt0 glob hook; signature fixed by toolchain. Advisory noise.,curl_full_audit_0.4.35,high
DCL37-C,curl,src/tool_doswin.h,37,FP,__crt0_glob_function name mandated by DJGPP runtime; platform shim.,curl_full_audit_0.4.35,high
DCL37-C,curl,src/tool_doswin.h,37,FP,__crt0_glob_function reserved name mandated by DJGPP runtime; cannot rename.,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_helpers.c,80,FP,reqname[] initializer table; implicit bounds idiomatic and valid C.,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_helpers.c,96,FP,"req is HttpReq enum bounded to table size; internal callers only, not attacker index.",curl_full_audit_0.4.35,med
ARR02-C,curl,src/tool_helpers.c,104,FP,dflt[] initializer table; implicit bounds idiomatic and valid C.,curl_full_audit_0.4.35,high
EXP15-C,curl,src/tool_helpers.c,113,FP,Intentional empty 'if(!method);' guarding else-if chain; deliberate no-op.,curl_full_audit_0.4.35,med
ERR33-C,curl,src/toolx/tool_time.c,53,FP,localtime return checked at line 54 ('if(tm)'); only in no-localtime_r fallback.,curl_full_audit_0.4.35,high
CON33-C,curl,src/toolx/tool_time.c,53,TP,localtime() async/thread-unsafe; CERT CON33 fires though it's a guarded last-resort fallback.,curl_full_audit_0.4.35,low
CON34-C,curl,src/toolx/tool_time.c,53,FP,Duplicate of CON33-C at same localtime site; count once.,curl_full_audit_0.4.35,high
MEM33-C,curl,src/toolx/tool_time.c,55,FP,struct tm has no flexible array member; '*store=*tm' is valid struct assignment.,curl_full_audit_0.4.35,high
API00-C,curl,lib/bufref.c,72,FP,"dtor function pointer stored, called later only if non-NULL; no deref here.",curl_full_audit_0.4.35,high
API05-C,curl,lib/bufref.c,72,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufref.c,120,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API02-C,curl,lib/cf-socket.h,60,FP,dev is char** out-param allocated by callee; not sized input array.,curl_full_audit_0.4.35,high
API02-C,curl,lib/cf-socket.h,60,FP,iface is char** out-param allocated by callee; not sized input array.,curl_full_audit_0.4.35,high
API02-C,curl,lib/cf-socket.h,60,FP,host is char** out-param allocated by callee; not sized input array.,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/config-os400.h,140,FP,__cplusplus__strings__ is platform/compiler-defined macro guard; cannot rename.,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/config-os400.h,209,FP,_LARGE_FILES mandated by OS400 feature-test convention; platform shim.,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/config-os400.h,286,FP,"__ptr128 is compiler-reserved keyword/macro; platform shim, cannot rename.",curl_full_audit_0.4.35,high
DCL37-C,curl,lib/config-win32.h,189,FP,_SSIZE_T_DEFINED is Windows CRT feature-guard convention; cannot rename.,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/config-win32.h,192,FP,_SSIZE_T_DEFINED is Windows CRT feature-guard convention; cannot rename.,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/config-win32.h,255,FP,_FILE_OFFSET_BITS standard glibc/CRT feature-test macro; cannot rename.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_hmac.h,66,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_hmac.h,67,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_hmac.h,68,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
STR31-C,curl,lib/curl_sha512_256.h,34,FP,"Curl_HMAC_SHA512_256[1] is const struct array (extern decl idiom), not char buffer.",curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sha512_256.h,38,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sha512_256.h,38,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/curl_sspi.c,107,FP,"identity is genuine struct pointer; sizeof(*identity) is the struct size, correct for memset.",curl_full_audit_0.4.35,high
EXP43-C,curl,lib/curl_sspi.c,142,FP,"dup_domain freshly malloc'd, domain points into separate buffer; regions disjoint.",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_sspi.c,198,FP,Function frees identity->members via safefree (nulls them); *identity is modified.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strcopy.c,38,FP,"Conformant-array-syntax advisory; curl never uses C99 array params, idiomatic char*/size_t.",curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strcopy.c,40,FP,const char* source param; conformant-array advisory not applicable to curl style.,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/curlx/strcopy.c,45,FP,memcpy guarded by if(slen<dsize) plus DEBUGASSERT; size validated.,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/easygetopt.c,34,FP,!Curl_easyopts_check() inside DEBUGASSERT; idiomatic boolean test.,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/easygetopt.c,47,FP,o points into Curl_easyopts[] array; o++ is in-bounds array iteration.,curl_full_audit_0.4.35,high
API00-C,curl,lib/easygetopt.c,53,FP,"Thin wrapper to lookup() which guards if(name); internal API, no deref.",curl_full_audit_0.4.35,high
DCL38-C,curl,lib/headers.h,36,FP,char buffer[1] struct-hack over-allocated at malloc; intentional C89 idiom.,curl_full_audit_0.4.35,med
STR31-C,curl,lib/headers.h,36,FP,"char[1] is over-allocated trailing struct-hack buffer, not fixed-size string.",curl_full_audit_0.4.35,high
API05-C,curl,lib/headers.h,48,FP,Conformant-array advisory on const char* header param; not curl convention.,curl_full_audit_0.4.35,high
DCL38-C,curl,lib/hsts.h,39,FP,char host[1] struct-hack over-allocated; intentional C89 flexible-member idiom.,curl_full_audit_0.4.35,med
STR31-C,curl,lib/hsts.h,39,FP,"host[1] is over-allocated struct-hack buffer, not a fixed string buffer.",curl_full_audit_0.4.35,high
API05-C,curl,lib/hsts.h,53,FP,Conformant-array advisory on const char* hostname; not curl convention.,curl_full_audit_0.4.35,high
API02-C,curl,lib/socks.h,35,FP,"buf already has blen size param; pnread is scalar out-param, not array.",curl_full_audit_0.4.35,high
API05-C,curl,lib/socks.h,37,FP,Conformant-array advisory on char* buf; not curl convention.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/socks.h,39,FP,pnread is *output* param (bytes read written through it); const wrong.,curl_full_audit_0.4.35,high
API02-C,curl,lib/uint-table.h,69,FP,"pkey is scalar uint32_t out-param, not an array needing capacity.",curl_full_audit_0.4.35,high
API02-C,curl,lib/uint-table.h,79,FP,"pkey scalar out-param; iterator API, no array capacity needed.",curl_full_audit_0.4.35,high
API02-C,curl,lib/uint-table.h,93,FP,"pkey scalar out-param; iterator API, no array capacity needed.",curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/cram.c,49,FP,"Internal auth helper; callers pass valid userp, not public NULL contract.",curl_full_audit_0.4.35,med
API00-C,curl,lib/vauth/cram.c,49,FP,"Internal auth helper; passwdp always valid from caller, not public API.",curl_full_audit_0.4.35,med
EXP30-C,curl,lib/vauth/cram.c,67,FP,"uptr() and len() both read chlg, neither mutates; no unsequenced side effects.",curl_full_audit_0.4.35,high
API02-C,curl,src/tool_cb_hdr.h,52,FP,FILE* stream is not an array; libcurl write-callback signature fixed.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_hdr.h,58,FP,Conformant-array advisory on callback ptr; signature fixed by libcurl.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_hdr.h,58,FP,"Conformant-array advisory; not curl convention, fixed callback signature.",curl_full_audit_0.4.35,high
API00-C,curl,src/tool_cb_soc.c,38,FP,"Opensocket callback; addr supplied by libcurl, signature fixed, always valid.",curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_cb_soc.c,38,FP,Callback signature fixed by CURLOPT_OPENSOCKETFUNCTION typedef; const cannot be added.,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_cb_soc.c,40,FP,Callback signature fixed by libcurl typedef; addr param const not addable.,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_getparam.h,376,FP,"certname is char** out-param, not an array needing capacity.",curl_full_audit_0.4.35,high
API02-C,curl,src/tool_getparam.h,376,FP,"passphrase is char** out-param, not an array needing capacity.",curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_getparam.h,382,FP,argv_item_t argv[] is standard main-style param; explicit bound inapplicable.,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_listhelp.c,36,FP,"helptext[] is extern, referenced from other TUs; cannot be static.",curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_listhelp.c,36,FP,Generated extern table consumed elsewhere; file scope required.,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_listhelp.c,36,FP,Initializer-sized helptext[] table; implicit bound idiomatic and correct.,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_urlglob.h,74,FP,urlnum/error scalars; no array param needs capacity argument.,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_urlglob.h,76,FP,"globbed is char** out-param, not array needing capacity.",curl_full_audit_0.4.35,high
API02-C,curl,src/tool_urlglob.h,77,FP,"output is char** out-param, not array needing capacity.",curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_util.c,57,FP,"time(NULL) fallback for wall clock; failure non-actionable, used only as timestamp.",curl_full_audit_0.4.35,med
STR34-C,curl,src/tool_util.c,114,FP,"*lastdirchar = 0 is a write of literal 0, not a sign-extending char read.",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_util.c,119,FP,"*pathp = filebuffer is char** pointer assignment, not signed-char read.",curl_full_audit_0.4.35,high
API05-C,curl,lib/bufref.h,40,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufref.h,45,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/connect.h,34,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API02-C,curl,lib/connect.h,75,FP,port is uint16_t* scalar out-param; sa already has salen; no array.,curl_full_audit_0.4.35,high
API02-C,curl,lib/cshutdn.h,96,FP,maxfd scalar out-param; fd_set args not arrays needing capacity.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cshutdn.h,98,FP,read_fd_set is populated (FD_SET) by the function; const wrong.,curl_full_audit_0.4.35,high
API02-C,curl,lib/curl_fopen.h,28,FP,"fh is FILE** out-param, not array needing capacity.",curl_full_audit_0.4.35,high
API02-C,curl,lib/curl_fopen.h,28,FP,"tempname is char** out-param, not array needing capacity.",curl_full_audit_0.4.35,high
API02-C,curl,lib/curl_get_line.h,29,FP,"buf is dynbuf*, input FILE*, eof bool*; none are sized arrays.",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_get_line.h,29,FP,FILE* input is consumed (read from) by getc; const FILE* not addable/wrong.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_md4.h,32,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_md4.h,32,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_md5.h,56,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_md5.h,56,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sha256.h,40,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sha256.h,40,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API02-C,curl,lib/curlx/fopen.h,50,FP,"fh is FILE* handle, not array; freopen-style signature fixed.",curl_full_audit_0.4.35,high
EXP37-C,curl,lib/curlx/fopen.h,52,FP,Declaration matches system freopen prototype; correct headers included via setup.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/inet_ntop.h,47,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/inet_ntop.h,47,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strcopy.h,27,FP,"Conformant-array-syntax advisory; mirrors strcopy.c decl, not curl convention.",curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strcopy.h,29,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strdup.h,31,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strdup.h,32,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
INT10-C,curl,lib/curlx/timediff.c,44,FP,"ms%1000 guarded by if(ms>0); operand positive, no negative-modulo UB.",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curlx/timediff.c,82,FP,struct timeval* read-only here but standard signature; curl style not project-wide const.,curl_full_audit_0.4.35,med
DCL00-C,curl,lib/curlx/wait.c,60,FP,r is reassigned by select() result on the POSIX path; not const-able.,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/curlx/wait.c,83,FP,"select(0,NULL,NULL,NULL,tv); all fd_set args NULL, no restrict aliasing.",curl_full_audit_0.4.35,high
API02-C,curl,lib/easyif.h,29,FP,"buffer has its own size arg; n is scalar out-param, not array.",curl_full_audit_0.4.35,high
API05-C,curl,lib/easyif.h,29,FP,Conformant-array-syntax advisory on const void* buffer; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftplistparser.h,31,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftplistparser.h,32,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API02-C,curl,lib/http_chunks.h,127,FP,"pconsumed is scalar size_t* out-param, not array needing capacity.",curl_full_audit_0.4.35,high
API05-C,curl,lib/http_chunks.h,128,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API02-C,curl,lib/idn.h,32,FP,"output is char** out-param (decoded string), not array needing capacity.",curl_full_audit_0.4.35,high
API02-C,curl,lib/idn.h,33,FP,"output is char** out-param (encoded string), not array needing capacity.",curl_full_audit_0.4.35,high
API05-C,curl,lib/if2ip.h,52,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/if2ip.h,53,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.h,153,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.h,154,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/multi_ntfy.h,50,FP,"CURLM_NTFY guard macro; args are side-effect-free lvalue pointers, multiple eval harmless.",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/multi_ntfy.h,50,FP,"Multiple eval of d, but d is always a plain pointer var; idiomatic null-guard macro.",curl_full_audit_0.4.35,med
API02-C,curl,lib/netrc.h,51,FP,"loginp is char** out-param, not array needing capacity.",curl_full_audit_0.4.35,high
API02-C,curl,lib/netrc.h,51,FP,"passwordp is char** out-param, not array needing capacity.",curl_full_audit_0.4.35,high
API02-C,curl,lib/uint-bset.h,84,FP,"pfirst scalar uint32_t* out-param; bitset iterator, no array capacity.",curl_full_audit_0.4.35,high
API02-C,curl,lib/uint-bset.h,97,FP,"pnext scalar uint32_t* out-param; bitset iterator, no array capacity.",curl_full_audit_0.4.35,high
API02-C,curl,lib/uint-spbset.h,75,FP,"pfirst scalar out-param; sparse bitset iterator, no array capacity.",curl_full_audit_0.4.35,high
API02-C,curl,lib/uint-spbset.h,88,FP,"pnext scalar out-param; sparse bitset iterator, no array capacity.",curl_full_audit_0.4.35,high
API02-C,curl,lib/vauth/digest.h,34,FP,value/content are char* output buffers in fixed digest-pair API; not capacity-arg style.,curl_full_audit_0.4.35,high
API02-C,curl,lib/vauth/digest.h,34,FP,"content is char* output buffer; digest-pair parser API, no added size arg.",curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/oauth2.c,86,FP,"Internal auth helper; user always valid from caller, not public NULL contract.",curl_full_audit_0.4.35,med
API00-C,curl,lib/vauth/oauth2.c,86,FP,"Internal auth helper; bearer always valid from caller, not public NULL contract.",curl_full_audit_0.4.35,med
API00-C,curl,lib/vauth/spnego_gssapi.c,72,FP,"data used only for infof logging; internal helper, callers pass valid handle.",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/spnego_gssapi.c,220,FP,Conformant-array-syntax advisory on char** outptr; not curl convention.,curl_full_audit_0.4.35,high
PRE08-C,curl,lib/vquic/curl_ngtcp2.h,34,FP,"8-char header-name collision advisory; external ngtcp2 names, irrelevant on modern FS.",curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.h,51,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API02-C,curl,lib/vssh/vssh.h,32,FP,"path is char** out-param, not array needing capacity.",curl_full_audit_0.4.35,high
API02-C,curl,lib/vssh/vssh.h,36,FP,"path is char** out-param, not array needing capacity.",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/cipher_suite.h,31,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/cipher_suite.h,40,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/hostcheck.h,31,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/hostcheck.h,32,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/keylog.h,59,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/keylog.h,61,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
ARR02-C,curl,src/curlinfo.c,46,FP,disabled[] string-literal table sized by initializer; implicit bound idiomatic.,curl_full_audit_0.4.35,high
FIO23-C,curl,src/curlinfo.c,270,FP,Standalone codegen tool main(); process exit flushes stdout; non-actionable.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_dbg.h,33,FP,Conformant-array-syntax advisory on debug callback; signature fixed by libcurl.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_dbg.h,34,FP,Conformant-array-syntax advisory on debug callback; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_rea.h,32,FP,Conformant-array-syntax advisory on read callback; signature fixed by libcurl.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_rea.h,32,FP,Conformant-array-syntax advisory on read callback; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_wrt.h,32,FP,Conformant-array-syntax advisory on write callback; signature fixed by libcurl.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_wrt.h,32,FP,Conformant-array-syntax advisory on write callback; not curl convention.,curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_cfgable.h,36,FP,tool_safefree must null caller's lvalue; cannot be inline fn; args side-effect-free.,curl_full_audit_0.4.35,high
PRE12-C,curl,src/tool_cfgable.h,36,FP,Standard safe-free macro nulls caller var; double-use of ptr is required idiom.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_formparse.h,60,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_formparse.h,61,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_getpass.h,35,FP,Conformant-array-syntax advisory on password buffer; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_getpass.h,35,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
DCL23-C,curl,src/tool_libinfo.h,53,FP,"feature_http2 named after protocol; trailing digit is meaningful, not confusing.",curl_full_audit_0.4.35,high
DCL23-C,curl,src/tool_libinfo.h,54,FP,"feature_http3 named after protocol; trailing digit is meaningful, not confusing.",curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_operate.h,28,FP,8-char filename-collision advisory; irrelevant on modern filesystems.,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_operate.h,82,FP,argv[] standard main-style param in struct; explicit bound inapplicable.,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_operhlp.h,33,FP,"inurlp is char** in/out-param, not array needing capacity.",curl_full_audit_0.4.35,high
API02-C,curl,src/tool_operhlp.h,34,FP,"filename is char** out-param, not array needing capacity.",curl_full_audit_0.4.35,high
API02-C,curl,src/tool_parsecfg.h,30,FP,"resolved is char** out-param, not array needing capacity.",curl_full_audit_0.4.35,high
API02-C,curl,src/tool_parsecfg.h,32,FP,"fp FILE*, db dynbuf*, error bool*; none sized arrays.",curl_full_audit_0.4.35,high
API05-C,curl,src/tool_progress.h,41,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_progress.h,42,FP,Conformant-array-syntax advisory; not curl convention.,curl_full_audit_0.4.35,high
DCL38-C,curl,src/var.h,32,FP,char name[1] struct-hack over-allocated with struct; intentional C89 idiom.,curl_full_audit_0.4.35,med
STR31-C,curl,src/var.h,32,FP,"name[1] over-allocated struct-hack buffer, not a fixed-size string.",curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_endian.c,79,FP,"buf is documented 2-byte buffer contract; internal byte-reader, callers pass valid.",curl_full_audit_0.4.35,high
API02-C,curl,lib/curl_gethostname.h,31,FP,Advisory style; signature already has namelen size arg; curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_ldap.h,31,FP,Conformant-array-syntax advisory; curl never uses C99 array params (brief #1),curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_memrchr.c,37,FP,memrchr clone with void* signature; conformant-array syntax inapplicable; advisory FP,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_memrchr.h,35,FP,Declaration matching memrchr clone; advisory conformant-array syntax FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curlx/basename.c,54,FP,POSIX basename drop-in; non-const mandated by macro fallback and contract; const breaks it,curl_full_audit_0.4.35,high
API02-C,curl,lib/curlx/basename.h,29,FP,basename returns pointer into path; size arg meaningless; advisory FP,curl_full_audit_0.4.35,high
API02-C,curl,lib/curlx/dynbuf.h,60,FP,dyn_take returns owned buffer with plen out-param; capacity arg inapplicable; advisory FP,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/curlx/nonblock.c,45,FP,"Every #if branch returns; final #else is #error, so no end-fallthrough exists",curl_full_audit_0.4.35,high
PRE06-C,curl,lib/curlx/snprintf.h,1,TP,Header genuinely lacks include guard; only defines SNPRINTF macro; minor but factually correct,curl_full_audit_0.4.35,low
API05-C,curl,lib/curlx/strerr.h,27,FP,"char *buf,size_t buflen strerror signature; conformant-array advisory FP",curl_full_audit_0.4.35,high
EXP37-C,curl,lib/getinfo.h,26,FP,Legitimate internal variadic declaration (getinfo); declaring variadic in header is normal C,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_aws_sigv4.h,35,FP,"const char*q,size_t len signature; conformant-array advisory FP",curl_full_audit_0.4.35,high
API05-C,curl,lib/httpsrr.h,61,FP,"const uint8_t*val,size_t vlen signature; conformant-array advisory FP",curl_full_audit_0.4.35,high
API05-C,curl,lib/strerror.h,29,FP,"char *buf,size_t buflen sspi_strerror signature; conformant-array advisory FP",curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.h,36,FP,"char *p,size_t len version signature; conformant-array advisory FP",curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/ssh.h,256,FP,"char *buffer,size_t buflen version signature; conformant-array advisory FP",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_int.h,76,FP,"const unsigned char*proto,size_t proto_len; conformant-array advisory FP",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_spack.h,38,FP,"const void*bufv,size_t buflen unpack signature; conformant-array advisory FP",curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.h,38,FP,"const char*mem,size_t nread ws_accept signature; conformant-array advisory FP",curl_full_audit_0.4.35,high
EXP36-C,curl,src/slist_wc.c,36,FP,"char* is data arg, not cast to slist; append returns properly-aligned malloc'd struct; no alignment issue",curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_cb_see.c,37,FP,CURLOPT_SEEKFUNCTION callback; fixed function-pointer signature; const cannot be added,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_filetime.c,86,FP,Internal helper passing filename to OS CreateFile/utime; callers supply valid name; no deref-without-check,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_help.h,48,FP,"const unsigned char*buf,size_t len helpscan signature; conformant-array advisory FP",curl_full_audit_0.4.35,high
API02-C,curl,src/tool_ipfs.h,30,FP,char **url out-param for owned string; capacity arg inapplicable; advisory FP,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_util.h,38,FP,char **pathp out-param for owned path string; capacity arg inapplicable; advisory FP,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/curl_rtmp.c,41,FP,"Replacement is a variable declaration 'int tv=...'; tv is a declarator, cannot parenthesize",curl_full_audit_0.4.35,high
PRE01-C,curl,lib/curl_rtmp.c,41,FP,s only used as s*1000 with literal arg; no precedence risk; decl-defining macro,curl_full_audit_0.4.35,high
PRE02-C,curl,lib/curl_rtmp.c,41,FP,"Replacement is a declaration; wrapping in parens is invalid C, misparse",curl_full_audit_0.4.35,high
PRE01-C,curl,lib/curl_rtmp.c,43,FP,"struct timeval tv={s,0} declaration; tv is declarator, not expression",curl_full_audit_0.4.35,high
PRE01-C,curl,lib/curl_rtmp.c,43,FP,"s used in initializer list element; literal arg, no precedence risk",curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_rtmp.c,54,FP,"Hash dtor callback signature fixed by typedef; void* params, no array syntax",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_rtmp.c,54,FP,rtmp_conn_dtor signature fixed by hash dtor function-pointer typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_rtmp.c,54,FP,Callback signature fixed by typedef; convention FP,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_rtmp.c,56,FP,"r=entry, pointee mutated via RTMP_Close/Free; const-local style, not actionable",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/curl_rtmp.c,60,FP,RTMP_Close then RTMP_Free are distinct ops; Close does not free,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_rtmp.c,66,FP,single-assignment local style flag; not actionable,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/curl_rtmp.c,66,FP,r ownership transferred to conn meta; rtmp_conn_dtor frees it,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/curl_rtmp.c,76,FP,r owned by conn meta (dtor frees); comment notes dtor performs cleanup,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_rtmp.c,79,FP,connect_it vtable signature; data heavily mutated; typedef-fixed,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_rtmp.c,82,FP,single-assignment local style flag; not actionable,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curl_rtmp.c,117,FP,"rtmp_recv is a forward-declared static function, not an uninit variable",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curl_rtmp.c,118,FP,"rtmp_send is a forward-declared static function, not an uninit variable",curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_rtmp.c,125,FP,single-assignment local style flag; not actionable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_rtmp.c,140,FP,done vtable signature; data param unused/void; typedef-fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_rtmp.c,150,FP,disconnect vtable signature; typedef-fixed,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_rtmp.c,154,FP,single-assignment local style flag; not actionable,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_rtmp.c,162,FP,rtmp_recv vtable signature (Curl_recv); convention FP,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_rtmp.c,166,FP,single-assignment local style flag; not actionable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_rtmp.c,188,FP,rtmp_send vtable signature; data used via data->conn; typedef-fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_rtmp.c,189,FP,Curl_send vtable signature; convention FP,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_rtmp.c,193,FP,single-assignment local style flag; not actionable,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_rtmp.c,209,FP,version buffer filled by msnprintf; curl never uses array-param syntax,curl_full_audit_0.4.35,high
INT14-C,curl,lib/curl_rtmp.c,212,FP,Byte-extraction from version constant; idiomatic mask+shift,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/curl_rtmp.c,250,FP,"Curl_scheme_rtmp is exported, consumed by scheme table elsewhere; needs external linkage",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/curl_rtmp.c,250,FP,Exported global needed across translation units,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/curl_rtmp.c,263,FP,Exported scheme global; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/curl_rtmp.c,263,FP,Exported global needed across translation units,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/curl_rtmp.c,276,FP,Exported scheme global; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/curl_rtmp.c,276,FP,Exported global needed across translation units,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/curl_rtmp.c,289,FP,Exported scheme global; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/curl_rtmp.c,289,FP,Exported global needed across translation units,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/curl_rtmp.c,302,FP,Exported scheme global; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/curl_rtmp.c,302,FP,Exported global needed across translation units,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/curl_rtmp.c,315,FP,Exported scheme global; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/curl_rtmp.c,315,FP,Exported global needed across translation units,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/netrc.c,34,FP,__NO_NET_API is an AmigaOS platform shim matching a system macro name,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/netrc.c,74,FP,file is closed at line 102 via curlx_fclose(file),curl_full_audit_0.4.35,high
EXP33-C,curl,lib/netrc.c,83,FP,line assigned at 86 and only used within the same if(!result) block,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/netrc.c,89,FP,dyn_ptr non-NULL after successful Curl_get_line+add; idiomatic,curl_full_audit_0.4.35,med
STR34-C,curl,lib/netrc.c,116,FP,Reading char* from char**; no char-to-larger sign extension,curl_full_audit_0.4.35,high
MEM03-C,curl,lib/netrc.c,117,FP,Plain pointer initialization to NULL; not a sensitive-buffer clear site,curl_full_audit_0.4.35,low
ARR30-C,curl,lib/netrc.c,140,FP,Tokenizer walks NUL-terminated in-memory file buffer; terminator-bounded,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/netrc.c,142,FP,while(tok && !done) loop; tok terminator-bounded; idiomatic,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/netrc.c,143,FP,tok_end assigned at 160 (tok_end=tok) before any use,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/netrc.c,182,FP,while(*tok_end) walks NUL-terminated buffer; terminator-bounded,curl_full_audit_0.4.35,high
STR34-C,curl,lib/netrc.c,184,FP,char s=*tok_end compared to char literals; no widening sign-extension,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/netrc.c,255,FP,"tok set to dyn_ptr or """" and never NULL at this switch; guarded",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/netrc.c,272,FP,!Curl_timestrcmp idiom for string-equality; idiomatic boolean use,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/netrc.c,272,FP,specific_login branch; login not freed here (free is in else branch),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/netrc.c,275,FP,free-then-strdup reassignment; not a double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/netrc.c,286,FP,curlx_free then immediate strdup reassign; not a double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/netrc.c,309,FP,"Curl_safefree nulls password; new-machine reset, not double-free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/netrc.c,311,FP,Curl_safefree nulls login on non-specific reset; not double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/netrc.c,316,FP,Curl_safefree nulls password on default reset; not double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/netrc.c,318,FP,Curl_safefree nulls login on default reset; not double-free,curl_full_audit_0.4.35,high
STR34-C,curl,lib/netrc.c,335,FP,"netrcbuffer=&nl[1] is pointer arithmetic, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/netrc.c,335,FP,Pointer arithmetic on nl; no char-to-larger assignment,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/netrc.c,355,FP,"login is heap (strdup), not a local; *loginp=login returns valid heap ptr",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/netrc.c,355,FP,Success path; login not freed; writing valid heap pointer to out-param,curl_full_audit_0.4.35,high
STR34-C,curl,lib/netrc.c,355,FP,"*loginp is char**; assigning pointer, not char sign-extension",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/netrc.c,356,FP,password is heap (strdup); *passwordp=password returns valid heap ptr,curl_full_audit_0.4.35,high
STR34-C,curl,lib/netrc.c,356,FP,"*passwordp is char**; pointer assignment, not char widening",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/netrc.c,362,FP,Error-path cleanup frees login once; loop frees were reassign or safefree,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/netrc.c,363,FP,Error-path cleanup frees password once; not a double-free,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/netrc.c,363,FP,Single error-path free of password; prior frees were reassign/safefree,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/netrc.c,392,FP,Both if/else assign retcode and fall to return retcode at end,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/netrc.c,415,FP,pw_res is out-param written by getpwuid_r before being read,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/netrc.c,442,FP,"homea is from curl_getenv (returns heap copy), not raw getenv; must be freed",curl_full_audit_0.4.35,high
ENV30-C,curl,lib/netrc.c,447,FP,filealloc is heap from curl_getenv/curl_maprintf; freeing is correct,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/netrc.c,453,FP,homea is heap from curl_getenv; freeing on OOM path is correct,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/netrc.c,456,FP,filealloc reassigned at 451 (curl_maprintf) before reuse; new allocation,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/netrc.c,457,FP,filealloc is heap from curl_maprintf; freeing is correct,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/netrc.c,457,FP,filealloc reassigned at 451 between the two frees; no double-free,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/netrc.c,457,FP,filealloc reassigned at 451; single free of new allocation,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/netrc.c,460,FP,homea is heap from curl_getenv; final free is correct,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/sha256.c,63,FP,init/final lifecycle pair; ctx destroyed in my_sha256_final or error path,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sha256.c,74,FP,my_sha256_update assigned to HMAC_params vtable; signature typedef-fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sha256.c,82,FP,my_sha256_final vtable signature; 'in' cast and mutated,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sha256.c,191,FP,Win32 my_sha256_update vtable signature; typedef-fixed,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/sha256.c,196,FP,"BYTE is unsigned char (align 1), not align 4; no alignment increase",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sha256.c,199,FP,Win32 my_sha256_final vtable signature; typedef-fixed,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/sha256.c,222,FP,Vendored LibTomCrypt macro; controlled call sites with no side effects,curl_full_audit_0.4.35,low
PRE12-C,curl,lib/sha256.c,222,FP,"WPA_GET_BE32 indexes (a)[n]; arg always simple ptr expr, no side effect",curl_full_audit_0.4.35,low
PRE00-C,curl,lib/sha256.c,227,FP,Vendored crypto macro; controlled call sites,curl_full_audit_0.4.35,low
PRE12-C,curl,lib/sha256.c,227,FP,"WPA_PUT_BE32 multi-indexes a; arg is simple ptr, no side effect",curl_full_audit_0.4.35,low
PRE00-C,curl,lib/sha256.c,235,FP,Vendored crypto macro; controlled call sites,curl_full_audit_0.4.35,low
PRE12-C,curl,lib/sha256.c,235,FP,"WPA_PUT_BE64 multi-indexes a; arg simple ptr, no side effect",curl_full_audit_0.4.35,low
PRE00-C,curl,lib/sha256.c,272,FP,RORc vendored crypto rotate macro; callers pass simple vars,curl_full_audit_0.4.35,low
PRE12-C,curl,lib/sha256.c,272,FP,"RORc evaluates x,y multiple times but args are side-effect-free",curl_full_audit_0.4.35,low
PRE00-C,curl,lib/sha256.c,276,FP,Sha256_Ch vendored crypto macro; controlled call sites,curl_full_audit_0.4.35,low
PRE01-C,curl,lib/sha256.c,276,FP,"Vendored crypto; x always simple var (e), no precedence risk in practice",curl_full_audit_0.4.35,low
PRE01-C,curl,lib/sha256.c,276,FP,"Vendored crypto; y always simple var, no actual misexpansion",curl_full_audit_0.4.35,low
PRE01-C,curl,lib/sha256.c,276,FP,"Vendored crypto; z always simple var, no actual misexpansion",curl_full_audit_0.4.35,low
PRE12-C,curl,lib/sha256.c,276,FP,z evaluated twice but args side-effect-free,curl_full_audit_0.4.35,low
PRE00-C,curl,lib/sha256.c,277,FP,Sha256_Maj vendored crypto macro; controlled call sites,curl_full_audit_0.4.35,low
PRE01-C,curl,lib/sha256.c,277,FP,"Vendored crypto; x always simple var, no precedence risk",curl_full_audit_0.4.35,low
PRE12-C,curl,lib/sha256.c,277,FP,x evaluated twice but args side-effect-free,curl_full_audit_0.4.35,low
PRE00-C,curl,lib/sha256.c,281,FP,Sigma0 vendored crypto macro; controlled call sites,curl_full_audit_0.4.35,low
PRE12-C,curl,lib/sha256.c,281,FP,x evaluated multiple times but args side-effect-free,curl_full_audit_0.4.35,low
PRE00-C,curl,lib/sha256.c,282,FP,Sigma1 vendored crypto macro; controlled call sites,curl_full_audit_0.4.35,low
PRE12-C,curl,lib/sha256.c,282,FP,x evaluated multiple times but args side-effect-free,curl_full_audit_0.4.35,low
PRE00-C,curl,lib/sha256.c,283,FP,Gamma0 vendored crypto macro; controlled call sites,curl_full_audit_0.4.35,low
PRE12-C,curl,lib/sha256.c,283,FP,x evaluated multiple times but args side-effect-free,curl_full_audit_0.4.35,low
PRE00-C,curl,lib/sha256.c,284,FP,Gamma1 vendored crypto macro; controlled call sites,curl_full_audit_0.4.35,low
PRE12-C,curl,lib/sha256.c,284,FP,x evaluated multiple times but args side-effect-free,curl_full_audit_0.4.35,low
PRE00-C,curl,lib/sha256.c,305,FP,RND vendored crypto compress macro; controlled call sites,curl_full_audit_0.4.35,low
PRE01-C,curl,lib/sha256.c,305,FP,"d used as d+=t0 (lvalue, simple var S[3]); no precedence risk",curl_full_audit_0.4.35,low
PRE01-C,curl,lib/sha256.c,305,FP,h used as simple lvalue; no precedence risk in practice,curl_full_audit_0.4.35,low
PRE01-C,curl,lib/sha256.c,305,FP,"i indexes K[i]/W[i]; always simple loop var, no precedence risk",curl_full_audit_0.4.35,low
PRE12-C,curl,lib/sha256.c,305,FP,a evaluated twice but args side-effect-free,curl_full_audit_0.4.35,low
EXP05-C,curl,lib/sha256.c,379,FP,CURLMIN macro misparse; n=CURLMIN(...) has no const cast,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sha256.c,399,FP,"out is the output buffer, written via WPA_PUT_BE32; must not be const",curl_full_audit_0.4.35,high
API05-C,curl,lib/sha256.c,454,FP,Curl_sha256it output/input buffers; curl never uses array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/sha256.c,454,FP,Convention FP; no C99 array-param syntax in curl,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/sha256.c,460,FP,my_sha256_init writes/initializes ctx; it does not read uninit data,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/socks_sspi.c,59,TP,"static helper, cf only read (cf->conn); const addable, not vtable-bound",curl_full_audit_0.4.35,low
STR34-C,curl,lib/socks_sspi.c,71,FP,*service_namep is char* assigned a pointer; no char sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,lib/socks_sspi.c,73,FP,"pointer assignment, not signed-char widening",curl_full_audit_0.4.35,high
EXP43-C,curl,lib/socks_sspi.c,79,FP,"standard SSPI AcquireCredentialsHandle out param, distinct pointers",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks_sspi.c,244,FP,"CURLE_OK is an enum value, not a freed pointer",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/socks_sspi.c,247,FP,socks5_free writes through sspi_w_token (Curl_safefree nulls members),curl_full_audit_0.4.35,high
EXP33-C,curl,lib/socks_sspi.c,314,FP,"pvBuffer set at 312; line checks malloc result, not uninitialized read",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,321,FP,return socks5_free() frees all three tokens; no leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,328,FP,socks5_free frees tokens on this error return,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,334,FP,socks5_free frees tokens; etbuf still NULL here,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,339,FP,socks5_free frees tokens; etbuf NULL at this point,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,343,FP,etbuf just failed malloc (NULL); socks5_free frees tokens,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,361,FP,etbuf freed here; tokens already freed at 351,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,369,FP,"nec branch: etbuf NULL, tokens freed at 351",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,378,FP,etbuf freed at 375; tokens freed at 351,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,385,FP,etbuf freed; tokens freed; nothing leaked,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,391,FP,etbuf freed; tokens freed earlier,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,397,FP,etbuf freed; tokens freed earlier,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,406,FP,token[0] just failed malloc (NULL); nothing to leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,414,FP,token[0] freed at 413 before return,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,431,FP,token[0] freed at 430; token[1] freed via FreeContextBuffer,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,440,FP,token[0] freed at 439; token[1] freed at 438,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,451,FP,token[0] freed at 450 before return,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_sspi.c,462,FP,"token[0] freed at 455; success return, no leak",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks_sspi.c,462,FP,"CURLE_OK is enum, not freed pointer",curl_full_audit_0.4.35,high
API00-C,curl,lib/socks_sspi.c,465,FP,internal negotiate fn; cf/data guaranteed valid by callers,curl_full_audit_0.4.35,high
API00-C,curl,lib/socks_sspi.c,465,FP,data always valid from connection state; not externally exported entry,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/socks_sspi.c,487,FP,socks5_sspi_setup guarantees non-NULL service_name or returns error (checked 483),curl_full_audit_0.4.35,high
MSC07-C,curl,lib/socks_sspi.c,519,FP,error: label reached via goto; not unreachable,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks_sspi.c,521,FP,"Curl_safefree nulls service_name; single free per path, no double-free",curl_full_audit_0.4.35,high
API05-C,curl,lib/version.c,83,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
EXP07-C,curl,lib/version.c,87,FP,"bit-mask version decode; literal masks idiomatic, advisory",curl_full_audit_0.4.35,high
API05-C,curl,lib/version.c,94,FP,conformant-array style advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/version.c,105,FP,conformant-array style advisory,curl_full_audit_0.4.35,high
INT13-C,curl,lib/version.c,111,FP,num is positive psl version number; signed shift advisory only,curl_full_audit_0.4.35,med
INT13-C,curl,lib/version.c,111,FP,"version-number masking, positive value; advisory",curl_full_audit_0.4.35,med
INT13-C,curl,lib/version.c,111,FP,"version-number masking, positive value; advisory",curl_full_audit_0.4.35,med
API05-C,curl,lib/version.c,123,FP,conformant-array style advisory,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/version.c,145,FP,curl_version is public exported libcurl API; needs external linkage,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/version.c,198,FP,getenv result checked by if(debugversion) at 199,curl_full_audit_0.4.35,high
CON34-C,curl,lib/version.c,198,FP,"DEBUGBUILD-only diagnostic getenv; advisory, value copied immediately",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/version.c,201,FP,"out is static char[300], not stack-local; safe to return",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/version.c,201,FP,static buffer zero-initialized; written before return,curl_full_audit_0.4.35,high
STR34-C,curl,lib/version.c,278,FP,strlen(src[j]) into size_t; no char widening at this site,curl_full_audit_0.4.35,high
STR34-C,curl,lib/version.c,284,FP,*outp++ = ' ' writes a literal char; no sign extension,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/version.c,284,FP,outp points into out[300] array; valid pointer arithmetic,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/version.c,287,FP,"memcpy size_t n, no const cast present (misparse)",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/version.c,288,FP,outp += n indexes into out[300] array,curl_full_audit_0.4.35,high
STR34-C,curl,lib/version.c,291,FP,*outp = 0 writes a char; no sign extension,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/version.c,293,FP,"out is static buffer, not destroyed on return",curl_full_audit_0.4.35,high
ARR02-C,curl,lib/version.c,302,FP,initializer-sized const string array; idiomatic implicit bounds,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/version.c,407,FP,both #if arms return; complete coverage under config,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/version.c,407,FP,present-callback signature fixed by feat.present typedef; const not addable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/version.c,420,FP,callback bound to features_table present pointer; typedef-fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/version.c,428,FP,callback bound to features_table present pointer; typedef-fixed,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/version.c,450,FP,initializer-sized struct array; idiomatic,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/version.c,556,FP,"CURL_ARRAYSIZE is compile-time constant, not a VLA",curl_full_audit_0.4.35,high
CON03-C,curl,lib/version.c,558,FP,version_info documented immutable between init/cleanup; advisory,curl_full_audit_0.4.35,med
DCL15-C,curl,lib/version.c,596,FP,curl_version_info is public exported libcurl API,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/version.c,687,FP,"p->name is static string literal; feature_names is static global, no stack escape",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h1-proxy.c,73,TP,static helper reads ts->tunnel_state only; const addable,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/cf-h1-proxy.c,78,TP,static helper reads ts only; const addable,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/cf-h1-proxy.c,83,TP,"tunnel_reinit (void)cf; cf unused, const addable (matches brief sample)",curl_full_audit_0.4.35,low
DCL13-C,curl,lib/cf-h1-proxy.c,84,TP,"tunnel_reinit (void)data; data unused, const addable",curl_full_audit_0.4.35,low
EXP33-C,curl,lib/cf-h1-proxy.c,112,FP,"ts = calloc(); assignment then NULL-checked, not deref of uninit",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/cf-h1-proxy.c,122,FP,"ts is heap calloc, not stack; *pts = ts is valid",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cf-h1-proxy.c,175,FP,Curl_safefree of a member nulls it; not UAF of data->state,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cf-h1-proxy.c,175,FP,"freeing proxyuserpwd member, struct itself not freed",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h1-proxy.c,196,TP,tunnel_want_send reads ts only; const addable,curl_full_audit_0.4.35,low
MEM30-C,curl,lib/cf-h1-proxy.c,212,FP,Curl_safefree(data->req.newurl) frees+nulls member; not UAF,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cf-h1-proxy.c,218,FP,req non-NULL after create_CONNECT success (result checked 215),curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cf-h1-proxy.c,225,FP,req valid after successful create_CONNECT,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h1-proxy.c,237,FP,send_CONNECT writes ts->nsent at 262; cf not modified but data is; ts mutated,curl_full_audit_0.4.35,med
EXP30-C,curl,lib/cf-h1-proxy.c,313,FP,"STRCONST expands to literal+length, no side-effecting calls",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cf-h1-proxy.c,324,FP,"STRCONST macro args are literals, no unsequenced side effects",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cf-h1-proxy.c,333,FP,STRCONST literal args; no side-effecting function calls,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cf-h1-proxy.c,337,FP,"!strncmp idiom, standard prefix match",curl_full_audit_0.4.35,high
EXP00-C,curl,lib/cf-h1-proxy.c,364,FP,ternary already parenthesized; | precedence correct,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cf-h1-proxy.c,378,FP,single_header only called with non-empty rcvbuf; linep non-NULL,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/cf-h1-proxy.c,534,FP,guarded by hlen && before linep[0] access,curl_full_audit_0.4.35,high
FLP03-C,curl,lib/cf-h1-proxy.c,549,FP,"httpproxycode/100 is integer division, not floating point",curl_full_audit_0.4.35,high
FLP03-C,curl,lib/cf-h1-proxy.c,644,FP,"integer division of int httpproxycode, not float",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cf-h1-proxy.c,646,FP,"Curl_safefree(data->req.newurl) frees+nulls member, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cf-h1-proxy.c,648,FP,"reading data->req.httpcode; newurl member freed, httpcode untouched",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cf-h1-proxy.c,648,FP,data->req struct not freed; only newurl member,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cf-h1-proxy.c,693,FP,Curl_safefree of proxyuserpwd member; not UAF of data->state,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cf-h1-proxy.c,693,FP,member free nulls pointer; struct intact,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cf-h1-proxy.c,700,FP,"Curl_req_soft_reset takes &data->req; reset not free, no UAF",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h1-proxy.c,776,FP,"exported insert_after API; signature parallels sibling cfilters, (void)data",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/http_chunks.c,72,FP,Curl_httpchunk_init writes ch fields; data unused but public API signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_chunks.c,83,FP,reset writes ch; data param matches public API family,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_chunks.c,94,FP,free mutates ch->trailer; public API signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_chunks.c,100,FP,is_done public API; data signature consistency,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_chunks.c,100,FP,ch read here but public API family signature fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_chunks.c,109,FP,conformant-array style advisory; curl convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_chunks.c,146,FP,hexbuffer[i]=*buf char-to-char copy; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_chunks.c,146,FP,"char-to-char assignment, no sign extension",curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_chunks.c,347,FP,"(unsigned int)*buf only for error-log %ux; cosmetic, idiomatic logging",curl_full_audit_0.4.35,med
API05-C,curl,lib/http_chunks.c,382,FP,conformant-array style advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_chunks.c,394,FP,cwriter callback signature bound to Curl_cwtype typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_chunks.c,404,FP,cwriter vtable callback; typedef-fixed signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_chunks.c,411,FP,cwriter vtable callback; typedef-fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_chunks.c,412,FP,conformant-array style advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_chunks.c,473,FP,creader callback signature bound to Curl_crtype typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_chunks.c,474,FP,creader vtable callback; typedef-fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_chunks.c,482,FP,creader callback; typedef-fixed signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_chunks.c,483,FP,creader vtable callback; typedef-fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_chunks.c,491,FP,creader callback; typedef-fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_chunks.c,544,FP,conformant-array style advisory,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http_chunks.c,556,FP,"tmp is output buffer filled by Curl_creader_read, not read uninitialized",curl_full_audit_0.4.35,high
INT30-C,curl,lib/http_chunks.c,561,FP,else branch only when blen>=MINLEN(1024); blen-=12 cannot underflow,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/http_chunks.c,572,FP,hd written by curl_msnprintf at 576; cannot be const,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_chunks.c,598,FP,conformant-array style advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_chunks.c,630,FP,cr_chunked_total_length vtable callback; typedef-fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_chunks.c,631,FP,creader vtable callback; typedef-fixed,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_chunks.c,654,FP,"thin wrapper; data passed to Curl_creader_create, not dereffed here",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_chunks.c,662,FP,reader non-NULL after Curl_creader_create success (if(!result)),curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic-tls.c,53,FP,Init wrapper delegates to backend ctx_init; callers pass valid struct ptrs; no internal deref,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic-tls.c,53,FP,"data passed through to backend init, not dereferenced here",curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic-tls.c,53,FP,"cb_setup forwarded to backend init, not dereferenced",curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic-tls.c,53,FP,"cb_user_data forwarded, opaque pointer not dereferenced",curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic-tls.c,53,FP,"session_reuse_cb (void)cast/forwarded, not dereferenced",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vquic/vquic-tls.c,53,FP,All #ifdef arms return; #else is #error so no path falls through,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,103,FP,"cleanup frees distinct members under guards; no UAF, memset follows",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,104,FP,ssl_ctx freed once after distinct ssl free; not freed pointer,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,104,FP,"ctx->ossl is struct member, not freed; backend free of contained ptr",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,105,FP,SSL_CTX_free of distinct member; no prior free of this pointer,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,107,FP,gnutls_deinit of session under guard; distinct from prior arm,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,107,FP,ctx->gtls is struct member not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,108,FP,session passed to deinit; not a use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,108,FP,"struct member access, no free of gtls",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,109,FP,shared_creds_free takes &member; cleanup function not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,109,FP,"member access, gtls struct not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,111,FP,"wolfSSL_free of ssl under guard; distinct member, no prior free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,111,FP,struct member wssl not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,112,FP,"member access only, no free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,113,FP,wolfSSL_CTX_free of distinct ssl_ctx member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,113,FP,struct member wssl not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vquic/vquic-tls.c,114,FP,"member access, no free of wssl",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/vquic/vquic-tls.c,116,FP,ctx is pointer to complete struct; sizeof(*ctx) correct for memset,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic-tls.c,150,FP,cf passed to get_primary_config which is null-tolerant; thin verify wrapper,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic-tls.c,196,FP,info written by callers' contract; getter never called with NULL info,curl_full_audit_0.4.35,med
MSC37-C,curl,lib/vquic/vquic-tls.c,196,FP,All #ifdef arms return bool incl #else return FALSE,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/vquic-tls.c,196,FP,"ctx members read but passed to backend; const not project convention, low value",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vquic/vquic-tls.c,221,FP,cf forwarded to report fns; const not applied project-wide,curl_full_audit_0.4.35,med
PRE00-C,curl,src/tool_parsecfg.c,36,FP,ISSEP evaluates x twice but x is *line side-effect-free deref; idiomatic guard macro,curl_full_audit_0.4.35,med
PRE12-C,curl,src/tool_parsecfg.c,36,FP,"macro arg is plain char deref, no side effect on double eval",curl_full_audit_0.4.35,med
ARR30-C,curl,src/tool_parsecfg.c,48,FP,"while(*line && ...) terminates at NUL; null-terminated string, bounded",curl_full_audit_0.4.35,high
CON43-C,curl,src/tool_parsecfg.c,54,FP,"single-threaded CLI config parse; no concurrent access, not double-fetch",curl_full_audit_0.4.35,high
EXP45-C,curl,src/tool_parsecfg.c,54,FP,"switch(out = *line) intentional assign-and-switch idiom, not comparison bug",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_parsecfg.c,54,FP,out is char assigned from char; no widening sign-extension here,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_parsecfg.c,54,FP,"char-to-char assignment, no integer promotion to larger type",curl_full_audit_0.4.35,high
API00-C,curl,src/tool_parsecfg.c,81,FP,"resolved is optional out-param, guarded by if(resolved) before deref",curl_full_audit_0.4.35,high
MSC04-C,curl,src/tool_parsecfg.c,81,FP,intentional recursion bounded by max_recursive counter; config-file include,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_parsecfg.c,96,FP,curlx_free declared in curlx headers included via tool_setup,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_parsecfg.c,116,FP,file closed at line 260 curlx_fclose(file) when not stdin,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_parsecfg.c,116,FP,FILE* not a raw fd; closed via curlx_fclose; duplicate of above,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_parsecfg.c,134,FP,line walks NUL-terminated dynbuf string; *line guard bounds loop,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_parsecfg.c,154,FP,"*line++='\0' is char store, no widening; no sign extension",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_parsecfg.c,167,FP,"unslashquote(++line) passes char*, not a char widening conversion",curl_full_audit_0.4.35,med
STR34-C,curl,src/tool_parsecfg.c,185,FP,*line='\0' char store; no integer widening,curl_full_audit_0.4.35,high
CON43-C,curl,src/tool_parsecfg.c,193,FP,single-threaded parse; switch(*line) not a TOCTOU double-fetch,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_parsecfg.c,224,FP,"config->next is global operation list freed at program teardown, not leaked",curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_parsecfg.c,240,FP,"!strcmp(filename,""-"") idiomatic equality test, intentional",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_parsecfg.c,273,FP,"*resolved = strdup result; pointer store, no char widening",curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_parsecfg.c,273,FP,curlx_strdup declared in curlx headers,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_parsecfg.c,277,FP,curlx_free declared in headers,curl_full_audit_0.4.35,high
MEM12-C,curl,src/tool_parsecfg.c,278,FP,file closed at 260 before this return; pathalloc freed at 277; no leak,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_parsecfg.c,278,FP,"config->next owned by global list, freed at teardown",curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_parsecfg.c,287,FP,fgets return checked: if(b) before strlen/use,curl_full_audit_0.4.35,high
FIO20-C,curl,src/tool_parsecfg.c,287,FP,truncation handled: loop accumulates until newline/EOF via dyn_addn,curl_full_audit_0.4.35,med
STR34-C,curl,src/tool_parsecfg.c,290,FP,strlen(b) takes char*; no char-to-int widening conversion present,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_parsecfg.c,334,FP,line=dyn_ptr(buf) under if(len) guard; non-NULL when len>0,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/curlx/timeval.c,36,FP,QueryPerformanceFrequency declared in windows.h on _WIN32 build,curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/timeval.c,40,FP,"pnow always passed via curlx_now()/&now stack var; internal helper, never NULL",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/curlx/timeval.c,44,FP,QueryPerformanceCounter declared in windows.h,curl_full_audit_0.4.35,high
FLP03-C,curl,lib/curlx/timeval.c,45,FP,"integer division of QuadPart, not floating-point; advisory FP",curl_full_audit_0.4.35,high
INT33-C,curl,lib/curlx/timeval.c,45,FP,"DEBUGASSERT(Curl_freq.QuadPart) precedes; freq set by QueryPerformanceFrequency, nonzero",curl_full_audit_0.4.35,med
FLP03-C,curl,lib/curlx/timeval.c,46,FP,"integer modulo/division, not FP operation",curl_full_audit_0.4.35,high
INT33-C,curl,lib/curlx/timeval.c,46,FP,QuadPart guarded by DEBUGASSERT and QPF success; nonzero on real hw,curl_full_audit_0.4.35,med
INT33-C,curl,lib/curlx/timeval.c,46,FP,"same divisor QuadPart, nonzero; duplicate site",curl_full_audit_0.4.35,med
PRE32-C,curl,lib/curlx/timeval.c,78,FP,"#if guards __APPLE__ block, not inside DEBUGASSERT macro arg here; misattributed",curl_full_audit_0.4.35,med
PRE32-C,curl,lib/curlx/timeval.c,90,FP,"#if for Apple availability inside if() condition, not a function-macro call",curl_full_audit_0.4.35,med
ERR33-C,curl,lib/curlx/timeval.c,112,FP,"time(NULL) for monotonic-clock fallback; (time_t)-1 acceptable, not security-relevant",curl_full_audit_0.4.35,med
API00-C,curl,lib/curlx/timeval.c,122,FP,"internal helper, pnow always &stack from curlx_now",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curlx/timeval.c,133,FP,static timebase zero-initialized by C; denom==0 check is the init guard,curl_full_audit_0.4.35,high
INT33-C,curl,lib/curlx/timeval.c,138,FP,timebase.denom set nonzero by mach_timebase_info before division,curl_full_audit_0.4.35,high
INT10-C,curl,lib/curlx/timeval.c,142,FP,"usecs is uint64_t; modulo on unsigned, no negative-operand issue",curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/timeval.c,147,FP,"internal helper, pnow from &stack var",curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/timeval.c,162,FP,"internal helper, pnow always valid &stack",curl_full_audit_0.4.35,high
ERR33-C,curl,lib/curlx/timeval.c,167,FP,"time(NULL) last-resort fallback; -1 tolerable, no exploit path",curl_full_audit_0.4.35,med
API00-C,curl,lib/curlx/timeval.c,186,FP,"newer always &stack from wrapper; const ptr params, internal use",curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/timeval.c,186,FP,older always valid &stack; never NULL caller,curl_full_audit_0.4.35,high
FLP03-C,curl,lib/curlx/timeval.c,215,FP,"integer division by constant 1000, not floating point",curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/timeval.c,222,FP,"newer valid &stack from wrapper, internal",curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/timeval.c,222,FP,"older valid &stack, never NULL",curl_full_audit_0.4.35,high
ERR33-C,curl,lib/curlx/timeval.c,264,FP,gmtime return checked: if(tm) before *store=*tm,curl_full_audit_0.4.35,high
CON33-C,curl,lib/curlx/timeval.c,264,FP,"gmtime only in #else fallback when no gmtime_r/_s; checksrc-acknowledged, portability",curl_full_audit_0.4.35,high
CON34-C,curl,lib/curlx/timeval.c,264,FP,duplicate of CON33 at same gmtime fallback site,curl_full_audit_0.4.35,high
MEM33-C,curl,lib/curlx/timeval.c,266,FP,struct tm has no flexible array member; *store=*tm is plain struct copy,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/uint-spbset.c,38,FP,bset is pointer to complete struct; sizeof(*bset) correct for memset,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/uint-spbset.c,50,FP,"count reads chunks; could be const but not project convention, low-value",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/uint-spbset.c,64,FP,"UNITTEST macro exports for tests; cannot be static, intentional",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/uint-spbset.c,64,FP,UNITTEST visibility needed for unit tests; static would break test linkage,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/uint-spbset.c,70,FP,curlx_free declared via curl_setup/curlx headers,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/uint-spbset.c,72,FP,"sizeof(bset->head) is sizeof a struct member, valid; bset is real ptr",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/uint-spbset.c,100,FP,curlx_calloc declared in curlx headers,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/uint-spbset.c,106,FP,"chunk is heap calloc'd, *panchor stores its address; not stack-local escape",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/uint-spbset.c,110,FP,sizeof(bset->head) member size correct; bset valid pointer to struct,curl_full_audit_0.4.35,high
API00-C,curl,lib/uint-spbset.c,117,FP,"i is uint32_t bitset index; no overflow, chunk arithmetic bounded by mask",curl_full_audit_0.4.35,high
INT14-C,curl,lib/uint-spbset.c,128,FP,i_chunk/64 and %64 standard bit-slot indexing; readable idiom,curl_full_audit_0.4.35,high
INT10-C,curl,lib/uint-spbset.c,129,FP,"i_chunk is uint32_t; %64 on unsigned, no negative-operand issue",curl_full_audit_0.4.35,high
API00-C,curl,lib/uint-spbset.c,133,FP,"uint32_t index, no overflow path",curl_full_audit_0.4.35,high
INT14-C,curl,lib/uint-spbset.c,142,FP,"standard slot index math, idiomatic",curl_full_audit_0.4.35,high
INT10-C,curl,lib/uint-spbset.c,143,FP,"unsigned i_chunk %64, no signedness issue",curl_full_audit_0.4.35,high
API00-C,curl,lib/uint-spbset.c,147,FP,"uint32_t index, no overflow",curl_full_audit_0.4.35,high
INT14-C,curl,lib/uint-spbset.c,155,FP,bit-slot indexing idiom,curl_full_audit_0.4.35,high
INT14-C,curl,lib/uint-spbset.c,156,FP,bit-slot indexing idiom,curl_full_audit_0.4.35,high
INT10-C,curl,lib/uint-spbset.c,158,FP,"unsigned modulo, no negative operand",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/uint-spbset.c,163,FP,"first reads bset; const possible but not convention, low-value",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/uint-spbset.c,180,FP,"chunk_first reads chunk; const possible, low-value style",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/uint-spbset.c,194,FP,"chunk_next reads chunk; const possible, low-value style",curl_full_audit_0.4.35,med
INT14-C,curl,lib/uint-spbset.c,200,FP,(last-offset)/64 slot index idiom,curl_full_audit_0.4.35,high
INT14-C,curl,lib/uint-spbset.c,200,FP,"last used in arithmetic/shift, idiomatic bit math",curl_full_audit_0.4.35,high
INT14-C,curl,lib/uint-spbset.c,202,FP,"i slot index used in shift/arith, idiomatic",curl_full_audit_0.4.35,high
API00-C,curl,lib/uint-spbset.c,221,FP,"++last on uint32_t; wrap harmless, bounded bitset traversal",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/uint-spbset.c,221,FP,"next reads bset; const possible, not convention",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/asyn-thrdd.c,107,FP,"Exported impl with (void)data; uniform resolver-impl signature, not const-correctable convention",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/asyn-thrdd.c,116,TP,"static addr_ctx_unlink only reads data; const-able, but curl does not follow convention",curl_full_audit_0.4.35,low
MEM30-C,curl,lib/asyn-thrdd.c,136,FP,addr_ctx->res read before addr_ctx freed at 139; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/asyn-thrdd.c,138,FP,sock_pair used before addr_ctx freed at 139; not UAF,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/asyn-thrdd.c,160,FP,hints non-NULL by caller contract in this branch; DEBUGASSERT guards,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/asyn-thrdd.c,186,FP,"err_exit is a goto label target, not unreachable code",curl_full_audit_0.4.35,high
API05-C,curl,lib/asyn-thrdd.c,331,FP,ares callback signature fixed by external typedef,curl_full_audit_0.4.35,high
CON34-C,curl,lib/asyn-thrdd.c,364,FP,DEBUGBUILD-only env gate during resolver init; not a real threading hazard,curl_full_audit_0.4.35,low
ERR33-C,curl,lib/asyn-thrdd.c,365,FP,getenv guarded non-NULL by check at 364 before re-fetch,curl_full_audit_0.4.35,high
CON34-C,curl,lib/asyn-thrdd.c,365,FP,DEBUGBUILD-only getenv during init; duplicate of 364,curl_full_audit_0.4.35,low
MEM30-C,curl,lib/asyn-thrdd.c,419,FP,"free of async.hostname then reassign at 420; member free-then-strdup, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/asyn-thrdd.c,419,FP,data->state.async never freed; only member hostname freed/reassigned,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/asyn-thrdd.c,420,FP,hostname reassigned after free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/asyn-thrdd.c,420,FP,struct async not freed; member-level free propagated to struct,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/asyn-thrdd.c,421,FP,reads freshly-strdup'd hostname; not freed memory,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/asyn-thrdd.c,421,FP,async struct not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/asyn-thrdd.c,421,FP,state not freed,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/asyn-thrdd.c,436,FP,"Curl_thread_create returns thread handle, not heap; freed via thread_join/destroy",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/asyn-thrdd.c,444,FP,"thread_hnd is a thread handle, not malloc'd memory",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/asyn-thrdd.c,452,FP,line is return TRUE; thread_hnd not heap memory,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/asyn-thrdd.c,454,FP,"err_exit is a goto label, not unreachable",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/asyn-thrdd.c,458,FP,"thread handle, not heap; async_thrdd_destroy already called",curl_full_audit_0.4.35,high
API00-C,curl,lib/asyn-thrdd.c,526,FP,thin wrapper; internal data always valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/asyn-thrdd.c,531,FP,internal entry; data always valid from caller,curl_full_audit_0.4.35,high
API00-C,curl,lib/asyn-thrdd.c,554,FP,internal; data always valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/asyn-thrdd.c,664,FP,internal; data always valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/vauth.c,65,FP,internal SPN builder; service passed as constant by callers,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/vauth.c,65,FP,host optional and NULL-checked in body via host && realm branches,curl_full_audit_0.4.35,high
DCL40-C,curl,lib/vauth/vauth.c,65,FP,two defs guarded by mutually-exclusive USE_WINDOWS_SSPI; only one compiles,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vauth/vauth.c,138,FP,exported read-only fn; const-able but curl does not follow convention,curl_full_audit_0.4.35,med
API05-C,curl,lib/vauth/vauth.c,150,FP,hash dtor signature fixed by typedef; curl never uses array-param syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vauth/vauth.c,150,FP,ntlm_conn_dtor key param fixed by hash dtor typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/vauth.c,150,FP,dtor signature fixed; array syntax not used,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/vauth.c,160,FP,internal getter; conn always valid,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vauth/vauth.c,169,FP,"ntlm is a pointer var (heap from meta_get/calloc); returns pointer, not local address",curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/vauth.c,172,FP,internal remover; conn valid,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/vauth.c,180,FP,dtor signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vauth/vauth.c,180,FP,krb5 dtor key param fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/vauth.c,180,FP,dtor signature fixed,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/vauth.c,190,FP,internal getter; conn valid,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vauth/vauth.c,199,FP,krb5 is heap pointer var; returns pointer value not local address,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/vauth.c,204,FP,gsasl dtor signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vauth/vauth.c,204,FP,dtor key param fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/vauth.c,204,FP,dtor signature fixed,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vauth/vauth.c,211,FP,gsasl freed once after cleanup; no double free,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/vauth.c,214,FP,internal getter; conn valid,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vauth/vauth.c,223,FP,gsasl is heap pointer var; returns pointer value,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/vauth.c,228,FP,nego dtor signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vauth/vauth.c,228,FP,dtor key param fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/vauth.c,228,FP,dtor signature fixed,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/vauth.c,238,FP,internal getter; conn valid,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vauth/vauth.c,247,FP,nego is heap pointer var; returns pointer value,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/vtls_spack.c,57,FP,"end and src both derive from same bufv buffer (buf, buf+buflen)",curl_full_audit_0.4.35,high
MEM33-C,curl,lib/vtls/vtls_spack.c,59,FP,"*val=**src is scalar uint8_t assignment, not flexible-array struct copy",curl_full_audit_0.4.35,high
INT14-C,curl,lib/vtls/vtls_spack.c,67,FP,"val is uint16_t (unsigned); shift is correct serialization, not signed arithmetic",curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/vtls_spack.c,75,FP,end-src same buffer,curl_full_audit_0.4.35,high
INT14-C,curl,lib/vtls/vtls_spack.c,75,FP,"src is uint8_t* pointer arithmetic; shift is on byte values, idiomatic decode",curl_full_audit_0.4.35,high
INT14-C,curl,lib/vtls/vtls_spack.c,85,FP,val is uint32_t unsigned; serialization shift,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/vtls_spack.c,95,FP,end-src same buffer,curl_full_audit_0.4.35,high
INT14-C,curl,lib/vtls/vtls_spack.c,95,FP,unsigned byte decode; idiomatic,curl_full_audit_0.4.35,high
INT14-C,curl,lib/vtls/vtls_spack.c,106,FP,val is uint64_t unsigned; serialization shift,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/vtls_spack.c,120,FP,end-src same buffer,curl_full_audit_0.4.35,high
INT14-C,curl,lib/vtls/vtls_spack.c,120,FP,unsigned byte decode,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/vtls_spack.c,132,FP,strlen on const char*; no char-to-int sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/vtls_spack.c,149,FP,"*val is char* (val is char**); pointer assignment, not char sign extension",curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/vtls_spack.c,153,FP,end-src same buffer,curl_full_audit_0.4.35,high
EXP40-C,curl,lib/vtls/vtls_spack.c,155,FP,const cast is on memdup0 source arg; *val is non-const char*,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/vtls_spack.c,155,FP,*val is char* assignment of memdup0 result; not char sign extension,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_spack.c,160,FP,curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_spack.c,173,FP,array-param syntax not used by convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_spack.c,174,FP,array-param syntax not used,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_spack.c,174,FP,array-param syntax not used,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/vtls_spack.c,183,FP,end-src same buffer,curl_full_audit_0.4.35,high
EXP40-C,curl,lib/vtls/vtls_spack.c,185,FP,const cast on memdup0 source; *val non-const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls_spack.c,192,FP,"Curl_ssl_session_pack reads s only; const-able but exported, convention not followed",curl_full_audit_0.4.35,low
API00-C,curl,lib/vtls/vtls_spack.c,239,FP,buflen bounds-checked via end-src guards in every decoder; no overflow path,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_spack.c,240,FP,array-param syntax not used,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vtls/vtls_spack.c,325,FP,"s is heap pointer from calloc; *ps=s stores heap, not local address",curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_cb_prg.c,41,FP,sinus[] bounds inferred from initializer; idiomatic const table,curl_full_audit_0.4.35,high
DCL22-C,curl,src/tool_cb_prg.c,69,FP,local buf needs no volatile; no setjmp/signal aliasing,curl_full_audit_0.4.35,high
ENV01-C,curl,src/tool_cb_prg.c,69,FP,no getenv involved; fixed display buffer,curl_full_audit_0.4.35,high
MEM05-C,curl,src/tool_cb_prg.c,69,FP,MAX_BARLENGTH is a compile-time constant; not a VLA,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_cb_prg.c,81,FP,check=width-2>=18 (width>=MIN_BARLENGTH 20); divisor never zero,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_cb_prg.c,81,FP,check>=18 by update_width invariant; never zero,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_cb_prg.c,83,FP,check>=18; divisor nonzero,curl_full_audit_0.4.35,high
INT10-C,curl,src/tool_cb_prg.c,83,FP,"tick kept in [0,200) non-negative; modulo well-defined",curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_cb_prg.c,83,FP,check>=18 nonzero,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_cb_prg.c,85,FP,check>=18 nonzero,curl_full_audit_0.4.35,high
INT10-C,curl,src/tool_cb_prg.c,85,FP,tick non-negative; modulo defined,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_cb_prg.c,85,FP,check>=18 nonzero,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_cb_prg.c,87,FP,check>=18 nonzero,curl_full_audit_0.4.35,high
INT10-C,curl,src/tool_cb_prg.c,87,FP,tick non-negative; modulo defined,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_cb_prg.c,87,FP,check>=18 nonzero,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_cb_prg.c,121,FP,CURLOPT_XFERINFOFUNCTION callback signature fixed; clientp->bar is mutated,curl_full_audit_0.4.35,high
ARR39-C,curl,src/tool_cb_prg.c,143,FP,"dltotal+ultotal+initial_size are curl_off_t integers, not pointer arithmetic",curl_full_audit_0.4.35,high
ARR39-C,curl,src/tool_cb_prg.c,156,FP,dlnow+ulnow+initial_size are integers; bar->initial_size is a member value,curl_full_audit_0.4.35,high
ENV01-C,curl,src/tool_cb_prg.c,184,FP,no getenv; fixed line buffer,curl_full_audit_0.4.35,high
MEM05-C,curl,src/tool_cb_prg.c,184,FP,MAX_BARLENGTH constant; not a VLA,curl_full_audit_0.4.35,high
FLP34-C,curl,src/tool_cb_prg.c,194,FP,integer-to-double of curl_off_t; no NaN/overflow possible,curl_full_audit_0.4.35,high
FLP34-C,curl,src/tool_cb_prg.c,194,FP,integer-to-double conversion; bounded,curl_full_audit_0.4.35,high
FLP34-C,curl,src/tool_cb_prg.c,197,FP,barwidth*frac to double; no range hazard,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_cb_prg.c,212,FP,"fflush on stderr progress display; return conventionally ignored, no action",curl_full_audit_0.4.35,low
API00-C,curl,src/tool_cb_prg.c,224,FP,init helper; config always valid from caller,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_cb_prg.c,224,FP,reads config only; const-able but curl convention not followed,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/cf-https-connect.c,71,TP,"static cf_hc_baller_is_active only reads b; const-able, not a vtable signature",curl_full_audit_0.4.35,low
DCL13-C,curl,lib/cf-https-connect.c,76,TP,static cf_hc_baller_has_started only reads b->cf; const-able,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/cf-https-connect.c,90,TP,static cf_hc_baller_data_pending does not modify b; const-able,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/cf-https-connect.c,96,TP,static cf_hc_baller_needs_flush does not modify b; const-able,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/cf-https-connect.c,102,TP,static cf_hc_baller_cntrl does not modify b; const-able,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/cf-https-connect.c,182,FP,"cf_hc_reset reads cf->ctx then mutates *ctx via pointer; const cf debatable, leave FP",curl_full_audit_0.4.35,low
EXP34-C,curl,lib/cf-https-connect.c,184,FP,cf always valid from callers; ctx NULL-checked before use,curl_full_audit_0.4.35,high
FLP03-C,curl,lib/cf-https-connect.c,193,FP,"happy_eyeballs_timeout/4 is integer timediff_t division, not floating-point",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cf-https-connect.c,233,FP,!strcmp idiom for ALPN equality; idiomatic,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-https-connect.c,310,FP,"i is the for-loop induction var, assigned in init clause",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-https-connect.c,445,FP,cf_hc_data_pending is a cftype vtable impl; signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-https-connect.c,460,TP,"static cf_get_max_baller_time only reads cf->ctx; const-able, not a vtable member",curl_full_audit_0.4.35,low
EXP33-C,curl,lib/cf-https-connect.c,500,FP,i is for-loop induction var,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/cf-https-connect.c,516,FP,all paths reach out: return result;,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-https-connect.c,516,FP,cf_hc_cntrl is a cftype vtable impl; signature fixed,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-https-connect.c,585,FP,ctx assigned by calloc on this line then NULL-checked; not uninitialized,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cf-https-connect.c,611,FP,cf non-NULL after Curl_cf_create success (result checked at 608),curl_full_audit_0.4.35,high
MSC37-C,curl,lib/cf-https-connect.c,619,FP,all paths reach out: return result;,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-https-connect.c,632,FP,cf set by cf_hc_create out-param; on failure goto out skips use,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-https-connect.c,638,TP,static cf_https_alpns_contain only reads list; const-able,curl_full_audit_0.4.35,low
API00-C,curl,lib/cf-https-connect.c,648,FP,exported setup; data always valid from internal callers,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-https-connect.c,648,FP,conn always valid from internal callers,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/cf-https-connect.c,648,FP,all paths reach out: return result;,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cf-https-connect.c,669,FP,"sockindex is FIRST/SECONDARYSOCKET (0/1), bounded by connection design",curl_full_audit_0.4.35,med
ARR30-C,curl,lib/cf-https-connect.c,669,FP,sockindex bounded to 0/1 by socket-index contract,curl_full_audit_0.4.35,med
ARR01-C,curl,lib/uint-bset.c,34,FP,"sizeof(*bset) on struct pointer is intentional struct size for memset, not array decay",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/uint-bset.c,47,FP,curlx_calloc declared via curl_setup.h memory macros; analyzer lacks preprocessor,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/uint-bset.c,52,FP,memcpy size is CURLMIN of both slot counts; bounded by dest alloc,curl_full_audit_0.4.35,high
INT32-C,curl,lib/uint-bset.c,52,FP,nslots bounded UINT32_MAX/64; *8 cannot overflow size_t on real targets,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/uint-bset.c,54,FP,curlx_free is a macro/decl from curl_setup.h not visible to analyzer,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/uint-bset.c,66,FP,curlx_free macro from headers,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/uint-bset.c,67,FP,"sizeof(*bset) = struct size for memset, intentional",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/uint-bset.c,71,FP,bset read via ->nslots; const possible but curl convention does not const these,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/uint-bset.c,77,FP,read-only accessor; curl does not const-qualify bset throughout API family,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/uint-bset.c,88,FP,read-only but part of non-const API family,curl_full_audit_0.4.35,med
ARR38-C,curl,lib/uint-bset.c,101,FP,memset bounded by nslots which sized the alloc; in-bounds,curl_full_audit_0.4.35,high
INT32-C,curl,lib/uint-bset.c,101,FP,nslots*8 bounded far below SIZE_MAX,curl_full_audit_0.4.35,high
INT14-C,curl,lib/uint-bset.c,108,FP,readability advisory on bitset slot math; idiomatic,curl_full_audit_0.4.35,high
INT14-C,curl,lib/uint-bset.c,119,FP,readability advisory on bit indexing,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/uint-bset.c,124,FP,read-only but non-const API family convention,curl_full_audit_0.4.35,med
INT14-C,curl,lib/uint-bset.c,126,FP,bit indexing advisory,curl_full_audit_0.4.35,high
INT14-C,curl,lib/uint-bset.c,146,FP,bit/shift math advisory; misattributed to bset,curl_full_audit_0.4.35,high
API00-C,curl,lib/uint-bset.c,146,FP,"last is uint32 incremented; bounded slot arithmetic, no overflow risk",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/uint-bset.c,146,FP,read-only but non-const API family,curl_full_audit_0.4.35,med
INT14-C,curl,lib/uint-bset.c,153,FP,slot index math advisory,curl_full_audit_0.4.35,high
INT14-C,curl,lib/uint-bset.c,156,FP,shift/index advisory,curl_full_audit_0.4.35,high
INT14-C,curl,lib/uint-bset.c,156,FP,bset misattributed in bit-shift expression,curl_full_audit_0.4.35,high
API00-C,curl,lib/uint-bset.c,175,FP,popcount is pure bit algorithm; no overflow-relevant arithmetic on x,curl_full_audit_0.4.35,high
INT14-C,curl,lib/uint-bset.c,185,FP,Hamming-weight bit algorithm; bitwise+arith inherent,curl_full_audit_0.4.35,high
INT14-C,curl,lib/uint-bset.c,190,FP,popcount multiplier constant; inherent,curl_full_audit_0.4.35,high
INT14-C,curl,lib/uint-bset.c,209,FP,ctz divide-and-conquer; bit algorithm idiom,curl_full_audit_0.4.35,high
DCL37-C,curl,src/tool_findfile.c,32,FP,"__NO_NET_API is AmigaOS platform shim, not a curl-defined reserved name",curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_findfile.c,47,FP,NULL-terminated finder table; implicit size from initializer is idiomatic,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_findfile.c,74,FP,fd closed via curlx_close(fd) at line 77 on success path,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_findfile.c,74,FP,no signed char conversion at open(); misparse of fd assignment,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_findfile.c,76,FP,curlx_strdup macro from tool_setup.h headers,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_findfile.c,98,FP,dotscore used as small loop bound flag; no overflow arithmetic,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_findfile.c,110,FP,path assigned at 133 before use at 135; declaration-only line,curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_findfile.c,113,FP,curl_free does not modify env; home is curl_getenv heap copy not getenv static,curl_full_audit_0.4.35,high
DCL00-C,curl,src/tool_findfile.c,117,FP,"c is reassigned conditionally; const inappropriate, it is a fresh alloc target",curl_full_audit_0.4.35,med
MEM30-C,curl,src/tool_findfile.c,117,FP,"home reassigned (=c) after free at 118; no UAF, freed-then-reassigned",curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_findfile.c,118,FP,"home is curl_getenv heap copy, curl_free is correct ownership free",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_findfile.c,118,FP,single free then reassign home=c; not double-free across loop iters,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_findfile.c,118,FP,free then home=c reassign; analyzer conflates per-branch frees,curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_findfile.c,127,FP,curl_free of heap home copy; correct,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_findfile.c,127,FP,distinct branch (withoutdot) with continue; fresh home each iteration,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_findfile.c,127,FP,branch-exclusive free followed by continue; no double-free,curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_findfile.c,133,FP,checkhome takes const char*; cannot modify home,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_findfile.c,133,FP,home valid here; freed only at 134 after checkhome returns,curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_findfile.c,134,FP,freeing heap home after use; correct ownership,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_findfile.c,134,FP,single free per loop iteration; home re-fetched next iter,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_findfile.c,134,FP,loop-iteration free conflated as double-free,curl_full_audit_0.4.35,high
ARR00-C,curl,src/tool_findfile.c,144,FP,"home here is pw->pw_dir (separate scope), never freed; not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_findfile.c,144,FP,distinct getpwuid block; home=pw->pw_dir not the freed loop var,curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_findfile.c,145,FP,checkhome takes const; pw->pw_dir not modified,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_findfile.c,145,FP,"home is pw->pw_dir, never freed; analyzer cross-scope confusion",curl_full_audit_0.4.35,high
CON03-C,curl,lib/asyn-ares.c,101,FP,ares_ver set once in global_init before threads; effectively immutable after init,curl_full_audit_0.4.35,med
API00-C,curl,lib/asyn-ares.c,213,FP,internal API; data always valid per caller contract (DEBUGASSERT pattern),curl_full_audit_0.4.35,high
DCL13-C,curl,lib/asyn-ares.c,227,FP,async_ares_cleanup writes ares->temp_ai=NULL via data; data mutated,curl_full_audit_0.4.35,med
API00-C,curl,lib/asyn-ares.c,239,FP,internal shutdown wrapper; data guaranteed valid by callers,curl_full_audit_0.4.35,high
API00-C,curl,lib/asyn-ares.c,249,FP,internal destroy; data always valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/asyn-ares.c,264,FP,internal pollset; data always valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/asyn-ares.c,382,FP,internal await; data always valid,curl_full_audit_0.4.35,high
INT10-C,curl,lib/asyn-ares.c,414,FP,"itimeout_ms guaranteed non-negative (clamped to INT_MAX, from positive timeout)",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/asyn-ares.c,486,FP,"ai is heap addrinfo param being linked into list, not address of local",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/asyn-ares.c,501,FP,"void* callback user_data cast to Curl_easy*; original was Curl_easy*, aligned",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/asyn-ares.c,592,FP,"node traversed read-only; could const but c-ares-shaped helper, low value",curl_full_audit_0.4.35,med
EXP33-C,curl,lib/asyn-ares.c,602,FP,ca assigned at 622 before any use in same iteration,curl_full_audit_0.4.35,high
WIN04-C,curl,lib/asyn-ares.c,608,FP,not a stored function pointer; EncodePointer is irrelevant here,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/asyn-ares.c,609,FP,ss_size set in all family branches (else continues); always init before use,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/asyn-ares.c,640,FP,(char*)ca + sizeof is correct byte arithmetic for flexible trailing buffer,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/asyn-ares.c,665,FP,"void* user_data was Curl_easy*; round-trip cast, properly aligned",curl_full_audit_0.4.35,high
API05-C,curl,lib/asyn-ares.c,684,FP,conformant-array advisory; curl never uses C99 array params,curl_full_audit_0.4.35,high
CON34-C,curl,lib/asyn-ares.c,836,FP,DEBUGBUILD-only getenv used immediately read-only; advisory,curl_full_audit_0.4.35,med
ENV34-C,curl,lib/asyn-ares.c,837,FP,servers is const char* consumed immediately by ares_set_servers; not stored long-term,curl_full_audit_0.4.35,med
CON34-C,curl,lib/asyn-ares.c,837,FP,duplicate of 836 getenv site; DEBUGBUILD-only advisory,curl_full_audit_0.4.35,med
MSC37-C,curl,lib/asyn-ares.c,882,FP,all paths return (ifdef/else both return); analyzer cannot see preprocessor branches,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/asyn-ares.c,882,FP,data->set.str read and ares->channel mutated via data; not const-able,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/asyn-ares.c,903,FP,all #ifdef branches return a value,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/asyn-ares.c,932,FP,all #ifdef branches return a value,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cshutdn.c,44,FP,conn guaranteed non-NULL by callers (attach + DEBUGASSERT contract),curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cshutdn.c,85,FP,conn non-NULL; established by cshutdn_run_once caller contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cshutdn.c,110,FP,DEBUGASSERT(!data->conn) then Curl_attach_connection; data valid by contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cshutdn.c,121,FP,"DEBUGASSERT(conn)/(data) at top; internal terminate, caller contract",curl_full_audit_0.4.35,high
API00-C,curl,lib/cshutdn.c,121,FP,conn asserted non-NULL at 129; internal API,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cshutdn.c,131,FP,conn asserted non-NULL at line 129 before deref,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cshutdn.c,154,FP,"Curl_conn_close on FIRSTSOCKET vs SECONDARYSOCKET; admin is handle, not freed",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cshutdn.c,159,FP,"Curl_conn_free frees conn (once); admin is the easy handle, not double-freed",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cshutdn.c,177,FP,!strcmp idiom in destination match; idiomatic,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/cshutdn.c,232,FP,e is a list iterator reassigned in loop (enext); const inappropriate,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/cshutdn.c,248,FP,done set by Curl_cshutdn_run_once->cshutdn_run_once on all paths before read,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/cshutdn.c,337,FP,return checked: if(p) before use at 338,curl_full_audit_0.4.35,high
CON34-C,curl,lib/cshutdn.c,337,FP,"DEBUGBUILD-only getenv, value consumed immediately; advisory",curl_full_audit_0.4.35,med
ENV30-C,curl,lib/cshutdn.c,340,FP,curlx_str_number takes const char**; does not modify env string content,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cshutdn.c,353,FP,data->multi mutated (connchanged); part of non-const API,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cshutdn.c,362,FP,reads data->multi->cshutdn list; non-const API convention,curl_full_audit_0.4.35,med
DCL00-C,curl,lib/cshutdn.c,368,FP,e is loop iterator reassigned via Curl_node_next; const inappropriate,curl_full_audit_0.4.35,med
EXP20-C,curl,lib/cshutdn.c,371,FP,!strcmp destination match idiom,curl_full_audit_0.4.35,high
API00-C,curl,lib/cshutdn.c,395,FP,"internal add; conn from caller always valid, llist append non-NULL",curl_full_audit_0.4.35,high
API00-C,curl,lib/cshutdn.c,395,FP,conns_in_pool size_t compared to max_total; no unchecked overflow arithmetic,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cshutdn.c,414,FP,"conn passed by caller, non-NULL; logging member access",curl_full_audit_0.4.35,high
API00-C,curl,lib/cshutdn.c,426,FP,thin wrapper forwarding to cshutdn_perform; no deref of data itself,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/cshutdn.c,503,FP,function returns result on all paths (goto out -> return result),curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cshutdn.c,530,FP,in-loop cleanup gotos out (past 530); final 530 cleanup not double-called,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/md4.c,115,FP,MD4_Update ctx written via CryptHashData; signature fixed by MD4 API family,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/md4.c,120,FP,"MD4_Final ctx hash destroyed/released; mutated, fixed API signature",curl_full_audit_0.4.35,med
PRE00-C,curl,lib/md4.c,198,FP,MD4_F params are simple side-effect-free lvalues; standard public-domain MD4,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/md4.c,198,FP,multiple eval of z harmless (no side effects in MD4 word args),curl_full_audit_0.4.35,med
PRE00-C,curl,lib/md4.c,199,FP,MD4_G simple lvalue args; canonical crypto macro,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/md4.c,199,FP,multiple eval harmless for side-effect-free args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/md4.c,205,FP,MD4_STEP canonical MD4 transform macro; args are plain registers,curl_full_audit_0.4.35,med
PRE01-C,curl,lib/md4.c,205,FP,f is a function-name macro arg; parenthesizing the callee is meaningless,curl_full_audit_0.4.35,low
PRE02-C,curl,lib/md4.c,205,FP,statement macro cannot be parenthesized as expression; advisory misfit,curl_full_audit_0.4.35,med
PRE10-C,curl,lib/md4.c,205,FP,"used only in flat sequence at call sites, never in braceless if; safe as-is",curl_full_audit_0.4.35,med
PRE11-C,curl,lib/md4.c,205,FP,trailing semicolon but call sites omit semicolon; used correctly throughout,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/md4.c,205,FP,"a multiple-eval harmless (register var, no side effects)",curl_full_audit_0.4.35,med
PRE00-C,curl,lib/md4.c,221,FP,"MD4_SET reads input bytes; canonical, n is integer literal at call sites",curl_full_audit_0.4.35,med
PRE01-C,curl,lib/md4.c,221,FP,n always integer literal (0..15) at all call sites; no precedence hazard,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/md4.c,221,FP,n is literal; multiple eval harmless,curl_full_audit_0.4.35,med
PRE01-C,curl,lib/md4.c,226,FP,MD4_GET n is literal index at call sites; no precedence issue,curl_full_audit_0.4.35,med
EXP45-C,curl,lib/md4.c,314,FP,"do-while(size -= 64) is intentional compound-assign loop, not =/== confusion",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/md4.c,321,FP,"returns ptr pointing into caller-owned input buffer, not a local's address",curl_full_audit_0.4.35,high
INT14-C,curl,lib/md4.c,343,FP,len bit-masking in hash length counter; idiomatic,curl_full_audit_0.4.35,high
INT14-C,curl,lib/md4.c,343,FP,saved_lo mask/add in MD4 counter; idiomatic,curl_full_audit_0.4.35,high
EXP07-C,curl,lib/md4.c,346,FP,">>29 is structural shift of 32-bit counter, not a magic constant assumption",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/md4.c,420,FP,sizeof(*ctx) is struct MD4_CTX size for memset; ctx is real struct pointer not decayed array,curl_full_audit_0.4.35,high
API05-C,curl,lib/md4.c,425,FP,conformant-array advisory; curl uses pointer params by convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/md4.c,426,FP,conformant-array advisory on const input/len signature,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/request.c,40,FP,sizeof(*req) on struct pointer is intended struct size for memset; not array decay,curl_full_audit_0.4.35,high
API00-C,curl,lib/request.c,43,FP,internal reset fn; callers always pass valid req; idiomatic curl no-null-check,curl_full_audit_0.4.35,high
API00-C,curl,lib/request.c,89,FP,"internal fn, req always valid from caller",curl_full_audit_0.4.35,high
API00-C,curl,lib/request.c,89,FP,"internal fn, data always valid",curl_full_audit_0.4.35,high
API00-C,curl,lib/request.c,98,FP,"internal fn, data always valid",curl_full_audit_0.4.35,high
MSC04-C,curl,lib/request.c,98,FP,reported cycle is conditional/bounded by handle state; not infinite recursion,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/request.c,98,FP,req param exists only for API symmetry; (void)req; const not project convention,curl_full_audit_0.4.35,high
API00-C,curl,lib/request.c,111,FP,"internal reset fn, data always valid",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/request.c,117,FP,"sendbuf_init is a bool flag, not freed pointer; no UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/request.c,118,FP,"Curl_bufq_reset resets, does not free struct sendbuf; not freed pointer",curl_full_audit_0.4.35,high
API00-C,curl,lib/request.c,166,FP,"internal free fn, data always valid",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/request.c,169,FP,sendbuf_init bool flag read before free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/request.c,170,FP,"Curl_bufq_free frees internals of sendbuf, &sendbuf itself not freed; not UAF",curl_full_audit_0.4.35,high
API05-C,curl,lib/request.c,175,FP,curl never uses C99 array-param syntax; advisory style,curl_full_audit_0.4.35,high
INT00-C,curl,lib/request.c,187,FP,DEBUGASSERT(hds_len<=blen) guarantees non-negative; debug-only block,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/request.c,189,FP,return of getenv assigned to p then checked if(p) on next line,curl_full_audit_0.4.35,high
CON34-C,curl,lib/request.c,189,FP,debug-only env read at startup; not a threaded hot path,curl_full_audit_0.4.35,med
ENV30-C,curl,lib/request.c,192,FP,"curlx_str_number takes const char**, parses, does not modify env string",curl_full_audit_0.4.35,high
INT00-C,curl,lib/request.c,201,FP,hds_len<=blen invariant (DEBUGASSERT line 182) holds; no underflow,curl_full_audit_0.4.35,high
API05-C,curl,lib/request.c,338,FP,reader callback signature; array-param syntax not used,curl_full_audit_0.4.35,high
API05-C,curl,lib/request.c,339,FP,callback signature; advisory style,curl_full_audit_0.4.35,high
API05-C,curl,lib/request.c,353,FP,internal helper signature; advisory style,curl_full_audit_0.4.35,high
INT30-C,curl,lib/request.c,393,FP,nwritten<=blen from xfer_send (sent at most blen); subtraction cannot wrap,curl_full_audit_0.4.35,high
API00-C,curl,lib/request.c,479,FP,"internal fn, data always valid",curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/krb5_sspi.c,81,FP,userp checked if(userp && *userp) before use; SSPI auth callee,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/krb5_sspi.c,81,FP,krb5 always valid from caller; internal auth fn,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/krb5_sspi.c,147,FP,output_token/credentials are krb5 struct members freed by Curl_auth_cleanup_gssapi; not leaks,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/vauth/krb5_sspi.c,150,FP,AcquireCredentialsHandle distinct in/out params; not aliased restrict,curl_full_audit_0.4.35,med
MEM12-C,curl,lib/vauth/krb5_sspi.c,156,FP,struct-member allocs freed by cleanup fn; not stack leaks,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/krb5_sspi.c,161,FP,struct-member allocs freed by cleanup fn,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/krb5_sspi.c,167,FP,struct-member allocs freed by cleanup fn,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/krb5_sspi.c,199,FP,struct-member allocs freed by cleanup fn,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/krb5_sspi.c,202,FP,struct-member allocs freed by cleanup fn,curl_full_audit_0.4.35,high
EXP42-C,curl,lib/vauth/krb5_sspi.c,204,FP,CtxtHandle has no padding (two pointer-sized fields); SSPI idiom memcmp ok,curl_full_audit_0.4.35,med
STR30-C,curl,lib/vauth/krb5_sspi.c,214,FP,"Curl_bufref_set stores ptr+len, does not modify literal; mutual_auth empty marker",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/krb5_sspi.c,218,FP,struct-member allocs freed by cleanup fn,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/krb5_sspi.c,237,FP,krb5 always valid from caller; internal fn,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vauth/krb5_sspi.c,240,FP,"krb5 is in/out, modified via context/QueryContextAttributes; cannot be const",curl_full_audit_0.4.35,high
DCL22-C,curl,lib/vauth/krb5_sspi.c,244,FP,offset is plain local accumulator; volatile not warranted,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/krb5_sspi.c,298,FP,input_buf[1] filled by DecryptMessage SSPI call before read; not uninitialized,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vauth/krb5_sspi.c,305,FP,indata=input_buf[1].pvBuffer non-NULL after cbBuffer==4 check at line 298,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/krb5_sspi.c,387,FP,wrap_buf filled by EncryptMessage before cbBuffer read; not uninitialized,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/vauth/krb5_sspi.c,398,FP,appdata+offset is plain unscaled byte ptr arith on unsigned char*; no sizeof,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/vauth/krb5_sspi.c,400,FP,unscaled byte ptr arith on unsigned char*; no double scaling,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/krb5_sspi.c,409,FP,trailer/message/padding freed at out: label; appdata returned via bufref ownership,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/krb5_sspi.c,413,FP,all local buffers freed at out: before this return; appdata ownership transferred,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/krb5_sspi.c,426,FP,"cleanup fn, krb5 always valid; members null-checked individually",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/krb5_sspi.c,438,FP,FreeCredentialsHandle is SSPI release not free; curlx_free once then NULL; no double-free,curl_full_audit_0.4.35,high
CON03-C,curl,lib/amigaos.c,66,FP,AmigaOS single-process init globals; set once at startup; platform shim,curl_full_audit_0.4.35,med
DCL37-C,curl,lib/amigaos.c,66,FP,__CurlISocket is file-static AmigaOS naming; leading underscore not externally reserved-collision here,curl_full_audit_0.4.35,med
DCL37-C,curl,lib/amigaos.c,66,TP,file-scope identifier starting with double underscore is technically reserved per DCL37,curl_full_audit_0.4.35,low
CON03-C,curl,lib/amigaos.c,67,FP,SocketFeatures set once at init; AmigaOS platform shim,curl_full_audit_0.4.35,med
EXP30-C,curl,lib/amigaos.c,82,FP,"SBTM_* are macros building tag args, not unsequenced side-effecting calls",curl_full_audit_0.4.35,med
DCL30-C,curl,lib/amigaos.c,90,FP,"ISocket holds interface from GetInterface (heap/system), not stack-local; valid lifetime",curl_full_audit_0.4.35,high
ERR33-C,curl,lib/amigaos.c,92,FP,atexit return unchecked but registering cleanup at init; low-impact idiom,curl_full_audit_0.4.35,low
ARR30-C,curl,lib/amigaos.c,121,FP,line 121 is fn signature for Curl_ipv4_resolve_r; no malloc/arith there; misattributed,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/amigaos.c,134,FP,(char*)buf+sizeof(struct hostent) is intended byte offset past header; correct gethostbyname_r usage,curl_full_audit_0.4.35,high
CON34-C,curl,lib/amigaos.c,152,TP,gethostbyname uses static storage; non-threadsafe (curl reopens lib but result static),curl_full_audit_0.4.35,med
EXP33-C,curl,lib/amigaos.c,153,FP,h assigned by gethostbyname() return before if(h); not uninitialized,curl_full_audit_0.4.35,high
CON34-C,curl,lib/amigaos.c,162,TP,non-threaded path gethostbyname static storage; flagged correctly though guarded by build mode,curl_full_audit_0.4.35,med
API00-C,curl,lib/amigaos.c,175,FP,"thin WaitSelect wrapper; fd_set ptrs may be NULL legitimately, passed through",curl_full_audit_0.4.35,high
API00-C,curl,lib/amigaos.c,175,FP,writefds passed through to WaitSelect; NULL valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/amigaos.c,175,FP,errorfds passed through; NULL valid for select,curl_full_audit_0.4.35,high
API00-C,curl,lib/amigaos.c,175,FP,timeout passed through; NULL valid for select,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/amigaos.c,178,FP,r is reassigned conceptually as return; const would block return r idiom; minor,curl_full_audit_0.4.35,med
ERR33-C,curl,lib/amigaos.c,181,FP,raise(SIGINT) for Ctrl-C delivery; return value irrelevant here,curl_full_audit_0.4.35,med
DCL37-C,curl,lib/amigaos.c,194,FP,"__request is external libnix symbol declaration, name fixed by library ABI",curl_full_audit_0.4.35,low
DCL37-C,curl,lib/amigaos.c,194,FP,__request name dictated by libnix ABI; cannot rename,curl_full_audit_0.4.35,low
PRE01-C,curl,lib/amigaos.c,197,FP,"msg used as string-literal concat (msg ""\n\a""); parenthesizing would break; idiom",curl_full_audit_0.4.35,med
EXP30-C,curl,lib/amigaos.c,218,FP,"SBTM_* tag-building macros, not unsequenced side-effecting function calls",curl_full_audit_0.4.35,med
ERR33-C,curl,lib/amigaos.c,225,FP,atexit return unchecked at init; low-impact idiom,curl_full_audit_0.4.35,low
API05-C,curl,lib/sendf.h,181,FP,prototype; curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.h,203,FP,prototype; advisory style,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,260,FP,reader is vtable do_read signature; modified by impls; const impossible,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,262,FP,reader vtable callback signature; cannot be const,curl_full_audit_0.4.35,high
API02-C,curl,lib/sendf.h,263,FP,"def_read takes (buf,blen) capacity pair; size already present as blen",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,264,FP,reader vtable signature; cannot be const,curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.h,265,FP,prototype; advisory style,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,266,FP,"nread is out-param (written), not const",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,268,FP,reader vtable signature; modified by impl,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,270,FP,reader vtable signature; cannot be const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,272,FP,reader vtable signature; cannot be const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,275,FP,reader vtable signature; cannot be const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,278,FP,reader vtable signature; cannot be const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,280,FP,reader vtable signature; cannot be const,curl_full_audit_0.4.35,high
API02-C,curl,lib/sendf.h,286,FP,Curl_creader_read has blen capacity param; size present,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,287,FP,reader modified through read chain; not const,curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.h,288,FP,prototype; advisory style,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,288,FP,nread out-param; not const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,292,FP,reader vtable signature; not const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,299,FP,preader is out double-pointer (creates reader); cannot be const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,308,FP,reader chain mutated; not const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.h,315,FP,reader vtable signature; not const,curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.h,421,FP,prototype; advisory style,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_cb_wrt.c,38,FP,config validated via DEBUGASSERT(config); internal CLI fn,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_cb_wrt.c,51,FP,"file stored in outs->stream, closed later by tool cleanup; ownership transfer",curl_full_audit_0.4.35,high
MEM12-C,curl,src/tool_cb_wrt.c,72,FP,early FALSE return on dyn_addf fail; fd==-1 nothing open; fbuffer leak minor (see FN),curl_full_audit_0.4.35,med
FIO42-C,curl,src/tool_cb_wrt.c,75,FP,fd fdopen'd into file then stored in outs->stream; closed by cleanup,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_cb_wrt.c,90,FP,"file is FILE* from fdopen, closed via outs->stream cleanup; closed on fdopen fail",curl_full_audit_0.4.35,high
MEM12-C,curl,src/tool_cb_wrt.c,100,FP,file handed to outs->stream ownership; not leaked at success return,curl_full_audit_0.4.35,high
MEM12-C,curl,src/tool_cb_wrt.c,107,FP,"FALSE return path: file NULL, fd closed; ownership otherwise transferred",curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_wrt.c,112,FP,win_console buffer param; advisory style,curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_cb_wrt.c,119,FP,"IS_TRAILING_BYTE args are simple lvalue indexes, no side effects in callers",curl_full_audit_0.4.35,med
PRE12-C,curl,src/tool_cb_wrt.c,119,FP,macro multi-eval of x but only called with side-effect-free rbuf[i]; benign,curl_full_audit_0.4.35,med
ARR01-C,curl,src/tool_cb_wrt.c,173,FP,"outs is struct OutStruct*, utf8seq is real array member; sizeof correct",curl_full_audit_0.4.35,high
INT14-C,curl,src/tool_cb_wrt.c,178,FP,rbuf[rlen-1]&0x80 bit test plus rlen arithmetic; readability advisory only,curl_full_audit_0.4.35,med
API00-C,curl,src/tool_cb_wrt.c,240,FP,libcurl WRITEFUNCTION callback; buffer guaranteed non-NULL by libcurl,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_cb_wrt.c,240,FP,sz*nmemb from libcurl bounded by CURL_MAX_WRITE_SIZE; checked at line 272,curl_full_audit_0.4.35,med
API00-C,curl,src/tool_cb_wrt.c,240,FP,nmemb bounded by libcurl; size checked before use,curl_full_audit_0.4.35,med
API05-C,curl,src/tool_cb_wrt.c,240,FP,callback signature fixed by libcurl typedef; advisory style,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_wrt.c,240,FP,callback signature fixed by libcurl typedef,curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_cb_wrt.c,261,FP,"curl_getenv returns allocated copy; curl_free frees that copy, not env",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_wrt.c,327,FP,"memchr(buffer,0,bytes) takes void*; no signed-char widening at this site",curl_full_audit_0.4.35,med
ERR33-C,curl,src/tool_cb_wrt.c,338,TP,"fwrite return rc only compared if(bytes==rc) for byte accounting, not checked for short write error path",curl_full_audit_0.4.35,med
ERR00-C,curl,src/tool_cb_wrt.c,338,FP,duplicate of ERR33 at same site; rc compared to bytes; count once,curl_full_audit_0.4.35,med
FIO18-C,curl,src/tool_cb_wrt.c,338,FP,writing arbitrary binary body not a null-terminated string; strlen inapplicable,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_cb_wrt.c,354,FP,fflush res checked: if(res) return CURL_WRITEFUNC_ERROR at line 358,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/inet_ntop.c,58,FP,conformant-array-syntax style advisory; curl never uses C99 array params,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/inet_ntop.c,58,FP,conformant-array-syntax style advisory,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/curlx/inet_ntop.c,60,FP,"tmp is fixed-size char[sizeof(...)], not a runtime VLA",curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/inet_ntop.c,88,FP,conformant-array-syntax style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/inet_ntop.c,88,FP,conformant-array-syntax style advisory,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/curlx/inet_ntop.c,97,FP,"tmp is fixed-size array, not VLA",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/curlx/inet_ntop.c,103,FP,"words[] is fixed-size compile-time array, not VLA",curl_full_audit_0.4.35,high
INT14-C,curl,lib/curlx/inet_ntop.c,112,FP,index/shift idiom; readability advisory only,curl_full_audit_0.4.35,high
INT14-C,curl,lib/curlx/inet_ntop.c,112,FP,"src indexing plus shift; standard ISC code, readability advisory",curl_full_audit_0.4.35,high
INT13-C,curl,lib/curlx/inet_ntop.c,112,FP,"i bounded 0..15; shift operand non-negative, no UB",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curlx/inet_ntop.c,139,FP,tp=tmp takes address of array; tmp written before read via SNPRINTF path,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/inet_ntop.c,144,FP,"*tp++=':' stores a literal char, no sign extension",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/inet_ntop.c,151,FP,"*tp++=':' stores literal char, no sign extension",curl_full_audit_0.4.35,high
STR04-C,curl,lib/curlx/inet_ntop.c,166,FP,"ldigits used as byte lookup table, not a string; deliberate unsigned",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/inet_ntop.c,171,FP,assigning unsigned-char digit from table; no sign issue,curl_full_audit_0.4.35,high
EXP07-C,curl,lib/curlx/inet_ntop.c,171,FP,hex bitmask literals are self-documenting; style advisory,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/inet_ntop.c,173,FP,assigning unsigned-char table value; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/inet_ntop.c,175,FP,assigning unsigned-char table value; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/inet_ntop.c,176,FP,assigning unsigned-char table value; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/inet_ntop.c,183,FP,*tp++=':' stores literal char,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/inet_ntop.c,210,FP,conformant-array-syntax style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/inet_ntop.c,210,FP,conformant-array-syntax style advisory,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_cb_dbg.c,40,FP,static storage is zero-initialized by standard,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_cb_dbg.c,46,FP,now set by toolx_localtime or memset before use,curl_full_audit_0.4.35,high
ARR00-C,curl,src/tool_cb_dbg.c,49,FP,"hms_buf is static, not stack-local; returning it is safe",curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_cb_dbg.c,49,FP,static array zero-initialized; written via snprintf,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_cb_dbg.c,59,FP,initializer-sized const string array; explicit bounds unnecessary,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_dbg.c,68,FP,conformant-array-syntax style advisory,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_dbg.c,68,FP,conformant-array-syntax style advisory,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_dbg.c,68,FP,conformant-array-syntax style advisory,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_dbg.c,69,FP,conformant-array-syntax style advisory,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_cb_dbg.c,119,FP,fflush of trace stream; failure non-actionable in debug dump,curl_full_audit_0.4.35,med
API00-C,curl,src/tool_cb_dbg.c,128,FP,fixed libcurl DEBUGFUNCTION callback signature; data guaranteed by libcurl,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_dbg.c,129,FP,conformant-array-syntax style advisory; signature fixed by libcurl typedef,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_dbg.c,130,FP,conformant-array-syntax style advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_cb_dbg.c,130,FP,userdata signature fixed by CURLOPT_DEBUGFUNCTION typedef; const not allowed,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_cb_dbg.c,156,FP,xfer_id only read after getinfo returns 0 (success writes it),curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_cb_dbg.c,158,FP,conn_id only read after getinfo success writes it,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_cb_dbg.c,171,FP,!strcmp idiom in dispatch; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_cb_dbg.c,173,FP,!strcmp idiom; idiomatic,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_cb_dbg.c,177,FP,"trace_stream cached in global, closed by tool cleanup (trace_fopened); not leaked",curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_cb_dbg.c,177,FP,fopen result tracked in global and closed at cleanup; duplicate of above,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_cb_dbg.c,191,FP,curl CLI debug callback is single-threaded; no concurrency,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_cb_dbg.c,192,FP,single-threaded CLI trace state; no concurrency,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_gssapi.c,105,FP,signature mirrors gss_init_sec_context API; cannot add const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_gssapi.c,106,FP,actual_mech_type is gss_OID* output param matching GSS API,curl_full_audit_0.4.35,high
ENV34-C,curl,lib/curl_gssapi.c,135,FP,"getenv stored in const char* and consumed immediately, not retained",curl_full_audit_0.4.35,high
CON34-C,curl,lib/curl_gssapi.c,135,FP,test-stub getenv; single-threaded test path,curl_full_audit_0.4.35,med
MEM30-C,curl,lib/curl_gssapi.c,227,FP,curlx_free(ctx) on error path then return; not used after free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curl_gssapi.c,227,FP,ctx->have_krb5 check precedes free; no access after free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curl_gssapi.c,227,FP,"ctx members read before free, freed only on error return",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curl_gssapi.c,252,FP,ctx->creds read before curlx_free(ctx); freed then returns,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curl_gssapi.c,260,FP,ctx->sent read into snprintf before any free; no UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curl_gssapi.c,263,FP,ctx->sent read in snprintf args before freeing on error,curl_full_audit_0.4.35,high
INT00-C,curl,lib/curl_gssapi.c,276,FP,length-used guarded by if(used>=length) check at line 268,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curl_gssapi.c,278,FP,"ctx is heap (curlx_calloc), not automatic; storing it is valid",curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_gssapi.c,313,FP,"data deref'd as data->set, always valid from caller; thin dispatcher",curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_gssapi.c,313,FP,ret_flags passed through to GSS API which accepts it,curl_full_audit_0.4.35,high
CON34-C,curl,lib/curl_gssapi.c,342,FP,getenv presence-check only; debug stub path,curl_full_audit_0.4.35,med
CON34-C,curl,lib/curl_gssapi.c,378,FP,getenv presence-check; debug stub path,curl_full_audit_0.4.35,med
API05-C,curl,lib/curl_gssapi.c,390,FP,conformant-array-syntax style advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_gssapi.c,390,FP,buf is written via snprintf inside loop; not read-only,curl_full_audit_0.4.35,med
ERR02-C,curl,lib/curl_gssapi.c,406,FP,curl_msnprintf return used to advance len; bounded by guard at 405,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_gssapi.c,429,FP,data only passed to infof; caller always supplies valid handle,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_gssapi.c,432,FP,buf is mutated by display_gss_error via snprintf; cannot be const,curl_full_audit_0.4.35,high
API00-C,curl,lib/uint-table.c,35,FP,"entry_dtor is function-pointer member stored, not dereferenced unchecked",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/uint-table.c,36,FP,"entry_dtor stored into tbl; it is a callback ptr, const inapplicable",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/uint-table.c,38,FP,"tbl is struct pointer; sizeof(*tbl) is struct size, correct",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/uint-table.c,70,FP,curlx_calloc declared in curl headers; sqc header-resolution miss,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/uint-table.c,74,FP,"dest allocated nrows; copy bounded by CURLMIN(nrows,tbl->nrows)",curl_full_audit_0.4.35,high
INT32-C,curl,lib/uint-table.c,74,FP,"nrows*sizeof(void*) bounded; allocated same way, no overflow path",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/uint-table.c,77,FP,curlx_free declared in headers; resolution miss,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/uint-table.c,89,FP,curlx_free declared in headers; resolution miss,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/uint-table.c,90,FP,tbl is struct pointer; sizeof(*tbl) correct,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/uint-table.c,93,FP,"UNITTEST export; declared in header, used by test harness externally",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/uint-table.c,93,FP,UNITTEST function intentionally exported for unit tests,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/uint-table.c,101,FP,accessor signature consistency; tbl not modified but API-wide convention,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/uint-table.c,106,FP,accessor API convention; const not applied project-wide,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/uint-table.c,111,FP,accessor API convention,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/uint-table.c,116,FP,"entry stored into table row, not read-only",curl_full_audit_0.4.35,med
API00-C,curl,lib/uint-table.c,152,FP,key passed to clear_rows which bounds via CURLMIN; no overflow arithmetic,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/uint-table.c,154,FP,"no restrict pointers; single tbl arg, no overlap UB",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/uint-table.c,157,FP,tbl not modified but API convention; minor,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/uint-table.c,159,FP,key bounds-checked: (key < tbl->nrows) before rows[key],curl_full_audit_0.4.35,high
DCL13-C,curl,lib/uint-table.c,162,FP,accessor API convention,curl_full_audit_0.4.35,med
API00-C,curl,lib/uint-table.c,190,FP,last_key+1 then bounds-checked in next_at loop; no unguarded arithmetic,curl_full_audit_0.4.35,high
API05-C,curl,lib/httpsrr.c,34,FP,conformant-array-syntax style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/httpsrr.c,35,FP,conformant-array-syntax style advisory,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/httpsrr.c,57,FP,"intentional empty-then-else idiom: skip if already stored, else store",curl_full_audit_0.4.35,med
API00-C,curl,lib/httpsrr.c,71,FP,data only passed to trace macros; caller supplies valid handle,curl_full_audit_0.4.35,high
API00-C,curl,lib/httpsrr.c,71,FP,val used with vlen guards per-branch; NULL handled by length checks,curl_full_audit_0.4.35,med
API05-C,curl,lib/httpsrr.c,73,FP,conformant-array-syntax style advisory,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/httpsrr.c,96,FP,"free(hi->ipv4hints) then reassign from memdup; free-then-reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/httpsrr.c,106,FP,free then reassign echconfiglist from memdup; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/httpsrr.c,116,FP,free then reassign ipv6hints from memdup; not UAF,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/httpsrr.c,124,FP,"val[0]/val[1] reached only when vlen==2, so val non-NULL",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/httpsrr.c,125,FP,"hi->port is a scalar field, not a freed pointer",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/httpsrr.c,137,FP,"rrinfo is struct pointer; sizeof(*rrinfo) is struct size, intended",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/httpsrr.c,139,FP,sizeof(*rrinfo) correct for memset of the struct,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/httpsrr.c,140,FP,"dup is heap (curlx_memdup), not automatic storage",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/httpsrr.c,143,FP,rrinfo members are freed (mutated) by Curl_safefree; not const,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/httpsrr.c,164,FP,val may be NULL but callee guards each branch by vlen before deref,curl_full_audit_0.4.35,med
API00-C,curl,lib/httpsrr.c,167,FP,data only passed to trace macros; valid by caller contract,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/httpsrr.c,175,FP,target assigned at 183 before read at 184 within same iteration,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/httpsrr.c,187,FP,free(hinfo->target) then reassign from strdup; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/httpsrr.c,191,FP,target read in trace after successful strdup reassign; not freed,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,81,FP,prototype style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,82,FP,prototype style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,84,FP,prototype style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,91,FP,prototype style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,116,FP,prototype style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,119,FP,prototype style advisory,curl_full_audit_0.4.35,high
API02-C,curl,lib/http.h,179,FP,buf paired with blen size param present; advisory misfire,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,180,FP,prototype style advisory,curl_full_audit_0.4.35,high
API02-C,curl,lib/http.h,209,FP,s paired with len size param present; advisory misfire,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,209,FP,prototype style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,209,FP,prototype style advisory,curl_full_audit_0.4.35,high
DCL38-C,curl,lib/http.h,220,FP,method[1] is deliberate trailing struct-hack allocated with extra; curl idiom,curl_full_audit_0.4.35,med
STR31-C,curl,lib/http.h,220,FP,"method[1] is flexible-member hack, sized by allocation not a literal",curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,227,FP,prototype style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,228,FP,prototype style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,229,FP,prototype style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,230,FP,prototype style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,233,FP,prototype style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.h,234,FP,prototype style advisory,curl_full_audit_0.4.35,high
INT14-C,curl,lib/noproxy.c,61,FP,Idiomatic netmask: shift+arith on bits; readability advisory only,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/noproxy.c,77,FP,Both #ifdef arms return; all paths return a value,curl_full_audit_0.4.35,high
INT14-C,curl,lib/noproxy.c,90,FP,bits/8 and bits&7 are standard byte/bit split; advisory,curl_full_audit_0.4.35,high
INT14-C,curl,lib/noproxy.c,100,FP,Idiomatic mask construction; readability advisory only,curl_full_audit_0.4.35,high
INT34-C,curl,lib/noproxy.c,100,FP,"rest=bits&7 so 8-rest in 1..8, well within int width",curl_full_audit_0.4.35,high
API05-C,curl,lib/noproxy.c,118,FP,Conformant-array style; curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/noproxy.c,119,FP,Conformant-array style advisory; project convention,curl_full_audit_0.4.35,high
INT30-C,curl,lib/noproxy.c,124,FP,Caller guards if(tokenlen); tokenlen>=1 here,curl_full_audit_0.4.35,high
INT30-C,curl,lib/noproxy.c,125,FP,Decrement guarded by tokenlen>=1 (trailing-dot check),curl_full_audit_0.4.35,high
INT30-C,curl,lib/noproxy.c,130,FP,Decrement inside if(tokenlen && *token=='.') guard,curl_full_audit_0.4.35,high
API05-C,curl,lib/noproxy.c,148,FP,Conformant-array style advisory; project convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/noproxy.c,149,FP,Conformant-array style advisory; project convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/noproxy.c,165,FP,&slash[1] assigned to char*; no char sign-extension occurs,curl_full_audit_0.4.35,high
STR34-C,curl,lib/noproxy.c,170,FP,*slash=0 writes constant; not a sign-extending read,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/noproxy.c,201,FP,!strcmp boolean idiom; standard curl convention,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/noproxy.c,208,FP,inet_pton documented to return 1 on success; ==1 correct,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/noproxy.c,208,FP,address is inet_pton output buffer; written not read,curl_full_audit_0.4.35,high
WIN04-C,curl,lib/noproxy.c,211,FP,EncodePointer suggestion nonsensical; no function pointer stored,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/noproxy.c,220,FP,while(*p) bounded by NUL terminator of no_proxy string,curl_full_audit_0.4.35,high
API00-C,curl,lib/pingpong.c,44,FP,Internal helper; data always valid from callers,curl_full_audit_0.4.35,high
API00-C,curl,lib/pingpong.c,70,FP,Internal state machine; data always valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/pingpong.c,129,FP,Internal init; pnow always passed valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/pingpong.c,150,FP,Internal send; data always valid,curl_full_audit_0.4.35,high
INT30-C,curl,lib/pingpong.c,197,FP,Guarded by bytes_written!=write_len; bytes_written<=write_len,curl_full_audit_0.4.35,high
API00-C,curl,lib/pingpong.c,218,FP,Thin varargs wrapper; data passed through,curl_full_audit_0.4.35,high
API05-C,curl,lib/pingpong.c,234,FP,Conformant-array style advisory; project convention,curl_full_audit_0.4.35,high
API00-C,curl,lib/pingpong.c,246,FP,Internal response reader; data always valid,curl_full_audit_0.4.35,high
API05-C,curl,lib/pingpong.c,249,FP,Conformant-array style advisory; project convention,curl_full_audit_0.4.35,high
INT30-C,curl,lib/pingpong.c,290,FP,"Header byte counter; bounded by response size, not wraparound",curl_full_audit_0.4.35,high
INT30-C,curl,lib/pingpong.c,292,FP,nread_resp counter accumulating bounded read sizes,curl_full_audit_0.4.35,high
STR34-C,curl,lib/pingpong.c,301,FP,"nl-line is pointer subtraction (ptrdiff), not char conversion",curl_full_audit_0.4.35,high
STR34-C,curl,lib/pingpong.c,301,FP,line is const char* pointer; no char sign extension,curl_full_audit_0.4.35,high
API00-C,curl,lib/pingpong.c,350,FP,Internal pollset; data always valid,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/pingpong.c,351,TP,pp only read in Curl_pp_pollset; could be const (brief-cited TP),curl_full_audit_0.4.35,low
DCL13-C,curl,lib/pingpong.c,359,TP,data unused ((void)data); could be const,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/pingpong.c,360,TP,pp only read in Curl_pp_needs_flush; could be const,curl_full_audit_0.4.35,low
INT30-C,curl,lib/pingpong.c,388,FP,Guarded by written!=sendleft; written<sendleft (partial send),curl_full_audit_0.4.35,high
ARR01-C,curl,lib/pingpong.c,403,FP,"memset(pp,0,sizeof(*pp)) is correct struct-size idiom",curl_full_audit_0.4.35,high
INT33-C,curl,lib/uint-hash.c,35,FP,slots nonzero by API contract; init/callers DEBUGASSERT slots,curl_full_audit_0.4.35,med
API00-C,curl,lib/uint-hash.c,44,FP,dtor stored not derefed; NULL dtor is valid (checked later),curl_full_audit_0.4.35,high
DCL13-C,curl,lib/uint-hash.c,46,FP,"dtor is function-pointer typedef, stored into h; const inapplicable",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/uint-hash.c,60,FP,value (void*) stored into e->value as non-const; can't const,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/uint-hash.c,65,FP,curlx_malloc declared via curlx header macros; not implicit,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/uint-hash.c,65,FP,e assigned from curlx_malloc then guarded by if(e); initialized,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/uint-hash.c,71,FP,"return e points to malloc'd heap, not automatic storage",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/uint-hash.c,90,FP,curlx_free declared via curlx header; not implicit,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/uint-hash.c,95,TP,"Static helper; he only read (he->next), never written through",curl_full_audit_0.4.35,low
PRE00-C,curl,lib/uint-hash.c,110,FP,Macro args always simple pointer/scalar vars; no side effects,curl_full_audit_0.4.35,med
PRE01-C,curl,lib/uint-hash.c,110,TP,Bare h in h->table unparenthesized (inconsistent with (h)->slots),curl_full_audit_0.4.35,low
PRE12-C,curl,lib/uint-hash.c,110,FP,Multiple-eval harmless: args are simple vars without side effects,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/uint-hash.c,121,FP,curlx_calloc declared via curlx header; not implicit,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/uint-hash.c,121,FP,sizeof(*he) does not evaluate/deref he,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/uint-hash.c,173,FP,"index id%slots, slots is table size; in-bounds by construction",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/uint-hash.c,215,FP,Only h->table freed; h->size is separate live struct member,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/uint-hash.c,219,FP,Public hash-API family consistency; const breaks uniformity,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/uint-hash.c,225,FP,visit may mutate via callback; public API family signature,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/uint-hash.c,226,FP,cb is function-pointer typedef; const inapplicable,curl_full_audit_0.4.35,med
DCL37-C,curl,src/tool_main.c,69,FP,_CRT_glob is MinGW runtime-mandated name; cannot rename,curl_full_audit_0.4.35,high
DCL37-C,curl,src/tool_main.c,69,FP,Reserved-id on platform-mandated MinGW _CRT_glob,curl_full_audit_0.4.35,high
DCL36-C,curl,src/tool_main.c,70,FP,"extern decl then definition; both external linkage, not static",curl_full_audit_0.4.35,high
DCL37-C,curl,src/tool_main.c,70,FP,_CRT_glob platform-mandated; cannot rename,curl_full_audit_0.4.35,high
DCL37-C,curl,src/tool_main.c,70,FP,Reserved-id on MinGW-mandated _CRT_glob,curl_full_audit_0.4.35,high
FIO23-C,curl,src/tool_main.c,94,FP,Early error return from main; OS flushes stdout at exit,curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_main.c,111,FP,"env is curl_getenv heap copy, not getenv static buffer; free OK",curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_main.c,122,FP,"str_number advances const char** cursor, doesn't modify content",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_main.c,122,FP,"env freed at L125, after str_number; no use-after-free",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_main.c,122,FP,"p points into env which is freed later, not before",curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_main.c,124,FP,env is curl_getenv heap copy; curl_free correct,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_main.c,124,FP,env reassigned by second curl_getenv at L118; distinct allocations,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_main.c,124,FP,Distinct CURL_MEMLIMIT alloc; first env block already returned/freed,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_main.c,141,FP,wmain/main signature fixed by C standard/Windows; cannot add size,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_main.c,141,FP,Standard main argv[] signature; bounds cannot be specified,curl_full_audit_0.4.35,high
SIG00-C,curl,src/tool_main.c,178,FP,"signal(SIGPIPE,SIG_IGN): no handler, no race; portable idiom",curl_full_audit_0.4.35,med
SIG02-C,curl,src/tool_main.c,178,FP,"Ignoring SIGPIPE, not using signals for data handling",curl_full_audit_0.4.35,high
SIG34-C,curl,src/tool_main.c,178,FP,main() is not a signal handler; not called from a handler,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_main.c,197,FP,fflush(NULL) at Windows process exit; nothing actionable,curl_full_audit_0.4.35,low
PRE08-C,curl,src/tool_operhlp.c,26,FP,8.3 filename-collision advisory; irrelevant on modern systems,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_operhlp.c,63,FP,!strcmp boolean idiom; standard curl convention,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_operhlp.c,63,FP,!strcmp boolean idiom; standard curl convention,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operhlp.c,107,FP,path non-NULL (url_get succeeded); curl_free is NULL-safe anyway,curl_full_audit_0.4.35,high
EXP30-C,curl,src/tool_operhlp.c,112,FP,|| introduces sequence point; ++ptr ordered before deref,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operhlp.c,136,FP,path non-NULL here (url_get for PATH succeeded earlier),curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operhlp.c,139,FP,path non-NULL here (url_get for PATH succeeded earlier),curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operhlp.c,146,FP,curlx_free declared via curlx header; not implicit,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operhlp.c,156,FP,curlx_free declared via curlx header; not implicit,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_operhlp.c,157,FP,*inurlp=newurl assigns char*; not a char sign-extension,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operhlp.c,167,FP,curl_free is NULL-safe; path may be NULL legitimately,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_operhlp.c,186,FP,*filename=strdup(...) assigns char*; not char sign-extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_operhlp.c,204,FP,*pc=0 writes constant 0; not a sign-extending read,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_operhlp.c,210,FP,*filename=strdup(...) assigns char*; not char sign-extension,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operhlp.c,210,FP,curlx_strdup declared via curlx header; not implicit,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_operhlp.c,214,FP,*filename=strdup(...) assigns char*; not char sign-extension,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operhlp.c,214,FP,curlx_strdup declared via curlx header; not implicit,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operhlp.c,218,FP,*filename NULL-checked at line 219 before this Windows-only use,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_operhlp.c,229,FP,*filename=sanitized assigns char*; not char sign-extension,curl_full_audit_0.4.35,high
API00-C,curl,lib/asyn-base.c,70,FP,Internal pollset; data always valid from caller,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/asyn-base.c,86,FP,sockets[] is ares_getsock output buffer; filled before read,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/asyn-base.c,96,FP,sockets filled by ares_getsock at L86 before loop reads,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/asyn-base.c,122,FP,socks[] is c-ares socket array; no environment variable involved,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/asyn-base.c,123,FP,pfd[] is pollfd array; no environment variable involved,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/asyn-base.c,133,FP,pfd[i].events/revents set to 0 in same loop iter before read,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/asyn-base.c,136,FP,socks filled by ares_getsock at L130 before loop reads,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/asyn-base.c,140,FP,socks filled by ares_getsock at L130 before loop reads,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/asyn-base.c,143,FP,pfd[i].events initialized at L133 in same iteration,curl_full_audit_0.4.35,high
API00-C,curl,lib/asyn-base.c,181,FP,Internal cleanup; data always valid from callers,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/asyn-base.c,181,FP,Cleanup cycle is bounded/guarded by handle state; not unbounded recursion,curl_full_audit_0.4.35,med
MEM30-C,curl,lib/asyn-base.c,192,FP,Only hostname member freed; state.async container not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/asyn-base.c,192,FP,data->state not freed; only nested hostname pointer freed,curl_full_audit_0.4.35,high
API00-C,curl,lib/asyn-base.c,195,FP,Internal destroy; data always valid from callers,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/asyn-base.c,195,FP,Cleanup cycle bounded by handle state; not unbounded recursion,curl_full_audit_0.4.35,med
MEM31-C,curl,lib/asyn-base.c,204,FP,doh_cleanup in different function path; data not freed by it,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/asyn-base.c,206,FP,Only hostname member freed; state.async container live,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/asyn-base.c,206,FP,Curl_safefree of struct member in destructor; frees-and-nulls once,curl_full_audit_0.4.35,high
WIN04-C,curl,lib/curl_threads.c,42,FP,EncodePointer is Windows-hardening advisory; not a CERT-C violation here,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curl_threads.c,47,FP,"real_arg=ac->arg saved before free(ac); func/arg copied out, not freed memory",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_threads.c,53,FP,arg stored into struct field; opaque thread-entry contract,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/curl_threads.c,64,FP,ac guarded by if(!(ac&&t)) goto err; non-NULL here,curl_full_audit_0.4.35,high
CON04-C,curl,lib/curl_threads.c,67,FP,thread joined/detached by caller via Curl_thread_join/destroy,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/curl_threads.c,67,FP,"rc is int return code, not allocation; pthread_create misclassified",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/curl_threads.c,67,FP,"errno is errno, not allocated memory",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/curl_threads.c,70,FP,"rc is int, no allocation; goto err frees real allocs t/ac",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/curl_threads.c,70,FP,errno not an allocation,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/curl_threads.c,73,FP,t returned to caller (ownership transfer); ac freed by thunk,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/curl_threads.c,73,FP,"rc is int, not allocated",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/curl_threads.c,73,FP,errno not allocated,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/curl_threads.c,75,FP,err: label reachable via goto; not unreachable,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/curl_threads.c,78,FP,err path frees t and ac correctly; no leak,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/curl_threads.c,78,FP,"rc is int, not allocated",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/curl_threads.c,78,FP,errno not allocated,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_threads.c,102,FP,arg passed opaquely to CreateThread; not dereferenced here,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/curl_threads.c,105,FP,CreateThread args distinct (func vs arg); no restrict aliasing,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_ntlm.c,51,FP,internal callee; data->conn deref guaranteed by call contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_ntlm.c,51,FP,header checked via checkprefix before use,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_ntlm.c,114,FP,internal API; DEBUGASSERT(data) and conn always valid,curl_full_audit_0.4.35,high
MEM03-C,curl,lib/http_ntlm.c,127,FP,"passwdp is const pointer into data state, not a writable local buffer",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_ntlm.c,167,FP,"authp=&data->state.authhost/authproxy, never NULL",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_ntlm.c,192,FP,"state=&conn->...ntlm_state, address of member, non-NULL",curl_full_audit_0.4.35,high
CON43-C,curl,lib/http_ntlm.c,195,FP,single-threaded local switch on *state; no double-fetch race,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_ntlm.c,203,FP,distinct accessor calls in one arg list; no shared-object unsequenced mod,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_ntlm.c,206,FP,allocuserpwd is &member address; *allocuserpwd freed/reassigned safely,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_ntlm.c,207,FP,char** write of maprintf result; no char sign-extension,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_ntlm.c,208,FP,base64 non-NULL after successful base64_encode (result==0),curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_ntlm.c,221,FP,distinct accessors; no unsequenced side effects,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_ntlm.c,221,FP,"base64 freshly allocated in this case; separate switch arm, not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_ntlm.c,222,FP,base64 valid here; analyzer conflated two switch cases,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_ntlm.c,225,FP,char** assignment; no sign extension,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_ntlm.c,225,FP,base64 used before its free at line 227; not yet freed,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_ntlm.c,226,FP,base64 non-NULL after successful encode,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_ntlm.c,227,FP,single free per arm; no double-free,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/socketpair.c,154,FP,addrlen=sizeof(a.inaddr) init; a zeroed by memset at 162,curl_full_audit_0.4.35,high
STR31-C,curl,lib/socketpair.c,156,FP,struct pollfd pfd[1] not a string buffer,curl_full_audit_0.4.35,high
INT18-C,curl,lib/socketpair.c,175,FP,setsockopt returns signed int; ==-1 comparison correct,curl_full_audit_0.4.35,high
INT18-C,curl,lib/socketpair.c,181,FP,setsockopt int return; comparison to -1 valid,curl_full_audit_0.4.35,high
INT18-C,curl,lib/socketpair.c,185,FP,bind returns int; ==-1 valid,curl_full_audit_0.4.35,high
POS02-C,curl,lib/socketpair.c,185,FP,loopback self-pipe helper; no privilege escalation context,curl_full_audit_0.4.35,high
POS02-C,curl,lib/socketpair.c,190,FP,local listener; no privilege drop relevant,curl_full_audit_0.4.35,high
INT18-C,curl,lib/socketpair.c,195,FP,connect returns int; ==-1 valid,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/socketpair.c,211,FP,"char check[sizeof(rnd)] is fixed-size (9), not a VLA",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/socketpair.c,212,FP,check filled by sread into p before memcmp; p=&check[0] is write target,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/socketpair.c,215,FP,rnd filled by Curl_rand before use,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/socketpair.c,253,FP,p points into check[] array; p+=nread within bounds (s tracks remaining),curl_full_audit_0.4.35,high
MSC07-C,curl,lib/socketpair.c,273,FP,error: label reachable via goto,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/socketpair.c,283,FP,Curl_wakeup_init returns on every #if branch,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/socketpair.c,310,FP,socks[2] is out-param array written by signal/consume; not const,curl_full_audit_0.4.35,high
STR31-C,curl,lib/socketpair.c,314,FP,"buf[1] init list, not string buffer needing terminator",curl_full_audit_0.4.35,high
STR31-C,curl,lib/socketpair.c,316,FP,"const char buf[1] sentinel byte, not a string",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/socketpair.c,337,FP,socks array is read AND state cleared by destroy; not const,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/curl_share.c,33,FP,curl_share_init is public exported API; must have external linkage,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/curl_share.c,35,FP,curlx_calloc declared in curlx headers/macros,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/curl_share.c,42,FP,curlx_free declared via curlx header,curl_full_audit_0.4.35,high
CON34-C,curl,lib/curl_share.c,49,FP,"getenv under DEBUGBUILD only; debug-build diagnostic, not production race",curl_full_audit_0.4.35,med
DCL15-C,curl,lib/curl_share.c,58,FP,curl_share_setopt is public API,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/curl_share.c,99,FP,"break ends case; following text is next case label, reachable",curl_full_audit_0.4.35,high
INT34-C,curl,lib/curl_share.c,144,FP,type is bounded CURL_LOCK_DATA_* enum; shift within int width,curl_full_audit_0.4.35,med
INT13-C,curl,lib/curl_share.c,144,FP,signed enum shift idiom on bounded small values,curl_full_audit_0.4.35,med
INT13-C,curl,lib/curl_share.c,150,FP,signed enum operand; bounded values,curl_full_audit_0.4.35,med
INT34-C,curl,lib/curl_share.c,150,FP,shift by bounded enum type; safe,curl_full_audit_0.4.35,med
MSC07-C,curl,lib/curl_share.c,166,FP,"break at case end; next is case label, reachable",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/curl_share.c,221,FP,curl_share_cleanup is public API,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/curl_share.c,264,FP,curlx_free declared in header,curl_full_audit_0.4.35,high
INT13-C,curl,lib/curl_share.c,277,FP,signed enum & idiom; bounded,curl_full_audit_0.4.35,med
INT34-C,curl,lib/curl_share.c,277,FP,shift by bounded enum; safe,curl_full_audit_0.4.35,med
INT13-C,curl,lib/curl_share.c,293,FP,signed enum & idiom; bounded,curl_full_audit_0.4.35,med
INT34-C,curl,lib/curl_share.c,293,FP,shift by bounded enum; safe,curl_full_audit_0.4.35,med
API00-C,curl,lib/http_negotiate.c,49,FP,internal API; conn/data guaranteed valid by callers,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_negotiate.c,49,FP,conn always valid in auth call path,curl_full_audit_0.4.35,high
MEM03-C,curl,lib/http_negotiate.c,57,FP,"passwdp is const pointer into conn, not a writable buffer to scrub",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http_negotiate.c,127,FP,result assigned by Curl_ssl_get_channel_binding at 125 before test,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_negotiate.c,151,FP,internal API; data valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_negotiate.c,151,FP,conn valid by call contract,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_negotiate.c,178,FP,"authp=&data->state.auth*, address of member, non-NULL",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_negotiate.c,180,FP,"state=&conn->...negotiate_state, non-NULL member address",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_negotiate.c,216,FP,maprintf NULL-safe for %s; userp NULL checked at 231,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_negotiate.c,220,FP,free then immediate reassign of aptr field; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_negotiate.c,220,FP,"data->state is struct member; free-reassign of its field, no UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_negotiate.c,221,FP,assigning userp to freed slot; reassignment not access,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_negotiate.c,221,FP,member reassignment after free; no UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_negotiate.c,225,FP,non-proxy branch: free then reassign userpwd; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_negotiate.c,225,FP,member field reassignment; no UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_negotiate.c,226,FP,reassign aptr.userpwd=userp after free; valid,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_negotiate.c,226,FP,member reassignment after free; no UAF,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/http1.c,38,FP,sizeof(*parser) on pointer-to-struct yields struct size correctly; not decayed array,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http1.c,47,FP,curlx_dyn_free(&scratch) then req=NULL; scratch not accessed after,curl_full_audit_0.4.35,high
API05-C,curl,lib/http1.c,78,FP,curl never uses C99 array-param syntax; stylistic advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http1.c,95,FP,stylistic array-syntax advisory; convention,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http1.c,145,FP,!strncmp method-match idiom; explicit comparison present in expr,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/http1.c,149,FP,"memchr(line,' ',line_len) bounded by line_len; valid",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http1.c,195,FP,"!strncmp(""CONNECT"",...) idiom; bounded",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/http1.c,208,FP,tmp[H1_MAX_URL_LEN] for URL target with bounds check; no env var,curl_full_audit_0.4.35,high
API00-C,curl,lib/http1.c,262,FP,buflen used as loop bound with decrement guard; no overflow arithmetic,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/http1.c,262,FP,all paths reach out: return result,curl_full_audit_0.4.35,high
API05-C,curl,lib/http1.c,263,FP,array-syntax style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http1.c,264,FP,array-syntax style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http1.c,265,FP,array-syntax style advisory,curl_full_audit_0.4.35,high
API00-C,curl,lib/http1.c,317,FP,internal write head; req valid by caller (parser->req),curl_full_audit_0.4.35,high
MSC37-C,curl,lib/http1.c,317,FP,single return path via out label returns result,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http1.c,323,FP,req->method deref; req always non-NULL from caller's parser->req,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/slist.c,29,FP,slist_get_last returns the (non-const) traversed node; cannot be const,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/slist.c,42,FP,"returns item pointing into caller's list, not a local",curl_full_audit_0.4.35,high
API00-C,curl,lib/slist.c,54,FP,"DEBUGASSERT(data); data ownership taken, not deref'd as NULL",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/slist.c,62,FP,curlx_malloc declared via curlx header/macro,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/slist.c,71,FP,"new_item is malloc'd heap pointer, not automatic storage",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/slist.c,74,FP,list non-NULL here (early-returned at 70); last non-NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/slist.c,85,FP,curl_slist_append handles NULL list (Curl_slist_append_nodup returns new),curl_full_audit_0.4.35,high
DCL15-C,curl,lib/slist.c,85,FP,curl_slist_append is public exported API,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/slist.c,87,FP,curlx_strdup declared via curlx header,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/slist.c,94,FP,curlx_free declared via header,curl_full_audit_0.4.35,high
API00-C,curl,lib/slist.c,104,FP,while(inlist) loop is NULL-safe (zero iterations),curl_full_audit_0.4.35,high
DCL13-C,curl,lib/slist.c,104,FP,inlist traversed and ->data read; could be const but signature is API; advisory,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/slist.c,124,FP,curl_slist_free_all is public exported API,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/slist.c,124,FP,public API used by external callers; cannot be static,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/slist.c,124,FP,list nodes freed (modified/freed); cannot be const,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/slist.c,136,FP,curlx_free declared via header,curl_full_audit_0.4.35,high
MSC41-C,curl,lib/urldata.h,96,FP,"ftp@example.com is conventional anonymous-FTP password, public well-known string, not a secret",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/urldata.h,218,FP,[adv] GOOD_EASY_HANDLE evaluates x multiple times; inline fn would be safer (advisory),curl_full_audit_0.4.35,adversarial-flip
PRE12-C,curl,lib/urldata.h,218,FP,"[adv] macro evaluates x multiple times; unsafe-macro pattern, side-effect arg would double-eval",curl_full_audit_0.4.35,adversarial-flip
PRE00-C,curl,lib/urldata.h,222,FP,[adv] non-DEBUG GOOD_EASY_HANDLE also evaluates x twice,curl_full_audit_0.4.35,adversarial-flip
PRE12-C,curl,lib/urldata.h,222,FP,[adv] macro evaluates x twice; genuine multiple evaluation,curl_full_audit_0.4.35,adversarial-flip
PRE00-C,curl,lib/urldata.h,581,FP,[adv] CUR_IP_QUAD_HAS_PORTS evaluates x->transport three times,curl_full_audit_0.4.35,adversarial-flip
PRE12-C,curl,lib/urldata.h,581,FP,[adv] x evaluated 3x; multiple evaluation present,curl_full_audit_0.4.35,adversarial-flip
PRE00-C,curl,lib/urldata.h,648,FP,[adv] CONN_SOCK_IDX_VALID evaluates i twice,curl_full_audit_0.4.35,adversarial-flip
PRE12-C,curl,lib/urldata.h,648,FP,[adv] i evaluated twice; multiple evaluation present,curl_full_audit_0.4.35,adversarial-flip
PRE00-C,curl,lib/urldata.h,732,FP,[adv] CURL_CONN_HOST_DISPNAME evaluates c many times,curl_full_audit_0.4.35,adversarial-flip
PRE12-C,curl,lib/urldata.h,732,FP,[adv] c evaluated multiple times across ternary chain,curl_full_audit_0.4.35,adversarial-flip
PRE00-C,curl,lib/urldata.h,738,FP,[adv] non-proxy CURL_CONN_HOST_DISPNAME evaluates c twice,curl_full_audit_0.4.35,adversarial-flip
PRE12-C,curl,lib/urldata.h,738,FP,[adv] c evaluated twice; multiple evaluation present,curl_full_audit_0.4.35,adversarial-flip
API01-C,curl,lib/urldata.h,1396,FP,"char *str[] is a pointer array, not a char buffer; no overflow into blobs",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/urldata.h,1594,FP,[adv] IS_MIME_POST evaluates a twice (a->set.mimepostp),curl_full_audit_0.4.35,adversarial-flip
PRE12-C,curl,lib/urldata.h,1594,FP,[adv] a evaluated twice; multiple evaluation present,curl_full_audit_0.4.35,adversarial-flip
EXP33-C,curl,lib/vtls/keylog.c,44,FP,static FILE* is zero/NULL-initialized by C standard; not uninitialized,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/vtls/keylog.c,47,FP,closed by paired Curl_tls_keylog_close() via curlx_fclose; module-level lifecycle,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/vtls/keylog.c,47,FP,fopen not open(); duplicate misclassified fd-leak; closed by paired close fn,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/vtls/keylog.c,47,FP,name from curl_getenv (malloc'd copy); fopen does not modify it,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/vtls/keylog.c,59,FP,Curl_safefree correctly frees the curl_getenv-allocated copy,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/keylog.c,66,FP,static FILE* default-initialized to NULL; not uninitialized,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/keylog.c,74,FP,static FILE* default-initialized to NULL,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/keylog.c,83,FP,static FILE* default-initialized to NULL,curl_full_audit_0.4.35,high
STR31-C,curl,lib/vtls/keylog.c,93,FP,NUL appended manually at L97 after bounds check linelen<=sizeof(buf)-2,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/vtls/keylog.c,97,FP,guarded: linelen<=254 then ++ <=255; buf[255] in-bounds,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/keylog.c,105,FP,advisory conformant-array style; curl convention never uses it,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/keylog.c,106,FP,"CLIENT_RANDOM_SIZE is a macro constant, not a later-declared param",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/keylog.c,107,FP,advisory conformant-array style,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/vtls/keylog.c,110,FP,line[] sized by compile-time constants; function does not use getenv,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vtls/keylog.c,110,FP,array sized entirely by macro constants; not a VLA,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/keylog.c,114,FP,static FILE* default-initialized to NULL,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_paramhlp.h,30,FP,file2string out-param char**; no array-capacity arg meaningful,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_paramhlp.h,30,FP,"FILE* is a handle, not a sized array",curl_full_audit_0.4.35,high
API02-C,curl,src/tool_paramhlp.h,38,FP,file2memory already returns size via size_t* out-param,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_paramhlp.h,38,FP,"FILE* is a handle, not a sized array",curl_full_audit_0.4.35,high
API03-C,curl,src/tool_paramhlp.h,38,FP,param-ordering style note; not an actionable CERT violation,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_paramhlp.h,38,FP,advisory conformant-array style,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_paramhlp.h,39,FP,file2memory_range returns size via out-param,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_paramhlp.h,39,FP,"FILE* handle, not sized array",curl_full_audit_0.4.35,high
API03-C,curl,src/tool_paramhlp.h,39,FP,param-ordering style note; not actionable,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_paramhlp.h,39,FP,advisory conformant-array style,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_paramhlp.h,42,FP,str2num takes NUL-terminated string + out long*; no size needed,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_paramhlp.h,43,FP,str2unum NUL-terminated string; no size arg meaningful,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_paramhlp.h,44,FP,oct2nummax NUL-terminated string; no size arg meaningful,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_paramhlp.h,45,FP,str2unummax NUL-terminated string; no size arg meaningful,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_paramhlp.h,46,FP,secs2ms NUL-terminated string; no size arg meaningful,curl_full_audit_0.4.35,high
API02-C,curl,src/tool_paramhlp.h,47,FP,proto2num char** out-param; no array-capacity arg meaningful,curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.c,100,FP,curl never uses C99 array-param syntax; advisory style,curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.c,102,FP,advisory array-syntax style; not applicable,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/hash.c,108,FP,curlx_malloc declared in curl headers/memdebug,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/hash.c,117,FP,"he is heap from curlx_malloc, not automatic storage",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/hash.c,138,FP,curlx_free declared in curl headers,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/hash.c,143,FP,static helper; curl does not follow const-param convention,curl_full_audit_0.4.35,low
PRE00-C,curl,lib/hash.c,158,FP,[adv] CURL_HASH_SLOT multiply-evaluates x in rvalue context,curl_full_audit_0.4.35,adversarial-flip
PRE01-C,curl,lib/hash.c,158,FP,x only used as x->table/(x)->; precedence-safe,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/hash.c,158,FP,[adv] x evaluated multiple times in macro body,curl_full_audit_0.4.35,adversarial-flip
API05-C,curl,lib/hash.c,161,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.c,161,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/hash.c,170,FP,curlx_calloc declared in curl headers,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hash.c,186,FP,he ownership transferred via hash_elem_link into table,curl_full_audit_0.4.35,high
API00-C,curl,lib/hash.c,202,FP,thin wrapper to Curl_hash_add2; never derefs p itself,curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.c,202,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.c,202,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.c,212,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.c,238,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/hash.c,245,FP,hash_func returns %slots; index always in-bounds,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/hash.c,270,FP,h->size is struct member; only h->table freed at 268,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/hash.c,295,FP,exported API; curl does not const-qualify hash params,curl_full_audit_0.4.35,low
EXP33-C,curl,lib/hash.c,312,FP,he assigned at 316 before any use,curl_full_audit_0.4.35,high
EXP40-C,curl,lib/hash.c,312,FP,anchor points to mutable table slot; no const violation,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/hash.c,315,FP,"comp is a function-pointer parameter, not undeclared fn",curl_full_audit_0.4.35,high
API00-C,curl,lib/hash.c,326,FP,key_length used only as loop bound; no overflow path,curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.c,326,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/hash.c,326,FP,key not modified but exported hash_function-shaped API,curl_full_audit_0.4.35,low
DCL00-C,curl,lib/hash.c,330,FP,"h is the accumulator, modified at 334-335",curl_full_audit_0.4.35,high
STR34-C,curl,lib/hash.c,333,FP,"char-deref sign-extension; categorical, harmless hash mixing",curl_full_audit_0.4.35,med
STR34-C,curl,lib/hash.c,333,FP,categorical char-deref sign extension,curl_full_audit_0.4.35,med
STR34-C,curl,lib/hash.c,333,FP,categorical char-deref sign extension,curl_full_audit_0.4.35,med
INT14-C,curl,lib/hash.c,334,FP,djb2-style hash idiom mixing shift and add,curl_full_audit_0.4.35,high
INT33-C,curl,lib/hash.c,338,FP,slots always >0 (DEBUGASSERT h->slots); never called with 0,curl_full_audit_0.4.35,low
API05-C,curl,lib/hash.c,341,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/hash.c,341,FP,k1 matches comp_function typedef; const cannot be added,curl_full_audit_0.4.35,low
API05-C,curl,lib/hash.c,342,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/hash.c,342,FP,k2 matches comp_function typedef; const cannot be added,curl_full_audit_0.4.35,low
EXP20-C,curl,lib/hash.c,344,FP,!memcmp equality idiom,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/hash.c,350,FP,hash stored into iter->hash (non-const); exported API,curl_full_audit_0.4.35,low
ARR02-C,curl,src/tool_help.c,41,FP,initializer-sized array; idiomatic and correct,curl_full_audit_0.4.35,high
INT18-C,curl,src/tool_help.c,91,FP,reached only after longdesc<=cols check; no underflow,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_help.c,158,FP,internal callers always pass valid ctx,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_help.c,158,FP,internal callers always pass valid trigger,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_help.c,158,FP,internal callers always pass valid arg,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_help.c,158,FP,internal callers always pass valid endarg,curl_full_audit_0.4.35,high
ARR01-C,curl,src/tool_help.c,169,FP,"ctx->rbuf is real array struct member, not decayed param",curl_full_audit_0.4.35,high
ARR01-C,curl,src/tool_help.c,170,FP,"ctx->rbuf is real array struct member, not decayed param",curl_full_audit_0.4.35,high
ARR01-C,curl,src/tool_help.c,173,FP,"ctx->rbuf is real array struct member, not decayed param",curl_full_audit_0.4.35,high
API00-C,curl,src/tool_help.c,176,FP,buf iterated by index over len; internal callers valid,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_help.c,176,FP,internal callers always pass valid ctx,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_help.c,176,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
INT32-C,curl,src/tool_help.c,182,FP,tlen=strlen of fixed nonzero literal; bounded,curl_full_audit_0.4.35,low
EXP20-C,curl,src/tool_help.c,184,FP,!memcmp equality idiom,curl_full_audit_0.4.35,high
INT32-C,curl,src/tool_help.c,190,FP,flen=strlen of fixed nonzero literal; bounded,curl_full_audit_0.4.35,low
EXP20-C,curl,src/tool_help.c,192,FP,!memcmp equality idiom,curl_full_audit_0.4.35,high
INT32-C,curl,src/tool_help.c,200,FP,elen=strlen of fixed nonzero literal; bounded,curl_full_audit_0.4.35,low
EXP20-C,curl,src/tool_help.c,202,FP,!memcmp equality idiom,curl_full_audit_0.4.35,high
ARR01-C,curl,src/tool_help.c,206,FP,"ctx->obuf is real array struct member, not decayed param",curl_full_audit_0.4.35,high
ARR01-C,curl,src/tool_help.c,207,FP,"ctx->obuf is real array struct member, not decayed param",curl_full_audit_0.4.35,high
ARR01-C,curl,src/tool_help.c,214,FP,"ctx->obuf is real array struct member, not decayed param",curl_full_audit_0.4.35,high
ARR01-C,curl,src/tool_help.c,215,FP,"ctx->obuf is real array struct member, not decayed param",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_help.c,258,FP,categorical char-pointer deref sign-extension,curl_full_audit_0.4.35,med
EXP20-C,curl,src/tool_help.c,260,FP,!strncmp prefix-match idiom,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_help.c,261,FP,lookup points into string buffer; valid pointer arithmetic,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_help.c,329,FP,builtin assigned in for-init before deref,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_help.c,329,FP,*builtin is loop guard; non-null when dereferenced,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_help.c,333,FP,categorical char-deref sign extension,curl_full_audit_0.4.35,med
STR34-C,curl,src/tool_help.c,333,FP,categorical char-deref sign extension,curl_full_audit_0.4.35,med
EXP20-C,curl,src/tool_help.c,337,FP,!strcmp equality idiom,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_help.c,338,FP,categorical char-deref sign extension,curl_full_audit_0.4.35,med
STR34-C,curl,src/tool_help.c,338,FP,categorical char-deref sign extension,curl_full_audit_0.4.35,med
DCL31-C,curl,src/tool_help.c,363,FP,curlx_malloc declared in curl headers,curl_full_audit_0.4.35,high
INT32-C,curl,src/tool_help.c,365,FP,feature_count small fixed build-time count; no overflow,curl_full_audit_0.4.35,med
EXP05-C,curl,src/tool_help.c,365,FP,"cast on own malloc'd feat_ext buffer; deliberate, no violation",curl_full_audit_0.4.35,med
EXP05-C,curl,src/tool_help.c,365,FP,cast on own malloc'd feat_ext buffer; deliberate,curl_full_audit_0.4.35,med
EXP05-C,curl,src/tool_help.c,372,FP,cast on own malloc'd feat_ext buffer for qsort,curl_full_audit_0.4.35,med
DCL31-C,curl,src/tool_help.c,378,FP,curlx_free declared in curl headers,curl_full_audit_0.4.35,high
EXP05-C,curl,src/tool_help.c,378,FP,cast on own malloc'd feat_ext buffer for free,curl_full_audit_0.4.35,med
API02-C,curl,lib/cfilters.h,250,FP,len size already paired with buf; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.h,251,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
API02-C,curl,lib/cfilters.h,253,FP,len already specifies buffer size; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.h,254,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.h,254,FP,"pnread is an out-parameter, written by callee",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.h,260,FP,"input_pending is an out-parameter, written by callee",curl_full_audit_0.4.35,high
API02-C,curl,lib/cfilters.h,263,FP,"pres1 is scalar out-param, not array; advisory",curl_full_audit_0.4.35,high
API02-C,curl,lib/cfilters.h,321,FP,len already specifies buffer size; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.h,322,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
API02-C,curl,lib/cfilters.h,324,FP,len already specifies buffer size; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.h,325,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.h,325,FP,"pnread is an out-parameter, written by callee",curl_full_audit_0.4.35,high
API02-C,curl,lib/cfilters.h,498,FP,len already specifies buffer size; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.h,498,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.h,499,FP,"pnread is an out-parameter, written by callee",curl_full_audit_0.4.35,high
API02-C,curl,lib/cfilters.h,506,FP,len already specifies buffer size; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.h,507,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
API02-C,curl,lib/cfilters.h,515,FP,maxlen specifies size; advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.h,519,FP,"pnread is an out-parameter, written by callee",curl_full_audit_0.4.35,high
API02-C,curl,lib/cfilters.h,526,FP,blen specifies size; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.h,529,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.h,559,FP,"input_pending is an out-parameter, written by callee",curl_full_audit_0.4.35,high
API02-C,curl,lib/cfilters.h,580,FP,"pport is scalar out-param, not array; advisory",curl_full_audit_0.4.35,high
API02-C,curl,lib/cfilters.h,609,FP,len already specifies buffer size; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.h,610,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.h,610,FP,"pnread is an out-parameter, written by callee",curl_full_audit_0.4.35,high
API02-C,curl,lib/cfilters.h,616,FP,len already specifies buffer size; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.h,617,FP,advisory array-syntax style,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/cfilters.h,655,FP,"CF_DATA_SAVE statement macro; cf/data are lvalue args, harmless",curl_full_audit_0.4.35,low
PRE01-C,curl,lib/cfilters.h,655,FP,data used inside cast; parenthesization moot,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/cfilters.h,655,FP,save evaluated multiple times but it is a plain lvalue,curl_full_audit_0.4.35,low
PRE00-C,curl,lib/cfilters.h,663,FP,"CF_DATA_RESTORE statement macro; cf is lvalue arg, harmless",curl_full_audit_0.4.35,low
PRE12-C,curl,lib/cfilters.h,663,FP,cf is a plain lvalue; multiple eval harmless,curl_full_audit_0.4.35,low
PRE00-C,curl,lib/cfilters.h,672,FP,"CF_DATA_SAVE non-debug variant; lvalue args, harmless",curl_full_audit_0.4.35,low
PRE01-C,curl,lib/cfilters.h,672,FP,data used inside cast; parenthesization moot,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/cfilters.h,672,FP,cf is a plain lvalue; multiple eval harmless,curl_full_audit_0.4.35,low
PRE00-C,curl,lib/cfilters.h,685,FP,"CF_DATA_CURRENT ternary macro; cf is lvalue, harmless",curl_full_audit_0.4.35,low
PRE12-C,curl,lib/cfilters.h,685,FP,cf evaluated twice but is a plain lvalue,curl_full_audit_0.4.35,low
API05-C,curl,lib/multi_ev.c,58,FP,hash callback signature fixed by Curl_hash typedef; no C99 array syntax in curl,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi_ev.c,58,FP,hash-func callback signature fixed by typedef; cannot add const,curl_full_audit_0.4.35,high
API05-C,curl,lib/multi_ev.c,65,FP,hash compare callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi_ev.c,65,FP,hash compare callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/multi_ev.c,66,FP,hash compare callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi_ev.c,66,FP,hash compare callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi_ev.c,78,FP,curlx_free declared in curlx header; sqc preprocessor blindness,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/multi_ev.c,101,FP,"returns 'there' which points to hash-stored heap entry, not a local",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi_ev.c,105,FP,curlx_calloc declared in curlx header,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/multi_ev.c,112,FP,idiomatic !Curl_hash_add boolean success test,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/multi_ev.c,117,FP,"returns 'check', a calloc'd heap pointer, not a local's address",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi_ev.c,132,TP,"static helper, data only read (data->mid); const-qualifiable",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/multi_ev.c,137,TP,"static helper, e only read (e->conn); const-qualifiable",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/multi_ev.c,138,TP,"static helper, conn only compared not modified; const-qualifiable",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/multi_ev.c,144,TP,"static helper, data only read (data->mid)",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/multi_ev.c,152,FP,"[adv] conn pointer itself not modified, only stored; const param valid",curl_full_audit_0.4.35,adversarial-flip
DCL13-C,curl,lib/multi_ev.c,164,TP,"static helper, data only read",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/multi_ev.c,173,TP,"static helper, conn only compared not modified",curl_full_audit_0.4.35,med
INT14-C,curl,lib/multi_ev.c,253,FP,"DEBUGASSERT readers+writers; readability advisory, no defect",curl_full_audit_0.4.35,high
API05-C,curl,lib/multi_ev.c,431,FP,hash dtor callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi_ev.c,431,FP,hash dtor callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/multi_ev.c,431,FP,hash dtor callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi_ev.c,438,FP,curlx_free declared in curlx header,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/multi_ev.c,438,FP,"single free of ps in dtor; no prior free, not a double-free",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/multi_ev.c,451,FP,"returns ps from Curl_pollset_create (heap), not a local address",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/multi_ev.c,463,FP,"returns ps from Curl_pollset_create (heap), not a local address",curl_full_audit_0.4.35,high
DCL00-C,curl,lib/multi_ev.c,489,FP,r is CURLcode return checked then reused; const-suggestion is noise,curl_full_audit_0.4.35,med
API00-C,curl,lib/multi_ev.c,520,FP,thin wrapper forwarding to mev_assess which null-checks multi/data,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi_ev.c,526,FP,thin wrapper to mev_assess; internal invariant data non-NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi_ev.c,526,FP,thin wrapper to mev_assess; conn may legitimately be NULL and handled,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi_ev.c,550,FP,"internal API, multi always valid; matches curl convention",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/multi_ev.c,552,FP,void *user_data stored into e->user_data (non-const); const invalid,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/multi_ev.c,554,FP,e is a struct pointer return; const-noise advisory,curl_full_audit_0.4.35,med
API00-C,curl,lib/multi_ev.c,561,FP,"internal API, multi always valid",curl_full_audit_0.4.35,med
API00-C,curl,lib/multi_ev.c,596,FP,"internal API, multi always valid",curl_full_audit_0.4.35,med
API00-C,curl,lib/multi_ev.c,596,FP,data passed through to mev_forget_socket; internal invariant,curl_full_audit_0.4.35,med
API00-C,curl,lib/multi_ev.c,602,FP,data->conn DEBUGASSERT only; internal invariant non-NULL,curl_full_audit_0.4.35,med
API00-C,curl,lib/multi_ev.c,612,FP,conn forwarded to mev_assess (NULL-tolerant); internal invariant,curl_full_audit_0.4.35,med
API05-C,curl,lib/progress.c,38,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/progress.c,39,FP,curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/progress.c,88,FP,curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/progress.c,89,FP,curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/progress.c,96,FP,unit[] initialized with explicit element list incl NUL; idiomatic,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/progress.c,171,FP,[adv] data only read; const-qualifiable (returns const ptr into data),curl_full_audit_0.4.35,adversarial-flip
DCL30-C,curl,lib/progress.c,176,FP,"pnow points into data->multi/progress, not a local; valid lifetime",curl_full_audit_0.4.35,high
API00-C,curl,lib/progress.c,191,FP,"internal API, data always valid per curl invariant",curl_full_audit_0.4.35,high
API00-C,curl,lib/progress.c,207,FP,"internal API, data always valid",curl_full_audit_0.4.35,high
API00-C,curl,lib/progress.c,218,FP,"internal API, data always valid",curl_full_audit_0.4.35,high
API00-C,curl,lib/progress.c,224,FP,"internal API, data always valid",curl_full_audit_0.4.35,high
API00-C,curl,lib/progress.c,232,FP,"internal API, data always valid",curl_full_audit_0.4.35,high
API00-C,curl,lib/progress.c,328,FP,"internal API, data always valid",curl_full_audit_0.4.35,high
API00-C,curl,lib/progress.c,342,FP,"internal API, data always valid",curl_full_audit_0.4.35,high
API00-C,curl,lib/progress.c,361,FP,"internal API, data always valid",curl_full_audit_0.4.35,high
API00-C,curl,lib/progress.c,366,FP,"internal API, data always valid",curl_full_audit_0.4.35,high
API00-C,curl,lib/progress.c,378,FP,"internal API, data always valid",curl_full_audit_0.4.35,high
INT33-C,curl,lib/progress.c,404,FP,"guarded by 'else if(us>=1000000)' so us/1000000>=1, never zero",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/progress.c,410,FP,data is mutated via Curl_expire/state writes; cannot be const,curl_full_audit_0.4.35,med
INT33-C,curl,lib/progress.c,434,FP,CURL_SPEED_RECORDS is a nonzero compile-time constant,curl_full_audit_0.4.35,high
INT33-C,curl,lib/progress.c,461,FP,CURL_SPEED_RECORDS nonzero compile-time constant,curl_full_audit_0.4.35,high
INT10-C,curl,lib/progress.c,461,FP,(i_latest+1) small nonneg int mod positive const; no negative remainder,curl_full_audit_0.4.35,high
FLP03-C,curl,lib/progress.c,475,FP,"duration_us clamped >=1; double division benign, advisory",curl_full_audit_0.4.35,med
FLP34-C,curl,lib/progress.c,475,FP,curl_off_t->double widening within range; advisory,curl_full_audit_0.4.35,med
FLP34-C,curl,lib/progress.c,475,FP,curl_off_t->double widening within range; advisory,curl_full_audit_0.4.35,med
INT33-C,curl,lib/progress.c,497,FP,"guarded by 'if(total>10000)' so total/100>=100, never zero",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/progress.c,503,TP,"static helper, d only read (speed/total_size/cur_size); const-qualifiable",curl_full_audit_0.4.35,med
INT33-C,curl,lib/progress.c,510,FP,guarded by '(d->speed > 0)'; never zero,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/progress.c,515,FP,"data heavily mutated (p->headers_out, progress fields); not const",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/progress.c,573,FP,"max6out calls write to distinct max6[N] buffers; no shared state, defined",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/progress.c,579,FP,max6out fills the buffer (snprintf) before returning the ptr that is read,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/progress.c,599,FP,"best-effort fflush of progress display; intentional ignore, idiomatic",curl_full_audit_0.4.35,med
FLP34-C,curl,lib/progress.c,635,FP,curl_off_t->double for deprecated callback; in-range widening advisory,curl_full_audit_0.4.35,med
FLP34-C,curl,lib/progress.c,636,FP,in-range widening advisory,curl_full_audit_0.4.35,med
FLP34-C,curl,lib/progress.c,637,FP,in-range widening advisory,curl_full_audit_0.4.35,med
FLP34-C,curl,lib/progress.c,638,FP,in-range widening advisory,curl_full_audit_0.4.35,med
API00-C,curl,lib/progress.c,663,FP,"internal API, data always valid",curl_full_audit_0.4.35,high
API00-C,curl,lib/progress.c,668,FP,"internal API, data always valid",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/rand.c,54,FP,all #if/#elif/#else branches return; sqc preprocessor blindness,curl_full_audit_0.4.35,high
API05-C,curl,lib/rand.c,54,FP,curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/rand.c,56,FP,length is caller-contract param for output buffer; documented API,curl_full_audit_0.4.35,high
CON07-C,curl,lib/rand.c,88,FP,"weak non-crypto fallback statics; benign race, not a real defect curl acts on",curl_full_audit_0.4.35,low
API05-C,curl,lib/rand.c,89,FP,curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/rand.c,108,FP,length is the documented output-buffer size param,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/rand.c,126,FP,r = randseed = expr is well-sequenced single assignment chain,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/rand.c,127,FP,r assigned on line 126 before use; not uninitialized,curl_full_audit_0.4.35,high
FIO50-C,curl,lib/rand.c,127,FP,"r is unsigned int, not a FILE stream; total misfire",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/rand.c,127,FP,"r is unsigned int, not a FILE stream; total misfire",curl_full_audit_0.4.35,high
ARR38-C,curl,lib/rand.c,128,FP,length is documented output-buffer size param (always 4),curl_full_audit_0.4.35,high
CON07-C,curl,lib/rand.c,135,FP,DEBUGBUILD-only env-override statics; not production threading concern,curl_full_audit_0.4.35,low
MSC37-C,curl,lib/rand.c,135,FP,both #ifdef USE_SSL branches return; preprocessor blindness,curl_full_audit_0.4.35,high
ENV34-C,curl,lib/rand.c,140,FP,"getenv result used immediately (strlen/memcpy), no later getenv overwrite",curl_full_audit_0.4.35,high
ERR33-C,curl,lib/rand.c,140,FP,return IS checked: 'if(force_entropy)' on next line,curl_full_audit_0.4.35,high
CON34-C,curl,lib/rand.c,140,FP,"DEBUGBUILD-only path, value used immediately; thread advisory n/a",curl_full_audit_0.4.35,med
CON03-C,curl,lib/rand.c,143,FP,DEBUGBUILD-only static seed flag; not a production sync concern,curl_full_audit_0.4.35,low
STR34-C,curl,lib/rand.c,147,FP,strlen(force_entropy) takes char*; no sign-extension; misfire,curl_full_audit_0.4.35,high
INT30-C,curl,lib/rand.c,155,FP,unsigned wrap is defined and intended for the PRNG seed,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/rand.c,166,FP,rnd is unsigned int*; sizeof(*rnd)=4 is correct and intended,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/rand.c,168,FP,rnd is unsigned int*; sizeof(*rnd)=4 is correct and intended,curl_full_audit_0.4.35,high
API00-C,curl,lib/rand.c,187,FP,"data documented to be NULL-able; not deref'd directly, passed to randit",curl_full_audit_0.4.35,high
API05-C,curl,lib/rand.c,191,FP,curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/rand.c,191,FP,"rnd is the output buffer, written via *rnd++; cannot be const",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/rand.c,200,FP,loop bounded by num counter; not unbounded,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/rand.c,208,FP,inner loop bounded by left counter; not unbounded,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/rand.c,209,FP,r set by randit() before write; error path returns early,curl_full_audit_0.4.35,high
API00-C,curl,lib/rand.c,225,FP,data documented NULL-able and passed onward; rnd output buffer,curl_full_audit_0.4.35,high
API00-C,curl,lib/rand.c,225,FP,"rnd is output buffer, written by Curl_hexencode; size validated above",curl_full_audit_0.4.35,high
API05-C,curl,lib/rand.c,225,FP,curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
INT14-C,curl,lib/rand.c,237,FP,num&1 / num/2 readability advisory; no defect,curl_full_audit_0.4.35,high
API00-C,curl,lib/rand.c,261,FP,"data documented NULL-able, passed to randit; not deref'd directly",curl_full_audit_0.4.35,high
API05-C,curl,lib/rand.c,261,FP,curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/rand.c,265,FP,"alnum is file-scope array, not a param; sizeof(alnum)=62 correct",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/rand.c,271,FP,loop bounded by num counter; not unbounded,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/rand.c,276,FP,r set by randit() in do-while before use; error path returns,curl_full_audit_0.4.35,high
INT33-C,curl,lib/rand.c,276,FP,"alnumspace = sizeof(alnum)-1 = 62, nonzero constant",curl_full_audit_0.4.35,high
INT33-C,curl,lib/rand.c,278,FP,"alnumspace = 62, nonzero constant",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_ctype.h,27,FP,"ctype-style macro, pure args, advisory; curl-wide idiom, no actual multi-eval bug",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,27,FP,"same macro; advisory inline-function recommendation, pure char args",curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,28,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,28,FP,"advisory; pure char args, no side effects",curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,33,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,33,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,35,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,35,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,36,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,36,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,37,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,37,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,38,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,38,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,39,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,39,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,40,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,40,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,41,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,41,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,42,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,42,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,43,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,43,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,44,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,44,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,45,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,45,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,46,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,46,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,47,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,47,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,49,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,49,FP,advisory; pure char args,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_ctype.h,50,FP,"ctype macro, pure args, advisory idiom",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ctype.h,50,FP,advisory; pure char args,curl_full_audit_0.4.35,med
DCL37-C,curl,lib/curl_setup.h,93,FP,MSVC-mandated platform shim macro; reserved name required by toolchain,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/curl_setup.h,195,FP,_THREAD_SAFE is a platform feature-test macro; name dictated by OS,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/curl_setup.h,206,FP,_REENTRANT platform feature-test macro; name dictated by OS,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/curl_setup.h,213,FP,_POSIX_PTHREAD_SEMANTICS Solaris feature-test macro; name dictated by OS,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/curl_setup.h,398,FP,Apple SDK env macro shim; name must match compiler-provided symbol,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/curl_setup.h,437,FP,__USE_INLINE__ AmigaOS clib macro; name dictated by platform,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/curl_setup.h,456,FP,_SYS_MBUF_H include-guard suppression for bsdsocket clash; required name,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_setup.h,459,FP,"select()-shaped signature; readfds is in/out fd_set, const impossible",curl_full_audit_0.4.35,high
DCL37-C,curl,lib/curl_setup.h,477,FP,__NO_NET_API AmigaOS platform macro; name dictated by platform,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/curl_setup.h,627,FP,SIZE_MAX standard fallback when limits.h lacks it; name required,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/curl_setup.h,629,FP,SIZE_MAX standard fallback; name required by standard,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/curl_setup.h,891,FP,_APP32_64BIT_OFF_T HP-UX platform macro; name dictated by OS headers,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/curl_setup.h,1009,FP,false fallback on pre-C99 HP-UX lacking stdbool; name required,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/curl_setup.h,1010,FP,true fallback on pre-C99 HP-UX; standard name required,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/curl_setup.h,1032,FP,false fallback for non-C99 platforms; standard name required,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/curl_setup.h,1033,FP,true fallback for non-C99 platforms; standard name required,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/curl_setup.h,1039,FP,"BIT(x)->curl_bit x:1; x is bitfield declarator, cannot parenthesize",curl_full_audit_0.4.35,high
PRE01-C,curl,lib/curl_setup.h,1060,FP,"DEBUGF(x)->x; x is a statement, parenthesizing is meaningless/wrong",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_setup.h,1279,FP,"CURLMAX advisory; double-eval is intended min/max idiom, pure args in use",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_setup.h,1279,FP,CURLMAX advisory inline-function recommendation; project idiom,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_setup.h,1280,FP,CURLMIN advisory; intended min/max idiom,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_setup.h,1280,FP,CURLMIN advisory; project idiom,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_setup.h,1285,FP,"STRCONST emits string-literal,len pair; literal-only arg, no eval hazard",curl_full_audit_0.4.35,high
PRE01-C,curl,lib/curl_setup.h,1285,FP,"STRCONST used only with string literals; parenthesizing harmless, no bug",curl_full_audit_0.4.35,high
PRE02-C,curl,lib/curl_setup.h,1285,FP,intentional two-arg expansion; wrapping in parens would break call sites,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_setup.h,1285,FP,literal-only arg; inline-function not applicable to comma-arg helper,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_setup.h,1287,FP,"CURL_ARRAYSIZE uses sizeof only; no runtime multi-eval, advisory",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_setup.h,1287,FP,"sizeof-only macro, no side-effecting eval; advisory",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_setup.h,1319,FP,Curl_safefree known-safe free+NULL idiom; ptr eval benign (per brief),curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_setup.h,1319,FP,"Curl_safefree free+NULL idiom; advisory, known safe",curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_setup.h,1360,FP,const char *source not an array param; conformant-array syntax N/A,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_setup.h,1362,FP,const char *source not an array param; suggestion inapplicable,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_setup.h,1364,FP,"void *ptr / const char *source pointers, not sized arrays; N/A",curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_setup.h,1364,FP,pointer params not arrays; conformant-array syntax inapplicable,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/curl_setup.h,1598,FP,"VERBOSE(x)->x; x is a statement, parenthesizing meaningless",curl_full_audit_0.4.35,high
PRE01-C,curl,lib/curl_setup.h,1602,FP,"NOVERBOSE(x)->x; x is a statement, parenthesizing meaningless",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/curlx/fopen.c,28,FP,every #if/#elif/#else branch returns; no path falls off end,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/fopen.c,67,FP,str_utf8 is const char* passed to WinAPI; no char-to-int sign extension,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curlx/fopen.c,131,FP,"'needed' set by mbstowcs_s(&needed,...) at line 129 before this check",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curlx/fopen.c,138,FP,"'count' set by mbstowcs_s(&count,...) at line 136 before this check",curl_full_audit_0.4.35,high
EXP15-C,curl,lib/curlx/fopen.c,170,FP,intentional empty branch with '/* do nothing */' comment; documented,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/curlx/fopen.c,170,FP,!wcsncmp boolean idiom; idiomatic string-equality test,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/curlx/fopen.c,172,FP,!wcsncmp boolean idiom; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/curlx/fopen.c,174,FP,!wcsncmp boolean idiom; idiomatic,curl_full_audit_0.4.35,high
STR00-C,curl,lib/curlx/fopen.c,173,FP,"fbuf[2]='?'; '?'=0x3F identical wide value, no behavioral defect",curl_full_audit_0.4.35,med
EXP20-C,curl,lib/curlx/fopen.c,174,FP,!wcsncmp boolean idiom; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/curlx/fopen.c,181,FP,!wcsncmp boolean idiom; idiomatic,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curlx/fopen.c,195,FP,"temp malloc'd at 187, not freed; wcscpy_s(temp+8,..) on live buffer",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curlx/fopen.c,196,FP,temp freed once only on error branch; not a double-free,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/curlx/fopen.c,196,FP,single free on error path then goto cleanup; not double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curlx/fopen.c,214,FP,"temp malloc'd at 206, live; wcscpy_s on valid buffer",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curlx/fopen.c,215,FP,temp freed once on error branch then goto cleanup; not double-free,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/curlx/fopen.c,215,FP,single error-path free; not double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curlx/fopen.c,226,FP,fbuf reassigned to temp at 220-221 (not freed); points to valid buffer,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curlx/fopen.c,233,FP,fbuf is the new live buffer (=temp); not freed before use,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curlx/fopen.c,240,FP,"*out=fbuf where fbuf is heap (malloc'd), not a stack-local address",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curlx/fopen.c,245,FP,cleanup frees fbuf once; success path sets fbuf=NULL first; safe,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/curlx/fopen.c,279,FP,handle is the return value of curlx_CreateFile; caller closes it,curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/fopen.c,296,FP,"thin Win32 wrapper; NULL filename handled by converter/helper, idiomatic",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curlx/fopen.c,330,FP,target points to live fixed/filename; fixed freed at 333 after use,curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/fopen.c,337,FP,"thin Win32 fopen wrapper; NULL handled downstream, idiomatic",curl_full_audit_0.4.35,high
FIO42-C,curl,lib/curlx/fopen.c,363,FP,result is the FILE* return value of curlx_win32_fopen; caller closes,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/curlx/fopen.c,367,FP,result is returned to caller; not a leak,curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/fopen.c,375,FP,"thin freopen wrapper; NULL handled downstream, idiomatic",curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/fopen.c,375,FP,"thin freopen wrapper; fp passed through to freopen_s, no deref",curl_full_audit_0.4.35,high
FIO42-C,curl,lib/curlx/fopen.c,401,FP,"'errno' is errno_t from freopen_s, not a FILE*; result returned to caller",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curlx/fopen.c,405,FP,"returns FILE* value 'result', not address of a local variable",curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/fopen.c,408,FP,"thin stat wrapper; path handled downstream, idiomatic",curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/fopen.c,408,FP,"thin stat wrapper; buffer passed to _stati64, no direct deref",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curlx/fopen.c,432,FP,target points to live path/fixed; fixed freed at 435 after use,curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/fopen.c,444,FP,"thin rename wrapper; oldpath handled downstream, idiomatic",curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/fopen.c,444,FP,"thin rename wrapper; newpath handled downstream, idiomatic",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/cw-out.c,81,FP,curlx_calloc is a curl macro/wrapper from headers sqc cannot resolve,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/cw-out.c,93,FP,"curlx_free is a curl macro from headers; declared, not undeclared",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cw-out.c,104,FP,cw_out_init is a Curl_cwtype vtable impl; signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cw-out.c,105,FP,vtable callback signature fixed by typedef; const cannot be added,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cw-out.c,122,FP,"ctx traversed; static helper but matches project idiom, low value",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cw-out.c,133,FP,cw_out_close vtable impl; signature fixed by Curl_cwtype typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cw-out.c,133,FP,vtable callback writer param fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cw-out.c,144,FP,"data only read; helper, but curl idiom does not const params",curl_full_audit_0.4.35,med
API05-C,curl,lib/cw-out.c,145,FP,conformant array syntax; curl never uses C99 array params,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/cw-out.c,174,FP,"cycle is through client callback/pause; bounded, intentional design",curl_full_audit_0.4.35,med
API05-C,curl,lib/cw-out.c,177,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/cw-out.c,179,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/cw-out.c,190,FP,"wcb is a function-pointer local var call, not undeclared function",curl_full_audit_0.4.35,high
MSC04-C,curl,lib/cw-out.c,221,FP,indirect recursion via callback/pause; bounded by buffer chain,curl_full_audit_0.4.35,med
API05-C,curl,lib/cw-out.c,225,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cw-out.c,248,FP,wcb_data set by cw_get_writefunc out-param before use,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cw-out.c,253,FP,min_write filled by cw_get_writefunc out-param before read,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cw-out.c,255,FP,max_write filled by cw_get_writefunc out-param before read,curl_full_audit_0.4.35,high
INT30-C,curl,lib/cw-out.c,260,FP,nwritten<=blen guaranteed (callback returns blen or error checked),curl_full_audit_0.4.35,high
INT30-C,curl,lib/cw-out.c,261,FP,blen-=nwritten with nwritten<=blen verified by cw_out_cb_write,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/cw-out.c,268,FP,bounded callback recursion cycle; intentional,curl_full_audit_0.4.35,med
EXP30-C,curl,lib/cw-out.c,278,FP,dyn_ptr/dyn_len on same buf have no harmful unsequenced side effects,curl_full_audit_0.4.35,high
INT30-C,curl,lib/cw-out.c,293,FP,consumed<dyn_len asserted on this branch; no underflow,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/cw-out.c,302,FP,"recursion bounded by buffer-chain length, not unbounded stack",curl_full_audit_0.4.35,med
EXP40-C,curl,lib/cw-out.c,317,FP,plast is non-const pointer-to-pointer; no const circumvention,curl_full_audit_0.4.35,high
API05-C,curl,lib/cw-out.c,343,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/cw-out.c,370,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cw-out.c,419,FP,cw_out_write is vtable impl; signature fixed by Curl_cwtype typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/cw-out.c,420,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/cw-out.c,444,FP,Curl_cwt_out exported via cw-out.h; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/cw-out.c,444,FP,exported symbol used by other TUs; file-scope is required,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/cw-out.c,466,FP,"callback recursion cycle; bounded, design-intended",curl_full_audit_0.4.35,med
API00-C,curl,lib/cw-out.c,487,FP,data always valid here; curl exported fns do not NULL-check easy handle,curl_full_audit_0.4.35,med
MSC04-C,curl,lib/cw-out.c,487,FP,bounded callback recursion cycle; intentional,curl_full_audit_0.4.35,med
API00-C,curl,lib/cw-out.c,504,FP,"data always valid; idiomatic curl, no NULL check needed",curl_full_audit_0.4.35,med
ARR02-C,curl,lib/parsedate.c,86,FP,"implicit bounds with initializer; idiomatic table, advisory",curl_full_audit_0.4.35,high
ARR02-C,curl,lib/parsedate.c,89,FP,"implicit bounds with initializer; idiomatic table, advisory",curl_full_audit_0.4.35,high
ARR02-C,curl,lib/parsedate.c,105,FP,implicit bounds with initializer; idiomatic table,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/parsedate.c,117,FP,implicit bounds with initializer; idiomatic tz table,curl_full_audit_0.4.35,high
API05-C,curl,lib/parsedate.c,201,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/parsedate.c,212,FP,"strlen(what[0]) operates on char*, not a char value; misfire",curl_full_audit_0.4.35,high
API05-C,curl,lib/parsedate.c,221,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/parsedate.c,239,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/parsedate.c,283,FP,static time2epoch; caller validates monnum 0-11 before call,curl_full_audit_0.4.35,med
ARR30-C,curl,lib/parsedate.c,283,FP,mon constrained 0-11 by parsedate before reaching time2epoch,curl_full_audit_0.4.35,med
STR34-C,curl,lib/parsedate.c,293,FP,"date[0]-'0' guarded by ISDIGIT caller; digit char, no sign issue",curl_full_audit_0.4.35,high
MEM33-C,curl,lib/parsedate.c,295,FP,"*endp=&date[2] is pointer assignment, not flexible-array struct copy",curl_full_audit_0.4.35,high
STR34-C,curl,lib/parsedate.c,295,FP,"pointer assignment, not a char sign-extension; misfire",curl_full_audit_0.4.35,high
STR34-C,curl,lib/parsedate.c,295,FP,date[2] indexing on digit string; no signed-char promotion bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/parsedate.c,295,FP,char-deref misfire on pointer assignment,curl_full_audit_0.4.35,high
MEM33-C,curl,lib/parsedate.c,298,FP,"*endp=&date[1] pointer assignment, not flexible-array copy",curl_full_audit_0.4.35,high
STR34-C,curl,lib/parsedate.c,298,FP,"pointer assignment misfire, no char sign-extension",curl_full_audit_0.4.35,high
STR34-C,curl,lib/parsedate.c,298,FP,digit-char return value; no sign-extension defect,curl_full_audit_0.4.35,high
STR34-C,curl,lib/parsedate.c,298,FP,char-deref misfire on pointer indexing,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/parsedate.c,309,FP,p always set by oneortwodigit out-param; never NULL,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/parsedate.c,326,FP,match: label reached via goto; code is reachable,curl_full_audit_0.4.35,high
STR34-C,curl,lib/parsedate.c,330,FP,"*endp=(char*)p pointer cast/assignment, not char sign-extension",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/parsedate.c,363,FP,date dereferenced in loop guard *date already; non-NULL on this path,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/parsedate.c,372,FP,"p=date, date non-NULL in this branch; never NULL",curl_full_audit_0.4.35,high
DCL00-C,curl,lib/parsedate.c,412,FP,num_digits reassigned at line 418; cannot be const,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/parsedate.c,424,FP,indate and date point into the same input string,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/parsedate.c,425,FP,"date[-1] guarded by indate<date, so date>start; valid index",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/parsedate.c,425,FP,date[-1] valid given indate<date guard,curl_full_audit_0.4.35,high
INT10-C,curl,lib/parsedate.c,435,FP,"val is unsigned int; modulo is unsigned, well-defined",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/parsedate.c,439,FP,date[-1] reachable only when indate<date; valid,curl_full_audit_0.4.35,high
INT10-C,curl,lib/parsedate.c,449,FP,val unsigned int; modulo well-defined,curl_full_audit_0.4.35,high
INT10-C,curl,lib/parsedate.c,450,FP,val unsigned int; modulo well-defined,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/parsedate.c,562,FP,curl_getdate is a public exported API symbol,curl_full_audit_0.4.35,high
STR34-C,curl,lib/parsedate.c,565,FP,p is char* passed to parsedate; not a char promotion,curl_full_audit_0.4.35,high
STR34-C,curl,lib/parsedate.c,584,FP,p is char* arg; no signed-char conversion defect,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/vauth/ntlm.c,161,FP,DEBUG_OUT(x) is a statement-block wrapper; parenthesizing would be wrong,curl_full_audit_0.4.35,med
EXP07-C,curl,lib/vauth/ntlm.c,182,FP,(1<<10) probes an unknown/reserved NTLM flag bit; idiomatic,curl_full_audit_0.4.35,high
EXP07-C,curl,lib/vauth/ntlm.c,212,FP,(1<<25) probes unknown flag bit in debug print; idiomatic,curl_full_audit_0.4.35,high
EXP07-C,curl,lib/vauth/ntlm.c,214,FP,(1<<26) unknown-flag probe; debug-only idiom,curl_full_audit_0.4.35,high
EXP07-C,curl,lib/vauth/ntlm.c,216,FP,(1<<27) unknown-flag probe; debug-only idiom,curl_full_audit_0.4.35,high
EXP07-C,curl,lib/vauth/ntlm.c,218,FP,(1<<28) unknown-flag probe; debug-only idiom,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vauth/ntlm.c,228,FP,"handle unused (void)handle; debug helper, curl does not const params",curl_full_audit_0.4.35,med
API05-C,curl,lib/vauth/ntlm.c,228,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/ntlm.c,236,FP,"dead debug code (DEBUG_ME=0); hex print of char, char-deref pattern",curl_full_audit_0.4.35,med
EXP34-C,curl,lib/vauth/ntlm.c,266,FP,type2 non-NULL: caller memcmp'd it with type2len>=32 before this,curl_full_audit_0.4.35,med
INT08-C,curl,lib/vauth/ntlm.c,270,FP,offset bounded by type2len via prior OR term; sum cannot overflow,curl_full_audit_0.4.35,med
MEM30-C,curl,lib/vauth/ntlm.c,280,FP,"free-then-reassign (curlx_free then memdup), not use-after-free",curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/ntlm.c,335,FP,"ntlm always valid from caller; idiomatic curl, no NULL check",curl_full_audit_0.4.35,med
ARR02-C,curl,lib/vauth/ntlm.c,339,FP,type2_marker implicit bounds with initializer; idiomatic,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vauth/ntlm.c,364,FP,type2len<32 short-circuits memcmp; type2 non-NULL when reached,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/vauth/ntlm.c,382,FP,DEBUG_OUT brace-block; no preprocessor directive in actual call args,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/vauth/ntlm.c,382,FP,macro-block misparse; no '#' directive inside the call,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/ntlm.c,396,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/ntlm.c,396,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vauth/ntlm.c,423,FP,data param via (void)data; curl idiom does not const easy handle,curl_full_audit_0.4.35,med
EXP30-C,curl,lib/vauth/ntlm.c,464,FP,"SHORTPAIR/LONGQUARTET macro args; comma-expr expansion, no side effects",curl_full_audit_0.4.35,high
PRE32-C,curl,lib/vauth/ntlm.c,502,FP,DEBUG_OUT brace-block misparse; no directive in real call args,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/vauth/ntlm.c,502,FP,macro-block misfire; no '#' in the call,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/vauth/ntlm.c,592,FP,"no cast-away-const present; memset(ntresp,...) misparse",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vauth/ntlm.c,609,FP,"ntbuffer[0x18] is fixed constant size, not a VLA",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vauth/ntlm.c,611,FP,"ntlmv2hash[0x18] is fixed constant size, not a VLA",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vauth/ntlm.c,646,FP,"ntbuffer[0x18] fixed constant size, not a VLA",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vauth/ntlm.c,647,FP,"lmbuffer[0x18] fixed constant size, not a VLA",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vauth/ntlm.c,682,FP,SHORTPAIR/LONGQUARTET comma-expr macro expansion; no side effects,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vauth/ntlm.c,782,FP,ptr_ntresp = &ntresp[0] or checked ntlmv2resp; non-NULL,curl_full_audit_0.4.35,high
INT30-C,curl,lib/vauth/ntlm.c,783,FP,size+=ntresplen guarded by overflow check at line 776,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/vauth/ntlm.c,785,FP,DEBUG_OUT brace-block misparse; no directive in call args,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/vauth/ntlm.c,785,FP,"duplicate of 785 PRE32 misfire; brace-block, no real directive",curl_full_audit_0.4.35,high
PRE32-C,curl,lib/vauth/ntlm.c,790,FP,DEBUG_OUT brace-block misparse; no directive in call args,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/vauth/ntlm.c,790,FP,"duplicate of 790 PRE32 misfire; brace-block, no real directive",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/md5.c,212,FP,my_md5_update signature fixed by HMAC_params/MD5_params function-pointer typedef; const cannot be added,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/md5.c,219,FP,my_md5_final signature fixed by function-pointer typedef in vtable,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/md5.c,276,FP,"MD5_F crypto round macro; idiomatic, performance-critical, public-domain reference impl",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/md5.c,276,FP,multiple-eval harmless on pure scalar locals; standard MD5 macro idiom,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/md5.c,277,FP,MD5_G crypto round macro; idiomatic reference implementation,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/md5.c,277,FP,multiple-eval of scalar word; harmless MD5 idiom,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/md5.c,285,FP,MD5_STEP perf-critical round macro; inline fn would defeat reference-impl intent,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/md5.c,285,FP,f param is always a bare macro name (MD5_F etc); parenthesizing would break call f(...),curl_full_audit_0.4.35,med
PRE02-C,curl,lib/md5.c,285,FP,multi-statement macro cannot be parenthesized as expression; advisory misapplied,curl_full_audit_0.4.35,med
PRE10-C,curl,lib/md5.c,285,TP,"multistatement MD5_STEP not do/while-wrapped; safe only because callers append nothing, but technically risky",curl_full_audit_0.4.35,low
PRE11-C,curl,lib/md5.c,285,FP,trailing semicolon intentional; callers invoke without semicolon (statement-list macro),curl_full_audit_0.4.35,med
PRE12-C,curl,lib/md5.c,285,FP,param a is an lvalue updated in place by design; macro idiom,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/md5.c,302,FP,MD5_SET byte-load macro; idiomatic reference impl,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/md5.c,302,FP,n is multiplied (n)*4 already parenthesized in body; warning misreads use,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/md5.c,302,FP,n is a compile-time constant literal at every call site; multiple-eval harmless,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/md5.c,307,FP,MD5_GET(n) uses ctx->block[n] with constant literal n; no precedence hazard,curl_full_audit_0.4.35,med
EXP36-C,curl,lib/md5.c,320,FP,"cast const void* data to const unsigned char*; byte pointer, alignment 1, no over-alignment",curl_full_audit_0.4.35,high
EXP45-C,curl,lib/md5.c,413,FP,do{...}while(size -= 64) is intentional MD5 block loop; size is multiple of 64,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/md5.c,420,FP,"returns ptr which points into caller-owned data buffer, not a local; no automatic storage escape",curl_full_audit_0.4.35,high
EXP05-C,curl,lib/md5.c,442,FP,in is void* (not const) cast to my_md5_ctx*; no const stripped,curl_full_audit_0.4.35,high
INT14-C,curl,lib/md5.c,445,FP,"MD5 counter masking; mixing & and + is the algorithm, advisory readability only",curl_full_audit_0.4.35,high
INT14-C,curl,lib/md5.c,445,FP,len used in + and >> by MD5 spec; idiomatic,curl_full_audit_0.4.35,high
EXP07-C,curl,lib/md5.c,448,FP,">>29 is the MD5 carry computation, not assuming a named constant's value",curl_full_audit_0.4.35,high
API05-C,curl,lib/md5.c,549,FP,curl never uses C99 conformant-array-param syntax; stylistic,curl_full_audit_0.4.35,high
API05-C,curl,lib/md5.c,550,FP,stylistic conformant-array advisory; not curl convention,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/md5.c,555,FP,"my_md5_init WRITES ctx (initializes a,b,c,d,lo,hi); does not read uninitialized value",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/md5.c,568,FP,"ctxt = curlx_malloc(); assigned before use, guarded by if(!ctxt) return",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/md5.c,571,FP,"ctxt is a heap pointer from malloc, not a local object; returning it is correct",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/md5.c,577,FP,ctxt freed before this NULL return; md5_hashctx not yet allocated; no leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/md5.c,585,FP,both ctxt and md5_hashctx freed on this error path before return NULL,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/md5.c,588,FP,"returns heap-allocated ctxt (the constructor's product), not automatic storage",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/md5.c,588,FP,"success path returns the allocation to caller; ownership transfer, not leak",curl_full_audit_0.4.35,high
API00-C,curl,lib/md5.c,591,FP,Curl_MD5_update is internal; callers pass valid context; siblings do not NULL-check either,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/md5.c,591,FP,context IS modified: hashctx updated via update_func through the pointer,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/vtls/cipher_suite.c,134,FP,"[adv] CS_ZIP_IDX multi-evals a..h; used only with compile-time constant idx names, so harmless in practice",curl_full_audit_0.4.35,adversarial-flip
PRE02-C,curl,lib/vtls/cipher_suite.c,134,FP,"macro expands to a brace-enclosed initializer list, not an expression; cannot be parenthesized",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/vtls/cipher_suite.c,134,FP,b etc are constant CS_TXT_IDX_* enum names; multiple eval harmless,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/vtls/cipher_suite.c,143,FP,CS_ENTRY id used only as struct initializer field; parenthesizing not meaningful,curl_full_audit_0.4.35,high
PRE05-C,curl,lib/vtls/cipher_suite.c,143,FP,## intentionally pastes CS_TXT_IDX_ prefix onto literal tokens; expansion-before-paste not desired,curl_full_audit_0.4.35,med
ARR02-C,curl,lib/vtls/cipher_suite.c,160,FP,"cs_list[] size inferred from initializer; idiomatic and correct, CS_LIST_LEN uses ARRAYSIZE",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/cipher_suite.c,542,FP,stylistic conformant-array param advisory; not curl convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/cipher_suite.c,568,FP,entry is const char* passed to strlen; no char-to-int sign-extension occurs,curl_full_audit_0.4.35,med
EXP30-C,curl,lib/vtls/cipher_suite.c,577,FP,"while(nxt<end && *(nxt++)) has a sequence point at &&; single modification of nxt, well-defined",curl_full_audit_0.4.35,high
INT31-C,curl,lib/vtls/cipher_suite.c,582,FP,"indexes are <CS_TXT_LEN (small), masked &0x3F; deliberate 6-bit pack into uint8_t, no real loss",curl_full_audit_0.4.35,high
INT31-C,curl,lib/vtls/cipher_suite.c,585,FP,"same deliberate bit-packing; values bounded and masked, cast intentional",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/cipher_suite.c,590,FP,conformant-array stylistic advisory; not curl convention,curl_full_audit_0.4.35,high
FIO50-C,curl,lib/vtls/cipher_suite.c,600,FP,"zip is a uint8_t[6] local array, not a FILE stream; rule wholly misapplied",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/vtls/cipher_suite.c,600,FP,"zip[0] is an array element, not a file stream",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/vtls/cipher_suite.c,601,FP,"zip is a byte array, not a FILE*; misapplied",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/vtls/cipher_suite.c,601,FP,"byte-array element, not a stream",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/vtls/cipher_suite.c,602,FP,"zip is uint8_t[6], not a FILE*; misapplied",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/vtls/cipher_suite.c,602,FP,"byte-array element, not a stream",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/vtls/cipher_suite.c,604,FP,"zip byte array, not a stream",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/vtls/cipher_suite.c,604,FP,"byte-array element, not a stream",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/vtls/cipher_suite.c,605,FP,"zip byte array, not a stream",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/vtls/cipher_suite.c,605,FP,"byte-array element, not a stream",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/vtls/cipher_suite.c,606,FP,"zip byte array, not a stream",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/vtls/cipher_suite.c,606,FP,"byte-array element, not a stream",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/cipher_suite.c,617,FP,entry is const char* used in strlen; no signed-char widening,curl_full_audit_0.4.35,med
API05-C,curl,lib/vtls/cipher_suite.c,635,FP,conformant-array stylistic advisory; not curl convention,curl_full_audit_0.4.35,high
MEM33-C,curl,lib/vtls/cipher_suite.c,670,FP,"no flexible-array struct here; (*end)++ pointer advance in for-loop, misparse",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/cipher_suite.c,670,FP,*end[0] is char compared in cs_is_separator(char); no widening assignment to larger type,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/cipher_suite.c,670,FP,*str[0] passed to cs_is_separator(char); no sign-extending widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/cipher_suite.c,670,FP,char deref used as char arg; duplicate misfire,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/cipher_suite.c,673,FP,*end and *str both point into the same caller string; end>=str by construction,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/cipher_suite.c,676,FP,conformant-array stylistic advisory; not curl convention,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vtls/cipher_suite.c,680,FP,r is reassigned at line 694 (r = cs_zip_to_str(...)); not const-eligible,curl_full_audit_0.4.35,high
EXP00-C,curl,lib/vtls/cipher_suite.c,685,FP,zip[0]>>2 != CONST grouped correctly by C precedence; explicit parens around comparison present,curl_full_audit_0.4.35,med
MEM30-C,curl,lib/file.c,89,FP,file_cleanup frees freepath then checks file->fd (different member); fd not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/file.c,90,FP,curlx_close(file->fd) on the int fd member; not the freed freepath,curl_full_audit_0.4.35,high
API05-C,curl,lib/file.c,95,FP,file_easy_dtor signature fixed by hash-dtor function-pointer typedef; conformant-array N/A,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/file.c,95,FP,"file_easy_dtor is a hash dtor callback; signature fixed by typedef, const not addable",curl_full_audit_0.4.35,high
API05-C,curl,lib/file.c,95,FP,callback signature fixed; conformant-array advisory N/A,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/file.c,101,FP,"file_cleanup frees file->freepath (member); curlx_free(file) frees the struct; distinct, no double free",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/file.c,105,FP,file_setup_connection signature fixed by Curl_protocol vtable; conn unused but typedef-bound,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/file.c,110,FP,filep = curlx_calloc(...); assigned before any use; guarded by if(!filep),curl_full_audit_0.4.35,high
EXP36-C,curl,lib/file.c,121,FP,Curl_meta_get returns void* to a calloc'd FILEPROTO (suitably aligned); no real alignment violation,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/file.c,139,FP,meta_get returns properly-aligned calloc'd struct; alignment fine,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/file.c,218,FP,real_path only freed on the binary-zero error path that returns; read at 218 occurs before any free,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/file.c,218,FP,real_path is checked non-NULL via Curl_urldecode result==0 contract; AMIGA-only branch,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/file.c,219,FP,"__unix_path_semantics is an external libnix symbol (AmigaOS -lunix); name dictated by the lib, not curl",curl_full_audit_0.4.35,high
DCL37-C,curl,lib/file.c,219,FP,extern symbol provided by Amiga libnix; cannot be renamed,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/file.c,231,FP,fd stored into file->fd / file->freepath; closed later by file_cleanup/file_done; not leaked,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/file.c,242,FP,fd is saved in file->fd before this return; file_done() at 241 closes it; no leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/file.c,246,FP,fd persisted into file->fd (connection state); closed at disconnect; not a leak,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/file.c,250,FP,file_disconnect signature fixed by Curl_protocol vtable typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/file.c,265,FP,"file_upload writes file->fd/path indirectly and reads file->path; not a pure-const candidate, internal helper",curl_full_audit_0.4.35,high
INT14-C,curl,lib/file.c,296,FP,"_S_IREAD|_S_IWRITE bitwise on perms then & ; idiomatic permission flags, readability advisory only",curl_full_audit_0.4.35,high
FIO42-C,curl,lib/file.c,301,FP,fd from curlx_open is closed at out: (line 370) and on every error return in file_upload,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/file.c,305,FP,this return is the fd<0 branch (open failed); nothing to close,curl_full_audit_0.4.35,high
INT18-C,curl,lib/file.c,308,FP,"infilesize is curl_off_t (signed); != -1 compares signed to signed, no unsigned wrap",curl_full_audit_0.4.35,med
MEM12-C,curl,lib/file.c,317,FP,fd explicitly curlx_close(fd) at line 315 before this return,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/file.c,373,FP,fd closed at out: label (370) reached by all paths via goto/fallthrough,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/file.c,391,FP,meta_get returns aligned calloc'd FILEPROTO; no real alignment issue,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/file.c,430,FP,"static const char accept_ranges[] sized by string initializer; idiomatic, sizeof used",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/file.c,485,FP,"resume_from += st_size: plain curl_off_t addition, no sizeof scaling; rule misfire",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/file.c,547,FP,xfer_buf from Curl_multi_xfer_buf_borrow checked via result; guarded reachable only when borrow succeeded,curl_full_audit_0.4.35,high
EXP45-C,curl,lib/file.c,574,FP,while((entry = readdir(dir))) is idiomatic readdir loop; intentional assignment in condition,curl_full_audit_0.4.35,high
CON34-C,curl,lib/file.c,574,FP,file_do is per-easy-handle single-threaded directory listing; readdir static buffer not shared across threads here,curl_full_audit_0.4.35,med
DCL15-C,curl,lib/file.c,626,FP,Curl_scheme_file has external linkage by design (referenced by the scheme registry),curl_full_audit_0.4.35,high
DCL19-C,curl,lib/file.c,626,FP,exported scheme table must be file-scope/external; cannot be function-local,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/formdata.c,63,FP,src is non-NULL form node from caller loop,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/formdata.c,102,FP,"post is heap (calloc), not automatic storage",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/formdata.c,144,FP,form_info guarded by if(!form||...) before call,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/formdata.c,216,FP,first_form fields written via FormInfoCopyField; not const,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/formdata.c,290,FP,form nesting bounded; stack-exhaustion advisory only,curl_full_audit_0.4.35,med
MSC04-C,curl,lib/formdata.c,290,TP,free_chain is factual direct recursion,curl_full_audit_0.4.35,low
MSC39-C,curl,lib/formdata.c,302,FP,caller does not reuse va_list; va_end called correctly,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/formdata.c,312,FP,macro param t is a type; no side-effect multi-eval,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/formdata.c,312,FP,"param t is a type token, harmless",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/formdata.c,314,FP,macro param t is a type; no side-effect multi-eval,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/formdata.c,314,FP,"param t is a type token, harmless",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/formdata.c,316,FP,macro param t is a type; no side-effect multi-eval,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/formdata.c,316,FP,"param t is a type token, harmless",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/formdata.c,447,FP,form guarded by if(!form||...) before AddFormInfo,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/formdata.c,523,FP,form guarded by if(!form||...) before AddFormInfo,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/formdata.c,581,FP,->more read before free; standard list teardown,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/formdata.c,582,FP,each node freed once in list walk,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/formdata.c,596,FP,free_chain while(c) loop is NULL-safe,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/formdata.c,638,FP,"distinct args (NULL,&toppart,form,NULL); no aliasing",curl_full_audit_0.4.35,high
EXP43-C,curl,lib/formdata.c,640,FP,distinct args; no restrict aliasing,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/formdata.c,665,FP,curl_formfree recursion bounded by form nesting,curl_full_audit_0.4.35,med
MEM30-C,curl,lib/formdata.c,679,FP,form->flags read; form not freed until later,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/formdata.c,681,FP,form->flags read; form freed only at end,curl_full_audit_0.4.35,high
API05-C,curl,lib/formdata.c,692,FP,curl never uses C99 array-param syntax (convention),curl_full_audit_0.4.35,high
EXP34-C,curl,lib/formdata.c,698,FP,guarded if(!name||!len); callee handles NULL name,curl_full_audit_0.4.35,high
API00-C,curl,lib/formdata.c,717,FP,data documented as nullable; mime_init handles NULL,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/formdata.c,719,FP,post is reassigned loop var; curl convention,curl_full_audit_0.4.35,med
EXP20-C,curl,lib/formdata.c,785,FP,"!strcmp idiom, idiomatic",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/formdata.c,844,FP,disabled-build stub param; (void) cast,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/formdata.c,845,FP,disabled-build stub param; (void) cast,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/formdata.c,852,FP,disabled-build stub param; (void) cast,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/formdata.c,852,FP,disabled-build stub param; (void) cast,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/formdata.c,861,FP,disabled-build stub param; (void) cast,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/headers.c,35,TP,"static helper, never writes hs, not a fn-ptr",curl_full_audit_0.4.35,low
DCL13-C,curl,lib/headers.c,38,FP,e stored into non-const h->anchor; const would not compile,curl_full_audit_0.4.35,med
DCL00-C,curl,lib/headers.c,41,FP,h is written through (h->name=...); not const-able,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/headers.c,42,FP,hs always non-NULL from list elem in caller,curl_full_audit_0.4.35,high
EXP07-C,curl,lib/headers.c,50,FP,deliberate reserved-bit OR; advisory magic-number,curl_full_audit_0.4.35,high
API00-C,curl,lib/headers.c,55,FP,function checks !data at line 69,curl_full_audit_0.4.35,high
API05-C,curl,lib/headers.c,56,FP,curl array-param-syntax convention,curl_full_audit_0.4.35,high
MEM33-C,curl,lib/headers.c,116,FP,plain pointer assign *hout=&...; no flexible-array copy,curl_full_audit_0.4.35,high
API00-C,curl,lib/headers.c,121,TP,derefs easy at L133 with no NULL check; sibling curl_easy_header checks it,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/headers.c,124,FP,prev is public API signature; fixed type,curl_full_audit_0.4.35,med
API05-C,curl,lib/headers.c,181,FP,curl array-param-syntax convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/headers.c,181,FP,namevalue writes *header++=0; header is modified,curl_full_audit_0.4.35,high
API05-C,curl,lib/headers.c,182,FP,out-param char**; convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/headers.c,182,FP,out-param char**; convention,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/headers.c,186,FP,"*name set to header pointing into heap hs->buffer, not local",curl_full_audit_0.4.35,high
STR34-C,curl,lib/headers.c,186,FP,"*name is char** assign of pointer, not char read",curl_full_audit_0.4.35,high
STR34-C,curl,lib/headers.c,200,FP,*header++=0 writes 0; no signed-char sign extension,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/headers.c,208,FP,"*value set to interior heap pointer, not local addr",curl_full_audit_0.4.35,high
STR34-C,curl,lib/headers.c,208,FP,"*value is char** pointer assign, not char read",curl_full_audit_0.4.35,high
STR34-C,curl,lib/headers.c,212,FP,*end--=0 writes 0; no sign extension,curl_full_audit_0.4.35,high
API00-C,curl,lib/headers.c,221,FP,hlen sized by trusted callback; bounded by MAX header count,curl_full_audit_0.4.35,med
API05-C,curl,lib/headers.c,221,FP,curl array-param-syntax convention,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/headers.c,259,FP,hs assigned by calloc then NULL-checked before deref,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/headers.c,263,FP,buffer[1] + hlen alloc; buffer[hlen] is in-bounds,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/headers.c,297,FP,writer is cwriter vtable callback signature; fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/headers.c,298,FP,cwriter callback signature; convention,curl_full_audit_0.4.35,high
API00-C,curl,lib/headers.c,324,FP,internal fn; data always valid; derefs but no caller passes NULL,curl_full_audit_0.4.35,med
API00-C,curl,lib/headers.c,351,FP,internal cleanup; data always valid,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/headers.c,367,FP,disabled-build stub param; (void) cast,curl_full_audit_0.4.35,high
API05-C,curl,lib/headers.c,368,FP,disabled-build stub; convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/headers.c,372,FP,disabled-build stub param,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/headers.c,383,FP,disabled-build stub param,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/headers.c,386,FP,disabled-build stub param,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_ipfs.c,35,FP,callers pass non-NULL (ipfs_path_c/gwpath validated),curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_ipfs.c,35,FP,char compared to char literal; no widening read,curl_full_audit_0.4.35,high
DCL00-C,curl,src/tool_ipfs.c,41,FP,ipfs_path_c reassigned later (L50/56); not const,curl_full_audit_0.4.35,high
DCL00-C,curl,src/tool_ipfs.c,42,FP,gateway_composed_c assigned at L61; not init-const,curl_full_audit_0.4.35,high
ENV34-C,curl,src/tool_ipfs.c,44,FP,getenv result used immediately then strdup'd; no overwrite risk,curl_full_audit_0.4.35,med
ERR33-C,curl,src/tool_ipfs.c,44,FP,checked via if(gateway_env) at L46,curl_full_audit_0.4.35,high
CON34-C,curl,src/tool_ipfs.c,44,FP,CLI tool single-thread; thread-safety advisory,curl_full_audit_0.4.35,med
ENV34-C,curl,src/tool_ipfs.c,53,FP,home used immediately in maprintf; no later getenv,curl_full_audit_0.4.35,med
ERR33-C,curl,src/tool_ipfs.c,53,FP,checked via if(home && *home),curl_full_audit_0.4.35,high
CON34-C,curl,src/tool_ipfs.c,53,FP,CLI tool single-thread advisory,curl_full_audit_0.4.35,med
ENV30-C,curl,src/tool_ipfs.c,63,FP,"ipfs_path_c is allocated (curl_getenv/maprintf), not getenv static",curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_ipfs.c,68,FP,gfile closed on both success (L88) and fail (L94),curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_ipfs.c,68,FP,"gfile is FILE*, closed via curlx_fclose on all paths",curl_full_audit_0.4.35,high
FIO34-C,curl,src/tool_ipfs.c,78,FP,line read loop; EOF/newline break; ferror advisory only,curl_full_audit_0.4.35,med
EXP30-C,curl,src/tool_ipfs.c,78,FP,single assignment to c then compared; sequence point at &&,curl_full_audit_0.4.35,high
EXP30-C,curl,src/tool_ipfs.c,78,FP,no unsequenced modify; one assign per iteration,curl_full_audit_0.4.35,high
FIO34-C,curl,src/tool_ipfs.c,78,FP,c declared int at L72; EOF distinguishable,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_ipfs.c,78,FP,c assigned in while condition before use,curl_full_audit_0.4.35,high
INT31-C,curl,src/tool_ipfs.c,79,FP,explicit (char) cast of a file byte (0-255),curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_ipfs.c,87,FP,"ipfs_path_c allocated, not getenv static; curl_free safe",curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_ipfs.c,95,FP,"ipfs_path_c allocated, not getenv static buffer",curl_full_audit_0.4.35,high
API00-C,curl,src/tool_ipfs.c,103,FP,tool fn; protocol always valid caller-side,curl_full_audit_0.4.35,med
API00-C,curl,src/tool_ipfs.c,103,FP,tool fn; config always valid caller-side,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_ipfs.c,104,FP,config read-only but tool fn signature convention,curl_full_audit_0.4.35,med
STR34-C,curl,src/tool_ipfs.c,186,FP,*inputpath='\0' writes 0; no signed-char read,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_ipfs.c,188,FP,gwpath set by checked curl_url_get PATH; non-NULL here,curl_full_audit_0.4.35,med
EXP34-C,curl,src/tool_ipfs.c,189,FP,gwpath non-NULL after successful url_get at L170,curl_full_audit_0.4.35,med
STR34-C,curl,src/tool_ipfs.c,203,FP,"*url pointer assign, not char read",curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_ipfs.c,212,FP,curl_free is NULL-safe (free wrapper),curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_ipfs.c,213,FP,curl_free NULL-safe,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_ipfs.c,214,FP,curl_free NULL-safe,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_ipfs.c,216,FP,curl_free NULL-safe,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_ipfs.c,217,FP,curl_free NULL-safe,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/escape.c,36,FP,curl_escape is public ABI-exported API; cannot be static,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/escape.c,42,FP,curl_unescape is public ABI-exported API; cannot be static,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/escape.c,44,FP,"distinct args (NULL,string,length,NULL); no aliasing of restrict params",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/escape.c,50,FP,curl_easy_escape is public exported API; cannot be static,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/escape.c,50,FP,"fixed public API signature; data param ignored, const not allowed",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/escape.c,61,FP,curlx_strdup provided via curlx header/macro; declared,curl_full_audit_0.4.35,high
STR00-C,curl,lib/escape.c,79,FP,"unsigned char out[3]={'%'} is idiomatic byte buffer, not a string",curl_full_audit_0.4.35,high
API00-C,curl,lib/escape.c,105,FP,DEBUGASSERT(string); internal callers guarantee non-null,curl_full_audit_0.4.35,high
API05-C,curl,lib/escape.c,105,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
API05-C,curl,lib/escape.c,106,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/escape.c,115,FP,string DEBUGASSERTed non-null; callers guard before call,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/escape.c,116,FP,curlx_malloc provided via curlx header/macro; declared,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/escape.c,122,FP,"ns holds heap malloc, not a local address; *ostring=ns valid",curl_full_audit_0.4.35,high
STR34-C,curl,lib/escape.c,122,FP,"*ostring=ns is pointer assignment, not char sign-extension",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/escape.c,124,FP,while(alloc) bounded by decrementing counter; not unbounded,curl_full_audit_0.4.35,high
INT31-C,curl,lib/escape.c,129,FP,"hexval 0-15; (<<4)|hexval yields 0-255, fits unsigned char",curl_full_audit_0.4.35,high
INT14-C,curl,lib/escape.c,129,FP,"string is pointer index, not mixed bitwise/arithmetic value",curl_full_audit_0.4.35,high
STR34-C,curl,lib/escape.c,145,FP,*ns++=(char)in stores unsigned char value; idiomatic,curl_full_audit_0.4.35,high
STR34-C,curl,lib/escape.c,147,FP,*ns=0 terminator; no sign-extension issue,curl_full_audit_0.4.35,high
API00-C,curl,lib/escape.c,163,FP,"olen is optional out-param, guarded by if(olen) before use",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/escape.c,163,FP,curl_easy_unescape is public exported API; cannot be static,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/escape.c,163,FP,"fixed public API signature; data ignored, const not allowed",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/escape.c,176,FP,outputlen set by Curl_urldecode via &outputlen; only read after success,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/escape.c,183,FP,str is pointer to heap memory; returning pointer value is correct,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/escape.c,183,FP,Curl_safefree nulls str; returns NULL not freed pointer,curl_full_audit_0.4.35,high
API00-C,curl,lib/escape.c,189,FP,curl_free(NULL) is well-defined; no validation needed,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/escape.c,189,FP,curl_free is public exported API; cannot be static,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/escape.c,191,FP,curlx_free provided via curlx header/macro; declared,curl_full_audit_0.4.35,high
API00-C,curl,lib/escape.c,200,FP,len guarded by DEBUGASSERT and runtime if(src&&len&&olen>=3),curl_full_audit_0.4.35,high
API00-C,curl,lib/escape.c,200,FP,olen guarded by DEBUGASSERT and runtime check before use,curl_full_audit_0.4.35,high
API05-C,curl,lib/escape.c,200,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
API05-C,curl,lib/escape.c,201,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
DCL38-C,curl,lib/bufq.h,38,TP,uint8_t data[1] used as flexible array; DCL38 prefers []; intentional struct-hack,curl_full_audit_0.4.35,low
STR31-C,curl,lib/bufq.h,39,FP,"void *dummy is alignment pointer in union, not a string buffer",curl_full_audit_0.4.35,high
API02-C,curl,lib/bufq.h,166,FP,len size param already present; advisory misfire,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.h,167,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
API02-C,curl,lib/bufq.h,170,FP,len size param already present; advisory misfire,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.h,171,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
API02-C,curl,lib/bufq.h,178,FP,len size param already present; advisory misfire,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.h,178,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/bufq.h,179,FP,pnread is out-param written by function; cannot be const,curl_full_audit_0.4.35,high
API02-C,curl,lib/bufq.h,181,FP,len size param already present; advisory misfire,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.h,181,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/bufq.h,182,FP,pnread is out-param written by function; cannot be const,curl_full_audit_0.4.35,high
API02-C,curl,lib/bufq.h,193,FP,plen size param already present; advisory misfire,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.h,194,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
API02-C,curl,lib/bufq.h,196,FP,plen size param already present; advisory misfire,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.h,197,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
API02-C,curl,lib/bufq.h,218,FP,writer callback + ctx; not a sized array; misfire,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.h,219,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
API02-C,curl,lib/bufq.h,233,FP,reader callback + ctx; not a sized array; misfire,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/bufq.h,233,FP,reader is a function-pointer typedef; const not meaningful,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.h,234,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/bufq.h,234,FP,reader_ctx is opaque callback context; const not applicable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/bufq.h,234,FP,pnread is out-param written by function; cannot be const,curl_full_audit_0.4.35,high
API02-C,curl,lib/bufq.h,242,FP,max_len + reader callback; not a sized array; misfire,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/bufq.h,243,FP,reader is a function-pointer typedef; const not meaningful,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.h,243,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/bufq.h,243,FP,reader_ctx is opaque callback context; const not applicable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/bufq.h,244,FP,pnread is out-param written by function; cannot be const,curl_full_audit_0.4.35,high
API02-C,curl,lib/bufq.h,253,FP,len size param already present; advisory misfire,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.h,254,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.h,255,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/curl_sasl.c,53,FP,mechtable[] sized by initializer list; idiomatic table,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sasl.c,81,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sasl.c,111,FP,conformant array syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/curl_sasl.c,124,FP,!strncmp idiom for option matching; idiomatic,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curl_sasl.c,128,FP,mechlen set by decode_mech via &mechlen; read only when mechbit nonzero,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_sasl.c,142,FP,internal init fn; data always valid from protocol callers,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/curl_sasl.c,142,FP,data read-only here but curl convention keeps Curl_easy non-const,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/curl_sasl.c,188,FP,names[] debug state-name table sized by initializer; idiomatic,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_sasl.c,223,FP,"sasl read via sasl->params; curl convention non-const, vtable-style",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/curl_sasl.c,232,TP,Curl_bufref_ptr may return NULL on empty success msg; *serverdata derefs NULL,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/curl_sasl.c,248,FP,sasl read via sasl->params; curl convention non-const,curl_full_audit_0.4.35,high
STR30-C,curl,lib/curl_sasl.c,254,FP,Curl_bufref_set stores const ptr with NULL free cb; literal not modified,curl_full_audit_0.4.35,high
STR30-C,curl,lib/curl_sasl.c,256,FP,Curl_bufref_set stores const ptr with NULL free cb; literal not modified,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/curl_sasl.c,261,FP,bufref getters have no shared side effects; order irrelevant,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_sasl.c,276,FP,sasl read-only but curl convention keeps these non-const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_sasl.c,276,FP,data read-only but curl convention keeps Curl_easy non-const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_sasl.c,300,FP,"data used in choose-helper, convention non-const, parallel signatures",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_sasl.c,389,FP,data (void)cast; parallel sasl_choose_* signatures require non-const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_sasl.c,468,FP,parallel sasl_choose_* signatures require uniform non-const data,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_sasl.c,488,FP,parallel sasl_choose_* signatures require uniform non-const data,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_sasl.c,505,FP,parallel sasl_choose_* signatures require uniform non-const data,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_sasl.c,525,FP,internal entrypoint; data always valid from protocol state machine,curl_full_audit_0.4.35,med
MSC37-C,curl,lib/curl_sasl.c,525,FP,function ends with return sctx.result; all paths return,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/curl_sasl.c,545,FP,"#ifdef is inside || operand chain of real functions, not a macro call arg",curl_full_audit_0.4.35,high
PRE32-C,curl,lib/curl_sasl.c,548,FP,"#ifdef inside || chain of sasl_choose_* calls, not inside memset",curl_full_audit_0.4.35,high
PRE32-C,curl,lib/curl_sasl.c,551,FP,"#ifdef inside || chain of sasl_choose_* calls, not inside memset",curl_full_audit_0.4.35,high
PRE32-C,curl,lib/curl_sasl.c,554,FP,"#ifdef inside || chain of sasl_choose_* calls, not inside memset",curl_full_audit_0.4.35,high
STR30-C,curl,lib/curl_sasl.c,789,FP,Curl_bufref_set stores const ptr with NULL free cb; literal not modified,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_sasl.c,594,FP,internal state-machine fn; data always valid from callers,curl_full_audit_0.4.35,med
API00-C,curl,lib/curl_sasl.c,871,FP,"data largely (void)cast; internal, callers guarantee valid",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_sasl.c,871,FP,sasl read-only in verbose branch but curl convention non-const,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_trc.h,54,FP,"Curl_debug(const char*ptr,size_t size); curl never uses array syntax",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,138,FP,"infof guard macro; data is side-effect-free pointer, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,138,FP,infof needs verbose-guard short-circuit; inline fn cannot replace varargs macro,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,143,FP,"CURL_TRC_M guard macro; data side-effect-free pointer, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,143,FP,"verbose-guard varargs logging macro; intentional, inline cannot replace",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,148,FP,"CURL_TRC_CF guard macro; pointers side-effect-free, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,148,FP,verbose-guard varargs logging macro; intentional design,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,153,FP,"CURL_TRC_WRITE guard macro; data side-effect-free, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,153,FP,verbose-guard varargs logging macro; intentional design,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,158,FP,"CURL_TRC_READ guard macro; data side-effect-free, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,158,FP,verbose-guard varargs logging macro; intentional design,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,163,FP,"CURL_TRC_DNS guard macro; data side-effect-free, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,163,FP,verbose-guard varargs logging macro; intentional design,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,168,FP,"CURL_TRC_TIMER guard macro; data side-effect-free, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,168,FP,verbose-guard varargs logging macro; intentional design,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,175,FP,"CURL_TRC_FTP guard macro; data side-effect-free, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,175,FP,verbose-guard varargs logging macro; intentional design,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,182,FP,"CURL_TRC_SMTP guard macro; data side-effect-free, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,182,FP,verbose-guard varargs logging macro; intentional design,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,189,FP,"CURL_TRC_SSLS guard macro; data side-effect-free, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,189,FP,verbose-guard varargs logging macro; intentional design,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,196,FP,"CURL_TRC_SSH guard macro; data side-effect-free, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,196,FP,verbose-guard varargs logging macro; intentional design,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,203,FP,"CURL_TRC_WS guard macro; data side-effect-free, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,203,FP,verbose-guard varargs logging macro; intentional design,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,311,FP,"Curl_trc_is_verbose predicate macro; data side-effect-free, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,311,FP,"verbose-check predicate macro; data is pointer, multi-eval harmless",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,315,FP,"Curl_trc_cf_is_verbose predicate macro; cf side-effect-free, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,315,FP,"verbose-check predicate macro; cf is pointer, multi-eval harmless",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_trc.h,322,FP,"CURL_TRC_EASY_TIMERS guard macro; data side-effect-free, multi-eval harmless",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_trc.h,322,FP,verbose-guard logging macro; intentional design,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftplistparser.c,175,FP,const-param on fixed callback/exported signature; categorical FP,curl_full_audit_0.4.35,high
API00-C,curl,lib/ftplistparser.c,181,FP,thin/exported wrapper; params validated by caller or DEBUGASSERT; categorical,curl_full_audit_0.4.35,high
API00-C,curl,lib/ftplistparser.c,224,FP,thin/exported wrapper; params validated by caller or DEBUGASSERT; categorical,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftplistparser.c,224,FP,const-param on fixed callback/exported signature; categorical FP,curl_full_audit_0.4.35,high
EXP07-C,curl,lib/ftplistparser.c,248,FP,"permission bit-flag construction 1<<n is idiomatic, not magic-value assumption",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/ftplistparser.c,251,FP,"permission bit-flag construction 1<<n is idiomatic, not magic-value assumption",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/ftplistparser.c,267,FP,"permission bit-flag construction 1<<n is idiomatic, not magic-value assumption",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/ftplistparser.c,270,FP,"permission bit-flag construction 1<<n is idiomatic, not magic-value assumption",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/ftplistparser.c,286,FP,"permission bit-flag construction 1<<n is idiomatic, not magic-value assumption",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/ftplistparser.c,289,FP,"permission bit-flag construction 1<<n is idiomatic, not magic-value assumption",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftplistparser.c,411,FP,mem=dyn_ptr after dyn_addn adds a byte; buffer non-empty so non-NULL,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/ftplistparser.c,412,FP,!strncmp idiom comparing prefix; idiomatic boolean test,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftplistparser.c,447,FP,mem=dyn_ptr after dyn_addn adds a byte; buffer non-empty so non-NULL,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftplistparser.c,485,FP,writing 0 (NUL terminator) into char buffer; no sign extension,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftplistparser.c,485,FP,mem=dyn_ptr after dyn_addn adds a byte; buffer non-empty so non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftplistparser.c,523,FP,mem=dyn_ptr after dyn_addn adds a byte; buffer non-empty so non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftplistparser.c,552,FP,mem=dyn_ptr after dyn_addn adds a byte; buffer non-empty so non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftplistparser.c,587,FP,mem=dyn_ptr after dyn_addn adds a byte; buffer non-empty so non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftplistparser.c,664,FP,mem=dyn_ptr after dyn_addn adds a byte; buffer non-empty so non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftplistparser.c,705,FP,mem=dyn_ptr after dyn_addn adds a byte; buffer non-empty so non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftplistparser.c,776,FP,mem=dyn_ptr after dyn_addn adds a byte; buffer non-empty so non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftplistparser.c,920,FP,mem=dyn_ptr after dyn_addn adds a byte; buffer non-empty so non-NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/ftplistparser.c,1013,FP,thin/exported wrapper; params validated by caller or DEBUGASSERT; categorical,curl_full_audit_0.4.35,high
API00-C,curl,lib/ftplistparser.c,1013,FP,thin/exported wrapper; params validated by caller or DEBUGASSERT; categorical,curl_full_audit_0.4.35,high
API00-C,curl,lib/ftplistparser.c,1013,FP,thin/exported wrapper; params validated by caller or DEBUGASSERT; categorical,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftplistparser.c,1013,FP,C99 array-param syntax; curl never uses; advisory FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftplistparser.c,1013,FP,const-param on fixed callback/exported signature; categorical FP,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftplistparser.c,1014,FP,C99 array-param syntax; curl never uses; advisory FP,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/ftplistparser.c,1040,FP,"loop-body char c read once per iter; trivial advisory, not actionable",curl_full_audit_0.4.35,med
MEM31-C,curl,lib/ftplistparser.c,1043,FP,parser->file_data freed in fail: label and by data_free cleanup,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/ftplistparser.c,1080,FP,"code after return is the fail: goto target; reachable, not dead",curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http_proxy.c,124,FP,intentional empty if/else-if chain skipping headers; deliberate no-op,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http_proxy.c,129,FP,intentional empty if/else-if chain skipping headers; deliberate no-op,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http_proxy.c,133,FP,intentional empty if/else-if chain skipping headers; deliberate no-op,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http_proxy.c,137,FP,intentional empty if/else-if chain skipping headers; deliberate no-op,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http_proxy.c,142,FP,intentional empty if/else-if chain skipping headers; deliberate no-op,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http_proxy.c,146,FP,intentional empty if/else-if chain skipping headers; deliberate no-op,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_proxy.c,154,FP,curlx_str/curlx_strlen read &name only; no unsequenced modification,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_proxy.c,165,FP,params guarded by DEBUGASSERT or set by caller; categorical wrapper FP,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_proxy.c,173,FP,"*phostname assigned a const char* pointer, not a char; analyzer misparse",curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_proxy.c,175,FP,"*phostname assigned a const char* pointer, not a char; analyzer misparse",curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_proxy.c,177,FP,"*phostname assigned a const char* pointer, not a char; analyzer misparse",curl_full_audit_0.4.35,high
API00-C,curl,lib/http_proxy.c,197,FP,params guarded by DEBUGASSERT or set by caller; categorical wrapper FP,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_proxy.c,197,FP,params guarded by DEBUGASSERT or set by caller; categorical wrapper FP,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http_proxy.c,212,FP,out-param set unconditionally by get_destination before use,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_proxy.c,212,FP,hostname set unconditionally by get_destination; non-NULL,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http_proxy.c,213,FP,out-param set unconditionally by get_destination before use,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_proxy.c,226,FP,req non-NULL after successful Curl_http_req_make (result checked),curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http_proxy.c,233,FP,!Curl_checkProxyheaders/!strcmp idiom; idiomatic boolean,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http_proxy.c,246,FP,!Curl_checkProxyheaders/!strcmp idiom; idiomatic boolean,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http_proxy.c,255,FP,!Curl_checkProxyheaders/!strcmp idiom; idiomatic boolean,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/http_proxy.c,269,FP,"req is heap pointer from Curl_http_req_make, not stack address",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http_proxy.c,301,FP,!Curl_checkProxyheaders/!strcmp idiom; idiomatic boolean,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http_proxy.c,308,FP,!Curl_checkProxyheaders/!strcmp idiom; idiomatic boolean,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_proxy.c,354,FP,params guarded by DEBUGASSERT or set by caller; categorical wrapper FP,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_proxy.c,354,FP,params guarded by DEBUGASSERT or set by caller; categorical wrapper FP,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_proxy.c,354,FP,params guarded by DEBUGASSERT or set by caller; categorical wrapper FP,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_proxy.c,354,FP,params guarded by DEBUGASSERT or set by caller; categorical wrapper FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_proxy.c,354,FP,const-param on exported/cfilter signature; categorical FP,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_proxy.c,366,FP,"*phostname assigned a const char* pointer, not a char; analyzer misparse",curl_full_audit_0.4.35,high
API00-C,curl,lib/http_proxy.c,413,FP,params guarded by DEBUGASSERT or set by caller; categorical wrapper FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_proxy.c,414,FP,const-param on exported/cfilter signature; categorical FP,curl_full_audit_0.4.35,high
API00-C,curl,lib/socks_gssapi.c,101,FP,exported entry; cf set by caller; categorical wrapper FP,curl_full_audit_0.4.35,high
STR34-C,curl,lib/socks_gssapi.c,124,FP,serviceptr char read in strlen/strchr context; no sign-extension bug,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks_gssapi.c,271,FP,Curl_safefree NULLs ptr after free; no UAF/double-free possible,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,277,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks_gssapi.c,280,FP,Curl_safefree NULLs ptr after free; no UAF/double-free possible,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks_gssapi.c,286,FP,Curl_safefree NULLs ptr after free; no UAF/double-free possible,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,289,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,306,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,316,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,380,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,393,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,407,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,416,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,426,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,435,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,443,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,450,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks_gssapi.c,458,FP,Curl_safefree NULLs ptr after free; no UAF/double-free possible,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,460,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks_gssapi.c,462,FP,Curl_safefree NULLs ptr after free; no UAF/double-free possible,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks_gssapi.c,467,FP,Curl_safefree NULLs ptr after free; no UAF/double-free possible,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,470,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks_gssapi.c,479,FP,Curl_safefree NULLs ptr after free; no UAF/double-free possible,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,484,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks_gssapi.c,486,FP,Curl_safefree NULLs ptr after free; no UAF/double-free possible,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,494,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks_gssapi.c,504,FP,Curl_safefree NULLs ptr after free; no UAF/double-free possible,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,507,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks_gssapi.c,510,FP,Curl_safefree NULLs ptr after free; no UAF/double-free possible,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks_gssapi.c,511,FP,Curl_safefree NULLs ptr after free; no UAF/double-free possible,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks_gssapi.c,526,FP,gss buffers released on every error path; no genuine leak,curl_full_audit_0.4.35,high
EXP37-C,curl,src/tool_setopt.h,102,FP,properly prototyped variadic tool_setopt_ptr declaration; legitimate,curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_setopt.h,104,FP,setopt macro arg y is always an option-name constant; no side effects,curl_full_audit_0.4.35,high
PRE05-C,curl,src/tool_setopt.h,104,FP,# / ## on y is intentional (literal token / setopt_nv_ paste); correct,curl_full_audit_0.4.35,high
PRE12-C,curl,src/tool_setopt.h,104,FP,#y is stringification not evaluation; y evaluated once; no multiple-eval risk,curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_setopt.h,105,FP,setopt macro arg y is always an option-name constant; no side effects,curl_full_audit_0.4.35,high
PRE05-C,curl,src/tool_setopt.h,105,FP,# / ## on y is intentional (literal token / setopt_nv_ paste); correct,curl_full_audit_0.4.35,high
PRE12-C,curl,src/tool_setopt.h,105,FP,#y is stringification not evaluation; y evaluated once; no multiple-eval risk,curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_setopt.h,106,FP,setopt macro arg y is always an option-name constant; no side effects,curl_full_audit_0.4.35,high
PRE05-C,curl,src/tool_setopt.h,106,FP,# / ## on y is intentional (literal token / setopt_nv_ paste); correct,curl_full_audit_0.4.35,high
PRE12-C,curl,src/tool_setopt.h,106,FP,#y is stringification not evaluation; y evaluated once; no multiple-eval risk,curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_setopt.h,107,FP,setopt macro arg y is always an option-name constant; no side effects,curl_full_audit_0.4.35,high
PRE05-C,curl,src/tool_setopt.h,107,FP,# / ## on y is intentional (literal token / setopt_nv_ paste); correct,curl_full_audit_0.4.35,high
PRE12-C,curl,src/tool_setopt.h,107,FP,#y is stringification not evaluation; y evaluated once; no multiple-eval risk,curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_setopt.h,108,FP,setopt macro arg y is always an option-name constant; no side effects,curl_full_audit_0.4.35,high
PRE05-C,curl,src/tool_setopt.h,108,FP,# / ## on y is intentional (literal token / setopt_nv_ paste); correct,curl_full_audit_0.4.35,high
PRE12-C,curl,src/tool_setopt.h,108,FP,#y is stringification not evaluation; y evaluated once; no multiple-eval risk,curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_setopt.h,109,FP,setopt macro arg y is always an option-name constant; no side effects,curl_full_audit_0.4.35,high
PRE05-C,curl,src/tool_setopt.h,109,FP,# / ## on y is intentional (literal token / setopt_nv_ paste); correct,curl_full_audit_0.4.35,high
PRE12-C,curl,src/tool_setopt.h,109,FP,#y is stringification not evaluation; y evaluated once; no multiple-eval risk,curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_setopt.h,110,FP,setopt macro arg y is always an option-name constant; no side effects,curl_full_audit_0.4.35,high
PRE05-C,curl,src/tool_setopt.h,110,FP,# / ## on y is intentional (literal token / setopt_nv_ paste); correct,curl_full_audit_0.4.35,high
PRE12-C,curl,src/tool_setopt.h,110,FP,#y is stringification not evaluation; y evaluated once; no multiple-eval risk,curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_setopt.h,111,FP,setopt macro arg y is always an option-name constant; no side effects,curl_full_audit_0.4.35,high
PRE05-C,curl,src/tool_setopt.h,111,FP,# / ## on y is intentional (literal token / setopt_nv_ paste); correct,curl_full_audit_0.4.35,high
PRE12-C,curl,src/tool_setopt.h,111,FP,#y is stringification not evaluation; y evaluated once; no multiple-eval risk,curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_setopt.h,113,FP,setopt macro arg y is always an option-name constant; no side effects,curl_full_audit_0.4.35,high
PRE05-C,curl,src/tool_setopt.h,113,FP,# / ## on y is intentional (literal token / setopt_nv_ paste); correct,curl_full_audit_0.4.35,high
PRE12-C,curl,src/tool_setopt.h,113,FP,#y is stringification not evaluation; y evaluated once; no multiple-eval risk,curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_setopt.h,118,FP,setopt macro arg y is always an option-name constant; no side effects,curl_full_audit_0.4.35,high
PRE05-C,curl,src/tool_setopt.h,118,FP,# / ## on y is intentional (literal token / setopt_nv_ paste); correct,curl_full_audit_0.4.35,high
PRE12-C,curl,src/tool_setopt.h,118,FP,#y is stringification not evaluation; y evaluated once; no multiple-eval risk,curl_full_audit_0.4.35,high
PRE08-C,curl,lib/url.c,39,FP,Windows SDK header name; not curl-controlled,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,180,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,184,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,185,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/url.c,212,FP,Indirect recursion via DoH sub-handle cleanup is intentional and bounded,curl_full_audit_0.4.35,low
EXP34-C,curl,lib/url.c,222,FP,Pointer guarded by prior len>0/non-NULL check or NULL-safe traversal,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,244,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,244,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,248,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,249,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,251,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/url.c,258,FP,Distinct cleanup fns free different members; Curl_safefree nulls; no double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,258,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,262,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,265,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,265,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/url.c,267,FP,Distinct cleanup fns free different members; Curl_safefree nulls; no double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,268,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,268,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,271,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,271,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,272,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,275,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,275,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,276,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,276,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,276,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,277,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,278,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,283,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,284,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,285,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/url.c,287,FP,Distinct cleanup fns free different members; Curl_safefree nulls; no double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,290,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,292,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,292,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,296,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,298,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,298,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,300,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,300,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,301,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,301,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,302,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,302,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,303,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,303,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,304,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,304,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,305,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,305,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,307,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,307,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,310,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,310,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,312,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,312,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,313,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,313,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,315,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,315,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,316,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,316,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,320,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,320,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,321,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,325,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/url.c,327,FP,Distinct cleanup fns free different members; Curl_safefree nulls; no double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,328,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,328,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,329,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/url.c,329,FP,Distinct cleanup fns free different members; Curl_safefree nulls; no double-free,curl_full_audit_0.4.35,high
DCL18-C,curl,lib/url.c,399,FP,0755/0644 intentional Unix file-permission octal,curl_full_audit_0.4.35,high
DCL18-C,curl,lib/url.c,402,FP,0755/0644 intentional Unix file-permission octal,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,458,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,480,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/url.c,511,FP,"Out-param assigned heap pointer (curlx_strdup/memdup0), not local address",curl_full_audit_0.4.35,high
API00-C,curl,lib/url.c,515,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API00-C,curl,lib/url.c,515,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/url.c,521,FP,Pointer guarded by prior len>0/non-NULL check or NULL-safe traversal,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,534,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,535,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,536,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,537,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,538,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,538,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,539,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,539,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,546,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,547,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,557,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,559,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/url.c,559,FP,Distinct cleanup fns free different members; Curl_safefree nulls; no double-free,curl_full_audit_0.4.35,high
API00-C,curl,lib/url.c,655,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API00-C,curl,lib/url.c,655,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/url.c,771,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,772,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,849,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,877,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,901,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,960,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,980,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,1037,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,1038,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,1062,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,1103,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,1117,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,1185,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,1390,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,1443,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/url.c,1462,FP,Code after return is a goto label target; reachable,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,1464,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,1465,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
API00-C,curl,lib/url.c,1469,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/url.c,1471,FP,Pointer guarded by prior len>0/non-NULL check or NULL-safe traversal,curl_full_audit_0.4.35,high
API05-C,curl,lib/url.c,1477,FP,Advisory C99 array-param syntax; curl never uses it,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/url.c,1528,FP,Value reassigned in loop or freed; const not applicable,curl_full_audit_0.4.35,med
ARR30-C,curl,lib/url.c,1529,FP,Loop bounded by len (<=7) or counter; not unbounded,curl_full_audit_0.4.35,high
INT14-C,curl,lib/url.c,1530,FP,Bitwise+arith in hash function is intentional,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/url.c,1531,FP,Pointer guarded by prior len>0/non-NULL check or NULL-safe traversal,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/url.c,1532,FP,"s is local char*, not a struct member; normal pointer walk",curl_full_audit_0.4.35,high
EXP15-C,curl,lib/url.c,1554,FP,Intentional empty if-arm with else fallthrough (commented),curl_full_audit_0.4.35,med
EXP33-C,curl,lib/url.c,1605,FP,"Set by out-param/calloc then guarded, or macro-opacity branch merge",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1651,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1651,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1651,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1651,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1654,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1660,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1661,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1661,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1661,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1661,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1662,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1663,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1664,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1664,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1664,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1664,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1667,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1667,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1667,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1667,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1672,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1672,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1672,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1672,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1675,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1675,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1677,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1677,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1679,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1687,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1687,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1687,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1687,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1690,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1690,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1690,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1690,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1690,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1694,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1694,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1694,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1694,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1694,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1696,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1696,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1696,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1696,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1699,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1699,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1699,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1699,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1700,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1703,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1703,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1703,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1705,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1712,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1715,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,1719,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1733,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1733,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1733,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1733,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1733,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1735,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1735,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1737,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1737,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
STR30-C,curl,lib/url.c,1738,FP,curl_url_set takes const char*; literal not modified,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1741,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1741,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1741,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1746,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1746,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1746,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1746,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1746,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1751,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1751,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1751,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1751,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1752,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1757,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1757,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1757,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1757,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1757,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1765,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1765,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1765,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1765,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1765,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1766,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1766,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1766,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1766,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1766,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1769,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1769,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1769,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1769,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1775,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1775,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1775,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1775,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1775,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1778,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1784,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1784,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1784,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1784,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1784,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1788,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1788,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1788,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1788,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1788,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1791,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1791,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1791,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1791,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1797,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1797,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1797,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1797,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1797,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1798,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1806,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1806,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1806,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1806,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1806,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,1809,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1809,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1809,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1809,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1809,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1816,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1816,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1816,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1816,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1816,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1820,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1820,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1820,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1820,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1820,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1824,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1824,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1824,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1824,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1830,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1830,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1830,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1830,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1831,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1831,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1833,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1833,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1833,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1834,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1834,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1841,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1841,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1841,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1841,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1841,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1846,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1846,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1848,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1848,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,1858,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,1864,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1866,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1867,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,1869,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,1871,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/url.c,1934,FP,"In-place str{lower,upper} with overlapping src==dst is documented behavior",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,1949,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/url.c,1972,FP,"Set by out-param/calloc then guarded, or macro-opacity branch merge",curl_full_audit_0.4.35,high
EXP43-C,curl,lib/url.c,1994,FP,"In-place str{lower,upper} with overlapping src==dst is documented behavior",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/url.c,2012,FP,"Set by out-param/calloc then guarded, or macro-opacity branch merge",curl_full_audit_0.4.35,high
EXP15-C,curl,lib/url.c,2084,FP,Intentional empty if-arm with else fallthrough (commented),curl_full_audit_0.4.35,med
DCL31-C,curl,lib/url.c,2132,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,2140,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,2166,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
INT30-C,curl,lib/url.c,2217,FP,host non-empty after url_get; len-1 in bounds,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,2242,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
MEM03-C,curl,lib/url.c,2247,FP,Sensitive-clear advisory on const literals / local; not a real issue,curl_full_audit_0.4.35,med
MEM30-C,curl,lib/url.c,2257,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/url.c,2326,FP,"curl_getenv returns malloc copy, not env ptr; safefree valid",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2331,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/url.c,2337,FP,Distinct cleanup fns free different members; Curl_safefree nulls; no double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2341,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2343,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2400,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2401,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2401,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2401,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2402,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2405,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2414,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2414,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2414,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2414,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2414,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2416,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2416,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2418,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2419,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2420,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2421,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2422,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2425,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/url.c,2430,FP,Distinct cleanup fns free different members; Curl_safefree nulls; no double-free,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/url.c,2431,FP,Distinct cleanup fns free different members; Curl_safefree nulls; no double-free,curl_full_audit_0.4.35,high
API00-C,curl,lib/url.c,2466,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API00-C,curl,lib/url.c,2466,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API00-C,curl,lib/url.c,2466,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API00-C,curl,lib/url.c,2466,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API05-C,curl,lib/url.c,2466,FP,Advisory C99 array-param syntax; curl never uses it,curl_full_audit_0.4.35,high
API05-C,curl,lib/url.c,2467,FP,Advisory C99 array-param syntax; curl never uses it,curl_full_audit_0.4.35,high
API05-C,curl,lib/url.c,2467,FP,Advisory C99 array-param syntax; curl never uses it,curl_full_audit_0.4.35,high
API05-C,curl,lib/url.c,2468,FP,Advisory C99 array-param syntax; curl never uses it,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/url.c,2515,FP,Pointer guarded by prior len>0/non-NULL check or NULL-safe traversal,curl_full_audit_0.4.35,high
STR34-C,curl,lib/url.c,2519,FP,char** deref / char* write misread as signed-char read,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/url.c,2521,FP,"Out-param assigned heap pointer (curlx_strdup/memdup0), not local address",curl_full_audit_0.4.35,high
STR34-C,curl,lib/url.c,2521,FP,char** deref / char* write misread as signed-char read,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/url.c,2522,FP,"Out-param assigned heap pointer (curlx_strdup/memdup0), not local address",curl_full_audit_0.4.35,high
STR34-C,curl,lib/url.c,2522,FP,char** deref / char* write misread as signed-char read,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/url.c,2524,FP,Code after return is a goto label target; reachable,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,2525,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,2526,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,2538,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/url.c,2561,FP,Loop bounded by len (<=7) or counter; not unbounded,curl_full_audit_0.4.35,high
EXP40-C,curl,lib/url.c,2579,FP,Taking address of non-const struct member to modify it,curl_full_audit_0.4.35,high
MEM03-C,curl,lib/url.c,2580,FP,Sensitive-clear advisory on const literals / local; not a real issue,curl_full_audit_0.4.35,med
EXP40-C,curl,lib/url.c,2580,FP,Taking address of non-const struct member to modify it,curl_full_audit_0.4.35,high
EXP40-C,curl,lib/url.c,2581,FP,Taking address of non-const struct member to modify it,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,2584,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
STR34-C,curl,lib/url.c,2585,FP,char** deref / char* write misread as signed-char read,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,2585,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2643,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
STR34-C,curl,lib/url.c,2648,FP,char** deref / char* write misread as signed-char read,curl_full_audit_0.4.35,high
STR34-C,curl,lib/url.c,2672,FP,char** deref / char* write misread as signed-char read,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,2672,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
STR34-C,curl,lib/url.c,2689,FP,char** deref / char* write misread as signed-char read,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,2689,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,2701,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
MEM03-C,curl,lib/url.c,2706,FP,Sensitive-clear advisory on const literals / local; not a real issue,curl_full_audit_0.4.35,med
EXP15-C,curl,lib/url.c,2709,FP,Intentional empty if-arm with else fallthrough (commented),curl_full_audit_0.4.35,med
DCL31-C,curl,lib/url.c,2717,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,2724,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
STR34-C,curl,lib/url.c,2749,FP,char** deref / char* write misread as signed-char read,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,2755,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
STR34-C,curl,lib/url.c,2782,FP,char** deref / char* write misread as signed-char read,curl_full_audit_0.4.35,high
STR34-C,curl,lib/url.c,2800,FP,char** deref / char* write misread as signed-char read,curl_full_audit_0.4.35,high
STR34-C,curl,lib/url.c,2817,FP,char** deref / char* write misread as signed-char read,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,2817,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,2826,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,2835,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
STR34-C,curl,lib/url.c,2845,FP,char** deref / char* write misread as signed-char read,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/url.c,2856,FP,Value reassigned in loop or freed; const not applicable,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/url.c,2865,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/url.c,2884,FP,"Set by out-param/calloc then guarded, or macro-opacity branch merge",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,2905,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
CON34-C,curl,lib/url.c,2949,FP,"getenv in DEBUGBUILD-only branch; dup of CON33 style, idiomatic",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2977,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2981,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,2991,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3000,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/url.c,3035,FP,host=conn-owned ptr in infof; no UB sequencing issue,curl_full_audit_0.4.35,med
MEM30-C,curl,lib/url.c,3035,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,3065,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/url.c,3093,FP,"Out-param assigned heap pointer (curlx_strdup/memdup0), not local address",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/url.c,3120,FP,!strncmp boolean idiom in dispatch,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,3151,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3182,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM33-C,curl,lib/url.c,3182,FP,url_move_hostname struct-copy move semantics after member free; intentional,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/url.c,3183,FP,memset of fixed-size struct member; size correct,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/url.c,3189,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,3198,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,3199,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3207,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3208,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3208,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3210,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3211,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3212,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3213,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3214,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3215,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3216,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3217,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3236,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/url.c,3237,FP,Curl_safefree nulls distinct struct members / free-then-reassign; not real UAF,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,3241,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/url.c,3246,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,3288,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,3296,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/url.c,3431,FP,"Out-param assigned heap pointer (curlx_strdup/memdup0), not local address",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/url.c,3467,FP,Pointer guarded by prior len>0/non-NULL check or NULL-safe traversal,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/url.c,3518,FP,Pointer guarded by prior len>0/non-NULL check or NULL-safe traversal,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/url.c,3525,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/url.c,3560,FP,Pointer guarded by prior len>0/non-NULL check or NULL-safe traversal,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/url.c,3583,FP,Pointer guarded by prior len>0/non-NULL check or NULL-safe traversal,curl_full_audit_0.4.35,high
API00-C,curl,lib/url.c,3653,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API00-C,curl,lib/url.c,3653,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API00-C,curl,lib/url.c,3653,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API00-C,curl,lib/url.c,3674,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API00-C,curl,lib/url.c,3674,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API00-C,curl,lib/url.c,3674,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API00-C,curl,lib/url.c,3746,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/url.c,3776,FP,Pointer param is modified (members written) or fixed by external typedef,curl_full_audit_0.4.35,high
EXP40-C,curl,lib/url.c,3779,FP,Taking address of non-const struct member to modify it,curl_full_audit_0.4.35,high
API00-C,curl,lib/url.c,3798,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/url.c,3810,FP,"Set by out-param/calloc then guarded, or macro-opacity branch merge",curl_full_audit_0.4.35,high
API00-C,curl,lib/url.c,3864,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
ARR01-C,curl,lib/url.c,3866,FP,memset of fixed-size struct member; size correct,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/url.c,3876,FP,curlx_* are internal macros/allocators declared in curl headers; false no-decl,curl_full_audit_0.4.35,high
API00-C,curl,lib/url.c,3882,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API00-C,curl,lib/url.c,3882,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API00-C,curl,lib/url.c,3887,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
API00-C,curl,lib/url.c,3887,FP,Thin/exported wrapper with documented non-NULL contract; siblings lack guard too,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/sendf.c,53,FP,curlx_free is a curl alloc wrapper declared in headers; not undeclared,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/sendf.c,53,FP,loop frees a distinct list node each iteration; not a double free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/sendf.c,54,FP,data (easy handle) is never freed; only writer node is,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/sendf.c,54,FP,"duplicate finding; data not freed, accessing data->req is fine",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/sendf.c,65,FP,curlx_free declared in headers; wrapper,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/sendf.c,65,FP,loop frees distinct reader node each iteration,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/sendf.c,66,FP,data not freed; reader node freed; data->req access valid,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/sendf.c,66,FP,duplicate; no UAF of data,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,70,FP,"internal API; data always valid easy handle, siblings do not null-check",curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,79,FP,internal API; data always valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,95,FP,internal API; data always valid,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/sendf.c,98,FP,r is modified (r = r->next at line 109); not const-able,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,117,FP,thin accessor; data always valid,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,117,FP,public API signature; const not part of convention,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,122,FP,thin setter; data always valid,curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.c,130,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,137,FP,vtable do_init signature fixed by Curl_cwtype typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,138,FP,vtable signature; const fixed by function-pointer typedef,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,145,FP,vtable do_write impl; data always valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,145,FP,vtable impl; writer passed non-null by dispatch,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,145,FP,"buf forwarded, not dereferenced here",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,146,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.c,147,FP,advisory array syntax; not curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,152,FP,vtable do_close signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,153,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,159,FP,"static helper passes data through; advisory, curl no convention",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,177,FP,vtable cw_download_write signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.c,178,FP,advisory array syntax,curl_full_audit_0.4.35,high
INT00-C,curl,lib/sendf.c,233,FP,guarded by if(nwrite>wmax) where nwrite=nbytes; subtraction safe,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,307,FP,vtable cw_raw_write signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.c,308,FP,advisory array syntax,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/sendf.c,325,FP,init/add cycle guarded by if(!*anchor); not unbounded recursion,curl_full_audit_0.4.35,med
MEM31-C,curl,lib/sendf.c,331,FP,"result stored into req.writer_stack, owned/freed by cl_reset_writer",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/sendf.c,339,FP,"writer added to stack on success, freed on failure; no leak",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/sendf.c,342,FP,"writer set via Curl_cwriter_create out-param, guarded by !result",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/sendf.c,349,FP,"writer reassigned by new create; freed-then-overwrite, not UAF",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/sendf.c,349,FP,"writer freed on add-fail, else owned by stack; no leak",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/sendf.c,349,FP,"writer overwritten by create out-param, not dereferenced after free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/sendf.c,351,FP,writer is freshly created non-freed pointer at this point,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/sendf.c,353,FP,single Curl_cwriter_free per branch; no double free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/sendf.c,358,FP,writer reassigned by create; freed-then-overwrite not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/sendf.c,358,FP,writer overwritten by out-param before use,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/sendf.c,360,FP,freshly created writer; not previously freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/sendf.c,362,FP,single free per branch; no double free,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,375,FP,buf is forwarded; DEBUGASSERTs guard; internal API,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/sendf.c,375,FP,"Curl_client_write is exported, declared in sendf.h",curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.c,376,FP,advisory array syntax,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,404,FP,data passed to do_init; always valid; internal API,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/sendf.c,414,FP,curlx_calloc declared in curl alloc headers,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/sendf.c,418,FP,casting void* (calloc) to struct*; no const involved,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/sendf.c,427,FP,curlx_free declared in headers,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/sendf.c,436,FP,curlx_free declared in headers,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/sendf.c,436,FP,single free guarded by if(writer); not double free,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,440,FP,iterates data->req.writer_stack; data always valid,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,440,FP,exported API; advisory const not curl convention,curl_full_audit_0.4.35,med
API00-C,curl,lib/sendf.c,452,FP,internal API; data always valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,452,FP,writer passed non-null by callers,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/sendf.c,452,FP,guarded init cycle (if(!*anchor)); not unbounded,curl_full_audit_0.4.35,med
EXP40-C,curl,lib/sendf.c,456,FP,anchor = &writer_stack; no const qualifier in play,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/sendf.c,466,FP,writer is non-null param from callers; loop derefs writer->phase safely,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,473,FP,iterates writer_stack; data always valid,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,473,FP,advisory const; exported API,curl_full_audit_0.4.35,med
EXP20-C,curl,lib/sendf.c,478,FP,!strcmp name match is idiomatic curl convention,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/sendf.c,479,FP,"writer is loop var pointing to heap list nodes, not automatic storage",curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,484,FP,iterates writer_stack; data always valid,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,484,FP,advisory const; exported API,curl_full_audit_0.4.35,med
DCL30-C,curl,lib/sendf.c,490,FP,"writer points to heap list node, not local automatic storage",curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,495,FP,iterates writer_stack; data always valid,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,495,FP,advisory const; exported API,curl_full_audit_0.4.35,med
API00-C,curl,lib/sendf.c,510,FP,thin wrapper to Curl_cw_out_unpause; data forwarded,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/sendf.c,510,FP,"long cycle through pause/unpause; bounded by state, not unbounded recursion",curl_full_audit_0.4.35,med
API00-C,curl,lib/sendf.c,515,FP,sets *nread/*eos then null-checks reader; internal API,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,515,FP,buf forwarded to do_read; not dereferenced here,curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.c,517,FP,advisory array syntax,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,526,FP,while(reader) handles null; zero iterations safe,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,535,FP,vtable do_init signature fixed by Curl_crtype typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,536,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,543,FP,vtable do_close signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,544,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,550,FP,vtable do_read impl; nread written via out-param chain,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,550,FP,vtable impl; eos out-param forwarded,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,551,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.c,552,FP,advisory array syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,565,FP,vtable needs_rewind signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,566,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,573,FP,vtable total_length impl; data forwarded,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,573,FP,vtable impl; reader->next checked,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,574,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,580,FP,vtable resume_from signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,581,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,590,FP,vtable cntrl signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,591,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,600,FP,vtable is_paused signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,601,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,608,FP,vtable done signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,609,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,629,FP,vtable cr_in_read signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,629,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,641,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.c,642,FP,advisory array syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,739,FP,vtable cr_in_needs_rewind signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,740,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,747,FP,vtable cr_in_total_length signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,748,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,756,FP,vtable cr_in_resume_from signature fixed by typedef,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/sendf.c,782,FP,"char scratch[4*1024] is fixed-size, not a VLA",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,819,FP,"static cr_in_rewind passes reader to ctx; advisory, no curl convention",curl_full_audit_0.4.35,high
ERR33-C,curl,lib/sendf.c,864,FP,fseek return stored in err and checked via if(err != -1),curl_full_audit_0.4.35,high
ERR00-C,curl,lib/sendf.c,864,FP,fseek return is checked at line 867,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,900,FP,vtable cr_in_is_paused signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,901,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,922,FP,data forwarded to do_init; always valid; internal API,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/sendf.c,932,FP,curlx_calloc declared in curl alloc headers,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/sendf.c,936,FP,casting void* (calloc) to struct*; no const involved,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/sendf.c,945,FP,curlx_free declared in headers,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/sendf.c,953,FP,curlx_free declared in headers,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/sendf.c,953,FP,single free guarded by if(reader); not double free,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,965,FP,vtable cr_lc_init signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,965,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,973,FP,vtable cr_lc_close signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,973,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,982,FP,vtable cr_lc_read signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.c,983,FP,advisory array syntax,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/sendf.c,1029,FP,"i-start is size_t index subtraction, not pointer subtraction",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1059,FP,vtable cr_lc_total_length signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1060,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/sendf.c,1082,FP,guarded reader-stack init cycle; not unbounded recursion,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/sendf.c,1089,FP,"add only entered when !result, so reader is non-null",curl_full_audit_0.4.35,high
MSC04-C,curl,lib/sendf.c,1096,FP,guarded init cycle; not unbounded recursion,curl_full_audit_0.4.35,med
API00-C,curl,lib/sendf.c,1124,FP,data forwarded; internal API; always valid,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/sendf.c,1124,FP,guarded init cycle; not unbounded recursion,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/sendf.c,1133,FP,"r set via create out-param, guarded by if(result) goto out",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/sendf.c,1133,FP,r non-null after !result guard; ctx = r->ctx safe,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/sendf.c,1134,FP,"ctx = r->ctx where ctx is calloc'd region, non-null",curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,1144,FP,internal API; data always valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,1144,FP,reader non-null from callers; insertion logic,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/sendf.c,1144,FP,guarded init cycle; not unbounded recursion,curl_full_audit_0.4.35,med
EXP40-C,curl,lib/sendf.c,1148,FP,anchor = &reader_stack; no const qualifier in play,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/sendf.c,1158,FP,reader is non-null param; loop derefs (*anchor) safely,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,1165,FP,DEBUGASSERT(r) guards; internal API,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,1165,FP,r asserted non-null; internal API,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,1180,FP,DEBUGASSERT(buf) guards; internal API,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,1180,FP,buf asserted; forwarded to read chain,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/sendf.c,1180,FP,"Curl_client_read is exported, declared in sendf.h",curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.c,1180,FP,advisory array syntax,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,1222,FP,while(reader) handles null; internal API,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1235,FP,vtable cr_null_read signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1236,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.c,1237,FP,advisory array syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1237,FP,vtable read buf is output buffer; written via memcpy elsewhere,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1249,FP,vtable cr_null_total_length signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1250,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,1272,FP,data forwarded to create/do_init; internal API,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/sendf.c,1277,FP,result is CURLcode int; r ownership passed to reader_stack,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/sendf.c,1282,FP,result is CURLcode int; r handed to do_init_reader_stack,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/sendf.c,1282,FP,"r set via create out-param, guarded by if(result) return",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1293,FP,vtable cr_buf_read signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.c,1294,FP,advisory array syntax,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/sendf.c,1307,FP,memcpy dest buf is char* (non-const); source const; no const cast,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1317,FP,vtable cr_buf_needs_rewind signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1318,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1325,FP,vtable cr_buf_cntrl signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1326,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1341,FP,vtable cr_buf_total_length signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1342,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1349,FP,vtable cr_buf_resume_from signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1350,FP,vtable signature fixed by typedef,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,1386,FP,data forwarded; internal API; always valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,1386,FP,buf stored into ctx->buf; may be null legitimately (cr_buf_read handles),curl_full_audit_0.4.35,high
API05-C,curl,lib/sendf.c,1387,FP,advisory array syntax,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/sendf.c,1396,FP,"r set via create out-param, guarded by if(result) goto out",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/sendf.c,1396,FP,r non-null after guard; ctx = r->ctx safe,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/sendf.c,1397,FP,"ctx is calloc'd reader region, non-null after guard",curl_full_audit_0.4.35,high
DCL00-C,curl,lib/sendf.c,1410,FP,advisory const-qualify; r is short-lived local pointer; idiomatic,curl_full_audit_0.4.35,med
API00-C,curl,lib/sendf.c,1414,FP,while loop handles null r; internal API,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/sendf.c,1416,FP,advisory const-qualify; idiomatic local,curl_full_audit_0.4.35,med
API00-C,curl,lib/sendf.c,1422,FP,while loop handles null r; internal API,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/sendf.c,1424,FP,advisory const-qualify; idiomatic local,curl_full_audit_0.4.35,med
API00-C,curl,lib/sendf.c,1430,FP,while(reader) handles null; internal API,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,1445,FP,while(reader) handles null; internal API,curl_full_audit_0.4.35,high
API00-C,curl,lib/sendf.c,1466,FP,for loop handles null; internal API,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sendf.c,1466,FP,advisory const; exported API,curl_full_audit_0.4.35,med
DCL30-C,curl,lib/sendf.c,1472,FP,"r is loop var pointing to heap list node, not local automatic storage",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/vssh/libssh.c,70,FP,Free-macro x always a simple lvalue (member access); no side-effect from multiple eval,curl_full_audit_0.4.35,med
PRE01-C,curl,lib/vssh/libssh.c,70,FP,x used only as statement-level lvalue; no operator-precedence hazard,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/vssh/libssh.c,70,FP,"Idiomatic guarded-free macro; lvalue arg, multiple eval benign",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vssh/libssh.c,121,FP,sshc threaded through state-machine helpers fixed by convention; curl does not const-qualify,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/vssh/libssh.c,155,FP,md5buffer written by snprintf loop at 154-155 before read at 157,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh.c,155,FP,md5buffer filled by snprintf before any read,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vssh/libssh.c,155,FP,hash guarded by rc!=SSH_OK||hlen!=16 goto cleanup before use,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vssh/libssh.c,186,FP,known_base64 set by export; rc!=SSH_OK goto cleanup guards use,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vssh/libssh.c,236,FP,found_base64 set by export; rc!=SSH_OK goto cleanup guards use,curl_full_audit_0.4.35,high
MEM03-C,curl,lib/vssh/libssh.c,298,FP,"known_base64 is a base64 public key, not sensitive secret data",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh.c,358,FP,sshp state-machine helper param; curl convention does not const-qualify,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vssh/libssh.c,383,FP,sshp state-machine helper param; not const-qualified by convention,curl_full_audit_0.4.35,med
MEM30-C,curl,lib/vssh/libssh.c,391,FP,sftp_attributes_free frees PREVIOUS value at 389; member reassigned by sftp_readdir,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,391,FP,"sftp_dir is a live libssh handle, not freed here",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,392,FP,readdir_attrs just reassigned at 391; not freed memory,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,393,FP,readdir_attrs reassigned at 391; accessing live attrs->name,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,393,FP,readdir_attrs is live after reassignment at 391,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,394,FP,readdir_attrs live; longname read from valid struct,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,394,FP,"readdir_attrs reassigned at 391, not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,395,FP,readdir_filename just assigned from live attrs->name,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,400,FP,readdir_filename points into live readdir_attrs,curl_full_audit_0.4.35,high
INT14-C,curl,lib/vssh/libssh.c,407,FP,readdir_len+1 is pure arithmetic; no bitwise op present (misparse),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,407,FP,readdir_len just assigned via strlen; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,417,FP,readdir_buf is a dyn buffer reset not freed; live,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,417,FP,readdir_longentry points into live readdir_attrs,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,423,FP,readdir_attrs->flags read from live struct,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,423,FP,readdir_attrs live after reassignment at 391,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,424,FP,readdir_attrs->permissions read from live struct,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,424,FP,readdir_attrs not freed; live,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,427,FP,readdir_filename points into live attrs,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,429,FP,readdir_linkPath just assigned by curl_maprintf at 426,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,442,FP,"sftp_dir is a live libssh handle, not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,447,FP,"ssh_session is the live connection session, not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,459,FP,sftp_attributes_free at 457 frees PREVIOUS link_attrs; reassigned at 459,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,460,FP,readdir_linkPath still live (freed later at 483),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,461,FP,readdir_link_attrs just assigned by sftp_lstat at 459,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,463,FP,ssh_session live; only passed to ssh_get_error,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,467,FP,link_attrs->name read from live struct,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,467,FP,readdir_link_attrs live after 459 reassignment,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,468,FP,"sftp_session live handle, not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,469,FP,readdir_linkPath still live (freed at 483),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,470,FP,readdir_tmp just assigned by sftp_readlink at 468,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,473,FP,readdir_tmp live; strlen on it,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,475,FP,"readdir_tmp live, assigned to readdir_filename",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,478,FP,link_attrs->name from live struct (else branch),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,478,FP,readdir_link_attrs live; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,479,FP,link_attrs->name read from live struct,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,479,FP,readdir_link_attrs live,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,480,FP,link_attrs->longname read from live struct,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,480,FP,readdir_link_attrs live,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,485,FP,"readdir_buf is dyn buffer (curlx_dyn_addf), not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,485,FP,readdir_filename live (points into attrs or readdir_tmp),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,498,FP,link_attrs freed once here (459-block frees only prior value); NULLed at 499,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vssh/libssh.c,515,FP,dyn_ptr/dyn_len are pure getters on same buffer; no unsequenced side effects,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh.c,608,FP,conn used in auth helper; curl does not const-qualify these params,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/vssh/libssh.c,643,FP,nprompts assigned at 642 immediately before use at 643,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh.c,690,FP,"conn param of block2waitfor; curl convention, (void)conn",curl_full_audit_0.4.35,med
INT13-C,curl,lib/vssh/libssh.c,699,FP,"masking known SSH poll flag bits; dir small non-negative, idiomatic",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vssh/libssh.c,953,FP,sshp state-machine helper param; curl convention,curl_full_audit_0.4.35,med
MEM30-C,curl,lib/vssh/libssh.c,967,FP,size is curl_off_t scalar copied from attrs->size; attrs freed not size,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,971,FP,data not freed; data->state.resume_from assignment to live struct,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/vssh/libssh.c,997,FP,sftp_open handle (not posix fd); closed by sftp_close in CLOSE/SHUTDOWN,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vssh/libssh.c,1041,FP,"scratch[4*1024] is fixed-size array, not a VLA",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh.c,1041,FP,scratch is a local buffer filled by fread_func at 1048 before use,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh.c,1101,FP,sshp state-machine helper param; curl convention,curl_full_audit_0.4.35,med
FIO42-C,curl,lib/vssh/libssh.c,1107,FP,"sftp_open handle, closed by sftp_close in CLOSE/SHUTDOWN states",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh.c,1158,FP,from is out-param filled by Curl_ssh_range before use in sftp_seek64,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh.c,1218,FP,sshp state-machine helper param; curl convention,curl_full_audit_0.4.35,med
MEM30-C,curl,lib/vssh/libssh.c,1254,FP,guarded if(sftp_file) then sftp_close+NULL; no UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1255,FP,sftp_file closed and NULLed in same block; not reused,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1259,FP,sftp_session guarded then freed+NULLed; distinct member,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh.c,1276,FP,"sftp_session is a connection member freed by SHUTDOWN/sshc_cleanup, not local leak",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh.c,1287,FP,sftp_session freed later by sshc_cleanup via conn dtor; not leaked on this return,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh.c,1290,FP,"sftp_session owned by sshc, freed by cleanup; not a leak",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1301,FP,most_recent_ftp_entrypath freed then reassigned by strdup; not UAF on data->state,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1302,FP,data->state not freed; member reassigned by curlx_strdup,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1303,FP,most_recent_ftp_entrypath freed at 1301 then reassigned at 1302; checked here,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1303,FP,"data->state is live struct, not freed",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh.c,1362,FP,sshp state-machine helper param; curl convention,curl_full_audit_0.4.35,med
EXP20-C,curl,lib/vssh/libssh.c,1446,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1447,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1448,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1449,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1450,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1474,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1475,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1496,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1503,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1524,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1531,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1561,FP,quote_item walked to ->next; safefree at 1558-59 frees distinct path members,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1561,FP,quote_item is a list node not freed; advanced to next,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1563,FP,quote_item live after advance; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1567,FP,"nextstate is an enum field, not freed memory",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1568,FP,nextstate enum field; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1601,FP,sftp_session live; sftp_attributes_free at 1600 freed prior quote_attrs only,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1601,FP,quote_path2 live; not freed in this path,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1602,FP,quote_attrs just assigned by sftp_stat at 1601,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1604,FP,sftp_session live; passed to sftp_get_error,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1610,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1611,FP,quote_path1 live; read into local p,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1618,FP,quote_attrs live (sftp_stat result); fields written,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1619,FP,quote_attrs live; flags OR-assigned,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1621,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1623,FP,quote_path1 live; read into local p,curl_full_audit_0.4.35,high
DCL18-C,curl,lib/vssh/libssh.c,1624,FP,07777 is intentional octal chmod permission mask (str_octal base arg),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1629,FP,quote_attrs live; permissions field set,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1630,FP,quote_attrs live; flags OR-assigned,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1632,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1633,FP,quote_path1 live; read into local p,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1640,FP,quote_attrs live; uid field set,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1641,FP,quote_attrs live; flags OR-assigned,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1643,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1644,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1647,FP,quote_path1 live; passed to Curl_getdate_capped,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh.c,1664,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1665,FP,quote_attrs live; atime field set,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1667,FP,quote_attrs live; mtime field set,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1669,FP,quote_attrs live; flags OR-assigned,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vssh/libssh.c,1681,FP,sockindex guarded by CONN_SOCK_IDX_VALID(sockindex) at 1680,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vssh/libssh.c,1684,FP,sockindex bounds-checked by CONN_SOCK_IDX_VALID at 1680,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vssh/libssh.c,1685,FP,sockindex bounds-checked by CONN_SOCK_IDX_VALID at 1680,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh.c,1775,FP,scp_session is connection member freed by SESSION_DISCONNECT/sshc_cleanup,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh.c,1836,FP,curlx_dyn_free in cleanup destructor; readdir_buf not used after,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vssh/libssh.c,2064,FP,slash_pos guarded by else if(sshc->slash_pos) at 2063 before deref,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh.c,2090,FP,err assigned at 2089 (sftp_get_error) immediately before use at 2090,curl_full_audit_0.4.35,high
INT13-C,curl,lib/vssh/libssh.c,2273,FP,"waitfor holds small KEEP_* flag bits; masking idiomatic, non-negative",curl_full_audit_0.4.35,med
INT13-C,curl,lib/vssh/libssh.c,2275,FP,waitfor flag-bit masking; idiomatic,curl_full_audit_0.4.35,med
EXP36-C,curl,lib/vssh/libssh.c,2293,FP,Curl_meta_get returns calloc'd struct (aligned); char* is generic void* cast,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh.c,2345,FP,conformant-array advisory; curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh.c,2345,FP,dtor callback signature fixed by Curl_meta_dtor typedef; const not addable,curl_full_audit_0.4.35,med
API05-C,curl,lib/vssh/libssh.c,2345,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh.c,2354,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh.c,2354,FP,dtor callback signature fixed by Curl_meta_dtor typedef,curl_full_audit_0.4.35,med
API05-C,curl,lib/vssh/libssh.c,2354,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh.c,2360,FP,sshc_cleanup frees members; curlx_free(sshc) frees container once; not double-free,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh.c,2372,FP,sshc assigned by curlx_calloc at 2372 then NULL-checked at 2373,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh.c,2381,FP,sshp assigned by curlx_calloc at 2381 then NULL-checked at 2382,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vssh/libssh.c,2384,FP,sshc/sshp registered via meta_set with dtors; ownership transferred (dtor frees on failure too),curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vssh/libssh.c,2386,FP,sshc/sshp owned by conn/easy meta with dtors; not leaked,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vssh/libssh.c,2401,FP,meta_get returns aligned calloc'd struct; generic void* cast,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh.c,2410,FP,"scp_recv is a static function (forward-declared at 2389), assigned not read-uninit",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh.c,2411,FP,"scp_send is a static function name, not an uninitialized variable",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh.c,2414,FP,sftp_recv is a static function name (decl 2389),curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh.c,2415,FP,sftp_send is a static function name (decl 2390),curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh.c,2418,FP,ssh_session stored in sshc (registered in conn meta); freed by sshc_cleanup dtor,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/vssh/libssh.c,2425,FP,"ipv6 buffer formatted from conn->host.name, not getenv result",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh.c,2434,FP,"ssh_session owned by sshc, freed by conn dtor even on this early return",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh.c,2447,FP,ssh_session freed by sshc_cleanup via conn dtor; not leaked here,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh.c,2455,FP,ssh_session freed by conn dtor on cleanup; not a local leak,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh.c,2470,FP,ssh_session freed by conn dtor; not leaked,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh.c,2479,FP,ssh_session freed by conn dtor; not leaked,curl_full_audit_0.4.35,high
STR30-C,curl,lib/vssh/libssh.c,2484,FP,ssh_options_set takes const void* and copies value; literal not modified,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh.c,2488,FP,ssh_session freed by conn dtor; not leaked,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh.c,2500,FP,ssh_session freed by conn dtor; not leaked,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh.c,2511,FP,ssh_session freed by conn dtor; not leaked,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vssh/libssh.c,2571,FP,"meta_get aligned struct; generic void* cast, no real alignment violation",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vssh/libssh.c,2590,FP,meta_get aligned struct; generic void* cast,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh.c,2620,FP,scp_send signature fixed by Curl_send function-pointer typedef; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh.c,2621,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh.c,2654,FP,scp_recv signature fixed by Curl_recv typedef; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh.c,2655,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vssh/libssh.c,2744,FP,meta_get aligned struct; generic void* cast,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vssh/libssh.c,2780,FP,sftp_send: every switch case (incl default) returns; no fallthrough to end,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh.c,2780,FP,sftp_send signature fixed by Curl_send typedef; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh.c,2781,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh.c,2807,FP,nwrite assigned at 2806 (sftp_aio_wait_write) before use at 2807,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh.c,2861,FP,sftp_recv signature fixed by Curl_recv typedef; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh.c,2862,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh.c,2900,FP,nread assigned at 2894/2896 before use at 2900,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/vssh/libssh.c,2917,FP,"default: return is a reachable switch arm, not dead code after a return",curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh.c,2964,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/multi.c,82,FP,[adv] GOOD_MULTI_HANDLE macro evaluates x multiple times; genuine multi-eval macro,curl_full_audit_0.4.35,adversarial-flip
PRE12-C,curl,lib/multi.c,82,FP,"[adv] same macro, x evaluated twice; inline fn would be safer",curl_full_audit_0.4.35,adversarial-flip
PRE00-C,curl,lib/multi.c,86,FP,[adv] non-debug GOOD_MULTI_HANDLE also evaluates x twice,curl_full_audit_0.4.35,adversarial-flip
PRE12-C,curl,lib/multi.c,86,FP,[adv] multi-eval of x in macro,curl_full_audit_0.4.35,adversarial-flip
API02-C,curl,lib/multi.c,95,FP,"timeout_ms is single out-param long*, not an array; no size needed",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,106,FP,multi_now internal helper; multi always non-NULL from internal callers,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,207,FP,ph_freeentry is hash dtor vtable signature; const cannot be added,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,224,FP,multi_addmsg internal; multi non-NULL,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,235,FP,curlx_calloc is curl-internal allocator declared in headers,curl_full_audit_0.4.35,high
CON34-C,curl,lib/multi.c,275,FP,getenv in DEBUGBUILD init only; not thread-shared concern here,curl_full_audit_0.4.35,med
MSC07-C,curl,lib/multi.c,309,FP,"'error:' is a goto label, not unreachable code after return",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/multi.c,323,FP,"Curl_mntfy_cleanup on member; single curlx_free(multi) at 331, no double-free",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,331,FP,curlx_free is internal macro/function from headers,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/multi.c,331,FP,single free of multi; prior cleanups are distinct member destructors,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,347,FP,multi_warn_debug internal; multi non-NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,358,FP,Curl_is_connecting internal; data always valid from callers,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,358,FP,curl convention does not const-qualify easy handle params,curl_full_audit_0.4.35,low
DCL00-C,curl,lib/multi.c,367,FP,new_size IS modified at lines 388/393; const suggestion wrong,curl_full_audit_0.4.35,high
INT00-C,curl,lib/multi.c,380,FP,used=tbl_count<=capacity invariant; subtraction cannot underflow,curl_full_audit_0.4.35,high
INT14-C,curl,lib/multi.c,380,FP,capacity>>2 vs arithmetic is idiomatic; readability advisory only,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,438,FP,curl_multi_add_handle checks GOOD_MULTI_HANDLE/GOOD_EASY_HANDLE before this,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,441,FP,multi validated by GOOD_MULTI_HANDLE at function entry,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/multi.c,529,FP,CURL_TRC_M args are pure reads; no conflicting side effects,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,542,FP,debug_print_sock_hash in #if 0 block; hash-print callback signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,556,FP,multi_conn_should_close reads data; curl convention keeps handle non-const,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/multi.c,665,FP,multi_done recursion bounded by data->state.done guard; not infinite,curl_full_audit_0.4.35,med
MEM30-C,curl,lib/multi.c,687,FP,Curl_safefree(data->req.newurl) nulls it; later data->req access is unrelated member,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/multi.c,688,FP,data->req struct not freed; safefree only freed newurl/location members,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/multi.c,705,FP,"data->mstate is a field, never freed; not UAF",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/multi.c,713,FP,no char*->int* alignment cast; misparse of progress call,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/multi.c,724,FP,data->multi never freed here; normal member access,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/multi.c,727,FP,data->req not freed; only its newurl/location members were,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/multi.c,732,FP,data->conn not freed; passed to cpool_do_locked normally,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/multi.c,735,FP,Curl_netrc_cleanup(&data->state.netrc) cleans member; not a freed-ptr access,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/multi.c,735,FP,"data->state is embedded struct, never freed",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,740,FP,close_connect_only is cpool_do_locked callback; fixed signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,741,FP,userdata is callback signature param; const not addable,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/multi.c,749,FP,remove_handle recursion bounded by data->multi/done guards,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/multi.c,767,FP,data validated by GOOD_EASY_HANDLE earlier in function,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,778,FP,multi validated by GOOD_MULTI_HANDLE at entry,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/multi.c,887,FP,CURL_TRC_M trace args are read-only; no unsequenced side effects,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,894,FP,Curl_multiplex_wanted does 'multi && ...' — explicitly NULL-safe,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,925,FP,Curl_attach_connection DEBUGASSERTs data; internal-only non-NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,925,FP,conn DEBUGASSERTed; internal contract guarantees non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,931,FP,conn DEBUGASSERTed non-NULL just above (line 930),curl_full_audit_0.4.35,high
EXP36-C,curl,lib/multi.c,950,FP,no char*->curltime* cast; Curl_pgrs_now returns proper type,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/multi.c,1099,FP,Curl_multi_pollset returns mresult at 'out'; all switch paths covered,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/multi.c,1178,FP,trace-log args read-only; no conflicting side effects,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,1215,FP,"curl_multi_fdset public API signature; (void)exc_fd_set, cannot change",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,1230,FP,multi validated by GOOD_MULTI_HANDLE at 1227,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,1285,FP,multi validated by GOOD_MULTI_HANDLE at 1282,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/multi.c,1326,FP,getsockopt fills t via &t before comparison; && short-circuits on failure,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,1479,FP,WSAWaitForMultipleEvents is Winsock API from system headers,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/multi.c,1490,FP,r is loop-local cast result; const advisory noise,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,1574,FP,curl_multi_wait is thin wrapper to multi_wait which validates,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,1574,FP,ret passed through to multi_wait; NULL handled there,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,1580,FP,multi_wait is static defined later in same TU,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,1584,FP,curl_multi_poll thin wrapper to multi_wait which validates multi,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,1584,FP,ret forwarded to multi_wait; NULL-checked there,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,1590,FP,multi_wait static defined in same file,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,1632,FP,multi_ischanged internal; multi non-NULL from callers,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,1645,FP,Curl_multi_connchanged internal setter; multi guaranteed valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,1650,FP,Curl_multi_add_perform internal; data validated downstream by add_handle,curl_full_audit_0.4.35,high
INT18-C,curl,lib/multi.c,1743,FP,k->size is curl_off_t (signed); comparison to -1 is valid signed compare,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,1847,FP,set_in_callback internal; multi non-NULL,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,1853,FP,multi_posttransfer reads data->set; curl keeps handle param mutable,curl_full_audit_0.4.35,low
ERR33-C,curl,lib/multi.c,1858,FP,signal() restoring prev SIGPIPE handler; ignoring return is idiomatic restore,curl_full_audit_0.4.35,med
SIG00-C,curl,lib/multi.c,1858,FP,"SIGPIPE suppression restore, not handler registration; platform-guarded",curl_full_audit_0.4.35,med
SIG01-C,curl,lib/multi.c,1858,FP,SIGPIPE restore is standard libcurl idiom; sigaction not portable here,curl_full_audit_0.4.35,med
SIG02-C,curl,lib/multi.c,1858,FP,"restoring prior handler, not using signals for data handling",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/multi.c,1885,FP,no char*->curltime* cast; Curl_pgrs_now type-correct,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,2018,FP,curlx_free internal allocator from headers,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/multi.c,2027,FP,newurl reassigned to data->req.newurl at 2019 after free; not freed ptr,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,2039,FP,curlx_free internal,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/multi.c,2042,FP,newurl reassigned to data->req.location at 2040 after free; live ptr,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,2058,FP,curlx_free internal,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/multi.c,2058,FP,single final free; intermediate frees followed by reassignment,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/multi.c,2058,FP,free-then-reassign pattern; newurl is live before this free,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,2185,FP,curlx_free internal,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/multi.c,2218,FP,implicit bool test on mspeed_check; idiomatic CURLcode check,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,2290,FP,multi internal; state machine callers pass valid multi,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/multi.c,2300,FP,Curl_connect fills &async; used only on !result success path,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/multi.c,2309,FP,Curl_connect fills &connected via out-param before use,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,2420,FP,internal multi access; non-NULL by state-machine contract,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,2441,FP,internal multi access; non-NULL,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/multi.c,2530,FP,Curl_conn_connect fills &connected out-param before 'connected &&' read,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/multi.c,2705,FP,"'case MSTATE_COMPLETED:' is a label after break, not dead code",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,2755,FP,internal multi access; non-NULL by contract,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/multi.c,2839,FP,cleanup<->Curl_close cycle bounded by magic=0 and state guards,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/multi.c,2845,FP,multi validated by GOOD_MULTI_HANDLE at 2842,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,2859,FP,data validated by GOOD_EASY_HANDLE at 2855,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/multi.c,2860,FP,"adjacent string-literal concatenation across lines, no preprocessor directive",curl_full_audit_0.4.35,high
PRE32-C,curl,lib/multi.c,2860,FP,string continuation misparsed as directive in macro arg,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/multi.c,2913,FP,multi_xfer_bufs_free frees members; single curlx_free(multi) at 2926,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/multi.c,2914,FP,Curl_mntfy_cleanup on member; not a double-free of multi,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,2926,FP,curlx_free internal,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/multi.c,2926,FP,single free of multi; preceding calls free distinct members,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/multi.c,2926,FP,only one curlx_free(multi); no prior free of multi itself,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,2951,FP,internal multi access; non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,2998,FP,add_next_timeout internal; d non-NULL from splay callers,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,3031,FP,internal multi access; non-NULL,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/multi.c,3060,FP,e is list iterator in verbose block; const advisory noise,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/multi.c,3072,FP,function returns on all paths; switch default/return coverage,curl_full_audit_0.4.35,med
ARR01-C,curl,lib/multi.c,3148,FP,"sizeof(multi->last_expire_ts) is a struct member, not a decayed array param",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,3196,FP,internal multi access; non-NULL by contract,curl_full_audit_0.4.35,high
INT13-C,curl,lib/multi.c,3256,FP,"val&CURLMNWC flag test; signed long from va_arg, idiomatic mask test",curl_full_audit_0.4.35,med
INT13-C,curl,lib/multi.c,3259,FP,"signed flag-mask test, idiomatic; bits are API constants",curl_full_audit_0.4.35,med
API00-C,curl,lib/multi.c,3281,FP,running_handles is optional out-param; curl_multi_socket wrapper,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,3295,FP,internal multi access; non-NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,3302,FP,running_handles optional out-param; thin wrapper,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,3315,FP,internal multi access; non-NULL,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,3338,FP,VERBOSE(...) macro sqc cannot expand; not a real untyped declaration,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,3340,FP,multi_timeout internal; multi non-NULL,curl_full_audit_0.4.35,high
MEM33-C,curl,lib/multi.c,3346,FP,"*expire_time=*multi_now() copies struct curltime, no flexible array member",curl_full_audit_0.4.35,high
DCL00-C,curl,lib/multi.c,3384,FP,e is loop iterator; const advisory noise,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,3404,FP,internal multi access; non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,3422,FP,internal multi access; non-NULL,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,3472,FP,curl convention keeps easy handle params non-const,curl_full_audit_0.4.35,low
ARR01-C,curl,lib/multi.c,3506,FP,"sizeof(*stamp) of pointed-to struct in memcpy; correct, not decayed array",curl_full_audit_0.4.35,high
INT10-C,curl,lib/multi.c,3545,FP,milli%1000 timeout value non-negative in practice; advisory,curl_full_audit_0.4.35,med
API00-C,curl,lib/multi.c,3599,FP,Curl_expire internal; data non-NULL from internal callers,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,3610,FP,Curl_expire_done internal; data non-NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,3622,FP,Curl_expire_clear internal; data non-NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,3653,FP,curl_multi_assign validates GOOD_MULTI_HANDLE; hashp used after checks,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/multi.c,3669,FP,multi validated by GOOD_MULTI_HANDLE earlier,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,3693,FP,internal/validated multi access; non-NULL,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,3713,FP,curl convention keeps handle params mutable,curl_full_audit_0.4.35,low
API00-C,curl,lib/multi.c,3718,FP,Curl_multi_max_concurrent_streams DEBUGASSERTs multi; internal non-NULL,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,3729,FP,curlx_malloc internal allocator from headers,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,3738,FP,"data from xfer table entry, guarded by 'if(a)' alloc and DEBUGASSERT",curl_full_audit_0.4.35,high
API05-C,curl,lib/multi.c,3788,FP,char**/size_t* signature; curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
STR34-C,curl,lib/multi.c,3792,FP,*pbuf=NULL assigns char* via char**; no char-to-int sign extension,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,3810,FP,curlx_free internal,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/multi.c,3810,FP,frees data->multi->xfer_buf member; data->multi struct not freed,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,3816,FP,curlx_malloc internal,curl_full_audit_0.4.35,high
STR34-C,curl,lib/multi.c,3826,FP,*pbuf=char* assignment via char**; no sign-extension,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,3831,FP,Curl_multi_xfer_buf_release DEBUGASSERTs data; internal non-NULL,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,3831,FP,buf is borrowed-back pointer marker; const not curl convention,curl_full_audit_0.4.35,low
API05-C,curl,lib/multi.c,3841,FP,char**/size_t* borrow signature; no C99 array syntax in curl,curl_full_audit_0.4.35,high
STR34-C,curl,lib/multi.c,3845,FP,char* assignment via char**; no sign extension,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,3863,FP,curlx_free internal,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/multi.c,3863,FP,frees xfer_ulbuf member; data->multi struct not freed,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,3870,FP,curlx_malloc internal,curl_full_audit_0.4.35,high
STR34-C,curl,lib/multi.c,3880,FP,char* via char**; no sign extension,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,3885,FP,release fn DEBUGASSERTs data; internal non-NULL,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,3885,FP,buf marker param; not curl const convention,curl_full_audit_0.4.35,low
API05-C,curl,lib/multi.c,3895,FP,"size_t,char** sockbuf signature; no C99 array syntax",curl_full_audit_0.4.35,high
STR34-C,curl,lib/multi.c,3899,FP,char* via char**; no sign extension,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,3911,FP,curlx_free internal,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/multi.c,3911,FP,frees xfer_sockbuf member; data->multi struct not freed,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi.c,3917,FP,curlx_malloc internal,curl_full_audit_0.4.35,high
STR34-C,curl,lib/multi.c,3926,FP,char* via char**; no sign extension,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,3930,FP,release fn DEBUGASSERTs data; internal non-NULL,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,3930,FP,buf marker param; not curl const convention,curl_full_audit_0.4.35,low
API00-C,curl,lib/multi.c,3953,FP,Curl_multi_get_easy internal; multi non-NULL from callers,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,3956,FP,internal multi access; non-NULL,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/multi.c,3958,FP,"returns 'data' from xfer table (heap), not address of a local variable",curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,3965,FP,Curl_multi_xfers_running internal; multi non-NULL by contract,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,3965,FP,reads multi->xfers_alive but curl convention keeps handle param non-const,curl_full_audit_0.4.35,low
EXP34-C,curl,lib/multi.c,3967,FP,internal multi access; non-NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,3970,FP,Curl_multi_mark_dirty checks 'data->multi &&'; effectively guarded,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi.c,3972,FP,data->multi checked in same expression; NULL-safe,curl_full_audit_0.4.35,high
API00-C,curl,lib/multi.c,3976,FP,Curl_multi_clear_dirty guards data->multi; NULL-safe,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi.c,4001,FP,"multi_xfer_dump has (void)multi unused; debug-only, const advisory",curl_full_audit_0.4.35,low
EXP30-C,curl,lib/multi.c,4023,FP,tbl_count/capacity in mfprintf args are pure reads; no side-effect conflict,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/multi.c,4032,FP,fflush(stderr) in debug dump; ignoring return is idiomatic,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,38,FP,vtable default impl; cf required non-NULL by chain contract; UNITTESTS only,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,46,FP,vtable shutdown stub; done always supplied by dispatcher; not validated by convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,46,FP,signature fixed by Curl_cftype do_shutdown typedef; const cannot be added,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,47,FP,vtable typedef-fixed signature; const not addable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,55,FP,adjust_pollset vtable typedef signature; fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,56,FP,vtable typedef-fixed signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,57,FP,vtable typedef-fixed signature,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,66,FP,vtable data_pending stub; cf non-NULL by contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,66,FP,data passed through to next filter; not deref'd here,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,66,FP,has_data_pending vtable typedef signature; fixed,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,73,FP,vtable send stub; pnwritten always supplied by dispatcher,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,73,FP,do_send vtable typedef signature; fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.c,74,FP,curl never uses C99 array-param syntax; advisory style,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,83,FP,vtable recv stub; pnread always supplied,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,83,FP,do_recv vtable typedef signature; fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.c,84,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,92,FP,vtable is_alive stub; cf non-NULL by contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,92,FP,"data passed to next filter, not deref'd",curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,92,FP,input_pending passed through; supplied by dispatcher,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,92,FP,is_alive vtable typedef signature; fixed,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,101,FP,vtable keep_alive stub; cf non-NULL by contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,101,FP,data passed to next filter only,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,101,FP,keep_alive vtable typedef signature; fixed,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,109,FP,vtable query stub; cf non-NULL by contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,109,FP,data passed through to next filter,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,109,FP,"pres1 forwarded to next filter, not deref'd here",curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,109,FP,"pres2 forwarded to next filter, not deref'd here",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,109,FP,query vtable typedef signature; fixed,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/cfilters.c,132,FP,curlx_free declared in curlx headers; sqc failed to resolve include,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,138,FP,"thin wrapper; data forwarded to discard_chain, conn from validated caller",curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,138,FP,internal helper; conn supplied non-NULL by callers; not validated by convention,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/cfilters.c,141,FP,sockindex is 0/1 from validated callers; cfilter[2] bounded,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/cfilters.c,141,FP,sockindex bounded 0/1 by CONN_SOCK_IDX_VALID upstream; cfilter[2],curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cfilters.c,141,FP,conn supplied non-NULL by callers; internal helper contract,curl_full_audit_0.4.35,med
API00-C,curl,lib/cfilters.c,144,FP,DEBUGASSERT(data->conn) present; data non-NULL by contract,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,150,FP,sockindex 0/1 from validated callers; cfilter[2] bounded,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/cfilters.c,150,FP,sockindex bounded; cfilter[2]; idiomatic dispatch,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,169,FP,guarded by CONN_SOCK_IDX_VALID at line 165,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,212,FP,DEBUGASSERT(data) present; data non-NULL by contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,212,FP,pnread set/forwarded; always supplied by caller,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.c,212,FP,C99 array-param syntax not used,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,219,FP,sockindex 0/1; cfilter[2] bounded; dispatch layer,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/cfilters.c,219,FP,sockindex bounded; cfilter[2],curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,230,FP,DEBUGASSERT(data) present; non-NULL by contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,230,FP,pnwritten set/forwarded; always supplied,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.c,231,FP,C99 array-param syntax not used,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,238,FP,sockindex 0/1; cfilter[2] bounded,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/cfilters.c,238,FP,sockindex bounded; cfilter[2],curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.c,255,FP,C99 array-param syntax not used,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,255,FP,writer_ctx matches Curl_bufq reader callback typedef; fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.c,256,FP,C99 array-param syntax not used,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,263,FP,cf stored into io.cf then used by callback; not pure-read here,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cfilters.c,264,FP,data stored into io.data and passed to send/recv; not const-able,curl_full_audit_0.4.35,med
API05-C,curl,lib/cfilters.c,280,FP,C99 array-param syntax not used,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,280,FP,writer_ctx matches bufq writer callback typedef; fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.c,281,FP,C99 array-param syntax not used,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,288,FP,cf stored into io.cf and used by callback; not const-able,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cfilters.c,289,FP,data stored into io.data and passed onward,curl_full_audit_0.4.35,med
API05-C,curl,lib/cfilters.c,291,FP,C99 array-param syntax not used,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,311,FP,ctx stored into cf->ctx (ownership transfer); not const,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/cfilters.c,317,FP,curlx_calloc declared in curlx headers; include not resolved,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cfilters.c,317,FP,cf assigned from curlx_calloc return; not uninitialized,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/cfilters.c,325,FP,cf is heap pointer from calloc; pointer value valid after return,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,329,FP,DEBUGASSERT guards; data forwarded to trace only,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,329,FP,DEBUGASSERT(conn) present,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,329,FP,DEBUGASSERT(!cf->conn) implies cf non-NULL; caller supplies created cf,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cfilters.c,335,FP,cf required non-NULL by API contract; DEBUGASSERT(!cf->conn),curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,338,FP,sockindex 0/1 from validated caller; cfilter[2],curl_full_audit_0.4.35,high
ARR30-C,curl,lib/cfilters.c,338,FP,sockindex bounded; cfilter[2],curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,341,FP,sockindex bounded 0/1; cfilter[2],curl_full_audit_0.4.35,high
ARR30-C,curl,lib/cfilters.c,341,FP,sockindex bounded; cfilter[2],curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,345,FP,DEBUGASSERT(cf_at) present; non-NULL by contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,345,FP,DEBUGASSERT(cf_new) present,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cfilters.c,352,FP,DEBUGASSERT(cf_new) at 351; non-NULL by contract,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/cfilters.c,362,FP,pnext points into heap cf_new->next; tail is heap pointer; valid,curl_full_audit_0.4.35,high
EXP40-C,curl,lib/cfilters.c,373,FP,idiomatic linked-list unlink via pointer-to-pointer; no const violation,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.c,405,FP,C99 array-param syntax not used,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.c,415,FP,C99 array-param syntax not used,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,446,FP,conn->cfilter iterated and passed onward; cf_cntrl_all static helper,curl_full_audit_0.4.35,med
API00-C,curl,lib/cfilters.c,491,FP,DEBUGASSERT(data)&DEBUGASSERT(data->conn) present,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,508,FP,guarded by CONN_SOCK_IDX_VALID at line 505,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,594,FP,checks CONN_SOCK_IDX_VALID then derefs conn; conn non-NULL by contract,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,594,TP,conn only read (cfilter[idx]!=NULL); exported non-vtable fn could take const,curl_full_audit_0.4.35,low
ARR00-C,curl,lib/cfilters.c,598,FP,guarded by CONN_SOCK_IDX_VALID at line 596,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,601,FP,CONN_SOCK_IDX_VALID checked; conn non-NULL by contract,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,601,FP,conn->scheme accessed; mutable through chain semantics; idiomatic non-const,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/cfilters.c,607,FP,guarded by CONN_SOCK_IDX_VALID at line 605,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cfilters.c,607,FP,conn deref after valid-index guard; conn non-NULL by contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,615,FP,CONN_SOCK_IDX_VALID checked; data->conn used per contract,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,615,FP,data->conn->cfilter traversed; data not const by convention,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/cfilters.c,621,FP,guarded by CONN_SOCK_IDX_VALID at line 619,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,632,FP,cf_is_ssl traverses chain reading flags; could be const but idiomatic non-const,curl_full_audit_0.4.35,med
API00-C,curl,lib/cfilters.c,643,FP,conn NULL-checked at line 647 ternary; CONN_SOCK_IDX_VALID guard,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,643,FP,conn forwarded to cf_is_ssl(conn->cfilter[]); idiomatic non-const,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/cfilters.c,647,FP,guarded by CONN_SOCK_IDX_VALID at line 645,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,657,FP,guarded by CONN_SOCK_IDX_VALID at line 654,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,665,FP,CONN_SOCK_IDX_VALID checked; data forwarded; non-NULL by contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,665,FP,conn NULL-checked via ternary at line 672,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,666,FP,conn->cfilter read; idiomatic non-const,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/cfilters.c,672,FP,guarded by CONN_SOCK_IDX_VALID at line 670; conn NULL-checked,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,676,FP,conn NULL-checked via ternary at line 682; CONN_SOCK_IDX_VALID guard,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,676,FP,conn->cfilter traversed; idiomatic non-const,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/cfilters.c,682,FP,guarded by CONN_SOCK_IDX_VALID at line 680; conn NULL-checked,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,693,FP,thin wrapper; data forwarded to cf get_transport; non-NULL by contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,693,FP,conn->cfilter[FIRSTSOCKET] deref; conn supplied non-NULL by callers,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cfilters.c,694,FP,conn->cfilter read; idiomatic non-const,curl_full_audit_0.4.35,med
API00-C,curl,lib/cfilters.c,700,FP,thin wrapper; data forwarded; non-NULL by contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,700,FP,conn->cfilter[FIRSTSOCKET] deref; conn supplied non-NULL,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cfilters.c,701,FP,conn->cfilter read; idiomatic non-const,curl_full_audit_0.4.35,med
API00-C,curl,lib/cfilters.c,707,FP,conn->cfilter[FIRSTSOCKET] deref; conn supplied non-NULL by callers,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cfilters.c,708,FP,conn->cfilter traversed; idiomatic non-const,curl_full_audit_0.4.35,med
API00-C,curl,lib/cfilters.c,731,FP,DEBUGASSERT(data)&DEBUGASSERT(data->conn); CONN_SOCK_IDX_VALID guard,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,741,FP,guarded by CONN_SOCK_IDX_VALID at line 738,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,751,FP,cf NULL-checked via ternary at line 756,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,765,FP,guarded by CONN_SOCK_IDX_VALID at line 763,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,768,FP,cf NULL-safe; while(cf...) loops handle NULL (zero iterations),curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,768,FP,data forwarded to adjust_pollset vtable; non-NULL by contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,788,FP,DEBUGASSERT(data) present,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,788,FP,DEBUGASSERT(conn) present at line 796,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cfilters.c,798,FP,DEBUGASSERT(conn) at 796; conn->cfilter[i] i=0/1 bounded,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,803,FP,DEBUGASSERT(cf) present at line 810,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,803,FP,DEBUGASSERT(data)&DEBUGASSERT(data->conn) present,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cfilters.c,829,FP,*phost is char** assigned const char*; not signed-char sign extension,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,834,FP,CONN_SOCK_IDX_VALID checked inline in ternary at line 834,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/cfilters.c,834,FP,CONN_SOCK_IDX_VALID guards index at line 834,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cfilters.c,849,FP,*phost is char** assigned const char*; not sign extension,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,854,FP,cntrl vtable default impl; signature fixed by Curl_cftype typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,855,FP,vtable typedef-fixed signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,856,FP,vtable typedef-fixed signature; arg2 void* by contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,866,FP,cf NULL-safe; for(;cf;cf=cf->next) zero iterations on NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,866,FP,arg2 opaque void* forwarded to cntrl callback; not deref'd here,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/cfilters.c,908,FP,"returns value of local alpn (a pointer set by query callback), not its address",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/cfilters.c,919,FP,"returns value of local remote_addr pointer, not its address",curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,951,FP,data->conn NULL-checked in ternary at line 955,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,960,FP,thin wrapper to cf_cntrl_all; data->conn used per contract,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,969,FP,guarded by CONN_SOCK_IDX_VALID at line 967,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,986,FP,thin wrapper to cf_cntrl_all; data->conn per contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,991,FP,thin wrapper to cf_cntrl_all; data->conn per contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,997,FP,conn->cfilter[FIRSTSOCKET] deref; conn supplied non-NULL by callers,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cfilters.c,997,FP,conn->cfilter read; idiomatic non-const,curl_full_audit_0.4.35,med
API00-C,curl,lib/cfilters.c,1005,FP,CONN_SOCK_IDX_VALID checked; conn deref per contract,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,1005,FP,conn->cfilter deref; conn supplied non-NULL by callers,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cfilters.c,1006,FP,conn->cfilter read; idiomatic non-const,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/cfilters.c,1013,FP,guarded by CONN_SOCK_IDX_VALID at line 1011,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,1017,FP,CONN_SOCK_IDX_VALID checked; data forwarded to query,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,1017,FP,conn->cfilter deref; conn supplied non-NULL by callers,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cfilters.c,1018,FP,conn->cfilter read; idiomatic non-const,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/cfilters.c,1028,FP,guarded by CONN_SOCK_IDX_VALID at line 1025,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,1037,FP,CONN_SOCK_IDX_VALID checked; data forwarded to query,curl_full_audit_0.4.35,high
API00-C,curl,lib/cfilters.c,1037,FP,conn->cfilter deref; conn supplied non-NULL by callers,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cfilters.c,1038,FP,conn->cfilter read; idiomatic non-const,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/cfilters.c,1048,FP,guarded by CONN_SOCK_IDX_VALID at line 1045,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cfilters.c,1054,FP,data->conn read in Curl_conn_sockindex; idiomatic non-const,curl_full_audit_0.4.35,med
API05-C,curl,lib/cfilters.c,1063,FP,C99 array-param syntax not used,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,1069,FP,guarded by CONN_SOCK_IDX_VALID at line 1067,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,1070,FP,guarded by CONN_SOCK_IDX_VALID at line 1067,curl_full_audit_0.4.35,high
API05-C,curl,lib/cfilters.c,1076,FP,C99 array-param syntax not used,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/cfilters.c,1089,FP,getenv return checked: if(p) at line 1090 before use,curl_full_audit_0.4.35,high
CON34-C,curl,lib/cfilters.c,1089,FP,DEBUGBUILD-only test hook; value checked; not a thread-safety concern in practice,curl_full_audit_0.4.35,med
ENV30-C,curl,lib/cfilters.c,1092,FP,"curlx_str_number advances local pointer p, does not modify env string contents",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,1099,FP,guarded by CONN_SOCK_IDX_VALID at line 1084,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cfilters.c,1100,FP,guarded by CONN_SOCK_IDX_VALID at line 1084,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,50,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,51,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mime.c,51,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
ARR02-C,curl,lib/mime.c,62,FP,static const array sized by full initializer; idiomatic,curl_full_audit_0.4.35,med
PRE01-C,curl,lib/mime.c,94,TP,"macro param stat_data unparenthesized (low impact, member-access use)",curl_full_audit_0.4.35,low
API00-C,curl,lib/mime.c,110,FP,internal/wrapper; callers guarantee non-NULL (DEBUGASSERT),curl_full_audit_0.4.35,med
FIO42-C,curl,lib/mime.c,117,FP,fclose present (l128) / fp is member freed in mime_file_free,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/mime.c,117,FP,fclose present (l128) / fp is member freed in mime_file_free,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/mime.c,124,FP,fread return used (count+=ret); VMS path,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/mime.c,124,FP,fread elem-size 1 count sizeof(buf) is valid byte read,curl_full_audit_0.4.35,high
ERR00-C,curl,lib/mime.c,124,FP,fread return used (count+=ret); VMS path,curl_full_audit_0.4.35,high
FIO17-C,curl,lib/mime.c,124,FP,"binary fread, no null terminator expected",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mime.c,185,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,193,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
ARR02-C,curl,lib/mime.c,201,FP,static const array sized by full initializer; idiomatic,curl_full_audit_0.4.35,med
ARR02-C,curl,lib/mime.c,212,FP,static const array sized by full initializer; idiomatic,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,241,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
API05-C,curl,lib/mime.c,241,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/mime.c,248,FP,"returns heap/struct-member ptr, not local-storage address",curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,253,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/mime.c,275,FP,"returns heap/struct-member ptr, not local-storage address",curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,287,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mime.c,288,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,308,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
API05-C,curl,lib/mime.c,314,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mime.c,315,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
STR34-C,curl,lib/mime.c,329,FP,char buffer read/write with &0xFF/&0x80; benign,curl_full_audit_0.4.35,med
API05-C,curl,lib/mime.c,339,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mime.c,340,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
STR34-C,curl,lib/mime.c,356,FP,char buffer read/write with &0xFF/&0x80; benign,curl_full_audit_0.4.35,med
STR34-C,curl,lib/mime.c,357,FP,char buffer read/write with &0xFF/&0x80; benign,curl_full_audit_0.4.35,med
STR34-C,curl,lib/mime.c,376,FP,char buffer read/write with &0xFF/&0x80; benign,curl_full_audit_0.4.35,med
EXP07-C,curl,lib/mime.c,376,FP,base64 bit-shift constants are idiomatic,curl_full_audit_0.4.35,high
FIO50-C,curl,lib/mime.c,376,FP,"'i' is an int, not a FILE stream; misparse",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/mime.c,376,FP,"'i' is an int, not a FILE stream; misparse",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mime.c,377,FP,char buffer read/write with &0xFF/&0x80; benign,curl_full_audit_0.4.35,med
EXP07-C,curl,lib/mime.c,377,FP,base64 bit-shift constants are idiomatic,curl_full_audit_0.4.35,high
STR34-C,curl,lib/mime.c,378,FP,char buffer read/write with &0xFF/&0x80; benign,curl_full_audit_0.4.35,med
STR34-C,curl,lib/mime.c,379,FP,char buffer read/write with &0xFF/&0x80; benign,curl_full_audit_0.4.35,med
EXP07-C,curl,lib/mime.c,403,FP,base64 bit-shift constants are idiomatic,curl_full_audit_0.4.35,high
EXP07-C,curl,lib/mime.c,404,FP,base64 bit-shift constants are idiomatic,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mime.c,418,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,437,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
INT14-C,curl,lib/mime.c,439,FP,n only arithmetic+array-index; no bitwise on n,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mime.c,444,FP,qp_class[256] indexed via &0xFF; not buf[4]; misattribution,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,451,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mime.c,452,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
STR31-C,curl,lib/mime.c,539,FP,memcpy of exact binary/encoded byte count; not C string,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/mime.c,539,FP,var assigned (malloc/loop-init) before use; sqc misparse,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mime.c,552,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
API05-C,curl,lib/mime.c,561,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,562,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mime.c,562,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,600,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
FIO42-C,curl,lib/mime.c,613,FP,fclose present (l128) / fp is member freed in mime_file_free,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,617,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,618,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
FIO17-C,curl,lib/mime.c,628,FP,"binary fread, no null terminator expected",curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,661,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,662,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,663,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
STR31-C,curl,lib/mime.c,683,FP,memcpy of exact binary/encoded byte count; not C string,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/mime.c,689,TP,genuine recursion (mime is recursive by design); advisory,curl_full_audit_0.4.35,low
API05-C,curl,lib/mime.c,690,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/mime.c,754,TP,genuine recursion (mime is recursive by design); advisory,curl_full_audit_0.4.35,low
MSC37-C,curl,lib/mime.c,754,FP,infinite for(;;) with returns inside; NOTREACHED end,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,754,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
INT30-C,curl,lib/mime.c,775,FP,sz bounded <= remaining by encoder contract; no wrap,curl_full_audit_0.4.35,high
INT31-C,curl,lib/mime.c,776,FP,"'buffer += sz' is pointer arithmetic, not char narrowing",curl_full_audit_0.4.35,high
INT30-C,curl,lib/mime.c,777,FP,sz bounded <= remaining by encoder contract; no wrap,curl_full_audit_0.4.35,high
INT30-C,curl,lib/mime.c,805,FP,sz bounded <= remaining by encoder contract; no wrap,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/mime.c,814,TP,genuine recursion (mime is recursive by design); advisory,curl_full_audit_0.4.35,low
API05-C,curl,lib/mime.c,815,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/mime.c,845,FP,STRCONST expands to literal+sizeof; no side-effecting calls,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/mime.c,852,FP,STRCONST expands to literal+sizeof; no side-effecting calls,curl_full_audit_0.4.35,high
INT30-C,curl,lib/mime.c,889,FP,sz bounded <= remaining by encoder contract; no wrap,curl_full_audit_0.4.35,high
INT31-C,curl,lib/mime.c,890,FP,"'buffer += sz' is pointer arithmetic, not char narrowing",curl_full_audit_0.4.35,high
INT30-C,curl,lib/mime.c,891,FP,sz bounded <= remaining by encoder contract; no wrap,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/mime.c,898,TP,genuine recursion (mime is recursive by design); advisory,curl_full_audit_0.4.35,low
API05-C,curl,lib/mime.c,898,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,899,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/mime.c,918,FP,STRCONST expands to literal+sizeof; no side-effecting calls,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/mime.c,1028,FP,Curl_safefree/freefunc then field nulled; no access of freed mem,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/mime.c,1037,FP,Curl_safefree/freefunc then field nulled; no access of freed mem,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/mime.c,1041,FP,Curl_safefree/freefunc then field nulled; no access of freed mem,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/mime.c,1072,FP,Curl_safefree/freefunc then field nulled; no access of freed mem,curl_full_audit_0.4.35,high
API00-C,curl,lib/mime.c,1098,FP,internal/wrapper; callers guarantee non-NULL (DEBUGASSERT),curl_full_audit_0.4.35,med
API00-C,curl,lib/mime.c,1098,FP,internal/wrapper; callers guarantee non-NULL (DEBUGASSERT),curl_full_audit_0.4.35,med
MEM05-C,curl,lib/mime.c,1098,FP,recursion depth bounded by mime nesting; not excessive,curl_full_audit_0.4.35,med
MSC04-C,curl,lib/mime.c,1098,TP,genuine recursion (mime is recursive by design); advisory,curl_full_audit_0.4.35,low
EXP33-C,curl,lib/mime.c,1132,FP,var assigned (malloc/loop-init) before use; sqc misparse,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/mime.c,1132,FP,ptr guaranteed non-NULL after checked create / NULL-safe loop,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/mime.c,1134,FP,var assigned (malloc/loop-init) before use; sqc misparse,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/mime.c,1184,FP,var assigned (malloc/loop-init) before use; sqc misparse,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/mime.c,1202,FP,"returns heap/struct-member ptr, not local-storage address",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/mime.c,1208,FP,sizeof(*part) on real allocated struct ptr is correct,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/mime.c,1221,FP,var assigned (malloc/loop-init) before use; sqc misparse,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/mime.c,1235,FP,"returns heap/struct-member ptr, not local-storage address",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/mime.c,1248,FP,Curl_safefree/freefunc then field nulled; no access of freed mem,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/mime.c,1265,FP,Curl_safefree/freefunc then field nulled; no access of freed mem,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,1273,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/mime.c,1357,FP,Curl_safefree/freefunc then field nulled; no access of freed mem,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/mime.c,1364,FP,static const array sized by full initializer; idiomatic,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,1398,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,1418,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
API00-C,curl,lib/mime.c,1489,FP,internal/wrapper; callers guarantee non-NULL (DEBUGASSERT),curl_full_audit_0.4.35,med
API05-C,curl,lib/mime.c,1496,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,1496,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,1529,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/mime.c,1540,TP,genuine recursion (mime is recursive by design); advisory,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/mime.c,1540,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
MSC04-C,curl,lib/mime.c,1566,TP,genuine recursion (mime is recursive by design); advisory,curl_full_audit_0.4.35,low
DCL30-C,curl,lib/mime.c,1602,FP,"returns heap/struct-member ptr, not local-storage address",curl_full_audit_0.4.35,high
ARR02-C,curl,lib/mime.c,1629,FP,static const array sized by full initializer; idiomatic,curl_full_audit_0.4.35,med
STR34-C,curl,lib/mime.c,1643,FP,char buffer read/write with &0xFF/&0x80; benign,curl_full_audit_0.4.35,med
API05-C,curl,lib/mime.c,1657,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/mime.c,1658,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/mime.c,1673,FP,recursion depth bounded by mime nesting; not excessive,curl_full_audit_0.4.35,med
MEM05-C,curl,lib/mime.c,1815,FP,recursion depth bounded by mime nesting; not excessive,curl_full_audit_0.4.35,med
MSC04-C,curl,lib/mime.c,1815,TP,genuine recursion (mime is recursive by design); advisory,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/mime.c,1844,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,1845,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,1855,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,1856,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,1865,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
API05-C,curl,lib/mime.c,1866,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mime.c,1999,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2000,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2007,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2008,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2016,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
MEM05-C,curl,lib/mime.c,2025,FP,"char scratch[4*1024] is fixed-size, not a VLA",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mime.c,2058,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2081,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2082,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
API00-C,curl,lib/mime.c,2103,FP,internal/wrapper; callers guarantee non-NULL (DEBUGASSERT),curl_full_audit_0.4.35,med
API00-C,curl,lib/mime.c,2103,FP,internal/wrapper; callers guarantee non-NULL (DEBUGASSERT),curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2103,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/mime.c,2112,FP,ptr guaranteed non-NULL after checked create / NULL-safe loop,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/mime.c,2113,FP,ptr guaranteed non-NULL after checked create / NULL-safe loop,curl_full_audit_0.4.35,high
DCL40-C,curl,lib/mime.c,2130,FP,CURL is typedef void; void*/CURL* identical types,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2130,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2136,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2141,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2147,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2154,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2161,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2168,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2175,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
API05-C,curl,lib/mime.c,2175,FP,curl never uses C99 array-param syntax; convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mime.c,2183,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2190,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2194,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2205,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2205,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2212,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2213,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mime.c,2221,FP,callback/vtable+public API signatures; const not addable,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/vtls/vtls.c,81,FP,"CLONE_STRING macro arg used in if/assign; idiomatic curl clone macro, no double-eval hazard",curl_full_audit_0.4.35,med
PRE01-C,curl,lib/vtls/vtls.c,81,FP,"'var' is a struct member name token (dest->var), parenthesizing is meaningless here",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/vtls/vtls.c,81,FP,"member-selector macro; inline fn cannot take field name; idiomatic, no real defect",curl_full_audit_0.4.35,med
PRE00-C,curl,lib/vtls/vtls.c,92,FP,"CLONE_BLOB evaluates arg once via blobdup(&dest->var,...); no multi-eval defect",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/vtls/vtls.c,92,FP,member-selector macro; no genuine multiple-evaluation hazard,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/vtls.c,98,FP,blobdup reads src->len/->data only; could be const but curl convention does not; advisory,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/vtls/vtls.c,105,FP,"curlx_malloc is a curl memory-wrapper macro/decl from headers; declared, sqc cannot see",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/vtls/vtls.c,112,FP,"(char*)d + sizeof(blob): char* arithmetic is byte-wise; flexible-array trailer, correct",curl_full_audit_0.4.35,high
EXP05-C,curl,lib/vtls/vtls.c,112,FP,d is non-const malloc'd; (char*)d casts pointer type not away const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,120,FP,"blobcmp reads only; const-advisory, curl does not follow project-wide",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/vtls.c,120,FP,second read-only; const-advisory,curl_full_audit_0.4.35,med
EXP20-C,curl,lib/vtls/vtls.c,128,FP,!memcmp idiom returning bool equality; idiomatic,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,195,FP,match_ssl_primary_config reads configs only; const-advisory; data unused,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/vtls.c,196,FP,c1 compared only; const-advisory,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/vtls.c,197,FP,c2 compared only; const-advisory,curl_full_audit_0.4.35,med
EXP20-C,curl,lib/vtls/vtls.c,214,FP,!Curl_timestrcmp equality idiom in config-match conjunction; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls.c,215,FP,!Curl_timestrcmp equality idiom; idiomatic,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,228,FP,internal entrypoint; callers always pass valid data; thin dispatch to match fn,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,228,FP,candidate always valid from connectdata; internal invariant,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,243,FP,source read-only in clone but CLONE_STRING reads source->var; const-advisory,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/vtls.c,275,FP,free_primary_ssl_config WRITES sslc members via Curl_safefree; cannot be const,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,296,FP,"exported config-complete; data is the easy handle, always valid by invariant",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,296,FP,function writes data->set extensively; cannot be const,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,413,FP,conn always valid; passes &conn->ssl_config to free helper,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls.c,415,FP,conn dereferenced is internal invariant; never NULL here,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,421,FP,guards data->conn before use; data itself always valid easy handle,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,421,FP,"reads data->set/conn, copies into dest; const-advisory, curl convention",curl_full_audit_0.4.35,med
EXP34-C,curl,lib/vtls/vtls.c,434,FP,dest set from data->conn members inside if(data->conn); non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls.c,434,FP,src set from data->set.* address-of; always non-NULL,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/vtls.c,444,FP,Curl_ssl_backend both #if branches return a value; ifdef-merge artifact,curl_full_audit_0.4.35,high
CON03-C,curl,lib/vtls/vtls.c,457,FP,init_ssl global init guarded by global init lock in curl; documented single-thread init,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/vtls.c,501,FP,cf_ctx_new ignores data ((void)data); const-advisory only,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls.c,507,FP,ctx assigned by curlx_calloc immediately; not uninitialized,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vtls/vtls.c,517,FP,backend alloc failed (NULL); ctx freed via curlx_free(ctx) before return NULL,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vtls/vtls.c,519,FP,"ctx is heap pointer from calloc, not automatic storage; returning it is correct",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vtls/vtls.c,519,FP,"success path returns owned ctx to caller; ownership transfer, not leak",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/vtls.c,525,FP,cf_ctx_free frees distinct members then ctx; Curl_safefree nulls; no UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/vtls.c,526,FP,Curl_bufq_free on distinct member earlydata; no use after free,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,546,FP,cfilter vtable callback; cf always supplied by filter chain,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,598,FP,conformant-array-syntax advisory; curl never uses C99 array params,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,600,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,609,FP,Curl_ssl_free_certinfo writes data->info.certs; cannot be const,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,649,FP,exported; data easy handle always valid; DEBUGASSERT guards certnum,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,649,FP,writes data->info.certs[]; cannot be const,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,651,FP,conformant-array advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,652,FP,conformant-array advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,682,FP,conformant-array advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,695,FP,conformant-array advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,696,FP,conformant-array advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,757,FP,conformant-array advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,758,FP,conformant-array advisory,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls.c,769,FP,!strncmp prefix-match idiom; idiomatic,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/vtls/vtls.c,800,FP,"sizeof in strncmp length arg (string literal), not a loop pointer bound; misparse",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls.c,801,FP,!strncmp prefix idiom in while condition; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls.c,809,FP,!memcmp equality idiom after explicit len compare; idiomatic,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls.c,809,FP,cert_hash set by base64_encode under if(!encode); reached only when non-NULL,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/vtls/vtls.c,829,FP,fp closed via curlx_fclose(fp) at end: label reached by every goto end,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vtls/vtls.c,831,FP,return result before any alloc; goto end frees buf/pem_ptr/fp; sha256sumdigest not in this branch,curl_full_audit_0.4.35,high
FIO14-C,curl,lib/vtls/vtls.c,836,FP,"fseek SEEK_END on file opened 'rb'; size bounded+validated; portable on real platforms, idiomatic",curl_full_audit_0.4.35,med
FIO19-C,curl,lib/vtls/vtls.c,836,FP,fseek/ftell for size with validation/bounds; acceptable portable idiom here,curl_full_audit_0.4.35,med
ERR33-C,curl,lib/vtls/vtls.c,838,FP,ftell result 'filesize' checked at line 841 (filesize<0) before use,curl_full_audit_0.4.35,high
ERR00-C,curl,lib/vtls/vtls.c,838,FP,ftell return checked at line 841; duplicate of ERR33,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/vtls/vtls.c,859,FP,"fread(buffer,1,want,fp): element size 1, want<=sizeof(buffer); correct, not byte/element confusion",curl_full_audit_0.4.35,high
FIO17-C,curl,lib/vtls/vtls.c,859,FP,"binary read into dynbuf, not a C-string; null terminator irrelevant",curl_full_audit_0.4.35,high
INT30-C,curl,lib/vtls/vtls.c,863,FP,"want = min(left,1024) so left-=want cannot underflow; loop exits when left==0",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls.c,868,FP,!memcmp equality idiom; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls.c,886,FP,!memcmp equality idiom guarded by length compare; idiomatic,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls.c,886,FP,memcmp guarded by pubkeylen==pem_len; if pem_len>0 pem_ptr non-NULL after successful decode,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vtls/vtls.c,894,FP,"end: label frees buf and pem_ptr, closes fp; sha256sumdigest belongs to other branch",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,917,FP,conformant-array advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,958,FP,conformant-array advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,967,FP,conformant-array advisory,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/vtls/vtls.c,1020,FP,"available_backends[] sized by NULL-terminated initializer list; idiomatic, intended",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,1056,FP,conformant-array advisory,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls.c,1065,FP,'selected' is static (zero-initialized to NULL); not uninitialized,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/vtls/vtls.c,1067,FP,backends is char[200]; backends+sizeof(backends) is correct end pointer (byte array),curl_full_audit_0.4.35,high
ERR02-C,curl,lib/vtls/vtls.c,1079,FP,"curl_msnprintf bounded by end-p; return advances p, length recomputed; output truncation-safe",curl_full_audit_0.4.35,med
EXP33-C,curl,lib/vtls/vtls.c,1088,FP,'backends' is static char[200] zero-init; p computed from it; not uninitialized,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls.c,1088,FP,"backends_len is static, zero-initialized; assigned in the if block before use",curl_full_audit_0.4.35,high
ENV30-C,curl,lib/vtls/vtls.c,1112,FP,"env from curl_getenv (heap copy), not libc getenv; freed with curlx_free; not aliasing static buffer",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/vtls.c,1114,FP,"curlx_free is curl memory-wrapper from headers; declared, sqc cannot resolve",curl_full_audit_0.4.35,high
ENV30-C,curl,lib/vtls/vtls.c,1114,FP,env is curl_getenv heap copy; curlx_free just frees it; no env-modification hazard,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/vtls/vtls.c,1125,FP,curl_getenv heap copy freed; not libc getenv static buffer,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/vtls.c,1133,FP,curlx_free wrapper declared in headers; sqc cannot see,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/vtls/vtls.c,1133,FP,curl_getenv heap copy freed; not env-static-buffer modification,curl_full_audit_0.4.35,high
EXP40-C,curl,lib/vtls/vtls.c,1145,FP,"assigning &available_backends (file-scope array) to out-param; explicit cast, public API contract",curl_full_audit_0.4.35,med
MEM30-C,curl,lib/vtls/vtls.c,1185,FP,"peer_cleanup: dispname freed only if !=hostname, then hostname freed separately; distinct, no double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/vtls.c,1185,FP,hostname is distinct member freed once via Curl_safefree; not UAF,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,1223,FP,Curl_ssl_peer_init; cf from filter chain always valid; cf->conn deref is invariant,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls.c,1265,FP,!strcmp equality idiom selecting dispname aliasing; idiomatic,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls.c,1300,FP,'save' initialized by CF_DATA_SAVE macro (header) sqc cannot expand,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls.c,1312,FP,'save' initialized by CF_DATA_SAVE macro; opaque to sqc,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls.c,1343,FP,'save' set by CF_DATA_SAVE before CF_DATA_RESTORE; macro-opaque,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls.c,1350,FP,!ssl_prefs_check bool idiom (returns bool TRUE/FALSE); idiomatic,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,1386,FP,conformant-array advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,1408,FP,conformant-array advisory,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls.c,1462,FP,'save' initialized by CF_DATA_SAVE macro; opaque,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,1474,FP,conformant-array advisory,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls.c,1483,FP,'save' set by CF_DATA_SAVE macro; opaque,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,1526,FP,conformant-array advisory,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls.c,1533,FP,'save' set by CF_DATA_SAVE macro; opaque,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls.c,1567,FP,'save' set by CF_DATA_SAVE inside if-block before restore; macro-opaque,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls.c,1584,FP,'save' set by CF_DATA_SAVE macro; opaque,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/vtls.c,1620,FP,"*palpn assigned a const char* (alpn string), not signed-char sign-extension; misparse",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/vtls.c,1633,FP,ssl_cf_cntrl is cfilter vtable impl; signature fixed by function-pointer typedef; const impossible,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,1634,FP,arg2 part of vtable cntrl signature; fixed by typedef; (void)arg2 unused,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls.c,1644,FP,!strcmp protocol-name match idiom; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls.c,1646,FP,!strcmp protocol match idiom; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls.c,1648,FP,!strcmp protocol match idiom; idiomatic,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,1656,FP,cf_ssl_is_alive is is_alive vtable impl; signature fixed by typedef; const impossible,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,1709,FP,cf_ssl_create passes conn to cf_ctx_new path; const-advisory; conn read-only here,curl_full_audit_0.4.35,med
MEM31-C,curl,lib/vtls/vtls.c,1721,FP,ctx freed via cf_ctx_free(ctx) at out: label on error; not leaked,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/vtls.c,1723,FP,ctx freed via cf_ctx_free at out: on error; success transfers ownership to cf,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,1742,FP,"thin wrapper; data passed to cf_ssl_create, not dereferenced here; always valid",curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,1742,FP,conn forwarded to cf_ssl_create; always valid by caller invariant,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,1755,FP,cf_at->conn deref forwarded; cf_at always valid from filter chain,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,1755,FP,data forwarded to cf_ssl_create; valid easy handle invariant,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,1771,FP,cf_ssl_proxy_create reads conn->http_proxy; const-advisory; (void)conn anyway,curl_full_audit_0.4.35,med
MEM31-C,curl,lib/vtls/vtls.c,1788,FP,ctx freed via cf_ctx_free at out: on error; success transfers ownership,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,1802,FP,cf_at->conn forwarded; cf_at valid from filter chain,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,1802,FP,data forwarded; valid easy handle,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,1816,FP,Curl_ssl_supports does (void)data; const-advisory only,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls.c,1836,FP,'save' set by CF_DATA_SAVE macro before restore; macro-opaque,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,1876,FP,guards data->conn (ternary) before deref; data is valid easy handle,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vtls/vtls.c,1882,FP,sockindex is FIRSTSOCKET/SECONDARYSOCKET (0/1) caller-constant; cfilter[] sized for it,curl_full_audit_0.4.35,med
ARR30-C,curl,lib/vtls/vtls.c,1882,FP,"sockindex bounded {0,1} by all internal callers; no OOB",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/vtls.c,1900,FP,"Curl_ssl_cf_is_proxy reads cf->cft->flags; const-advisory; but used as predicate, curl convention",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/vtls.c,1905,FP,"both #ifdef branches of get_config return; ifdef-merge artifact, all paths return",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,1906,FP,data read to pick &data->set.*; const-advisory; returns non-const member ptr,curl_full_audit_0.4.35,med
MSC37-C,curl,lib/vtls/vtls.c,1916,FP,both #ifdef branches of get_primary_config return; all paths return,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/vtls/vtls.c,1934,FP,"buf is struct alpn_proto_buf* not array param; sizeof(*buf) yields full struct size, correct",curl_full_audit_0.4.35,high
INT08-C,curl,lib/vtls/vtls.c,1940,FP,"off int, blen<=ALPN_NAME_MAX-1; off+blen+1 cannot overflow int and is compared to buffer size",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/vtls/vtls.c,1940,FP,"buf is real struct pointer; sizeof(buf->data) is fixed-array size, correct",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/vtls/vtls.c,1956,FP,buf real struct ptr; sizeof(*buf) is struct size; not decayed array param,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/vtls/vtls.c,1961,FP,sizeof(buf->data) is fixed member array size; correct,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,1973,FP,Curl_alpn_contains_proto guards proto via plen=proto?strlen:0 and 'plen &&' loop cond; NULL-safe,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/vtls.c,1976,FP,strlen(proto) takes char*; no signed-char promotion of a value; misparse,curl_full_audit_0.4.35,med
STR34-C,curl,lib/vtls/vtls.c,1976,FP,proto used as string ptr to strlen; no sign-extension defect,curl_full_audit_0.4.35,med
EXP20-C,curl,lib/vtls/vtls.c,1979,FP,!memcmp equality idiom guarded by slen==plen; idiomatic,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,1985,FP,"Curl_alpn_restrict_to internal; callers pass literal proto strings; strlen tolerates, DEBUGASSERT guards",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/vtls.c,1987,FP,strlen(proto) on char*; no sign-extension of value; misparse,curl_full_audit_0.4.35,med
ARR01-C,curl,lib/vtls/vtls.c,1988,FP,spec is real struct ptr; sizeof(spec->entries[0]) is fixed sub-array size; correct,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/vtls/vtls.c,1989,FP,sizeof(spec->entries[0]) fixed member-array size; correct,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/vtls/vtls.c,1990,FP,"memcpy(entries[0],proto,plen+1) bounded by if(plen<sizeof(entries[0])) guard; safe",curl_full_audit_0.4.35,high
INT32-C,curl,lib/vtls/vtls.c,1990,FP,plen=strlen(proto) small; plen+1 cannot overflow; guarded against entry-array size,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/vtls/vtls.c,1998,FP,"Curl_alpn_copy: dest and src are distinct objects (caller-supplied), not overlapping; memcpy correct",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/vtls/vtls.c,1998,FP,dest real struct ptr; sizeof(*dest) is struct size; correct,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/vtls/vtls.c,2000,FP,sizeof(*dest) struct size in memset; correct,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,2003,FP,Curl_alpn_set_negotiated; connssl from cf->ctx invariant always valid,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/vtls.c,2003,FP,all paths reach 'out:' and return result; not a fall-through-without-return,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,2003,FP,cf is (void)cf unused; const-advisory only,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.c,2006,FP,conformant-array advisory,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,2071,FP,Curl_on_session_reuse; cf->ctx invariant; cf always valid from chain,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,2071,FP,scs supplied by scache layer always valid; scs->alpn read after,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls.c,2071,FP,do_early_data is out-param written (*do_early_data=FALSE) immediately; caller supplies,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls.c,2074,FP,scs read (scs->alpn) only; const-advisory; curl convention,curl_full_audit_0.4.35,med
MEM30-C,curl,lib/http2.c,167,FP,h2_stream_ctx_free frees members then stream once; not double-free,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http2.c,167,FP,single free of stream after member frees; no double-free,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/http2.c,197,FP,sizeof(*ctx) on real struct pointer (memset size); correct usage,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,202,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/http2.c,263,FP,H2_STREAM_CTX evals data via ternary guard; idiomatic curl accessor macro,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/http2.c,263,FP,"accessor macro single logical use; idiomatic, not multiple-eval bug",curl_full_audit_0.4.35,med
EXP33-C,curl,lib/http2.c,272,FP,stream assigned by curlx_calloc then NULL-checked before deref,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/http2.c,288,FP,"stream points to heap (calloc) or hash entry, not stack local",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,292,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/http2.c,358,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/http2.c,359,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/http2.c,360,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/http2.c,369,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
DCL30-C,curl,lib/http2.c,380,FP,"stream points to heap (calloc) or hash entry, not stack local",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http2.c,384,FP,"stream stored in hash via uint32_hash_set; freed by hash dtor, not leaked",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/http2.c,393,FP,"stream points to heap (calloc) or hash entry, not stack local",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http2.c,423,FP,"char* hash/ctx value, properly aligned heap object; spurious alignment warn",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http2.c,466,FP,"o set by nghttp2_option_new(&o), rc-checked before use",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,481,TP,static non-vtable helper reads ctx only; const ctx* applies; never writes,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/http2.c,573,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
API05-C,curl,lib/http2.c,598,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,609,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
API05-C,curl,lib/http2.c,610,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,611,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,657,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/http2.c,673,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
EXP20-C,curl,lib/http2.c,685,FP,idiomatic !strcmp/!strncmp/zero-test boolean usage,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http2.c,694,FP,idiomatic !strcmp/!strncmp/zero-test boolean usage,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http2.c,707,FP,"char* hash/ctx value, properly aligned heap object; spurious alignment warn",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/http2.c,713,FP,"stream points to heap (calloc) or hash entry, not stack local",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http2.c,763,FP,url non-NULL: set by curl_url_get only when uc==0 reaches here,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/http2.c,774,FP,push_promise: all paths set rv and reach fail: return rv,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http2.c,790,FP,"char* hash/ctx value, properly aligned heap object; spurious alignment warn",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http2.c,856,FP,newstream set by http2_data_setup success + DEBUGASSERT(newstream),curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,889,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,906,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http2.c,939,FP,"char* hash/ctx value, properly aligned heap object; spurious alignment warn",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http2.c,950,FP,nghttp2 getters are pure reads as args; no shared mutation/UB,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http2.c,961,FP,rv assigned by nghttp2_submit_rst_stream before is_fatal(rv),curl_full_audit_0.4.35,high
API00-C,curl,lib/http2.c,1049,FP,"thin export/callback; deref via setup or NULL-safe free, project idiom",curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,1049,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/http2.c,1102,FP,index len clamped to buffer size before write; in-bounds,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,1120,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
ARR30-C,curl,lib/http2.c,1133,FP,index len clamped to buffer size before write; in-bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/http2.c,1161,FP,index len clamped to buffer size before write; in-bounds,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,1224,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
ARR30-C,curl,lib/http2.c,1238,FP,index len clamped to buffer size before write; in-bounds,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,1257,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,1257,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,1349,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/http2.c,1374,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
API05-C,curl,lib/http2.c,1393,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,1394,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,1396,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http2.c,1427,FP,idiomatic !strcmp/!strncmp/zero-test boolean usage,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http2.c,1435,FP,idiomatic !strcmp/!strncmp/zero-test boolean usage,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/http2.c,1474,FP,"push_headers persists in stream, freed by free_push_headers/ctx dtor",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/http2.c,1481,FP,"push_headers persists in stream, freed by free_push_headers/ctx dtor",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/http2.c,1493,FP,"push_headers persists in stream, freed by free_push_headers/ctx dtor",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/http2.c,1496,FP,"push_headers persists in stream, freed by free_push_headers/ctx dtor",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/http2.c,1508,FP,"push_headers persists in stream, freed by free_push_headers/ctx dtor",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/http2.c,1515,FP,"push_headers persists in stream, freed by free_push_headers/ctx dtor",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http2.c,1524,FP,nghttp2 getters are pure reads as args; no shared mutation/UB,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/http2.c,1528,FP,"push_headers persists in stream, freed by free_push_headers/ctx dtor",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/http2.c,1536,FP,"push_headers persists in stream, freed by free_push_headers/ctx dtor",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http2.c,1551,FP,nghttp2 getters are pure reads as args; no shared mutation/UB,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/http2.c,1555,FP,"push_headers persists in stream, freed by free_push_headers/ctx dtor",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/http2.c,1564,FP,"push_headers persists in stream, freed by free_push_headers/ctx dtor",curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,1569,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,1570,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,1571,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
API05-C,curl,lib/http2.c,1572,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,1619,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
API05-C,curl,lib/http2.c,1620,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,1622,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
API00-C,curl,lib/http2.c,1635,FP,"thin export/callback; deref via setup or NULL-safe free, project idiom",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http2.c,1647,FP,"binlen set by curlx_sztouz(rc,&binlen) before use; macro artifact",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http2.c,1726,FP,nghttp2 getters are pure reads as args; no shared mutation/UB,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http2.c,1728,FP,nghttp2 getters are pure reads as args; no shared mutation/UB,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http2.c,1790,FP,"char* hash/ctx value, properly aligned heap object; spurious alignment warn",curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,1829,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,1829,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
API05-C,curl,lib/http2.c,1943,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http2.c,1946,FP,"char* hash/ctx value, properly aligned heap object; spurious alignment warn",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http2.c,1961,FP,save filled by CF_DATA_SAVE macro (sqc can't expand) before restore,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http2.c,1998,FP,nghttp2 getters are pure reads as args; no shared mutation/UB,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,2015,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http2.c,2022,FP,stream guaranteed non-NULL by callers (data_setup success/DEBUGASSERT),curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,2060,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http2.c,2083,FP,stream guarded: !stream branch calls h2_submit; else uses non-NULL,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http2.c,2109,FP,idiomatic !strcmp/!strncmp/zero-test boolean usage,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http2.c,2173,FP,stream from http2_data_setup success path; non-NULL,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/http2.c,2187,FP,"stream points to heap (calloc) or hash entry, not stack local",curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,2193,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http2.c,2197,FP,"char* hash/ctx value, properly aligned heap object; spurious alignment warn",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http2.c,2201,FP,save filled by CF_DATA_SAVE macro (sqc can't expand) before restore,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http2.c,2260,FP,nghttp2 getters are pure reads as args; no shared mutation/UB,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http2.c,2272,FP,nghttp2 getters are pure reads as args; no shared mutation/UB,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http2.c,2286,FP,"char* hash/ctx value, properly aligned heap object; spurious alignment warn",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http2.c,2290,FP,save filled by CF_DATA_SAVE macro (sqc can't expand) before restore,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http2.c,2304,FP,nghttp2 getters are pure reads as args; no shared mutation/UB,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http2.c,2315,FP,nghttp2 getters are pure reads as args; no shared mutation/UB,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http2.c,2340,FP,"char* hash/ctx value, properly aligned heap object; spurious alignment warn",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http2.c,2343,FP,save filled by CF_DATA_SAVE macro (sqc can't expand) before restore,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http2.c,2380,FP,rc is int return code; actual alloc cbs freed at out: callbacks_del,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http2.c,2383,FP,rc is int return code; actual alloc cbs freed at out: callbacks_del,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http2.c,2404,FP,"rc is int code not pointer; cbs freed at out: label, no leak",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http2.c,2404,FP,cbs from callbacks_new rc-checked non-zero->goto out before use,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http2.c,2407,FP,"rc is int code not pointer; cbs freed at out: label, no leak",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http2.c,2421,FP,"binlen set by curlx_sztouz(rclen,&binlen) before use",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http2.c,2424,FP,"rc is int code not pointer; cbs freed at out: label, no leak",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http2.c,2431,FP,stream from http2_data_setup success + DEBUGASSERT(stream),curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http2.c,2440,FP,"rc is int code not pointer; cbs freed at out: label, no leak",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http2.c,2463,FP,"rc is int code not pointer; cbs freed at out: label, no leak",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http2.c,2473,FP,"rc is int code not pointer; cbs freed at out: label, no leak",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http2.c,2484,FP,"rc is int code not pointer; cbs freed at out: label, no leak",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http2.c,2510,FP,save filled by CF_DATA_SAVE macro (sqc can't expand) before restore,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/http2.c,2513,FP,"result is CURLcode enum, not an fd; no open()/close() involved",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http2.c,2548,FP,save filled by CF_DATA_SAVE macro (sqc can't expand) before restore,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,2557,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/http2.c,2581,FP,save filled by CF_DATA_SAVE macro (sqc can't expand) before restore,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http2.c,2623,FP,"char* hash/ctx value, properly aligned heap object; spurious alignment warn",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,2653,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/http2.c,2660,FP,save filled by CF_DATA_SAVE macro (sqc can't expand) before restore,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,2686,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/http2.c,2705,FP,save filled by CF_DATA_SAVE macro (sqc can't expand) before restore,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http2.c,2719,FP,save filled by CF_DATA_SAVE macro (sqc can't expand) before restore,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http2.c,2737,FP,save filled by CF_DATA_SAVE macro (sqc can't expand) before restore,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http2.c,2738,FP,idiomatic !strcmp/!strncmp/zero-test boolean usage,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http2.c,2749,FP,"char* hash/ctx value, properly aligned heap object; spurious alignment warn",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http2.c,2754,FP,"char* hash/ctx value, properly aligned heap object; spurious alignment warn",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http2.c,2802,FP,"ctx=cf->ctx assigned at decl; macro/branch artifact, not uninit",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,2822,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/http2.c,2830,FP,ctx=cf->ctx assigned at decl; not uninitialized,curl_full_audit_0.4.35,high
API00-C,curl,lib/http2.c,2866,FP,"thin export/callback; deref via setup or NULL-safe free, project idiom",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http2.c,2878,FP,cf from http2_cfilter_add success path; non-NULL when reached,curl_full_audit_0.4.35,high
API00-C,curl,lib/http2.c,2885,FP,"thin export/callback; deref via setup or NULL-safe free, project idiom",curl_full_audit_0.4.35,high
API00-C,curl,lib/http2.c,2905,FP,"thin export/callback; deref via setup or NULL-safe free, project idiom",curl_full_audit_0.4.35,high
API00-C,curl,lib/http2.c,2905,FP,"thin export/callback; deref via setup or NULL-safe free, project idiom",curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,2907,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http2.c,2920,FP,cf from http2_cfilter_add success; non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http2.c,2933,FP,ctx=cf->ctx with cf non-NULL after add success; guarded,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http2.c,2963,FP,"char* hash/ctx value, properly aligned heap object; spurious alignment warn",curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,2969,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,2969,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
API00-C,curl,lib/http2.c,2975,FP,"thin export/callback; deref via setup or NULL-safe free, project idiom",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,2975,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
API05-C,curl,lib/http2.c,2981,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,2981,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
API00-C,curl,lib/http2.c,2987,FP,"thin export/callback; deref via setup or NULL-safe free, project idiom",curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,2987,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.c,2987,FP,curl never uses C99 array-param syntax; advisory by convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http2.c,2987,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/http2.c,2997,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/http2.c,3004,FP,param mutated or fixed callback/vtable/exported signature; const N/A,curl_full_audit_0.4.35,med
PRE08-C,curl,lib/vquic/curl_ngtcp2.c,33,FP,"External ngtcp2 crypto headers; names fixed by upstream library, not curl-renamable",curl_full_audit_0.4.35,high
PRE08-C,curl,lib/vquic/curl_ngtcp2.c,33,FP,External ngtcp2 crypto headers; names fixed by upstream library,curl_full_audit_0.4.35,high
PRE08-C,curl,lib/vquic/curl_ngtcp2.c,33,FP,External ngtcp2 crypto headers; mutually exclusive #ifdef branches anyway,curl_full_audit_0.4.35,high
PRE08-C,curl,lib/vquic/curl_ngtcp2.c,33,FP,External ngtcp2 crypto headers; names fixed upstream,curl_full_audit_0.4.35,high
PRE08-C,curl,lib/vquic/curl_ngtcp2.c,35,FP,External ngtcp2 crypto headers; names fixed upstream,curl_full_audit_0.4.35,high
PRE08-C,curl,lib/vquic/curl_ngtcp2.c,35,FP,External ngtcp2 crypto headers; names fixed upstream,curl_full_audit_0.4.35,high
PRE08-C,curl,lib/vquic/curl_ngtcp2.c,35,FP,External ngtcp2 crypto headers; names fixed upstream,curl_full_audit_0.4.35,high
PRE08-C,curl,lib/vquic/curl_ngtcp2.c,37,FP,External ngtcp2 crypto headers; names fixed upstream,curl_full_audit_0.4.35,high
PRE08-C,curl,lib/vquic/curl_ngtcp2.c,37,FP,External ngtcp2 crypto headers; names fixed upstream,curl_full_audit_0.4.35,high
PRE08-C,curl,lib/vquic/curl_ngtcp2.c,41,FP,External ngtcp2 crypto headers; names fixed upstream,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,102,FP,Curl never uses C99 array-param syntax; advisory style,curl_full_audit_0.4.35,high
INT33-C,curl,lib/vquic/curl_ngtcp2.c,212,FP,NGTCP2_MILLISECONDS is a nonzero compile-time macro constant,curl_full_audit_0.4.35,high
INT33-C,curl,lib/vquic/curl_ngtcp2.c,213,FP,NGTCP2_MILLISECONDS is a nonzero compile-time macro constant,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,265,FP,H3_STREAM_CTX macro retrieves heap-allocated calloc'd struct; properly aligned,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vquic/curl_ngtcp2.c,293,FP,"[adv] hash_count==1 tests for exactly-one-stream transition (first add); intentional, but brittle idiom",curl_full_audit_0.4.35,adversarial-flip
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,306,FP,Signature fixed by Curl_uint32_hash_visit callback typedef,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,368,FP,H3_STREAM_CTX returns heap struct; alignment fine,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,388,FP,"cf used to access ctx; static helper but cf passed through, low value",curl_full_audit_0.4.35,med
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,391,FP,Curl_pgrs_now returns aligned curltime*; not char* reinterpret,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vquic/curl_ngtcp2.c,394,FP,"Curl_pgrs_now returns &data->progress.t_startsingle, never NULL",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,399,FP,cf passed through to access ctx; idiomatic,curl_full_audit_0.4.35,med
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,403,FP,Curl_pgrs_now returns aligned curltime*,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vquic/curl_ngtcp2.c,409,FP,Curl_pgrs_now never returns NULL,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,417,FP,get_conn signature fixed by ngtcp2 crypto_conn_ref get_conn typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,425,FP,qlog_callback signature fixed by ngtcp2 settings.qlog.write typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,439,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,439,FP,qlog_callback signature fixed by ngtcp2 typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,440,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
ERR02-C,curl,lib/vquic/curl_ngtcp2.c,446,FP,"ssize_t from write(); standard POSIX idiom, advisory",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,455,FP,ctx mutated (settings/transport_params written) in quic_settings,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,456,FP,data read for set.connecttimeout; static helper but low value,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,457,FP,"pktx->ts read; helper, idiomatic non-const",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,496,FP,handshake_completed signature fixed by ngtcp2_callbacks typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,609,FP,ngtcp2 recv_stream_data callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,610,FP,ngtcp2 callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,610,FP,ngtcp2 callback signature fixed by typedef,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,618,FP,H3_STREAM_CTX returns aligned heap struct,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,645,FP,ngtcp2 acked_stream_data_offset callback signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,647,FP,ngtcp2 callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,647,FP,ngtcp2 callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,666,FP,ngtcp2 stream_close callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,697,FP,ngtcp2 stream_reset callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,718,FP,ngtcp2 stream_stop_sending callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,719,FP,ngtcp2 callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,720,FP,ngtcp2 callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,737,FP,ngtcp2 extend_max_local_streams_bidi callback signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,753,FP,ngtcp2 extend_max_stream_data callback signature fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,778,FP,cb_rand signature fixed by ngtcp2 rand callback typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,792,FP,ngtcp2 get_new_connection_id callback signature fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,793,FP,ngtcp2 callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,794,FP,ngtcp2 callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,794,FP,ngtcp2 callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,812,FP,ngtcp2 recv_rx_key callback signature fixed by typedef,curl_full_audit_0.4.35,high
CON03-C,curl,lib/vquic/curl_ngtcp2.c,837,FP,"Static const callback table; read-only after init, no thread mutation",curl_full_audit_0.4.35,high
INT33-C,curl,lib/vquic/curl_ngtcp2.c,933,FP,NGTCP2_MILLISECONDS is nonzero macro constant,curl_full_audit_0.4.35,high
INT10-C,curl,lib/vquic/curl_ngtcp2.c,933,FP,"timeout is ngtcp2_duration (uint64); operands unsigned, no negative remainder",curl_full_audit_0.4.35,high
INT33-C,curl,lib/vquic/curl_ngtcp2.c,936,FP,NGTCP2_MILLISECONDS is nonzero macro constant,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,959,FP,H3_STREAM_CTX returns aligned heap struct,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/curl_ngtcp2.c,963,FP,save initialized by CF_DATA_SAVE macro before CF_DATA_RESTORE; sqc cannot expand,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,978,FP,nghttp3 stream_close callback signature fixed by typedef,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,985,FP,H3_STREAM_CTX returns aligned heap struct,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1011,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1030,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,1094,FP,nghttp3 recv_data callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1095,FP,nghttp3 callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1096,FP,nghttp3 callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1096,FP,nghttp3 callback signature fixed by typedef,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,1101,FP,H3_STREAM_CTX returns aligned heap struct,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,1122,FP,nghttp3 deferred_consume callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1123,FP,nghttp3 callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,1123,FP,nghttp3 callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1124,FP,nghttp3 callback signature fixed by typedef,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,1129,FP,H3_STREAM_CTX returns aligned heap struct,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,1143,FP,nghttp3 end_headers callback signature fixed by typedef,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,1149,FP,H3_STREAM_CTX returns aligned heap struct,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,1170,FP,nghttp3 recv_header callback signature fixed by typedef,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,1180,FP,H3_STREAM_CTX returns aligned heap struct,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vquic/curl_ngtcp2.c,1206,FP,"curlx_dyn_addn calls sequenced via if(!result) chain, not unsequenced args",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vquic/curl_ngtcp2.c,1230,FP,curlx_dyn_addn calls sequenced via if(!result) chain,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,1236,FP,nghttp3 stop_sending callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,1237,FP,nghttp3 callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,1238,FP,nghttp3 callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,1255,FP,nghttp3 reset_stream callback signature fixed by typedef,curl_full_audit_0.4.35,high
CON03-C,curl,lib/vquic/curl_ngtcp2.c,1275,FP,Static const nghttp3 callback table; read-only after init,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_ngtcp2.c,1315,FP,"rc is int return code, not allocation; sqc misread &ctx->h3conn out-param",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_ngtcp2.c,1322,FP,rc is int; h3conn freed via nghttp3_conn_del in ctx_close,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_ngtcp2.c,1329,FP,"rc is int return code, not allocated memory",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_ngtcp2.c,1336,FP,"rc is int return code, not allocated memory",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_ngtcp2.c,1343,FP,"rc is int return code, not allocated memory",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_ngtcp2.c,1350,FP,"rc is int return code, not allocated memory",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_ngtcp2.c,1358,FP,"rc is int return code, not allocated memory",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_ngtcp2.c,1361,FP,"rc is int return code, not allocated memory",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,1366,FP,"recv_closed_stream reads stream fields but stream non-const by convention; mutated via *pnread sibling pattern, low value",curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1403,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,1403,FP,cf_ngtcp2_recv is cfilter vtable recv impl; signature fixed by Curl_cftype,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,1406,FP,H3_STREAM_CTX returns aligned heap struct,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/curl_ngtcp2.c,1416,FP,save initialized by CF_DATA_SAVE macro; sqc cannot expand,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,1474,FP,nghttp3 acked_req_body callback signature fixed by typedef,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,1480,FP,H3_STREAM_CTX returns aligned heap struct,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,1506,FP,nghttp3 read_req_body data_reader signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1508,FP,nghttp3 data_reader signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1508,FP,nghttp3 data_reader signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1509,FP,nghttp3 data_reader signature fixed by typedef,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,1514,FP,H3_STREAM_CTX returns aligned heap struct,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1572,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vquic/curl_ngtcp2.c,1627,FP,e is a pointer reassigned each loop iteration via getn(); const would prevent reassignment,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/vquic/curl_ngtcp2.c,1628,FP,i<nheader=dynhds_count; getn returns valid entry for in-range index,curl_full_audit_0.4.35,high
INT18-C,curl,lib/vquic/curl_ngtcp2.c,1650,FP,infilesize is curl_off_t (signed); -1 compare is correct signed sentinel,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1705,FP,cf_ngtcp2_send cfilter vtable impl; signature fixed by Curl_cftype,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,1709,FP,H3_STREAM_CTX returns aligned heap struct,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/curl_ngtcp2.c,1714,FP,save initialized by CF_DATA_SAVE macro; sqc cannot expand,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/vquic/curl_ngtcp2.c,1738,FP,"result is CURLcode from h3_stream_open, not an open() fd",curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1804,FP,vquic recv_pkts callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1808,FP,vquic callback signature fixed by typedef,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/curl_ngtcp2.c,1826,FP,path filled by ngtcp2_addr_init (local+remote) before use at read_pkt,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/vquic/curl_ngtcp2.c,1834,FP,"buflen/offset are size_t scalars, not pointers; no sizeof scaling",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/vquic/curl_ngtcp2.c,1836,FP,"buf is unsigned char*; byte-granular pointer add, no double scaling",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,1854,FP,"pktx->ts read; cf_progress_ingress helper, idiomatic non-const",curl_full_audit_0.4.35,med
MSC37-C,curl,lib/vquic/curl_ngtcp2.c,1880,FP,read_pkt_to_send: infinite for(;;) only exits via explicit returns; no fallthrough,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1880,FP,vquic sipn callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_ngtcp2.c,1881,FP,vquic callback signature fixed by typedef,curl_full_audit_0.4.35,high
INT13-C,curl,lib/vquic/curl_ngtcp2.c,1920,FP,fin only ever 0/1; OR with ngtcp2 flag macro is value-correct,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/curl_ngtcp2.c,1924,FP,vec[16] populated by nghttp3_conn_writev_stream before use; veccnt bounds reads,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,1965,FP,"buffer cast to ngtcp2 API; library copies, no aligned-int deref through char*",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,2092,FP,h3_data_pause matches cfilter cntrl dispatch convention; cf unused but kept,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,2106,FP,cf_ngtcp2_cntrl arg2 is generic void* event payload; signature fixed by vtable,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/curl_ngtcp2.c,2112,FP,save initialized by CF_DATA_SAVE macro; sqc cannot expand,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_ngtcp2.c,2125,FP,H3_STREAM_CTX returns aligned heap struct,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/curl_ngtcp2.c,2189,FP,save initialized by CF_DATA_SAVE macro; sqc cannot expand,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/vquic/curl_ngtcp2.c,2194,FP,"buffer[NGTCP2_MAX_UDP_PAYLOAD_SIZE] is a packet scratch buffer, not env-var sized",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/curl_ngtcp2.c,2217,FP,buffer written by ngtcp2_conn_write_connection_close (out-param) before read,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/curl_ngtcp2.c,2283,FP,save initialized by CF_DATA_SAVE macro; sqc cannot expand,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vquic/curl_ngtcp2.c,2336,FP,quic_tp NULL only when no 0RTT params; Curl_ossl_add_session handles NULL/len 0,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vquic/curl_ngtcp2.c,2407,FP,quic_tp NULL only when no 0RTT params; Curl_gtls_cache_session handles NULL/len 0,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,2455,FP,tls_ctx_setup signature fixed by Curl_vquic_tls_init callback typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_ngtcp2.c,2512,FP,on_session_reuse reads scs fields; signature fixed by vquic_tls callback,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vquic/curl_ngtcp2.c,2617,FP,sockaddr set by Curl_cf_socket_peek on success (guard returns on failure),curl_full_audit_0.4.35,med
MEM31-C,curl,lib/vquic/curl_ngtcp2.c,2619,FP,rc is int; qconn out-param freed via ngtcp2_conn_del in ctx_close,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/vquic/curl_ngtcp2.c,2630,FP,"&ctx->tls passed as tls ctx and as setup-callback user_data; intentional, no restrict aliasing UB",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_ngtcp2.c,2640,FP,rc is int return code; qconn freed in ctx_close,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_ngtcp2.c,2645,FP,rc is int return code; qconn freed in ctx_close,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_ngtcp2.c,2660,FP,rc is int return code; qconn freed in ctx_close,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/curl_ngtcp2.c,2687,FP,save initialized by CF_DATA_SAVE macro; sqc cannot expand,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/curl_ngtcp2.c,2778,FP,save initialized by CF_DATA_SAVE macro; sqc cannot expand,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vquic/curl_ngtcp2.c,2837,FP,"*palpn assigned string literal/NULL (char**), not signed-char read",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/curl_ngtcp2.c,2857,FP,save initialized by CF_DATA_SAVE macro; sqc cannot expand,curl_full_audit_0.4.35,high
INT33-C,curl,lib/vquic/curl_ngtcp2.c,2870,FP,NGTCP2_MILLISECONDS is nonzero macro constant,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/curl_ngtcp2.c,2914,FP,"create wrapper; ctx calloc-guarded, params passed to helpers not derefed directly",curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/curl_ngtcp2.c,2914,FP,"create wrapper; data forwarded to Curl_cf_udp_create, no unchecked deref",curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/curl_ngtcp2.c,2914,FP,"create wrapper; conn stored, not derefed before use",curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/curl_ngtcp2.c,2914,FP,create wrapper; ai forwarded to Curl_cf_udp_create,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_ngtcp2.c,2930,FP,result is CURLcode not alloc; cf freed via Curl_conn_cf_discard_chain on error,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vquic/curl_ngtcp2.c,2933,FP,cf->conn=conn only reached when Curl_cf_create returned CURLE_OK (cf non-NULL),curl_full_audit_0.4.35,high
STR31-C,curl,lib/hostip.c,126,FP,"'out' is struct dynbuf[1/2] array, not a char string buffer; misparse",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/hostip.c,133,FP,dns guarded by DEBUGASSERT; internal callers pass non-NULL,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/hostip.c,143,FP,out[1] only compiled under CURLRES_IPV6 where array size is 2,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/hostip.c,148,FP,"#ifdef sits in if-condition body, not inside a macro invocation; misparse",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/hostip.c,152,FP,"char buf[MAX_IPADR_LEN] holds inet_ntop output, no getenv involved",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/hostip.c,153,FP,dynbuf out[] initialized via curlx_dyn_init before read,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/hostip.c,169,FP,out[1] read only under CURLRES_IPV6 (size 2),curl_full_audit_0.4.35,high
ARR30-C,curl,lib/hostip.c,169,FP,out[1] read only under CURLRES_IPV6 (size 2),curl_full_audit_0.4.35,high
ARR30-C,curl,lib/hostip.c,177,FP,out[1] freed only under CURLRES_IPV6 (size 2),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/hostip.c,188,FP,"reading hinfo to pass to cleanup/free, not access after free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/hostip.c,189,FP,"hinfo freed after cleanup; no use-after-free, sequential frees",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/hostip.c,193,FP,curlx_free declared in curlx header sqc cannot resolve,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,203,FP,"internal helper, DEBUGASSERT(bufsize); callers pass valid addrinfo node",curl_full_audit_0.4.35,med
API05-C,curl,lib/hostip.c,203,FP,curl never uses C99 conformant array param syntax; advisory,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/hostip.c,209,FP,ai non-NULL by internal contract; callers iterate a non-NULL list,curl_full_audit_0.4.35,med
API05-C,curl,lib/hostip.c,233,FP,conformant-array-syntax advisory; not curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/hostip.c,235,FP,conformant-array-syntax advisory; not curl convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/hostip.c,237,FP,"name passed as char* to Curl_strntolower, not read as signed char",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/hostip.c,261,FP,"hash callback void* cast to entry struct; idiomatic, properly aligned",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/hostip.c,298,FP,data is shared handle type used non-const project-wide; callback convention,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/hostip.c,300,FP,internal helper; data always valid,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/hostip.c,308,FP,dnscache only compared by address; const not curl convention here,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/hostip.c,310,FP,internal helper; data always valid,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/hostip.c,315,FP,dnscache only compared by address; const not curl convention here,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/hostip.c,317,FP,internal helper; data always valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,325,FP,thin entry; dnscache_get tolerates and !dnscache returns early,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/hostip.c,327,FP,struct pointer alignment fine; misparse of internal accessor,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,355,FP,dnscache_get null-checked before use; no unchecked deref,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/hostip.c,357,FP,alignment fine; internal accessor misparse,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/hostip.c,381,FP,"char entry_id[MAX_HOSTCACHE_LEN] DNS id buffer, no getenv",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hostip.c,388,FP,create_dnscache_id returns size_t length; entry_len is not a pointer,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hostip.c,396,FP,"entry_len is size_t length, not allocated memory",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hostip.c,439,FP,two Curl_hash_delete on mutually-exclusive branches; entry_id is stack,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hostip.c,442,FP,"entry_len is size_t length, nothing to free",curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,459,FP,data passes to dnscache_get which handles; no unchecked deref,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,459,FP,hostname passed to fetch_addr/create_dnscache_id which handle it,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/hostip.c,464,FP,alignment fine; internal accessor misparse,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/hostip.c,516,FP,nodes assigned by curlx_malloc and guarded if(nodes) before deref,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/hostip.c,520,FP,rnd assigned by curlx_malloc and guarded if(rnd) before deref,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/hostip.c,531,FP,"rnd is unsigned int*, not const; cast adds no const removal",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/hostip.c,556,FP,"rnd freed L547, nodes freed L551 on all paths; no leak",curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,560,FP,internal; callers pass valid data (DEBUGASSERT chain),curl_full_audit_0.4.35,med
API00-C,curl,lib/hostip.c,560,FP,"hostlen is a length, not user-tainted; advisory overflow check",curl_full_audit_0.4.35,high
API05-C,curl,lib/hostip.c,563,FP,conformant-array-syntax advisory; not curl convention,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/hostip.c,572,FP,internal; data valid by contract,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/hostip.c,581,FP,all callers pass non-NULL hostname; strlen reached only when !hostlen,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/hostip.c,584,FP,curlx_calloc declared in curlx memory header sqc cannot resolve,curl_full_audit_0.4.35,high
API05-C,curl,lib/hostip.c,614,FP,conformant-array-syntax advisory; not curl convention,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/hostip.c,619,FP,"char entry_id[MAX_HOSTCACHE_LEN] DNS id buffer, no getenv",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hostip.c,629,FP,"entry_len is size_t length from create_dnscache_id, not memory",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hostip.c,637,FP,"entry_len is size_t length, nothing to free",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/hostip.c,642,FP,"dns is a heap pointer returned by value, not address of a local",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hostip.c,642,FP,"entry_len is size_t length, nothing to free",curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,645,FP,dnscache_get null-checked at L652 before any deref,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/hostip.c,648,FP,alignment fine; internal accessor misparse,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/hostip.c,649,FP,"char id[MAX_HOSTCACHE_LEN] DNS id buffer, no getenv",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hostip.c,655,FP,"idlen is size_t length from create_dnscache_id, not memory",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/hostip.c,655,FP,entry checked non-NULL by caller (L986 guards before add),curl_full_audit_0.4.35,med
MEM31-C,curl,lib/hostip.c,662,FP,"idlen is size_t length, nothing to free",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hostip.c,666,FP,"idlen is size_t length, nothing to free",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/hostip.c,675,FP,name non-NULL; get_localhost6 only called with literal hostnames,curl_full_audit_0.4.35,med
STR34-C,curl,lib/hostip.c,675,FP,"name passed to strlen as char*, not read as signed char",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/hostip.c,699,FP,"(char*)ca + sizeof(...) is correct byte arithmetic, single scaling",curl_full_audit_0.4.35,high
EXP05-C,curl,lib/hostip.c,700,FP,"ss_size is const size_t value used in memcpy, no pointer const cast",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/hostip.c,701,FP,(char*)ai_addr + ss_size is correct byte arithmetic,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/hostip.c,702,FP,dst (canonname region) and src (name arg) are distinct buffers,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/hostip.c,703,FP,"ca is a heap pointer returned by value, not a local's address",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/hostip.c,715,FP,name non-NULL; get_localhost called with literal hostnames,curl_full_audit_0.4.35,med
STR34-C,curl,lib/hostip.c,715,FP,"name passed to strlen as char*, not signed-char read",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/hostip.c,728,FP,curlx_calloc declared in curlx header sqc cannot resolve,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/hostip.c,736,FP,(char*)ca + sizeof(...) correct byte arithmetic,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/hostip.c,737,FP,"ss_size const size_t in memcpy, no pointer const cast",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/hostip.c,738,FP,(char*)ai_addr + ss_size correct byte arithmetic,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/hostip.c,739,FP,dst and src are distinct buffers; no overlap,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/hostip.c,743,FP,ca is heap pointer returned by value,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/hostip.c,745,FP,ca6 is heap pointer returned by value,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,771,FP,has data? guard at L775 plus DEBUGASSERT,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/hostip.c,789,FP,"inet_pton writes into 'in'; it parses string, does not read in",curl_full_audit_0.4.35,high
API05-C,curl,lib/hostip.c,799,FP,conformant-array-syntax advisory; not curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/hostip.c,800,FP,conformant-array-syntax advisory; not curl convention,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/hostip.c,804,FP,full is non-NULL hostname from caller; internal tailmatch,curl_full_audit_0.4.35,high
INT00-C,curl,lib/hostip.c,804,FP,"guarded: if(plen>flen) return FALSE at L802, so flen>=plen",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/hostip.c,826,FP,alignment fine; internal accessor misparse,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,860,FP,dnscache_get/DEBUGASSERT; not a raw unchecked deref of data,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,860,FP,hostname DEBUGASSERTed; all callers pass validated non-NULL,curl_full_audit_0.4.35,med
EXP36-C,curl,lib/hostip.c,867,FP,alignment fine; internal accessor misparse,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/hostip.c,888,FP,hostname guaranteed non-NULL by all callers; DEBUGASSERT follows,curl_full_audit_0.4.35,med
EXP15-C,curl,lib/hostip.c,972,FP,intentional 'if(result);' as head of else-if cleanup chain,curl_full_audit_0.4.35,med
DCL30-C,curl,lib/hostip.c,980,FP,"*entry=dns assigns a heap pointer, not address of a local",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/hostip.c,992,FP,"*entry=dns assigns a heap pointer, not a local's address",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/hostip.c,997,FP,idiomatic CURLcode !Curl_resolv_check truthiness test,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/hostip.c,998,FP,"*entry=dns assigns heap pointer, not a local's address",curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,1014,FP,thin wrapper; forwards to Curl_resolv; DEBUGASSERT data path,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,1014,FP,hostname DEBUGASSERTed at L1021 before use,curl_full_audit_0.4.35,high
SIG30-C,curl,lib/hostip.c,1051,FP,siglongjmp is on POSIX async-signal-safe list; canonical sigsetjmp pattern,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/hostip.c,1051,FP,curl_jmpenv initialized by sigsetjmp before handler can fire,curl_full_audit_0.4.35,high
SIG31-C,curl,lib/hostip.c,1051,FP,sigjmp_buf is the required jump mechanism; cannot be sig_atomic_t,curl_full_audit_0.4.35,med
API00-C,curl,lib/hostip.c,1076,FP,hostname DEBUGASSERTed at L1098,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,1076,FP,"entry is an out-param; *entry=NULL is a write, always valid",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/hostip.c,1137,FP,"sigsetjmp(curl_jmpenv,...) initializes the buffer at this very call",curl_full_audit_0.4.35,high
SIG00-C,curl,lib/hostip.c,1149,FP,query-then-set idiom preserves existing sa_mask; intentional,curl_full_audit_0.4.35,low
SIG02-C,curl,lib/hostip.c,1149,FP,SIGALRM resolve-timeout is curl's documented intentional fallback design,curl_full_audit_0.4.35,med
SIG00-C,curl,lib/hostip.c,1158,FP,sets handler via prior queried sigact; mask preserved intentionally,curl_full_audit_0.4.35,low
SIG02-C,curl,lib/hostip.c,1158,FP,"intentional SIGALRM timeout design, documented in source",curl_full_audit_0.4.35,med
ERR33-C,curl,lib/hostip.c,1162,FP,signal() return saved in keep_sigact and restored at L1201; benign on SIG_ERR,curl_full_audit_0.4.35,med
SIG00-C,curl,lib/hostip.c,1162,FP,signal() is the explicit #else fallback when sigaction unavailable,curl_full_audit_0.4.35,med
SIG01-C,curl,lib/hostip.c,1162,FP,signal() fallback is intentional for platforms lacking sigaction,curl_full_audit_0.4.35,med
SIG02-C,curl,lib/hostip.c,1162,FP,intentional SIGALRM timeout design,curl_full_audit_0.4.35,med
SIG34-C,curl,lib/hostip.c,1162,FP,"Curl_resolv_timeout is a normal function, NOT a signal handler",curl_full_audit_0.4.35,high
SIG00-C,curl,lib/hostip.c,1196,FP,restoring saved sigaction struct; masking preserved,curl_full_audit_0.4.35,low
SIG02-C,curl,lib/hostip.c,1196,FP,intentional SIGALRM timeout design,curl_full_audit_0.4.35,med
ERR33-C,curl,lib/hostip.c,1201,FP,signal() restore; return value not actionable here,curl_full_audit_0.4.35,med
SIG00-C,curl,lib/hostip.c,1201,FP,signal() fallback restore path; intentional,curl_full_audit_0.4.35,med
SIG01-C,curl,lib/hostip.c,1201,FP,signal() fallback restore path; intentional,curl_full_audit_0.4.35,med
SIG02-C,curl,lib/hostip.c,1201,FP,intentional SIGALRM timeout design,curl_full_audit_0.4.35,med
SIG34-C,curl,lib/hostip.c,1201,FP,not in a signal handler; normal function restore code,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/hostip.c,1245,FP,alignment fine; internal accessor misparse,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/hostip.c,1249,FP,dns=*pdns under if(*pdns) guard; non-NULL before refcount--,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,1279,FP,dnscache_get null-checked at L1284 before deref,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/hostip.c,1281,FP,alignment fine; internal accessor misparse,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/hostip.c,1288,FP,internal; data valid by contract,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/hostip.c,1291,FP,"char entry_id[MAX_HOSTCACHE_LEN] DNS id buffer, no getenv",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/hostip.c,1291,FP,entry_id stack buffer filled by create_dnscache_id before any read,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/hostip.c,1315,FP,curlx_str/curlx_strlen are pure accessors on &source; no UB ordering,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hostip.c,1315,FP,"entry_len is size_t length from create_dnscache_id, not memory",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/hostip.c,1325,FP,dns assigned by Curl_hash_pick/dnscache_add_addr before use,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/hostip.c,1328,FP,char address[64] written by memcpy at L1386 before read,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/hostip.c,1332,FP,VERBOSE() macro wraps a typed declaration; sqc macro misparse,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/hostip.c,1357,FP,ai assigned by Curl_str2addr (guarded by result) before use,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/hostip.c,1374,FP,curlx_str/curlx_strlen pure accessors; no unsequenced side effects,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/hostip.c,1386,FP,memcpy args use pure accessors; no UB ordering,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/hostip.c,1387,FP,"guarded: strlen>=sizeof(address) goto err at L1383, index<64",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hostip.c,1392,FP,"entry_len is size_t length, not allocated memory; head freed at err label",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hostip.c,1414,FP,"entry_len is size_t length, nothing to free",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/hostip.c,1418,FP,pure accessors; no unsequenced side effects,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hostip.c,1418,FP,"entry_len is size_t length, not memory",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/hostip.c,1446,FP,pure accessors in dnscache_add_addr args; no UB ordering,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hostip.c,1472,FP,"entry_len is size_t length, nothing to free",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/hostip.c,1502,FP,result assigned on both doh and else branches before use at L1510,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/hostip.c,1518,FP,every compiled path returns CURLE_OK or Curl_async_pollset result,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,1541,FP,"internal; data->conn deref is internal contract, callers valid",curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,1541,FP,dns forwarded to Curl_setup_conn; not dereferenced here,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip.c,1570,FP,internal async callback; data->conn valid by contract,curl_full_audit_0.4.35,med
API00-C,curl,lib/hostip.c,1570,FP,detail null-checked via ternary at L1587,curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_formparse.c,28,FP,8-char header-name collision is an obsolete-system advisory; curl uses long descriptive names by convention,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_formparse.c,36,FP,curlx_calloc declared via curlx headers/macros sqc cannot resolve; declaration exists,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_formparse.c,60,FP,curlx_strdup declared via curlx headers; not an actual missing declaration,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_formparse.c,64,FP,curlx_free declared via curlx headers; declaration exists,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_formparse.c,107,FP,curlx_strdup declared via curlx headers,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_formparse.c,109,FP,m is linked into parent->subparts and freed by tool_mime_free tree walk; not leaked,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_formparse.c,111,FP,curlx_free declared via curlx headers,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_formparse.c,128,FP,ftell(stdin) result is explicitly checked: origin>=0 guards the branch at line 131,curl_full_audit_0.4.35,med
ERR00-C,curl,src/tool_formparse.c,128,FP,ftell return checked via origin>=0 at line 131; duplicate of ERR33 here,curl_full_audit_0.4.35,med
PRE32-C,curl,src/tool_formparse.c,132,FP,"ftell is not a macro here; #ifdef is inside an if-condition, not a function-call argument list",curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_formparse.c,137,FP,size assigned in both branches (136 and 158) before use at 167,curl_full_audit_0.4.35,high
CON43-C,curl,src/tool_formparse.c,143,FP,"single-threaded CLI form parsing; switch on file2memory return, no concurrent double-fetch",curl_full_audit_0.4.35,high
MEM05-C,curl,src/tool_formparse.c,177,FP,tree depth bounded by user mime nesting; recursion idiomatic for freeing a tree,curl_full_audit_0.4.35,med
MSC04-C,curl,src/tool_formparse.c,177,FP,direct recursion is the natural tree-free idiom; not a defect,curl_full_audit_0.4.35,med
MEM30-C,curl,src/tool_formparse.c,182,FP,"mime->prev read before curlx_free(mime) at 190; recursion frees siblings, no UAF",curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_formparse.c,190,FP,curlx_free declared via curlx headers,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_formparse.c,195,FP,size param ignored (void)size; callback signature fixed by curl_read_callback typedef,curl_full_audit_0.4.35,med
API05-C,curl,src/tool_formparse.c,195,FP,conformant-array-syntax advisory; curl never uses C99 array params and signature is callback-fixed,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_formparse.c,196,FP,conformant-array-syntax advisory on callback-fixed signature,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_formparse.c,216,FP,fread result captured into nitems and ferror(stdin) checked immediately after at 217,curl_full_audit_0.4.35,med
FIO17-C,curl,src/tool_formparse.c,216,FP,binary mime data read into caller buffer; no null terminator semantics apply,curl_full_audit_0.4.35,high
MEM05-C,curl,src/tool_formparse.c,253,FP,tool2curlparts recurses on m->prev; depth bounded by user mime list; idiomatic,curl_full_audit_0.4.35,med
MSC04-C,curl,src/tool_formparse.c,253,FP,direct recursion over prev-list; not a defect,curl_full_audit_0.4.35,med
EXP34-C,curl,src/tool_formparse.c,274,FP,submime is non-NULL when result==OK from tool2curlmime; guarded by !result,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_formparse.c,276,FP,curl_mime_free is NULL-safe; submime here is non-NULL anyway,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_formparse.c,321,FP,"curl passed to curl_mime_init which validates; m derefed only via tool2curlparts(m->subparts), internal contract",curl_full_audit_0.4.35,med
API00-C,curl,src/tool_formparse.c,321,FP,m always non-NULL from internal callers; m->subparts deref is internal contract,curl_full_audit_0.4.35,med
MSC04-C,curl,src/tool_formparse.c,321,FP,"mutual recursion mirrors mime tree; idiomatic, depth bounded by user input",curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_formparse.c,321,FP,"m is read but is the mutable mime tree; exported signature, const not desired here",curl_full_audit_0.4.35,med
STR34-C,curl,src/tool_formparse.c,344,FP,char* deref compared to char literals; no sign-extension to larger type,curl_full_audit_0.4.35,high
EXP40-C,curl,src/tool_formparse.c,346,FP,word_begin is char*; ptr is char*; no const being cast away (out-param string slicing),curl_full_audit_0.4.35,med
ARR30-C,curl,src/tool_formparse.c,352,FP,while(*ptr) terminates on NUL of a NUL-terminated string copy; bounded,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_formparse.c,365,FP,"*end_pos set to ptr which points into caller's contents buffer, not function-local storage",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,365,FP,char* assignment; no sign extension,curl_full_audit_0.4.35,high
MEM33-C,curl,src/tool_formparse.c,372,FP,*ptr2++ = *ptr++ is byte copy of chars; no flexible-array-member struct involved,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,372,FP,char byte copy in unescape loop; no sign extension to wider type,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,372,FP,ptr2 walks into the same NUL-terminated buffer; idiomatic string pointer arithmetic,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,372,FP,char byte read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,372,FP,char byte read; no sign extension,curl_full_audit_0.4.35,high
ARR36-C,curl,src/tool_formparse.c,373,FP,ptr and *end_pos point into the same contents buffer; valid comparison,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_formparse.c,374,FP,"*end_pos=ptr2 points into caller's buffer, not function-local storage",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,374,FP,char* assignment; no sign extension,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_formparse.c,384,FP,"*str=ptr points into caller's contents buffer, valid after return",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,384,FP,char* deref/assignment; no sign extension,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,385,FP,word_begin+1 points within the input buffer; valid string arithmetic,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,395,FP,char* deref; no sign extension,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_formparse.c,395,FP,*str=*end_pos=ptr points into caller's buffer,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,395,FP,char* assignment; no sign extension,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_formparse.c,396,FP,"returns word_begin which points into caller's input buffer, not a local",curl_full_audit_0.4.35,high
EXP36-C,curl,src/tool_formparse.c,402,FP,curl_slist_append takes char*; no alignment upcast of misaligned data,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_formparse.c,407,FP,"*plist=s where s is from curl_slist_append (heap), not function-local",curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_formparse.c,423,FP,ptr from curlx_dyn_ptr after successful my_get_line; non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_formparse.c,444,FP,branch guarded by *pheaders non-NULL; l=*pheaders so l non-NULL,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_formparse.c,453,FP,"l->data freed at 448, reassigned at 451 via maprintf, then read; reassign not UAF",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,476,FP,char* deref; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,487,FP,*ptype=NULL pointer assignment; STR34 misfire,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,489,FP,*pfilename=NULL pointer assignment; misfire,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,493,FP,*pencoder=NULL pointer assignment; misfire,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,495,FP,"p++ skipping blanks in NUL-terminated string; idiomatic, bounded",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,497,FP,*pdata=word pointer assignment; not a char->wider sign extension,curl_full_audit_0.4.35,high
ARR00-C,curl,src/tool_formparse.c,500,FP,endpos[-1] guarded by endpos > *pdata; index never negative,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_formparse.c,500,FP,"endpos set by get_param_word, always non-NULL",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,502,FP,sep=*p char read; no sign extension issue (masked &0xFF at use),curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,502,FP,char read into char sep; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,503,FP,*endpos='\0' NUL write; not sign extension,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_formparse.c,504,FP,"while(sep==';') driven by parse state, terminates at end of input",curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,505,FP,p++ over NUL-terminated string; idiomatic,curl_full_audit_0.4.35,high
EXP30-C,curl,src/tool_formparse.c,505,FP,while(p++ && ISBLANK(*p)) modifies and reads p in separate sub-expressions with sequence point at &&,curl_full_audit_0.4.35,med
ARR37-C,curl,src/tool_formparse.c,510,FP,p+=5 to skip 'type=' prefix in string; bounded by content,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,510,FP,p++ skip blanks in string; idiomatic,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,517,FP,p+=tlen where tlen from strcspn bounds within string; valid,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,519,FP,sep=*p char read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,519,FP,char read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,523,FP,*endct='\0' NUL write; not sign extension,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,526,FP,p+=9 skip 'filename=' prefix; bounded by string content,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,526,FP,p++ skip blanks; idiomatic,curl_full_audit_0.4.35,high
ARR00-C,curl,src/tool_formparse.c,532,FP,endpos[-1] guarded by endpos > filename; index valid,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,534,FP,sep=*p char read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,534,FP,char read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,535,FP,*endpos='\0' NUL write; not sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,539,FP,*endct='\0' NUL write; not sign extension,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,542,FP,p+=8 skip 'headers=' prefix; bounded by content,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,548,FP,p++ skip '@'/'<' and blanks; idiomatic string walk,curl_full_audit_0.4.35,high
ARR00-C,curl,src/tool_formparse.c,554,FP,endpos[-1] guarded by endpos > hdrfile; index valid,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,556,FP,sep=*p char read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,556,FP,char read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,557,FP,*endpos='\0' NUL write; not sign extension,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_formparse.c,558,FP,fp closed via curlx_fclose at 567 in the success branch; NULL fp not opened,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_formparse.c,558,FP,duplicate fd-leak claim; curlx_fclose closes fp; not open(),curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_formparse.c,560,FP,errbuf is an out-buffer filled by curlx_strerror; not read uninitialized,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,578,FP,p++ skip blanks in string; idiomatic,curl_full_audit_0.4.35,high
ARR00-C,curl,src/tool_formparse.c,583,FP,endpos[-1] guarded by endpos > hdr; index valid,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,585,FP,sep=*p char read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,585,FP,char read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,586,FP,*endpos='\0' NUL write; not sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,596,FP,*endct='\0' NUL write; not sign extension,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,599,FP,p+=8 skip 'encoder=' prefix; bounded,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,599,FP,p++ skip blanks; idiomatic,curl_full_audit_0.4.35,high
ARR00-C,curl,src/tool_formparse.c,605,FP,endpos[-1] guarded by endpos > encoder; index valid,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,607,FP,sep=*p char read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,607,FP,char read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,608,FP,*endpos='\0' NUL write; not sign extension,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,612,FP,p++ in for-loop over NUL-terminated content-type string; bounded by *p && delimiters,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_formparse.c,614,FP,endct=p+1 within string buffer; valid arithmetic,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,615,FP,char read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,615,FP,char read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,621,FP,sep=*p char read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,621,FP,char read; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,622,FP,*endpos='\0' NUL write; not sign extension,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_formparse.c,623,FP,get_param_word always returns non-NULL (word_begin); unknown non-NULL,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,630,FP,*endct='\0' NUL write; not sign extension,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_formparse.c,633,FP,"*ptype=type where type points into caller's str buffer, not function-local",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,633,FP,pointer assignment; no sign extension,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_formparse.c,638,FP,*pfilename=filename points into caller's buffer; not local storage,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,638,FP,pointer assignment; no sign extension,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_formparse.c,643,FP,*pencoder=encoder points into caller's buffer; not local,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,643,FP,pointer assignment; no sign extension,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_formparse.c,648,FP,*pheaders=headers where headers is heap slist; not function-local,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_formparse.c,654,FP,*str=p points into caller's buffer; valid after return,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,654,FP,pointer assignment; no sign extension,curl_full_audit_0.4.35,high
INT13-C,curl,src/tool_formparse.c,655,FP,sep & 0xFF on a char promoted to int; masking already guards sign bits,curl_full_audit_0.4.35,med
PRE00-C,curl,src/tool_formparse.c,705,FP,"SET_TOOL_MIME_PTR uses field/m once each per expansion; do-while idiom, args are simple lvalues",curl_full_audit_0.4.35,med
PRE01-C,curl,src/tool_formparse.c,705,FP,field used as (m)->field member access; parenthesizing field is meaningless for member name,curl_full_audit_0.4.35,med
PRE12-C,curl,src/tool_formparse.c,705,FP,m is a simple lvalue (part); no side effects from multiple evaluation in practice,curl_full_audit_0.4.35,med
MEM33-C,curl,src/tool_formparse.c,738,FP,*mimecurrent=*mimeroot pointer assignment; no flexible-array struct copy,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_formparse.c,742,FP,curlx_strdup declared via curlx headers,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,752,FP,*contp++='\0' NUL write splitting name=value; not sign extension,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_formparse.c,762,FP,*mimecurrent=part where part is heap tool_mime; not function-local,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_formparse.c,767,FP,"!strcmp(contp, "")"") boolean idiom for option matching; idiomatic",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_formparse.c,876,FP,"*contp=(char)sep restoring a delimiter byte; explicit char cast, no sign extension",curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,88,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/http.c,90,FP,sizeof(*neg) on real struct pointer; correct,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,126,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,126,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,150,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,150,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,150,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,152,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http.c,200,FP,char* deref in string parsing; no harmful sign-extension,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,200,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
STR34-C,curl,lib/http.c,206,FP,char* deref in string parsing; no harmful sign-extension,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,227,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,243,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http.c,284,FP,"pointer guarded (len&&, calloc-assigned, DEBUGASSERT) before deref",curl_full_audit_0.4.35,high
STR34-C,curl,lib/http.c,285,FP,char* deref in string parsing; no harmful sign-extension,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/http.c,308,FP,all real paths return; switch covers cases,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,308,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http.c,315,FP,char* deref in string parsing; no harmful sign-extension,curl_full_audit_0.4.35,high
WIN04-C,curl,lib/http.c,348,FP,Windows EncodePointer advisory; N/A to portable code,curl_full_audit_0.4.35,high
WIN04-C,curl,lib/http.c,352,FP,Windows EncodePointer advisory; N/A to portable code,curl_full_audit_0.4.35,high
WIN04-C,curl,lib/http.c,355,FP,Windows EncodePointer advisory; N/A to portable code,curl_full_audit_0.4.35,high
WIN04-C,curl,lib/http.c,358,FP,Windows EncodePointer advisory; N/A to portable code,curl_full_audit_0.4.35,high
WIN04-C,curl,lib/http.c,362,FP,Windows EncodePointer advisory; N/A to portable code,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/http.c,394,FP,type specifier present; parse artifact,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,591,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,593,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,593,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,593,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,594,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,594,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http.c,607,FP,data->req.newurl/h are lifecycle members freed elsewhere; not a leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,613,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,613,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,615,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,615,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http.c,619,FP,data->req.newurl/h are lifecycle members freed elsewhere; not a leak,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,688,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,691,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,707,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,756,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http.c,774,FP,intentional empty-body if/else filter ladder with comments,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,846,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,847,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http.c,870,FP,char* deref in string parsing; no harmful sign-extension,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,892,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,893,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http.c,893,FP,data->req.newurl/h are lifecycle members freed elsewhere; not a leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,893,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,893,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,894,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,894,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,896,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http.c,904,FP,data->req.newurl/h are lifecycle members freed elsewhere; not a leak,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,1012,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,1012,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/http.c,1012,FP,all real paths return; switch covers cases,curl_full_audit_0.4.35,high
MSC41-C,curl,lib/http.c,1057,FP,"auth scheme name / HTTP token, not a credential",curl_full_audit_0.4.35,high
MSC41-C,curl,lib/http.c,1065,FP,"auth scheme name / HTTP token, not a credential",curl_full_audit_0.4.35,high
MSC41-C,curl,lib/http.c,1069,FP,"auth scheme name / HTTP token, not a credential",curl_full_audit_0.4.35,high
MSC41-C,curl,lib/http.c,1073,FP,"auth scheme name / HTTP token, not a credential",curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,1115,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,1115,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/http.c,1123,FP,style: could be const; not a defect,curl_full_audit_0.4.35,high
EXP00-C,curl,lib/http.c,1186,FP,precedence is correct; advisory parenthesization,curl_full_audit_0.4.35,high
EXP00-C,curl,lib/http.c,1186,FP,precedence is correct; advisory parenthesization,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1246,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1254,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1254,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1255,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1255,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1264,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1267,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1267,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1274,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1276,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1276,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1277,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1279,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1279,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1280,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1281,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1281,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1282,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1293,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1293,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1323,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1323,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1324,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1324,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1325,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1325,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1326,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1326,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1348,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1348,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1349,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1349,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1350,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1350,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1351,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1351,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1363,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1363,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1364,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1364,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1365,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1365,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1366,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1366,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1367,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1367,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,1405,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,1405,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,1406,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,1408,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http.c,1427,FP,char* deref in string parsing; no harmful sign-extension,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http.c,1427,FP,char* deref in string parsing; no harmful sign-extension,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,1454,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,1465,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,1515,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http.c,1543,FP,"pointer guarded (len&&, calloc-assigned, DEBUGASSERT) before deref",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http.c,1545,FP,"pointer guarded (len&&, calloc-assigned, DEBUGASSERT) before deref",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http.c,1546,FP,"pointer guarded (len&&, calloc-assigned, DEBUGASSERT) before deref",curl_full_audit_0.4.35,high
DCL00-C,curl,lib/http.c,1556,FP,style: could be const; not a defect,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http.c,1556,FP,char* through creader API; alignment fine in practice,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/http.c,1563,FP,style: could be const; not a defect,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http.c,1563,FP,char* through creader API; alignment fine in practice,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/http.c,1573,FP,style: could be const; not a defect,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http.c,1573,FP,char* through creader API; alignment fine in practice,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/http.c,1580,FP,style: could be const; not a defect,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/http.c,1580,FP,char* through creader API; alignment fine in practice,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,1587,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,1587,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,1594,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,1612,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
EXP00-C,curl,lib/http.c,1621,FP,precedence is correct; advisory parenthesization,curl_full_audit_0.4.35,high
INT14-C,curl,lib/http.c,1621,FP,bitwise+arith readability advisory,curl_full_audit_0.4.35,high
FLP03-C,curl,lib/http.c,1622,FP,"integer division (httpcode/100), not floating point",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,1654,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,1725,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,1781,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http.c,1801,FP,intentional empty-body if/else filter ladder with comments,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http.c,1807,FP,intentional empty-body if/else filter ladder with comments,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http.c,1811,FP,intentional empty-body if/else filter ladder with comments,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http.c,1815,FP,intentional empty-body if/else filter ladder with comments,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http.c,1820,FP,intentional empty-body if/else filter ladder with comments,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http.c,1823,FP,intentional empty-body if/else filter ladder with comments,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http.c,1827,FP,intentional empty-body if/else filter ladder with comments,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,1917,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,1918,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,1926,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/http.c,1969,FP,"request points to string literals, not local; valid after return",curl_full_audit_0.4.35,high
STR34-C,curl,lib/http.c,1969,FP,char* deref in string parsing; no harmful sign-extension,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1980,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1980,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1994,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1996,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1997,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,1997,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2000,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2001,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2006,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2006,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2007,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2007,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
EXP43-C,curl,lib/http.c,2028,FP,memmove on intentionally overlapping regions; correct tool,curl_full_audit_0.4.35,high
INT32-C,curl,lib/http.c,2028,FP,strlen(cookiehost)-1 with cookiehost non-empty (starts with [),curl_full_audit_0.4.35,high
STR34-C,curl,lib/http.c,2031,FP,char* deref in string parsing; no harmful sign-extension,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http.c,2037,FP,char* deref in string parsing; no harmful sign-extension,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2046,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2070,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,2080,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/http.c,2106,FP,style: could be const; not a defect,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http.c,2106,FP,data->req.newurl/h are lifecycle members freed elsewhere; not a leak,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http.c,2155,FP,char* deref in string parsing; no harmful sign-extension,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2157,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http.c,2185,FP,data->req.newurl/h are lifecycle members freed elsewhere; not a leak,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http.c,2210,FP,variable assigned by calloc/parse before use; not uninitialized,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2211,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MSC07-C,curl,lib/http.c,2260,FP,reachable; break/return inside switch case is normal,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,2313,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,2374,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,2426,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/http.c,2443,FP,all real paths return; switch covers cases,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2476,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2499,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/http.c,2500,FP,"adjacent string-literal concatenation, not a preprocessor directive",curl_full_audit_0.4.35,high
PRE32-C,curl,lib/http.c,2500,FP,"adjacent string-literal concatenation, not a preprocessor directive",curl_full_audit_0.4.35,high
MSC07-C,curl,lib/http.c,2510,FP,reachable; break/return inside switch case is normal,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2531,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2607,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2609,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2609,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2610,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2610,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2611,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2611,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2612,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2612,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2612,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2616,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2619,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2619,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2621,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2621,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2625,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2625,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2630,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2630,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2635,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2635,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2636,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2636,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2637,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2637,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2638,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2638,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2641,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2641,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2646,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2646,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2648,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2648,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2650,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2650,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2650,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2727,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2731,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http.c,2736,FP,variable assigned by calloc/parse before use; not uninitialized,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,2765,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2911,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2917,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/http.c,2925,FP,reachable; break/return inside switch case is normal,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2926,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2926,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2927,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2928,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2930,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2934,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2934,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2935,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2935,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2936,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2938,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2938,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2945,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2946,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2946,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,2957,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2965,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2966,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2966,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2966,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2967,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2967,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,2967,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,3011,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,3011,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,3108,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,3108,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,3110,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,3110,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3123,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3123,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http.c,3125,FP,char* deref in string parsing; no harmful sign-extension,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,3134,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3135,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,3156,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3157,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,3170,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3171,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/http.c,3184,FP,HD_IS/HD_VAL macros local; multiple-eval args are pure,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/http.c,3184,FP,macro multi-eval of pure args; idiomatic local macro,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/http.c,3187,FP,HD_IS/HD_VAL macros local; multiple-eval args are pure,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/http.c,3187,FP,macro multi-eval of pure args; idiomatic local macro,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/http.c,3193,FP,HD_IS/HD_VAL macros local; multiple-eval args are pure,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/http.c,3193,FP,macro multi-eval of pure args; idiomatic local macro,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3202,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
CON34-C,curl,lib/http.c,3211,FP,getenv static-storage advisory; single-threaded config path,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3236,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http.c,3252,FP,char* deref in string parsing; no harmful sign-extension,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http.c,3252,FP,char* deref in string parsing; no harmful sign-extension,curl_full_audit_0.4.35,high
INT18-C,curl,lib/http.c,3266,FP,k->size is signed curl_off_t; ==-1 compare valid,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http.c,3267,FP,variable assigned by calloc/parse before use; not uninitialized,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,3309,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,3310,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3373,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,3393,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3433,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,3484,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3499,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/http.c,3511,TP,time(NULL) return unchecked; degenerate -1 harmless but technically a violation,curl_full_audit_0.4.35,low
API05-C,curl,lib/http.c,3532,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
CON34-C,curl,lib/http.c,3566,FP,getenv static-storage advisory; single-threaded config path,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3595,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3641,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3662,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/http.c,3735,FP,reachable; break/return inside switch case is normal,curl_full_audit_0.4.35,high
INT18-C,curl,lib/http.c,3810,FP,k->size is signed curl_off_t; ==-1 compare valid,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3826,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/http.c,3838,FP,intentional empty-body if/else filter ladder with comments,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,3852,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3880,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,3881,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
INT30-C,curl,lib/http.c,3953,FP,pconsumed += blen bounded by recv buffer; no wrap,curl_full_audit_0.4.35,high
INT30-C,curl,lib/http.c,3963,FP,pconsumed += blen bounded by recv buffer; no wrap,curl_full_audit_0.4.35,high
INT18-C,curl,lib/http.c,3993,FP,k->size is signed curl_off_t; ==-1 compare valid,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http.c,4101,FP,data->req.newurl/h are lifecycle members freed elsewhere; not a leak,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http.c,4166,FP,data->req.newurl/h are lifecycle members freed elsewhere; not a leak,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,4170,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,4171,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/http.c,4177,FP,loop bounded by NUL terminator / null-terminated buffer index,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,4195,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
INT30-C,curl,lib/http.c,4198,FP,pconsumed += blen bounded by recv buffer; no wrap,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http.c,4225,FP,idiomatic !strcmp/!checkheaders boolean test,curl_full_audit_0.4.35,high
CON43-C,curl,lib/http.c,4227,FP,switch on *p over stable header buffer; no concurrent double-fetch,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http.c,4344,FP,"pointer guarded (len&&, calloc-assigned, DEBUGASSERT) before deref",curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,4363,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,4382,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,4428,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http.c,4490,FP,"pointer guarded (len&&, calloc-assigned, DEBUGASSERT) before deref",curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,4531,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,4532,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/http.c,4538,FP,loop bounded by NUL terminator / null-terminated buffer index,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,4553,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,4569,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,4579,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,4579,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/http.c,4579,FP,all real paths return; switch covers cases,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,4580,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http.c,4591,FP,variable assigned by calloc/parse before use; not uninitialized,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,4609,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,4609,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,4609,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/http.c,4619,FP,style: could be const; not a defect,curl_full_audit_0.4.35,high
INT07-C,curl,lib/http.c,4625,FP,char digit arithmetic in status parse; benign,curl_full_audit_0.4.35,high
INT08-C,curl,lib/http.c,4625,FP,narrow char arithmetic on digit; benign,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,4633,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,4634,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,4635,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,4636,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,4637,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http.c,4644,FP,variable assigned by calloc/parse before use; not uninitialized,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,4763,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,4763,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,4763,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,4764,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http.c,4765,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http.c,4773,FP,variable assigned by calloc/parse before use; not uninitialized,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,4811,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,4812,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
ARR02-C,curl,lib/http.c,4823,FP,H2_NON_FIELD[] sized by initializer; bounds implicit by design,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http.c,4832,FP,callback/vtable or struct-mutating signature; const not addable,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/http.c,4847,FP,loop bounded by NUL terminator / null-terminated buffer index,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/http.c,4859,FP,loop bounded by NUL terminator / null-terminated buffer index,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,4874,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
API00-C,curl,lib/http.c,4874,FP,thin wrapper / DEBUGASSERT-guarded; sibling NULL not deref here,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http.c,4885,FP,"pointer guarded (len&&, calloc-assigned, DEBUGASSERT) before deref",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,4911,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,4914,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,4918,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http.c,4922,FP,"STRCONST macro expands to (s,sizeof-1); no real unsequenced side effects",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http.c,4929,FP,"pointer guarded (len&&, calloc-assigned, DEBUGASSERT) before deref",curl_full_audit_0.4.35,high
MSC41-C,curl,lib/http.c,4930,FP,"auth scheme name / HTTP token, not a credential",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http.c,4950,FP,variable assigned by calloc/parse before use; not uninitialized,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/http.c,4971,FP,resp->prev chain short/bounded; not excessive recursion,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/http.c,4971,TP,Curl_http_resp_free directly recurses on resp->prev chain,curl_full_audit_0.4.35,low
MEM30-C,curl,lib/http.c,4975,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,4976,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http.c,4977,FP,free of distinct struct member or free+reassign; not UAF (struct-poison FP),curl_full_audit_0.4.35,high
DCL15-C,curl,lib/http.c,5011,FP,Curl_scheme_* exported via header; intentionally non-static,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/http.c,5011,FP,file-scope scheme table referenced cross-file via header,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/http.c,5028,FP,Curl_scheme_* exported via header; intentionally non-static,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/http.c,5028,FP,file-scope scheme table referenced cross-file via header,curl_full_audit_0.4.35,high
DCL37-C,curl,src/tool_doswin.c,60,FP,DJGPP runtime-mandated callback name; spelling fixed by toolchain (shim),curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_doswin.c,60,FP,signature fixed by DJGPP runtime; arg is (void)cast unused,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_doswin.c,92,FP,advisory C99 array-param style; curl never uses it,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,113,FP,char read/index into real array; no sign-extension defect,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,115,FP,p points into real string buffer (path); valid pointer walk,curl_full_audit_0.4.35,high
ENV01-C,curl,src/tool_doswin.c,140,FP,dos_name[PATH_MAX] not fed by getenv; bounded by strlen guard,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,155,FP,"*sanitized=NULL pointer null-assign, not char sign-extension",curl_full_audit_0.4.35,high
MEM33-C,curl,src/tool_doswin.c,171,FP,char assignment *d=*s misparsed as flexible-array struct copy,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,171,FP,char-to-char copy into dos_name array; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,171,FP,char-to-char copy; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,171,FP,char-to-char copy; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,172,FP,assigning char literal to char; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,181,FP,char literal assigned to char; no sign extension,curl_full_audit_0.4.35,high
MEM33-C,curl,src/tool_doswin.c,183,FP,char assignment misparsed as flexible-array struct copy,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,183,FP,char-to-char copy; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,183,FP,char read into char; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,183,FP,char read into char; no sign extension,curl_full_audit_0.4.35,high
MEM33-C,curl,src/tool_doswin.c,194,FP,char assignment misparsed as flexible-array struct copy,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,194,FP,char-to-char copy; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,194,FP,char read into char; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,194,FP,char read into char; no sign extension,curl_full_audit_0.4.35,high
MEM33-C,curl,src/tool_doswin.c,198,FP,char assignment misparsed as flexible-array struct copy,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,198,FP,char-to-char copy; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,198,FP,char read into char; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,198,FP,char read into char; no sign extension,curl_full_audit_0.4.35,high
MEM33-C,curl,src/tool_doswin.c,202,FP,char assignment misparsed as flexible-array struct copy,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,202,FP,char-to-char copy; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,202,FP,char read into char; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,202,FP,char read into char; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,205,FP,char literal '_' assigned to char; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,209,FP,char literal '.' assigned to char; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,212,FP,char literal '-' assigned to char; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,215,FP,char literal '.' assigned to char; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,222,FP,char literal 'x' assigned to char; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,225,FP,char literal 'x' assigned to char; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,230,FP,char literal 'x' assigned to char; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,233,FP,char literal 'x' assigned to char; no widening,curl_full_audit_0.4.35,high
EXP05-C,curl,src/tool_doswin.c,236,FP,"memcpy(d,""plus"",4); d is non-const char*, no cast present",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,244,FP,char literal '_' assigned to char; no widening,curl_full_audit_0.4.35,high
MEM33-C,curl,src/tool_doswin.c,247,FP,char assignment misparsed as flexible-array struct copy,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,247,FP,char-to-char copy; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,247,FP,char read into char; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,247,FP,char read into char; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,255,FP,NUL terminator '\0' assigned to char; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,265,FP,"*sanitized pointer assignment from strdup, not char sign-ext",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,299,FP,"*sanitized=NULL pointer null-assign, not char sign-extension",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,305,FP,"*sanitized pointer assignment from strdup, not char sign-ext",curl_full_audit_0.4.35,high
ARR38-C,curl,src/tool_doswin.c,321,FP,buffer=malloc(len+3); memcpy len+1 within bounds,curl_full_audit_0.4.35,high
INT32-C,curl,src/tool_doswin.c,321,FP,len+1 from strlen cannot overflow in practice; bounded,curl_full_audit_0.4.35,high
STR31-C,curl,src/tool_doswin.c,321,FP,memcpy of len+1 includes NUL; buffer sized correctly,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,332,FP,char compared/promoted to ASCII match; categorical char FP,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,333,FP,char promoted in comparison; ASCII values; categorical FP,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,334,FP,char promoted in comparison; ASCII values; categorical FP,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,335,FP,char promoted in comparison; ASCII values; categorical FP,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,336,FP,char promoted in comparison; ASCII values; categorical FP,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,337,FP,char promoted in comparison; ASCII values; categorical FP,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,337,FP,char promoted in comparison; ASCII values; categorical FP,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,338,FP,p indexes into heap string buffer; valid array access,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,338,FP,p[3] char compared to ASCII range; categorical char FP,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,338,FP,p indexes into heap string buffer; valid array access,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,338,FP,p[3] char compared to ASCII range; categorical char FP,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_doswin.c,346,FP,wrong buffer assoc (line731 buffer is other fn); p is heap string,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,346,FP,p indexes into heap string buffer; valid array access,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_doswin.c,349,FP,wrong buffer assoc; p walks NUL-terminated heap string,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,349,FP,p indexes into heap string buffer; valid array access,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_doswin.c,350,FP,wrong buffer assoc; index x bounded by NUL scan,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,350,FP,p indexes into heap string buffer; valid array access,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_doswin.c,353,FP,wrong buffer assoc; index x bounded by NUL scan,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,353,FP,p indexes into heap string buffer; valid array access,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_doswin.c,355,FP,wrong buffer assoc; index x bounded by NUL scan,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,355,FP,p indexes into heap string buffer; valid array access,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_doswin.c,360,FP,wrong buffer assoc; index x bounded by NUL scan,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,360,FP,p indexes into heap string buffer; valid array access,curl_full_audit_0.4.35,high
ARR38-C,curl,src/tool_doswin.c,367,FP,memmove p_len+1 within buffer that has 2 spare bytes,curl_full_audit_0.4.35,high
EXP43-C,curl,src/tool_doswin.c,367,FP,memmove handles overlap by design; args not restrict,curl_full_audit_0.4.35,high
INT32-C,curl,src/tool_doswin.c,367,FP,p_len+1 from strlen cannot overflow; bounded,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,367,FP,p points into heap buffer; valid pointer arithmetic,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,368,FP,p[0] write into heap string buffer; valid,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,387,FP,base char promoted; categorical char FP,curl_full_audit_0.4.35,high
ARR38-C,curl,src/tool_doswin.c,393,FP,memmove blen+1 guarded by len==bufsize-1 check above,curl_full_audit_0.4.35,high
EXP43-C,curl,src/tool_doswin.c,393,FP,memmove handles overlap by design; args not restrict,curl_full_audit_0.4.35,high
INT32-C,curl,src/tool_doswin.c,393,FP,blen+1 from strlen cannot overflow; bounded,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_doswin.c,400,FP,"buffer is curlx_malloc heap, valid after return; not stack-local",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,400,FP,"*sanitized pointer assignment, not char sign-extension",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,443,FP,"*sanitized=NULL pointer null-assign, not char sign-extension",curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_doswin.c,455,FP,!strncmp boolean idiom; idiomatic prefix test,curl_full_audit_0.4.35,high
ARR38-C,curl,src/tool_doswin.c,455,FP,"target is heap strdup string, not size-3 buffer; false size",curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,457,FP,target+4 into heap string with verified \\?\ prefix; valid,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,463,FP,p walks heap string buffer; valid pointer increment,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_doswin.c,464,FP,banned assigned in inner for-init before use; not uninitialized,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,469,FP,char literal '_' assigned to char; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,475,FP,char literal '_' assigned to char; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,485,FP,target[len] addressing into heap string; char index FP,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,485,FP,char read into char; no sign extension,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,485,FP,target indexes into heap string buffer; valid array access,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_doswin.c,487,FP,"p walks heap string, guarded by p!=target; valid",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,494,FP,NUL '\0' assigned to char; no widening,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_doswin.c,501,FP,sc assigned by msdosify() before if(sc) test; not uninitialized,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_doswin.c,507,FP,target freed once then reassigned to fresh p; no UAF/double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_doswin.c,507,FP,"p is fresh callee allocation; target free then reassign, no UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_doswin.c,507,FP,&p out-param written by callee before target freed; no UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_doswin.c,508,FP,target freed once per branch then reassigned; not double-free,curl_full_audit_0.4.35,high
CON34-C,curl,src/tool_doswin.c,515,FP,DEBUGBUILD-only getenv in single-threaded CLI init; idiomatic,curl_full_audit_0.4.35,med
CON34-C,curl,src/tool_doswin.c,517,FP,DEBUGBUILD-only getenv in single-threaded CLI init; idiomatic,curl_full_audit_0.4.35,med
DCL30-C,curl,src/tool_doswin.c,521,FP,target is heap allocation valid after return; not stack-local,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_doswin.c,521,FP,"*sanitized pointer assignment from heap target, not char sign-ext",curl_full_audit_0.4.35,high
API00-C,curl,src/tool_doswin.c,548,FP,internal fn; config always valid from callers; never NULL,curl_full_audit_0.4.35,med
API00-C,curl,src/tool_doswin.c,548,FP,bundle_file passed to SearchPath which tolerates it; caller-valid,curl_full_audit_0.4.35,med
ENV01-C,curl,src/tool_doswin.c,553,FP,buf[MAX_PATH] filled by SearchPath with MAX_PATH cap; not getenv,curl_full_audit_0.4.35,high
EXP43-C,curl,src/tool_doswin.c,558,FP,SearchPath args are distinct pointers; no aliasing,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_doswin.c,562,FP,free(cacert) then reassign from convert(); free-reassign not UAF,curl_full_audit_0.4.35,high
MEM05-C,curl,src/tool_doswin.c,599,FP,"sizeof()*2 is compile-time constant array size, not a VLA",curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_doswin.c,642,FP,static struct zero-initialized by default; not uninitialized,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_doswin.c,669,FP,!curlx_verify_windows_version boolean idiom; idiomatic,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_doswin.c,685,TP,"atexit() return unchecked; can fail, cleanup silently not registered",curl_full_audit_0.4.35,low
EXP36-C,curl,src/tool_doswin.c,709,FP,void* thread param from calloc'd struct; properly aligned,curl_full_audit_0.4.35,high
CON07-C,curl,src/tool_doswin.c,758,FP,statics accessed only from main thread; worker never touches them,curl_full_audit_0.4.35,med
CON03-C,curl,src/tool_doswin.c,762,FP,stdin_thread single-thread access; no cross-thread visibility issue,curl_full_audit_0.4.35,med
CON03-C,curl,src/tool_doswin.c,763,FP,socket_r single-thread access; no cross-thread visibility issue,curl_full_audit_0.4.35,med
DCL00-C,curl,src/tool_doswin.c,763,FP,socket_r is reassigned at lines 832/870; cannot be const,curl_full_audit_0.4.35,high
ERR06-C,curl,src/tool_doswin.c,766,FP,debug invariant assert; deliberate; not error-handling path,curl_full_audit_0.4.35,med
ERR06-C,curl,src/tool_doswin.c,769,FP,debug invariant assert; deliberate; not error-handling path,curl_full_audit_0.4.35,med
POS02-C,curl,src/tool_doswin.c,795,FP,bind to loopback ephemeral port is not a privileged operation,curl_full_audit_0.4.35,high
POS02-C,curl,src/tool_doswin.c,806,FP,listen on loopback socket is not a privileged operation,curl_full_audit_0.4.35,high
EXP30-C,curl,src/tool_doswin.c,812,FP,GetCurrentProcess/GetStdHandle side-effect-free; no unsequenced UB,curl_full_audit_0.4.35,high
EXP43-C,curl,src/tool_doswin.c,812,FP,DuplicateHandle source/dest are distinct pointers; no aliasing,curl_full_audit_0.4.35,high
EXP43-C,curl,src/tool_doswin.c,823,FP,CreateThread args are distinct pointers; no aliasing,curl_full_audit_0.4.35,high
WIN01-C,curl,src/tool_doswin.c,874,TP,TerminateThread genuinely flagged hazardous API; curl uses as last resort,curl_full_audit_0.4.35,low
ERR06-C,curl,src/tool_doswin.c,891,FP,debug invariant assert; deliberate; not error-handling path,curl_full_audit_0.4.35,med
API05-C,curl,lib/vtls/gtls.c,84,FP,"gtls_push is a gnutls transport callback; signature fixed, curl never uses C99 array syntax",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,84,FP,"callback signature; conformant-array advisory, curl convention",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,108,FP,"gtls_pull gnutls callback; fixed signature, advisory only",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,108,FP,callback signature; conformant-array advisory,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/vtls/gtls.c,203,FP,f closed via curlx_fclose(f) at out: label on every path,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/vtls/gtls.c,203,FP,"f is FILE* via fopen, closed at line 219; not an fd leak",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vtls/gtls.c,206,FP,filelen assigned/read in || chain; short-circuit gives sequence points,curl_full_audit_0.4.35,high
FIO14-C,curl,lib/vtls/gtls.c,206,FP,"stream opened binary 'rb'; SEEK_END on binary is curl idiom, not text UB",curl_full_audit_0.4.35,med
FIO19-C,curl,lib/vtls/gtls.c,206,FP,ftell-for-size advisory; established curl idiom with full error checking,curl_full_audit_0.4.35,med
ERR33-C,curl,lib/vtls/gtls.c,207,FP,ftell return checked: (filelen = ftell(f)) < 0 guards,curl_full_audit_0.4.35,high
ERR00-C,curl,lib/vtls/gtls.c,207,FP,ftell result checked < 0 in same condition,curl_full_audit_0.4.35,high
EXP45-C,curl,lib/vtls/gtls.c,209,FP,"malloc-in-condition with negation guard; idiomatic, result checked",curl_full_audit_0.4.35,med
INT31-C,curl,lib/vtls/gtls.c,209,FP,filelen guarded >=0 by prior < 0 short-circuit before cast,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/gtls.c,209,FP,filelen assigned by ftell earlier in same || chain before use,curl_full_audit_0.4.35,high
FIO17-C,curl,lib/vtls/gtls.c,211,FP,"loaded_file holds binary cert data, not a NUL-terminated C string",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/gtls.c,211,FP,ptr guarded by !(ptr=malloc()) goto out before fread,curl_full_audit_0.4.35,high
INT31-C,curl,lib/vtls/gtls.c,211,FP,filelen non-negative after guard,curl_full_audit_0.4.35,high
INT31-C,curl,lib/vtls/gtls.c,211,FP,filelen non-negative after guard,curl_full_audit_0.4.35,high
INT31-C,curl,lib/vtls/gtls.c,217,FP,filelen non-negative after guard,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vtls/gtls.c,220,FP,f closed at out:; ptr ownership returned via loaded_file.data,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/gtls.c,220,FP,"loaded_file.data is live allocation or NULL, not freed",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,320,FP,"peer read-only here but curl does not const-qualify; static helper, marginal",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,321,FP,"conn_config read-only; curl convention, not const-qualified",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/gtls.c,341,FP,*prioritylist is char** assigned a string-literal pointer; no signed-char read,curl_full_audit_0.4.35,high
INT13-C,curl,lib/vtls/gtls.c,345,FP,"ssl_version OR'd as switch discriminant of curl enum constants; bounded, idiomatic",curl_full_audit_0.4.35,med
STR34-C,curl,lib/vtls/gtls.c,347,FP,"char** pointer assignment of literal, no char sign extension",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/gtls.c,351,FP,char** literal pointer assignment,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/gtls.c,355,FP,char** literal pointer assignment,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/gtls.c,359,FP,char** literal pointer assignment,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/gtls.c,363,FP,char** literal pointer assignment,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/gtls.c,367,FP,char** literal pointer assignment,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/gtls.c,371,FP,char** literal pointer assignment,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/gtls.c,375,FP,char** literal pointer assignment,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/gtls.c,378,FP,char** literal pointer assignment,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/gtls.c,382,FP,char** literal pointer assignment,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/gtls.c,391,FP,"data derefed only via Curl_pgrs_now; caller-validated, curl never null-checks data here",curl_full_audit_0.4.35,med
EXP33-C,curl,lib/vtls/gtls.c,398,FP,shared = calloc(...) assigned and NULL-checked before deref,curl_full_audit_0.4.35,high
MEM33-C,curl,lib/vtls/gtls.c,410,FP,"shared->time = *Curl_pgrs_now() is plain struct copy, no flexible array",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vtls/gtls.c,411,FP,"shared is heap calloc, not automatic storage; valid after return",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/gtls.c,418,FP,creds caller-validated via DEBUGASSERT; up_ref takes non-null arg,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/gtls.c,444,FP,"false alignment: Curl_ssl_cf_get_config accessor return cast, not raw char*",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/gtls.c,448,FP,config from cf accessor always returns valid pointer,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/gtls.c,454,FP,ssl_config from cf accessor always valid,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/gtls.c,460,FP,rc assigned at 459 in same #else branch before use at 460,curl_full_audit_0.4.35,high
MSC41-C,curl,lib/vtls/gtls.c,555,FP,"hash-key string 'tls:gtls:x509:share', not a credential",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/gtls.c,574,FP,conn_config from accessor always valid,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vtls/gtls.c,592,FP,"shared_creds from hash_pick is heap, not local automatic storage",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,598,FP,hash dtor callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,598,FP,hash dtor key param fixed by function-pointer typedef; cannot const-qualify,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,598,FP,hash dtor callback signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,598,FP,hash dtor p param fixed by typedef,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/gtls.c,602,FP,!memcmp inside DEBUGASSERT; idiomatic boolean test,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/gtls.c,621,FP,conn_config from accessor always valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/gtls.c,639,FP,cf passed to accessor which handles it; siblings never null-check cf,curl_full_audit_0.4.35,med
API00-C,curl,lib/vtls/gtls.c,639,FP,"data caller-validated; internal entry, curl convention",curl_full_audit_0.4.35,med
EXP36-C,curl,lib/vtls/gtls.c,644,FP,"false alignment on accessor return, not raw char*",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/gtls.c,654,FP,conn_config accessor always valid,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/gtls.c,657,FP,ssl_config accessor always valid,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,690,FP,public API ssl_peer_key param; curl never uses array syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,693,FP,alpn param advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,694,FP,quic_tp param advisory; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,807,FP,gtls is read here but curl does not const-qualify gtls_ctx*; convention,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/gtls.c,819,FP,conn_config accessor always valid,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/gtls.c,869,FP,false alignment on accessor return,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/gtls.c,876,FP,config accessor always valid,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/gtls.c,883,FP,"'result' is a CURLcode return code, not allocated memory; misclassified allocator",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/gtls.c,892,FP,rc assigned before each use in SRP branch,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/gtls.c,895,FP,"result is CURLcode, not memory; real alloc in gtls->shared_creds freed by close",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/gtls.c,900,FP,"result is CURLcode return value, not a pointer",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/gtls.c,909,FP,"result is CURLcode return value, not a pointer",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/gtls.c,914,FP,ssl_config accessor always valid,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/gtls.c,949,FP,"result is CURLcode return value, not a pointer",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/gtls.c,956,FP,"result is CURLcode return value, not a pointer",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/gtls.c,966,FP,!!gnutls_check_version is explicit bool coercion idiom,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/gtls.c,971,FP,"result is CURLcode return value, not a pointer",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/gtls.c,981,FP,prioritylist set via &prioritylist out-param at line 976 before use,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/gtls.c,1000,FP,"result is CURLcode return value, not a pointer",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/gtls.c,1021,FP,"result is CURLcode return value, not a pointer",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/gtls.c,1033,FP,"result is CURLcode return value, not a pointer",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/gtls.c,1043,FP,"result is CURLcode return value, not a pointer",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/gtls.c,1052,FP,"result is CURLcode return value, not a pointer",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/gtls.c,1056,FP,"result is CURLcode return value, not a pointer",curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/gtls.c,1095,FP,"cf handled by accessor; public init, siblings don't null-check",curl_full_audit_0.4.35,med
API00-C,curl,lib/vtls/gtls.c,1095,FP,data caller-validated entry point; curl convention,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/gtls.c,1100,FP,"cb_setup is a function pointer param, not derefed as data; const N/A",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,1103,FP,sess_reuse_cb is a function pointer param; const N/A,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/gtls.c,1106,FP,false alignment on accessor return,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/vtls/gtls.c,1108,FP,"gtls_alpns[] is a gnutls_datum_t array, no getenv involved",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/gtls.c,1121,FP,conn_config accessor always valid,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/gtls.c,1141,FP,ssl_config accessor always valid,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/gtls.c,1183,FP,"alpns filled by Curl_alpn_copy(&alpns,...) at line 1116 before use",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vtls/gtls.c,1187,FP,gtls_alpns[i] written in loop before read by gnutls_alpn_set_protocols,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,1314,FP,gctx read-only but curl does not const gtls_ctx*; public fn convention,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vtls/gtls.c,1322,FP,gnutls_kx/cipher/mac_get are pure getters; no shared-state side effects,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,1336,FP,"peer read-only; static helper but curl convention, not const-qualified",curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vtls/gtls.c,1341,FP,certname is written by gnutls_x509_crt_get_dn_by_oid and certname[0]=0; not const,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/gtls.c,1404,FP,certfields.data re-populated by get_issuer_dn2 at 1400 after free at 1397,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/gtls.c,1406,FP,"distinct allocation freed once; reassigned between frees, no double-free",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,1530,FP,cf is callback param ((void)cf); signature fixed by gtls_chain_get_der typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,1531,FP,data is callback param ((void)data); fixed callback signature,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,1532,FP,callback signature fixed; conformant-array advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,1532,FP,user_data callback param fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,1534,FP,pder out-param callback signature; advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,1569,FP,config read-only here but public fn; curl does not const-qualify,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,1570,FP,ssl_config->certverifyresult written via certverifyresult ptr; not const-able,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/gtls.c,1588,FP,chain.certs/num_certs set by gnutls_certificate_get_peers before read,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/gtls.c,1835,FP,all paths set result and reach 'return result' via out: label,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/gtls.c,1841,FP,false alignment on accessor return,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/vtls/gtls.c,1844,FP,data->set.str[] indexed by enum constant; misattributed to unrelated char str[96],curl_full_audit_0.4.35,high
ARR30-C,curl,lib/vtls/gtls.c,1845,FP,data->set.str[] enum-constant index; bogus buffer attribution,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/vtls/gtls.c,1847,FP,data->set.str[] enum-constant index; bogus buffer attribution,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/gtls.c,1868,FP,gtls_send_earlydata returns result at end via out: label on all paths,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,2029,FP,gtls_data_pending is a vtable impl; signature fixed by Curl_ssl backend struct,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,2046,FP,"gtls_send vtable impl; signature fixed, advisory",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/gtls.c,2184,FP,gtls_close frees distinct backend->gtls members; backend->gtls itself not freed,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,2192,FP,gtls_recv vtable impl; signature fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,2233,FP,"Curl_gtls_version public API; fixed signature, advisory",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,2239,FP,gtls_random vtable callback ((void)data); signature fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,2240,FP,gtls_random entropy vtable param; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,2248,FP,gtls_sha256sum vtable impl; signature fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/gtls.c,2250,FP,gtls_sha256sum output param vtable; advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/gtls.c,2265,FP,gtls_get_internals vtable impl; signature fixed by Curl_ssl struct,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/rtsp.c,73,FP,[adv] RTP_PKT_LENGTH evaluates (p) multiple times; idiomatic curl macro but rule applies,curl_full_audit_0.4.35,adversarial-flip
PRE12-C,curl,lib/rtsp.c,73,FP,"[adv] Macro evaluates param p (p[2],p[3]) multiple times; could be inline function",curl_full_audit_0.4.35,adversarial-flip
API05-C,curl,lib/rtsp.c,88,FP,Curl never uses C99 array-param syntax; dtor callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/rtsp.c,88,FP,rtsp_easy_dtor key param fixed by Curl_meta_dtor function-pointer typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/rtsp.c,88,FP,"conformant-array advisory; curl convention, callback signature",curl_full_audit_0.4.35,high
API05-C,curl,lib/rtsp.c,96,FP,dtor callback signature fixed by typedef; curl never uses array syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/rtsp.c,96,FP,rtsp_conn_dtor key fixed by Curl_meta_dtor typedef; cannot add const,curl_full_audit_0.4.35,high
API05-C,curl,lib/rtsp.c,96,FP,conformant-array advisory; callback signature,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/rtsp.c,111,FP,rtspc assigned by calloc then null-checked before deref; not uninitialized,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/rtsp.c,121,FP,"meta_set calls dtor on failure (url.c:3876); ownership transferred, no leak",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/rtsp.c,123,FP,"success return; rtspc/rtsp owned by meta hash with dtors, freed at cleanup",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/rtsp.c,168,FP,Curl_meta_get returns void* to heap struct stored as RTSP*; properly aligned,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/rtsp.c,242,FP,"!Curl_checkheaders idiom; returns ptr, ! tests NULL = header-absent, clear",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/rtsp.c,251,FP,!Curl_checkheaders NULL test idiom,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/rtsp.c,252,FP,"adjacent string-literal concatenation across lines, no preprocessor directive",curl_full_audit_0.4.35,high
PRE32-C,curl,lib/rtsp.c,252,FP,"adjacent string literals, not a #directive in args",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/rtsp.c,260,FP,!Curl_checkheaders NULL test idiom,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/rtsp.c,261,FP,"adjacent string-literal concatenation, no preprocessor directive",curl_full_audit_0.4.35,high
PRE32-C,curl,lib/rtsp.c,261,FP,"adjacent string literals across lines, not #directive",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/rtsp.c,284,FP,Curl_meta_get void* to heap-allocated RTSP struct; aligned,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,403,FP,free-then-reassign: curlx_free then aptr.rtsp_transport=maprintf; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,403,FP,data->state is struct member never freed; free-reassign pattern,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,404,FP,"reassignment of freed member, not a read of freed memory",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,404,FP,data->state struct not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,406,FP,"data->set.str read, unrelated to freed aptr.rtsp_transport",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,407,FP,"reads reassigned (maprintf result) rtsp_transport, not freed memory",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,407,FP,aptr re-populated before this null-check,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,407,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,417,FP,"reads reassigned rtsp_transport (maprintf), not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,417,FP,aptr live after reassignment,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,417,FP,data->state not freed,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/rtsp.c,427,FP,!Curl_checkheaders NULL test idiom,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,428,FP,"data->set.str read, unrelated to freed accept_encoding",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,429,FP,free-then-reassign accept_encoding=maprintf; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,429,FP,data->state struct not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,430,FP,reassignment target of freed member; not read of freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,430,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,432,FP,"data->set.str read, unrelated",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,434,FP,"reads reassigned accept_encoding (maprintf), not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,434,FP,aptr live after reassignment,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,434,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,438,FP,reads reassigned accept_encoding into p_accept_encoding; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,438,FP,aptr live,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,438,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,447,FP,"Curl_safefree nulls uagent; this is the free site, not a UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,447,FP,aptr struct member not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,447,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,448,FP,safefree call site nulls pointer; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,448,FP,data->state not freed,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/rtsp.c,450,FP,!Curl_checkheaders NULL test idiom,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,451,FP,data->set.str read; uagent not freed on this branch (else of safefree),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,452,FP,else-branch reads live uagent (safefree only in if-branch); not freed here,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,452,FP,aptr not freed on this path,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,452,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,462,FP,reads proxyuserpwd; not freed in this function,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,462,FP,aptr not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,462,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,464,FP,reads userpwd; freed only later at 551 (after use),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,464,FP,aptr not freed at this point,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,464,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,467,FP,"Curl_safefree(ref) nulls it; this is free site, reassigned at 470",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,467,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,468,FP,"reads state.referer (bufref), unrelated to freed aptr.ref",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,468,FP,data->state not freed,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/rtsp.c,469,FP,!Curl_checkheaders NULL test idiom,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,470,FP,reassignment target aptr.ref=maprintf; not UAF (was safefree'd null at 467),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,470,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,471,FP,"reads state.referer bufref, not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,471,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,473,FP,reads reassigned aptr.ref into p_referrer; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,473,FP,aptr live,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,473,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,481,FP,reads state.use_range bool; nothing freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,481,FP,data->state not freed,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/rtsp.c,485,FP,!Curl_checkheaders NULL test idiom,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,485,FP,reads state.range; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,485,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,486,FP,"curlx_free(rangeline) is free site, reassigned at 487; not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,486,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,487,FP,reassignment target rangeline=maprintf; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,487,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,488,FP,reads state.range arg to maprintf; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,488,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,489,FP,reads reassigned rangeline into p_range; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,489,FP,aptr live,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,489,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,551,FP,Curl_safefree(userpwd) free site after p_userpwd already consumed at 545,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,551,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,585,FP,increments rtsp_next_client_CSeq counter; nothing freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,585,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,587,FP,reads req.writebytecount counter; nothing freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,587,FP,data->req not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,590,FP,passes writebytecount to pgrs; nothing freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/rtsp.c,590,FP,data->req not freed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/rtsp.c,602,FP,"rtspc modified: rtp_write_body_junk passes to fns; rtspc->in_header read, member writes elsewhere in flow",curl_full_audit_0.4.35,med
API05-C,curl,lib/rtsp.c,603,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/rtsp.c,622,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/rtsp.c,666,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/rtsp.c,726,FP,"DEBUGASSERT(curlx_dyn_len==1) is an assertion of exact state, not boolean test",curl_full_audit_0.4.35,high
INT13-C,curl,lib/rtsp.c,727,FP,"off=buf[0]%8 is 0-7, non-negative bounded; 1<<off safe",curl_full_audit_0.4.35,high
INT34-C,curl,lib/rtsp.c,727,FP,off in 0-7 (mod 8 of unsigned char); shift always valid,curl_full_audit_0.4.35,high
STR34-C,curl,lib/rtsp.c,763,FP,"curlx_dyn_len return, not a *buf char sign-extension; misparse",curl_full_audit_0.4.35,med
STR34-C,curl,lib/rtsp.c,782,FP,curlx_dyn_len return; not char sign-extension; misparse,curl_full_audit_0.4.35,med
API05-C,curl,lib/rtsp.c,838,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
INT18-C,curl,lib/rtsp.c,887,FP,"req.size is signed curl_off_t; <= -1 compares signed, no unsigned conversion",curl_full_audit_0.4.35,high
API05-C,curl,lib/rtsp.c,926,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
INT10-C,curl,lib/rtsp.c,960,FP,chan from curlx_str_number(max 255) is non-negative; off=chan%8 well-defined,curl_full_audit_0.4.35,high
INT31-C,curl,lib/rtsp.c,961,FP,"off 0-7, (1<<off) max 128 fits unsigned char; no upper bits lost",curl_full_audit_0.4.35,high
INT34-C,curl,lib/rtsp.c,961,FP,off in 0-7; shift always valid,curl_full_audit_0.4.35,high
INT13-C,curl,lib/rtsp.c,961,FP,off non-negative bounded 0-7; signed shift safe,curl_full_audit_0.4.35,high
API00-C,curl,lib/rtsp.c,976,FP,Curl_rtsp_parseheader is internal; data/header always non-NULL from callers (resp parser),curl_full_audit_0.4.35,med
API00-C,curl,lib/rtsp.c,976,FP,header param always valid from header-parse callers; internal fn,curl_full_audit_0.4.35,med
EXP36-C,curl,lib/rtsp.c,980,FP,Curl_meta_get void* to heap RTSP struct; aligned,curl_full_audit_0.4.35,high
STR34-C,curl,lib/rtsp.c,981,FP,"&header[5] is pointer arithmetic to char*, not signed-char sign extension",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/rtsp.c,996,FP,header is const char* param; header+8 is string ptr arithmetic; misparse of header[5] subscript as array,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/rtsp.c,1038,FP,header is const char* param; header+10 valid string arithmetic; not a 5-element array,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/rtsp.c,1073,FP,"Curl_scheme_rtsp has external linkage (declared in header, used by url.c scheme table)",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/rtsp.c,1073,FP,file-scope scheme table intentionally exported; cannot be function-local,curl_full_audit_0.4.35,high
PRE08-C,curl,lib/vtls/vtls_scache.c,43,FP,8-char header-name collision is irrelevant on modern systems; advisory noise,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/vtls/vtls_scache.c,68,FP,GOOD_SCACHE args are simple lvalues with no side effects; idiomatic curl macro,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/vtls/vtls_scache.c,68,FP,multiple eval of pure lvalue x has no side-effect hazard; idiomatic,curl_full_audit_0.4.35,med
ENV01-C,curl,lib/vtls/vtls_scache.c,81,FP,abspath sized by _MAX_PATH for _fullpath; no env-var involved here,curl_full_audit_0.4.35,high
MEM34-C,curl,lib/vtls/vtls_scache.c,81,FP,no free() of abspath in _WIN32 branch; abspath is _fullpath dest buffer,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/vtls/vtls_scache.c,81,FP,"_MAX_PATH is a Windows platform macro, not a curl-defined identifier",curl_full_audit_0.4.35,high
DCL37-C,curl,lib/vtls/vtls_scache.c,81,FP,_MAX_PATH is system-provided Windows macro; not curl's to rename,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vtls/vtls_scache.c,89,FP,r is reused for free()'s return path; const-qualifying a CURLcode result is noise,curl_full_audit_0.4.35,med
MSC37-C,curl,lib/vtls/vtls_scache.c,102,FP,function returns r on all paths via out label; no fall-through,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls_scache.c,104,FP,"blob->data passed to Curl_sha256it; logically read-only but blob deref is fine, advisory",curl_full_audit_0.4.35,med
DCL00-C,curl,lib/vtls/vtls_scache.c,106,FP,r is reassigned through the function via goto chain; not effectively const,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/vtls/vtls_scache.c,118,FP,hash[] filled by Curl_sha256it before the loop reads it,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/vtls_scache.c,132,FP,peer_key[len-1] compared to char literals 'G'/':'; no integer promotion hazard,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/vtls_scache.c,132,FP,char compared against char literal; no sign-extension to larger type,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls_scache.c,138,FP,cf passed to Curl_ssl_cf_get_primary_config; internal caller always supplies non-NULL cf,curl_full_audit_0.4.35,med
STR34-C,curl,lib/vtls/vtls_scache.c,149,FP,*ppeer_key = NULL assignment; no char-to-larger-int conversion,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,175,FP,"ssl from get_primary_config; internal cf always has primary config, non-NULL by invariant",curl_full_audit_0.4.35,med
MSC41-C,curl,lib/vtls/vtls_scache.c,233,FP,"""CApath"" is a key-label string, not a credential",curl_full_audit_0.4.35,high
MSC41-C,curl,lib/vtls/vtls_scache.c,239,FP,"""Issuer"" is a key-label string, not a credential",curl_full_audit_0.4.35,high
MSC41-C,curl,lib/vtls/vtls_scache.c,243,FP,"""CertBlob"" is a key-label string, not a credential",curl_full_audit_0.4.35,high
MSC41-C,curl,lib/vtls/vtls_scache.c,248,FP,"""CAInfoBlob"" is a key-label string, not a credential",curl_full_audit_0.4.35,high
MSC41-C,curl,lib/vtls/vtls_scache.c,253,FP,"""IssuerBlob"" is a key-label string, not a credential",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/vtls_scache.c,290,FP,*ppeer_key assigned dynbuf-taken char*; no char-to-int sign extension,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls_scache.c,324,FP,udata is (void)udata-cast llist dtor callback signature; const not allowed by typedef,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/vtls_scache.c,330,FP,s->alpn and s freed as distinct members sequentially; not use-after-free,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls_scache.c,334,FP,thin wrapper forwarding to create2; never derefs alpn itself,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.c,334,FP,curl never uses C99 conformant array param syntax; stylistic,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.c,335,FP,curl never uses C99 conformant array param syntax; stylistic,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls_scache.c,344,FP,"quic_tp may legitimately be NULL; create2 stores it without deref, no validation needed",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.c,344,FP,curl never uses C99 conformant array param syntax; stylistic,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.c,345,FP,curl never uses C99 conformant array param syntax; stylistic,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.c,347,FP,curl never uses C99 conformant array param syntax; stylistic,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls_scache.c,358,FP,s assigned by calloc on the same line before any deref; not uninitialized,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vtls/vtls_scache.c,379,FP,"s points to calloc'd heap memory, not a local; valid after return",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,397,FP,peer comes from &scache->peers[i] array slots; never NULL at callers,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/vtls_scache.c,401,FP,sobj_free is a callback invoked then nulled; not a freed-pointer access,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls_scache.c,416,FP,sobj is opaque ownership-transfer pointer stored into peer->sobj; const inappropriate,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/vtls_scache.c,417,FP,sobj_free is a function pointer typedef; const-qualifying makes no sense,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/vtls_scache.c,421,FP,sobj_free(peer->sobj) invokes dtor callback; not access of freed memory,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,451,FP,"peer DEBUGASSERT'd implicitly; always an array slot from caller, non-NULL",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/vtls/vtls_scache.c,459,FP,"peer->key_salt is a fixed array member of a struct, not a decayed param; sizeof correct",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/vtls/vtls_scache.c,460,FP,peer->key_hmac is a fixed array member of a struct; sizeof correct,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls_scache.c,491,FP,peer used only in DEBUGASSERT here but is part of mutate-API family; const noise,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/vtls/vtls_scache.c,495,FP,peer is (void)peer cast; deref only in DEBUGASSERT; callers pass array slot,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls_scache.c,499,TP,"static helper reads only s->valid_until; could be const, not a callback signature",curl_full_audit_0.4.35,low
EXP34-C,curl,lib/vtls/vtls_scache.c,502,FP,s is a live session node element; caller loop guarantees non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,508,FP,peer is array-slot pointer from internal callers; never NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,519,FP,peer is array-slot pointer; non-NULL by invariant,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls_scache.c,537,FP,peers assigned by calloc on the same statement before deref; not uninitialized,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/vtls_scache.c,541,FP,scache assigned by calloc before any deref; not uninitialized,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vtls/vtls_scache.c,544,FP,peers freed explicitly here on calloc failure; scache is NULL; no leak,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vtls/vtls_scache.c,558,FP,"scache is calloc'd heap; *pscache=scache hands off ownership, valid after return",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vtls/vtls_scache.c,559,FP,"scache/peers returned via *pscache to caller; ownership transferred, not leaked",curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls_scache.c,562,FP,GOOD_SCACHE(scache) macro NULL-checks scache before any use,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/vtls_scache.c,578,FP,no char* reinterpreted as struct; spurious alignment claim on normal API call,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls_scache.c,598,FP,peer is mutated/compared family; array slot; const noise,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/vtls_scache.c,599,TP,conn_config only read (clientcert/username/password); could be const in this static helper,curl_full_audit_0.4.35,low
MSC37-C,curl,lib/vtls/vtls_scache.c,620,FP,function returns result on all paths via out label,curl_full_audit_0.4.35,high
MEM33-C,curl,lib/vtls/vtls_scache.c,643,FP,"*ppeer = &scache->peers[i] is pointer assignment, not flexible-array struct copy",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,655,FP,ssl_peer_key non-NULL on this path (caller guards ssl_peer_key before find_peer),curl_full_audit_0.4.35,high
ARR01-C,curl,lib/vtls/vtls_scache.c,658,FP,scache->peers[i].key_salt is a struct array member; sizeof correct,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls_scache.c,664,FP,!memcmp idiom for equality test; idiomatic curl style,curl_full_audit_0.4.35,high
MEM33-C,curl,lib/vtls/vtls_scache.c,674,FP,"*ppeer pointer assignment, not flexible-array struct copy",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vtls/vtls_scache.c,711,FP,"peer points into scache->peers[] heap array, not local; valid after return",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vtls/vtls_scache.c,732,FP,peer points into heap peers array via *ppeer=peer; not a local address,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,745,FP,username may be NULL; peer_init checks if(srp_username) before strdup; NULL-safe,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,745,FP,password may be NULL; peer_init guards if(srp_password) before use; NULL-safe,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vtls/vtls_scache.c,749,FP,peer is heap array slot via *ppeer=peer; valid after return,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,765,FP,s is a valid session pointer from caller; non-NULL by add-session contract,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,766,FP,peer is array slot passed by internal caller; non-NULL,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/vtls/vtls_scache.c,789,FP,"time(NULL) used for session-lifetime arithmetic; (time_t)-1 worst-case mis-expires, no safety bug",curl_full_audit_0.4.35,med
EXP34-C,curl,lib/vtls/vtls_scache.c,797,FP,s non-NULL: early return at top if !scache; s validated by callers before reaching here,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls_scache.c,836,FP,ssl_peer_key forwarded to cf_scache_add_session which tolerates NULL; not derefed unchecked,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/vtls_scache.c,841,FP,spurious alignment claim; no char*-to-struct reinterpretation,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/vtls_scache.c,842,FP,"spurious alignment claim; normal API call, no pointer reinterpret",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,846,FP,ssl_config DEBUGASSERT'd at 844; release path: if !scache short-circuits the && before deref,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/vtls/vtls_scache.c,867,FP,Curl_ssl_session_destroy explicitly does if(s) at its top; NULL-safe,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls_scache.c,870,FP,cf forwarded to get_primary_config; internal callers always supply non-NULL cf,curl_full_audit_0.4.35,med
API00-C,curl,lib/vtls/vtls_scache.c,870,FP,data used via cf_ssl_scache_get which derefs data->share; callers always supply data,curl_full_audit_0.4.35,med
API00-C,curl,lib/vtls/vtls_scache.c,870,FP,ssl_peer_key forwarded to find_peer_by_key which tolerates the value; not unchecked deref,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/vtls_scache.c,875,FP,spurious alignment claim; normal API call,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vtls/vtls_scache.c,899,FP,"s is heap session via Curl_node_take_elem; *ps=s hands off, valid after return",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,904,FP,peer guarded: this branch only entered when s non-NULL which implies peer found,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls_scache.c,913,FP,cf forwarded to get_primary_config; callers always supply cf,curl_full_audit_0.4.35,med
API00-C,curl,lib/vtls/vtls_scache.c,913,FP,data used by scache_get; callers always supply data,curl_full_audit_0.4.35,med
API00-C,curl,lib/vtls/vtls_scache.c,913,FP,ssl_peer_key forwarded to add_peer which tolerates NULL; not unchecked deref,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls_scache.c,913,FP,"sobj DEBUGASSERT'd at 924; ownership pointer stored, not derefed",curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls_scache.c,913,FP,sobj_dtor_cb DEBUGASSERT'd at 925; checked before invocation,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/vtls_scache.c,919,FP,spurious alignment claim; normal API call,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls_scache.c,947,FP,cf forwarded to get_primary_config; callers supply cf,curl_full_audit_0.4.35,med
API00-C,curl,lib/vtls/vtls_scache.c,947,FP,data used by scache_get; callers supply data,curl_full_audit_0.4.35,med
API00-C,curl,lib/vtls/vtls_scache.c,947,FP,"ssl_peer_key forwarded to find_peer_by_key; tolerated, not unchecked deref",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/vtls_scache.c,951,FP,spurious alignment claim; normal API call,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vtls/vtls_scache.c,969,FP,"sobj = peer->sobj is a stored heap/opaque pointer, not a local address",curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls_scache.c,972,FP,cf is (void)cf cast; not derefed; callers supply it anyway,curl_full_audit_0.4.35,med
API00-C,curl,lib/vtls/vtls_scache.c,972,FP,"ssl_peer_key forwarded to find_peer_by_key; tolerated, not unchecked deref",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/vtls_scache.c,976,FP,spurious alignment claim; normal API call,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/vtls/vtls_scache.c,1005,FP,"peer->key_salt is a struct fixed-array member; sizeof correct, no decay",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/vtls/vtls_scache.c,1010,FP,peer->key_salt is a struct fixed-array member; sizeof correct,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/vtls_scache.c,1019,FP,function returns result on all paths via out label,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls_scache.c,1039,FP,!memcmp equality idiom; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls_scache.c,1040,FP,!memcmp equality idiom; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/vtls_scache.c,1055,FP,!memcmp equality idiom; idiomatic,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls_scache.c,1071,FP,data used by scache_get; callers supply data,curl_full_audit_0.4.35,med
API00-C,curl,lib/vtls/vtls_scache.c,1071,FP,sdata forwarded to Curl_ssl_session_unpack which validates; not unchecked deref here,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.c,1072,FP,curl never uses C99 conformant array param syntax; stylistic,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.c,1073,FP,curl never uses C99 conformant array param syntax; stylistic,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.c,1074,FP,curl never uses C99 conformant array param syntax; stylistic,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/vtls_scache.c,1076,FP,spurious alignment claim; normal API call,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,1119,FP,ssl_peer_key is NULL here by design (else-branch); peer_init handles NULL via salt+hmac path,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,1128,FP,s non-NULL here: unpack succeeded at 1091 producing s; guarded by if(peer),curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/vtls_scache.c,1139,FP,Curl_ssl_session_destroy does if(s) internally; NULL-safe (s set NULL after handoff),curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/vtls_scache.c,1143,FP,data used by scache_get; callers supply data,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/vtls_scache.c,1144,FP,export_fn is a function pointer typedef; const-qualifying is meaningless,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/vtls_scache.c,1147,FP,spurious alignment claim; normal API call,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/vtls/vtls_scache.c,1152,FP,"time(NULL) for expiry arithmetic only; (time_t)-1 mis-expires at worst, no security impact",curl_full_audit_0.4.35,med
DCL00-C,curl,lib/vtls/vtls_scache.c,1153,FP,r reassigned throughout export loop via goto chain; not effectively const,curl_full_audit_0.4.35,med
EXP30-C,curl,lib/vtls/vtls_scache.c,1200,FP,export_fn args use curlx_dyn_uptr/dyn_len on distinct buffers; no shared-object unsequenced mutation,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,133,FP,libssh2 kbd_callback signature fixed by external typedef; const impossible,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vssh/libssh2.c,247,FP,LIBSSH2_FREE_FUNC macro defines void fn; sqc cannot expand macro,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,254,FP,sshkeycallback matches curl_sshkeycallback typedef; const impossible,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,258,FP,callback signature fixed by typedef,curl_full_audit_0.4.35,high
INT13-C,curl,lib/vssh/libssh2.c,368,FP,keybit OR of libssh2 enum constants; advisory,curl_full_audit_0.4.35,low
EXP34-C,curl,lib/vssh/libssh2.c,373,FP,host filled by libssh2_knownhost_checkp; non-NULL when keycheck<=MISMATCH,curl_full_audit_0.4.35,med
STR34-C,curl,lib/vssh/libssh2.c,429,FP,"remotekey is const char* key buffer arg, not signed-char read",curl_full_audit_0.4.35,high
INT13-C,curl,lib/vssh/libssh2.c,432,FP,keybit OR of libssh2 enum flags; advisory,curl_full_audit_0.4.35,low
ARR00-C,curl,lib/vssh/libssh2.c,541,FP,md5buffer written by snprintf in loop before being read,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh2.c,541,FP,md5buffer filled by curl_msnprintf before read,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,607,FP,sshc written via state machine; not const,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh2.c,634,FP,p assigned (kh_name_end+2) before use,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh2.c,643,FP,port filled by curlx_str_number out-param before read,curl_full_audit_0.4.35,high
INT14-C,curl,lib/vssh/libssh2.c,644,FP,advisory readability; no real defect,curl_full_audit_0.4.35,low
EXP34-C,curl,lib/vssh/libssh2.c,670,FP,store non-NULL on all found=TRUE paths,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vssh/libssh2.c,719,FP,sshc mutated by sftp_quote (acceptfail etc); not const,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,798,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,799,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,800,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,801,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,802,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,821,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,822,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,838,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,845,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,861,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,868,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,874,FP,idiomatic !strncmp command dispatch,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,889,FP,sshp mutated (quote_attrs memset); not const,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh2.c,915,FP,attrs filled by libssh2_sftp_stat_ex; read only when rc==0,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vssh/libssh2.c,1017,FP,"scratch[4*1024] is constant-size array, not VLA",curl_full_audit_0.4.35,high
ENV30-C,curl,lib/vssh/libssh2.c,1109,FP,curl_getenv returns malloc copy; curlx_free correct,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,1181,FP,idiomatic !!strncmp dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,1203,FP,idiomatic !strncmp dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,1215,FP,idiomatic !strncmp dispatch,curl_full_audit_0.4.35,high
DCL18-C,curl,lib/vssh/libssh2.c,1219,FP,07777 intentional octal permission mask,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,1227,FP,idiomatic !strncmp dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,1239,FP,idiomatic !strncmp dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,1240,FP,idiomatic !strncmp dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/libssh2.c,1257,FP,idiomatic !strncmp dispatch,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/vssh/libssh2.c,1268,FP,"fail: label reachable via goto, not unreachable",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,1276,FP,sshp mutated (quote_attrs); not const,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh2.c,1288,FP,attrs filled by stat_ex before use,curl_full_audit_0.4.35,high
INT14-C,curl,lib/vssh/libssh2.c,1288,FP,advisory readability,curl_full_audit_0.4.35,low
EXP33-C,curl,lib/vssh/libssh2.c,1315,FP,from filled by Curl_ssh_range out-param,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vssh/libssh2.c,1420,FP,distinct fn calls in failf args; no shared side effects,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vssh/libssh2.c,1548,FP,unknown[] aliased via err_msg (char*); cannot const,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,1555,FP,ssh_session read by last_error; not freed here,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vssh/libssh2.c,1581,FP,strlen calls in args; no shared mutable state,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,1799,FP,sshp written (readdir_filename out); not const,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,1815,FP,free-then-strdup reassign of homedir; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,1817,FP,free-then-strdup reassign; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,1818,FP,data->state field reassigned after free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,1818,FP,data->state field reassigned after free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,1819,FP,strdup reassign; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,1819,FP,strdup reassign; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,1898,FP,"quote_item advanced to ->next after safefree of paths, not item",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,1898,FP,"quote_item advanced to ->next after safefree of paths, not item",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,1900,FP,"quote_item is fresh ->next pointer, not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,1904,FP,"nextstate is enum field, not freed memory",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,1905,FP,nextstate enum read; not UAF,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vssh/libssh2.c,1958,FP,strlen calls in symlink args; no shared side effects,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vssh/libssh2.c,2007,FP,strlen calls in rename args; no shared side effects,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh2.c,2114,FP,statvfs filled by libssh2_sftp_statvfs; read when rc==0,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,2140,FP,sshp param of state fn; mutated elsewhere/typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,2171,FP,sshp param; not const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,2233,FP,sshp param; not const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,2278,FP,sshp param; not const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,2350,FP,sshp param; not const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,2378,FP,sshp param; not const,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,2437,FP,ssh_session read by last_error after freeing ssh_channel,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,2508,FP,ssh_session read after freeing ssh_channel; session live,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,2534,FP,ssh_session read; freed only after this line,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vssh/libssh2.c,2779,FP,*slash_pos guarded by if(slash_pos) at line above,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vssh/libssh2.c,2818,FP,dyn_ptr/dyn_len calls; no shared side effects,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,2967,FP,ssh_session read by last_error after freeing channel,curl_full_audit_0.4.35,high
INT13-C,curl,lib/vssh/libssh2.c,3030,FP,waitfor & KEEP_RECV bit test; advisory,curl_full_audit_0.4.35,low
INT13-C,curl,lib/vssh/libssh2.c,3032,FP,waitfor & KEEP_SEND bit test; advisory,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/vssh/libssh2.c,3051,FP,data param of ssh_block2waitfor signature; (void)data,curl_full_audit_0.4.35,high
INT13-C,curl,lib/vssh/libssh2.c,3061,FP,dir & block-direction bit test; advisory,curl_full_audit_0.4.35,low
EXP36-C,curl,lib/vssh/libssh2.c,3074,FP,void* abstract cast in libssh2 callback; idiomatic,curl_full_audit_0.4.35,low
INT13-C,curl,lib/vssh/libssh2.c,3131,FP,dir & INBOUND bit test; advisory,curl_full_audit_0.4.35,low
INT13-C,curl,lib/vssh/libssh2.c,3133,FP,dir & OUTBOUND bit test; advisory,curl_full_audit_0.4.35,low
API05-C,curl,lib/vssh/libssh2.c,3144,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,3144,FP,dtor key param signature fixed; not const,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh2.c,3144,FP,advisory array-param syntax,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,3150,FP,dyn_free of distinct member readdir in dtor; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vssh/libssh2.c,3151,FP,dyn_free of distinct member readdir_link; not UAF,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh2.c,3155,FP,advisory array-param syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,3155,FP,dtor signature fixed; not const,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh2.c,3155,FP,advisory array-param syntax,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vssh/libssh2.c,3161,FP,sshc_cleanup frees members not sshc; single free here,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh2.c,3174,FP,sshc assigned by curlx_calloc immediately above,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh2.c,3181,FP,sshp assigned by curlx_calloc immediately above,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vssh/libssh2.c,3183,FP,sshp NULL on this path; sshc owned by meta-store dtor,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vssh/libssh2.c,3188,FP,sshp ownership transferred to meta-store dtor,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vssh/libssh2.c,3190,FP,success path; objects owned by meta-store dtors,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh2.c,3197,FP,advisory array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh2.c,3198,FP,advisory array-param syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,3198,FP,tls callback signature fixed by libssh2 typedef,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vssh/libssh2.c,3201,FP,void* abstract cast in libssh2 callback,curl_full_audit_0.4.35,low
API05-C,curl,lib/vssh/libssh2.c,3225,FP,advisory array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh2.c,3226,FP,advisory array-param syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/libssh2.c,3226,FP,tls send callback signature fixed by typedef,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vssh/libssh2.c,3229,FP,void* abstract cast in libssh2 callback,curl_full_audit_0.4.35,low
EXP33-C,curl,lib/vssh/libssh2.c,3387,FP,"scp_recv is forward-declared static fn, taking address",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh2.c,3388,FP,scp_send is static fn pointer; address-of,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh2.c,3391,FP,sftp_recv is static fn; address-of,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/libssh2.c,3392,FP,sftp_send is static fn; address-of,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vssh/libssh2.c,3489,FP,char* to SSHPROTO* alignment via meta-store; idiomatic,curl_full_audit_0.4.35,low
EXP36-C,curl,lib/vssh/libssh2.c,3508,FP,alignment via meta-store; idiomatic,curl_full_audit_0.4.35,low
API05-C,curl,lib/vssh/libssh2.c,3540,FP,advisory array-param syntax on send buffer,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh2.c,3572,FP,advisory array-param syntax on recv buffer,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vssh/libssh2.c,3660,FP,alignment via meta-store; idiomatic,curl_full_audit_0.4.35,low
API05-C,curl,lib/vssh/libssh2.c,3698,FP,advisory array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh2.c,3729,FP,advisory array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/vssh/libssh2.c,3797,FP,advisory array-param syntax on Curl_ssh_version buffer,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/cf-socket.c,292,FP,"dest is a struct pointer; curl_sa_addrbuf is a real array member, sizeof is correct",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/cf-socket.c,293,FP,"sizeof of array struct member, not decayed param array",curl_full_audit_0.4.35,high
FIO42-C,curl,lib/cf-socket.c,332,FP,"*sockfd is socket from callback, not fopen FILE*; closed by socket_close",curl_full_audit_0.4.35,high
CON34-C,curl,lib/cf-socket.c,340,FP,DEBUGBUILD-only getenv for test injection; not thread-shared concern,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-socket.c,395,FP,data validated via DEBUGASSERT; addr reassigned to local if NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-socket.c,395,FP,addr explicitly NULL-checked and replaced with dummy local,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-socket.c,415,FP,socket_close passes conn to fclosesocket and Curl_multi_will_close; conventionally non-const,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/cf-socket.c,434,FP,sclose is a curl macro/wrapper declared in headers; macro-opaque,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-socket.c,444,FP,thin wrapper delegating to socket_close which NULL-guards conn,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-socket.c,444,FP,conn documented nullable; callee guards with if(conn),curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cf-socket.c,491,FP,!strncmp prefix-match idiom in parse dispatch,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cf-socket.c,495,FP,char** out-param deref assignment; not sign-extension bug,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cf-socket.c,498,FP,!strncmp prefix-match idiom,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cf-socket.c,502,FP,"char** out-param pointer assignment, not signed char read",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cf-socket.c,505,FP,!strncmp prefix-match idiom,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cf-socket.c,512,FP,char** out-param pointer assignment,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cf-socket.c,516,FP,char** out-param pointer assignment,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/cf-socket.c,518,FP,curlx_free declared in curl header; macro-opaque misfire,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cf-socket.c,519,FP,char** out-param NULL assignment,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cf-socket.c,527,FP,char** out-param pointer assignment,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/cf-socket.c,543,FP,h is passed by address to Curl_resolv_blocking which modifies it,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/cf-socket.c,573,FP,myhost is a buffer written by if2ip/printable_address; not const,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-socket.c,618,FP,error assigned =SOCKERRNO in same statement before use; initialized,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cf-socket.c,682,FP,"writing NUL terminator through char*, not signed-extension read",curl_full_audit_0.4.35,high
POS02-C,curl,lib/cf-socket.c,746,FP,client lib binding local socket; not a privileged daemon needing privdrop,curl_full_audit_0.4.35,high
INT08-C,curl,lib/cf-socket.c,757,FP,bounded local-port log arithmetic; no overflow risk,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/cf-socket.c,854,FP,"switch case label after return CURLE_OK, not unreachable code",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/cf-socket.c,900,FP,"ctx is real struct pointer; memset(ctx,0,sizeof(*ctx)) is correct idiom",curl_full_audit_0.4.35,high
ERR33-C,curl,lib/cf-socket.c,910,FP,getenv result checked with if(p) immediately after,curl_full_audit_0.4.35,high
CON34-C,curl,lib/cf-socket.c,910,FP,DEBUGBUILD-only test-injection getenv,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/cf-socket.c,913,FP,"curlx_str_number advances const char** cursor, does not modify string",curl_full_audit_0.4.35,high
ERR33-C,curl,lib/cf-socket.c,916,FP,getenv checked with if(p),curl_full_audit_0.4.35,high
CON34-C,curl,lib/cf-socket.c,916,FP,DEBUGBUILD test getenv,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/cf-socket.c,919,FP,curlx_str_number does not mutate env string,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/cf-socket.c,922,FP,getenv checked with if(p),curl_full_audit_0.4.35,high
CON34-C,curl,lib/cf-socket.c,922,FP,DEBUGBUILD test getenv,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/cf-socket.c,925,FP,curlx_str_number does not mutate env string,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/cf-socket.c,928,FP,getenv checked with if(p),curl_full_audit_0.4.35,high
CON34-C,curl,lib/cf-socket.c,928,FP,DEBUGBUILD test getenv,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/cf-socket.c,931,FP,curlx_str_number does not mutate env string,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/cf-socket.c,986,FP,curlx_free declared in header; macro-opaque,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-socket.c,990,FP,set_local_ip writes cf->ctx members; cf used via callbacks; conventional,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/cf-socket.c,993,FP,cf always non-NULL from internal callers; ctx guarded later,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cf-socket.c,994,FP,ctx assigned from cf->ctx then guarded by getsockname conditions,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/cf-socket.c,1007,FP,VERBOSE() macro misparse; expands to int error decl or nothing,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-socket.c,1022,FP,set_remote_ip writes ctx->ip and ctx->error via cf; conventional,curl_full_audit_0.4.35,med
FIO42-C,curl,lib/cf-socket.c,1062,FP,"result is a CURLcode, not an open() fd; the fd is ctx->sock",curl_full_audit_0.4.35,high
FIO42-C,curl,lib/cf-socket.c,1256,FP,"result is CURLcode from cf_socket_open, not an open() fd",curl_full_audit_0.4.35,high
INT13-C,curl,lib/cf-socket.c,1302,FP,idiomatic select-flag mask on int rc,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-socket.c,1376,FP,ideal filled by WSAIoctl output param (short-circuit) before read,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-socket.c,1388,FP,vtable send callback signature fixed by typedef; cannot use array syntax,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/cf-socket.c,1395,FP,VERBOSE() macro misparse for orig_len declaration,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/cf-socket.c,1405,FP,c is modified by Curl_rand_bytes via address,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-socket.c,1472,FP,vtable recv callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/cf-socket.c,1482,FP,c modified by Curl_rand via address,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-socket.c,1533,FP,cf_socket_update_data writes cf->conn member; conventional non-const,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-socket.c,1561,FP,arg2 is vtable cntrl void* param fixed by typedef; (void)arg2,curl_full_audit_0.4.35,high
STR31-C,curl,lib/cf-socket.c,1587,FP,"pfd[1] is a struct pollfd array, not a string buffer",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-socket.c,1619,FP,cf_socket_query is vtable callback; signature fixed by typedef,curl_full_audit_0.4.35,med
MSC07-C,curl,lib/cf-socket.c,1674,FP,"switch default+break then return; reachable, not dead code",curl_full_audit_0.4.35,high
CON03-C,curl,lib/cf-socket.c,1682,FP,Curl_cft_tcp is a const vtable initialized once; not mutable shared state,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/cf-socket.c,1682,FP,exported cfilter type referenced across TUs; must have external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/cf-socket.c,1682,FP,exported global vtable; cannot be function-local,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-socket.c,1700,FP,pcf written unconditionally at out:; ai checked with if(!ai),curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-socket.c,1700,FP,ai explicitly NULL-checked before use,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-socket.c,1701,FP,"(void)data; exported create signature, conventional",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-socket.c,1702,FP,(void)conn; exported create signature,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/cf-socket.c,1718,FP,curlx_calloc declared in curl memory header; macro-opaque,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-socket.c,1741,FP,linux_quic_mtu calls setsockopt with ctx->sock; not const-able,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-socket.c,1768,FP,linux_quic_gro uses ctx->sock in setsockopt; not const,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/cf-socket.c,1813,FP,all paths return result via goto out fallthrough; no missing return,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/cf-socket.c,1827,FP,"result is CURLcode, not an open() fd",curl_full_audit_0.4.35,high
CON03-C,curl,lib/cf-socket.c,1848,FP,const vtable initialized once; not mutable shared state,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/cf-socket.c,1848,FP,exported across TUs; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/cf-socket.c,1848,FP,exported global vtable,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-socket.c,1866,FP,ai NULL-checked before use,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-socket.c,1867,FP,(void)data exported create signature,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-socket.c,1868,FP,(void)conn exported create signature,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/cf-socket.c,1879,FP,curlx_calloc header-declared; macro-opaque,curl_full_audit_0.4.35,high
CON03-C,curl,lib/cf-socket.c,1902,FP,const vtable initialized once,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/cf-socket.c,1902,FP,exported across TUs,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/cf-socket.c,1902,FP,exported global vtable,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-socket.c,1920,FP,pcf written at out:; ai NULL-checked,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-socket.c,1920,FP,ai NULL-checked before use,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-socket.c,1921,FP,(void)data exported signature,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-socket.c,1922,FP,(void)conn exported signature,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/cf-socket.c,1933,FP,curlx_calloc header-declared; macro-opaque,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-socket.c,1955,FP,vtable callback signature fixed by typedef,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-socket.c,1983,FP,vtable callback signature fixed by typedef,curl_full_audit_0.4.35,med
INT13-C,curl,lib/cf-socket.c,2057,FP,idiomatic select-flag mask on int socketstate,curl_full_audit_0.4.35,high
CON03-C,curl,lib/cf-socket.c,2132,FP,const vtable initialized once,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/cf-socket.c,2132,FP,exported across TUs,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/cf-socket.c,2132,FP,exported global vtable,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-socket.c,2150,FP,data/conn used via Curl_conn_cf_* helpers that handle internal state,curl_full_audit_0.4.35,med
API00-C,curl,lib/cf-socket.c,2150,FP,conn always valid from internal callers,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-socket.c,2152,FP,s dereferenced (*s) to read fd; sqc misreports; effectively read-only but conventional,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/cf-socket.c,2160,FP,sockindex is internal FIRSTSOCKET/SECONDARYSOCKET enum 0/1; bounded,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/cf-socket.c,2160,FP,"sockindex internal index 0/1, not attacker-controlled",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/cf-socket.c,2162,FP,curlx_calloc header-declared; macro-opaque,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/cf-socket.c,2177,FP,sockindex internal bounded index,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/cf-socket.c,2177,FP,sockindex internal bounded index,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cf-socket.c,2178,FP,cf is non-NULL after successful Curl_cf_create; out: skipped on success,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-socket.c,2191,FP,data used to index cfilter[]; internal always-valid; while(cf) NULL-safe,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-socket.c,2191,FP,exported signature; data read-only here but conventional,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/cf-socket.c,2194,FP,sockindex internal bounded index 0/1,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/cf-socket.c,2194,FP,sockindex internal bounded index,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-socket.c,2206,FP,cf_is_socket reads cf->cft only; could be const but project convention non-const,curl_full_audit_0.4.35,med
API00-C,curl,lib/cf-socket.c,2214,FP,all out-params guarded with if(psock)/if(paddr)/if(pip) before deref,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-socket.c,2214,FP,paddr guarded with if(paddr),curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-socket.c,2214,FP,pip guarded with if(pip),curl_full_audit_0.4.35,high
DCL15-C,curl,lib/cf-socket.c,2214,FP,Curl_cf_socket_peek is exported (used by ftp/tftp); needs external linkage,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-socket.c,2215,FP,(void)data exported signature,curl_full_audit_0.4.35,med
MEM33-C,curl,lib/cf-socket.c,2227,FP,*paddr = &ctx->addr is pointer assignment; ip_quadruple has no flexible array,curl_full_audit_0.4.35,high
CON03-C,curl,lib/easy.c,86,FP,"s_lock is curl_simple_lock, init macro; lock primitive itself, not a racy shared scalar",curl_full_audit_0.4.35,high
CON03-C,curl,lib/easy.c,106,FP,Curl_cmalloc allocator callback set once before threads; documented single-init contract,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/easy.c,106,FP,Curl_cmalloc is exported global used across translation units; cannot be static,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/easy.c,106,FP,intentional exported global allocator callback; minimal-scope advice inapplicable,curl_full_audit_0.4.35,high
CON03-C,curl,lib/easy.c,107,FP,Curl_cfree allocator callback set before threads; intentional global,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/easy.c,107,FP,exported global with external linkage by design,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/easy.c,107,FP,intentional exported global allocator callback,curl_full_audit_0.4.35,high
CON03-C,curl,lib/easy.c,108,FP,Curl_crealloc allocator callback set before threads; intentional global,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/easy.c,108,FP,exported global with external linkage by design,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/easy.c,108,FP,intentional exported global allocator callback,curl_full_audit_0.4.35,high
CON03-C,curl,lib/easy.c,109,FP,Curl_cstrdup allocator callback set before threads; intentional global,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/easy.c,109,FP,exported global with external linkage by design,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/easy.c,109,FP,intentional exported global allocator callback,curl_full_audit_0.4.35,high
CON03-C,curl,lib/easy.c,110,FP,Curl_ccalloc allocator callback set before threads; intentional global,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/easy.c,110,FP,exported global with external linkage by design,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/easy.c,110,FP,intentional exported global allocator callback,curl_full_audit_0.4.35,high
CON34-C,curl,lib/easy.c,181,FP,getenv in DEBUGBUILD-only path under global_init lock; result not stored across threads,curl_full_audit_0.4.35,med
MSC07-C,curl,lib/easy.c,188,FP,"line 188 is the 'fail:' label after return; goto targets it, not unreachable",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/easy.c,197,FP,curl_global_init is public exported API,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/easy.c,213,FP,curl_global_init_mem is public exported API,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/easy.c,225,FP,"'initialized' is file-scope static, zero-initialized by C standard",curl_full_audit_0.4.35,high
CON07-C,curl,lib/easy.c,255,FP,curl_global_cleanup guarded by global_init_lock when threadsafe; documented non-reentrant API,curl_full_audit_0.4.35,med
DCL15-C,curl,lib/easy.c,255,FP,curl_global_cleanup is public exported API,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/easy.c,259,FP,"'initialized' is file-scope static, zero-initialized",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/easy.c,273,FP,"'easy_init_flags' file-scope static, zero-initialized; only reached after init",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/easy.c,281,FP,"'leakpointer' file-scope static, zero-initialized",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/easy.c,292,FP,curl_global_trace is public exported API,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/easy.c,292,FP,both #ifdef arms return; sqc misses preprocessor branches,curl_full_audit_0.4.35,high
API00-C,curl,lib/easy.c,312,FP,thin wrapper forwarding name to Curl_init_sslset_nolock which validates; never derefs here,curl_full_audit_0.4.35,high
API00-C,curl,lib/easy.c,312,FP,"avail forwarded to nolock impl, not dereferenced in wrapper",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/easy.c,312,FP,curl_global_sslset is public exported API,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/easy.c,338,FP,"'initialized' file-scope static, zero-initialized",curl_full_audit_0.4.35,high
FIO42-C,curl,lib/easy.c,350,FP,"'result' is CURLcode from Curl_open, not a file descriptor; total misfire",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/easy.c,356,FP,"'data' is heap struct from Curl_open(&data), not automatic storage",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/easy.c,381,FP,events_timer signature fixed by CURLMOPT_TIMERFUNCTION typedef; const impossible,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/easy.c,435,FP,events_socket signature fixed by CURLMOPT_SOCKETFUNCTION typedef,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,474,FP,m freed only in REMOVE branch which breaks immediately; line 474 reached only when not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,488,FP,m freshly allocated via curlx_malloc and NULL-checked at 486; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,489,FP,m freshly allocated and NULL-checked; member writes are valid init,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/easy.c,524,FP,"populate_fds writes through fds[] (f->fd=...), so fds is modified; const wrong anyway",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/easy.c,524,FP,"ev->list traversal reads via m, but ev not const-able; param is non-modified yet idiomatic",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/easy.c,538,FP,f points into fds[] array; f++ is legitimate array iteration,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/easy.c,548,FP,poll_fds reads ev->ms and ev->list-derived fields; const-able but advisory FP per convention,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/easy.c,603,FP,pollrc set by poll_fds via &pollrc at line 597 before read,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/easy.c,617,FP,fds[] filled by populate_fds at 592 before loop reads,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/easy.c,623,FP,fds[] filled by populate_fds before read,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/easy.c,624,FP,fds[] filled by populate_fds before read,curl_full_audit_0.4.35,high
CON03-C,curl,lib/easy.c,670,FP,static evs in DEBUGBUILD single-threaded blocking transfer; not cross-thread shared,curl_full_audit_0.4.35,high
API00-C,curl,lib/easy.c,837,FP,GOOD_EASY_HANDLE(data) macro validates ptr before any use,curl_full_audit_0.4.35,high
API00-C,curl,lib/easy.c,853,FP,GOOD_EASY_HANDLE(data) validates easy before deref,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/easy.c,872,FP,dupset reads src fields but src->set copied; const-able but advisory FP,curl_full_audit_0.4.35,med
ARR38-C,curl,lib/easy.c,886,FP,"memset(dst->set.str, 0, STRING_LAST*sizeof(char*)) sizes the array exactly",curl_full_audit_0.4.35,high
ARR38-C,curl,lib/easy.c,887,FP,"memset(dst->set.blobs, 0, BLOB_LAST*sizeof) sizes the array exactly",curl_full_audit_0.4.35,high
INT18-C,curl,lib/easy.c,906,FP,"postfieldsize is curl_off_t (signed), == -1 is valid signed sentinel comparison",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/easy.c,907,FP,curlx_strdup declared in included curlx/strdup.h; macro/header sqc misses,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/easy.c,921,FP,sizeof(*dst->set.mimepostp) sizes the pointee struct correctly for malloc,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/easy.c,938,FP,dupeasy_meta_freeentry signature fixed by Curl_hash freeentry typedef,curl_full_audit_0.4.35,high
API00-C,curl,lib/easy.c,952,FP,GOOD_EASY_HANDLE(data) validates d before use,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/easy.c,959,FP,curlx_calloc declared via curlx headers; macro/header sqc misses,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/easy.c,968,FP,data validated by GOOD_EASY_HANDLE earlier; non-NULL after guard,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/easy.c,1063,FP,"line 1063 is 'fail:' label, a goto target, not unreachable",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1069,FP,fail-path frees distinct members then frees outcurl once; no UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1069,FP,"sequential cleanup of distinct struct members, not freed pointer reuse",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1070,FP,Curl_altsvc_cleanup(&outcurl->asi) distinct member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1071,FP,Curl_hsts_cleanup(&outcurl->hsts) distinct member; not UAF,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/easy.c,1073,FP,curlx_free declared via curlx headers; macro/header sqc misses,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1073,FP,outcurl freed exactly once at end of fail path; no double-free,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/easy.c,1089,FP,data validated by GOOD_EASY_HANDLE at 1086 (curl_easy_reset),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1100,FP,"Curl_freeset(data) frees members not data; data is live, reinit follows. Not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1100,FP,data never freed in curl_easy_reset; analyzer misattributes member-free to handle,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1100,FP,data is live handle being reset; no free of data occurred,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1101,FP,memset reinitializes data->set; data not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1104,FP,"data live; Curl_initinfo reinit, no free occurred",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1104,FP,data not freed; analyzer misattribution,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1104,FP,data live handle; no UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1107,FP,data not freed in reset; member ops only,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1109,FP,data->progress.hide write on live handle; no free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1110,FP,data->state write on live handle; no free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1111,FP,data->state write on live handle; no free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1114,FP,memset authhost on live handle; data not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1114,FP,data live; no free occurred,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1114,FP,data live handle member access; no UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1114,FP,duplicate misfire; data not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1115,FP,memset authproxy on live handle; no free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1115,FP,data live; no free occurred,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1115,FP,data live member access; no UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1115,FP,duplicate misfire; data not freed,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/easy.c,1136,FP,curl_easy_pause is public exported API,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/easy.c,1145,FP,GOOD_EASY_HANDLE(data) check in same condition guards deref,curl_full_audit_0.4.35,high
API05-C,curl,lib/easy.c,1224,FP,curl never uses C99 array-param syntax; advisory style FP by convention,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/easy.c,1239,FP,data validated by GOOD_EASY_HANDLE at 1230,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/easy.c,1252,FP,c is connectdata* out-param assigned via &c in easy_connection; not const-able,curl_full_audit_0.4.35,med
API00-C,curl,lib/easy.c,1272,FP,Curl_senddata internal; data validated by easy_connection's !data check,curl_full_audit_0.4.35,high
API05-C,curl,lib/easy.c,1272,FP,curl convention: no C99 array-param syntax,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/easy.c,1276,FP,c is out-param assigned via &c in easy_connection; not const,curl_full_audit_0.4.35,med
API05-C,curl,lib/easy.c,1302,FP,curl convention: no C99 array-param syntax,curl_full_audit_0.4.35,high
API00-C,curl,lib/easy.c,1334,FP,sdata forwarded to Curl_ssl_session_import; not dereferenced in wrapper,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/easy.c,1334,FP,curl_easy_ssls_import is public exported API,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/easy.c,1334,FP,both #if/#else arms return; sqc misses preprocessor branches,curl_full_audit_0.4.35,high
API05-C,curl,lib/easy.c,1334,FP,curl convention: no C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/easy.c,1335,FP,curl convention: no C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/easy.c,1336,FP,curl convention: no C99 array-param syntax,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/easy.c,1355,FP,curl_easy_ssls_export is public exported API,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/easy.c,1355,FP,both #if/#else arms return; sqc misses preprocessor branches,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/easy.c,1376,FP,Curl_meta_set: data is internally-supplied non-NULL handle; DEBUGASSERT guards meta_data,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/easy.c,1378,FP,"meta_dtor is a parameter (function pointer), not an undeclared function",curl_full_audit_0.4.35,high
API00-C,curl,lib/easy.c,1384,FP,Curl_meta_remove internal helper; data always a valid handle from callers,curl_full_audit_0.4.35,high
API00-C,curl,lib/easy.c,1384,FP,key internal helper arg; forwarded to Curl_hash_delete which handles it,curl_full_audit_0.4.35,high
API00-C,curl,lib/easy.c,1389,FP,Curl_meta_get internal helper; data valid handle from callers,curl_full_audit_0.4.35,high
API00-C,curl,lib/easy.c,1389,FP,key forwarded to Curl_hash_pick; internal helper,curl_full_audit_0.4.35,high
API00-C,curl,lib/easy.c,1394,FP,Curl_meta_reset internal helper; data valid handle from callers,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/easy.c,1118,FP,"curl_easy_reset reinitializes data; Curl_http_auth_cleanup_digest cleans members, data not freed",curl_full_audit_0.4.35,high
API00-C,curl,lib/transfer.c,84,FP,internal handle 'data' always non-NULL; DEBUGASSERT contract; no caller passes NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/transfer.c,84,FP,"thislen guarded by DEBUGASSERT; used only as strnequal len, no overflow arithmetic",curl_full_audit_0.4.35,high
API05-C,curl,lib/transfer.c,85,FP,curl never uses C99 conformant array param syntax; advisory style only,curl_full_audit_0.4.35,high
API05-C,curl,lib/transfer.c,176,FP,conformant array syntax advisory; not curl convention,curl_full_audit_0.4.35,high
INT18-C,curl,lib/transfer.c,186,FP,data->req.size is signed curl_off_t; comparing to -1 is correct,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/transfer.c,221,FP,k is modified (k->keepon &= ...) in sendrecv_dl; const impossible,curl_full_audit_0.4.35,high
API00-C,curl,lib/transfer.c,357,FP,internal handle 'data' always non-NULL; no NULL caller path,curl_full_audit_0.4.35,high
INT14-C,curl,lib/transfer.c,369,FP,idiomatic bitwise flag test (k->keepon & KEEP_RECV); no arithmetic mixing bug,curl_full_audit_0.4.35,high
INT18-C,curl,lib/transfer.c,388,FP,k->size signed curl_off_t; != -1 sentinel check is correct,curl_full_audit_0.4.35,high
INT18-C,curl,lib/transfer.c,412,FP,k->size signed curl_off_t; sentinel -1 compare correct,curl_full_audit_0.4.35,high
API00-C,curl,lib/transfer.c,435,FP,internal handle 'data' always non-NULL,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/transfer.c,469,FP,curlx_free declared via curl headers; not undeclared,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,502,FP,"Curl_safefree(info.wouldredirect) distinct member; no UAF, struct-field-free propagation",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,505,FP,data->state.httpreq distinct member never freed; false propagation from member free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,505,FP,data->state not freed; whole-struct poisoning from member free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,506,FP,data->state not freed; false UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,506,FP,data->set.filesize not freed; member-free propagation,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,506,FP,data->set not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,507,FP,httpreq distinct member; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,507,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,508,FP,httpreq not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,508,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,509,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,509,FP,set.postfieldsize not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,509,FP,data->set not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,510,FP,set.postfields read not freed here,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,510,FP,data->set not freed,curl_full_audit_0.4.35,high
INT18-C,curl,lib/transfer.c,510,FP,infilesize signed curl_off_t; ==-1 sentinel correct,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,510,FP,infilesize not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,510,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,511,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,511,FP,set.postfields read; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,511,FP,data->set not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,514,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,522,FP,state.resolve read; not freed in this function,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,522,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,533,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,539,FP,set.no_signal not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,539,FP,data->set not freed,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/transfer.c,540,FP,"signal() return saved to prev_signal for later restore, not an error check",curl_full_audit_0.4.35,med
MEM30-C,curl,lib/transfer.c,540,FP,data->state not freed,curl_full_audit_0.4.35,high
SIG00-C,curl,lib/transfer.c,540,FP,"signal(SIGPIPE,SIG_IGN) sets ignore not a handler; curl deliberate, HAVE_SIGNAL guarded",curl_full_audit_0.4.35,med
SIG02-C,curl,lib/transfer.c,540,FP,"ignoring SIGPIPE (abnormal write error), not using signals for normal functionality",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,550,FP,state.authhost not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,550,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,550,FP,authhost.want not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,550,FP,state.authhost not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,550,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,551,FP,state.authproxy not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,551,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,551,FP,authproxy.want not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,551,FP,state.authproxy not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,551,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,554,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,554,FP,set.wildcard_enabled not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,554,FP,data->set not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,555,FP,state.wildcardmatch not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,555,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,557,FP,data->wildcard not freed; allocated below if NULL,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,559,FP,data->wildcard just calloc'd; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,562,FP,data->wildcard not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,572,FP,data->hsts not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,580,FP,"set.str[] array element read; only aptr.uagent freed later, distinct",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/transfer.c,581,FP,curlx_free declared via curl headers,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,581,FP,free-then-reassign of aptr.uagent on next line; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,581,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,582,FP,aptr.uagent reassigned after free; write target not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,582,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,583,FP,set.str[USERAGENT] read for printf; distinct from freed uagent,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,584,FP,"aptr.uagent just assigned; NULL check, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,584,FP,state.aptr not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,584,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,588,FP,set.str[USERNAME] read; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,589,FP,set.str[PASSWORD] read; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,590,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,592,FP,Curl_setstropt manages aptr.user free/dup internally; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,592,FP,state.aptr not freed here,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,592,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,593,FP,set.str[USERNAME] read; distinct member,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,595,FP,aptr.passwd managed by setstropt; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,595,FP,state.aptr not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,595,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,596,FP,set.str[PASSWORD] read; distinct member,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,599,FP,aptr.proxyuser managed by setstropt,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,599,FP,state.aptr not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,599,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,600,FP,set.str[PROXYUSERNAME] read; distinct member,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,602,FP,aptr.proxypasswd managed by setstropt,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,602,FP,state.aptr not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,602,FP,data->state not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,603,FP,set.str[PROXYPASSWORD] read; distinct member,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/transfer.c,606,FP,data->req.headerbytecount write; req never freed in this function,curl_full_audit_0.4.35,high
STR34-C,curl,lib/transfer.c,618,FP,*url is char* assignment to char**; no sign-extension to wider int,curl_full_audit_0.4.35,high
STR34-C,curl,lib/transfer.c,664,FP,*url = Curl_bufref_dup pointer assign; no char sign extension,curl_full_audit_0.4.35,high
INT18-C,curl,lib/transfer.c,700,FP,recv_size signed curl_off_t; == -1 sentinel correct in DEBUGASSERT,curl_full_audit_0.4.35,high
API00-C,curl,lib/transfer.c,752,FP,internal handle always non-NULL; DEBUGASSERT contract,curl_full_audit_0.4.35,high
API05-C,curl,lib/transfer.c,764,FP,conformant array syntax advisory; not curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/transfer.c,801,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/transfer.c,804,FP,hd0[hdlen] is DEBUGASSERT null-terminator check; caller contract guarantees terminator,curl_full_audit_0.4.35,med
API00-C,curl,lib/transfer.c,813,FP,thin wrapper; data always non-NULL,curl_full_audit_0.4.35,high
API05-C,curl,lib/transfer.c,830,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API00-C,curl,lib/transfer.c,852,FP,internal handle always non-NULL; DEBUGASSERT,curl_full_audit_0.4.35,high
API05-C,curl,lib/transfer.c,853,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API00-C,curl,lib/transfer.c,888,FP,thin wrapper; data always non-NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/transfer.c,893,FP,thin wrapper; data always non-NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/transfer.c,903,FP,thin wrapper; data always non-NULL,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/transfer.c,903,FP,indirect recursion via flush/unpause callback chain bounded by paused-state guards; terminates,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/wolfssl.c,117,FP,wssl_tls13_secret_callback ctx is fixed wolfSSL secret-cb typedef signature; const not addable,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/wolfssl.c,195,FP,"ms is out-param filled by wolfSSL_get_keys, only read after SUCCESS check",curl_full_audit_0.4.35,high
ARR02-C,curl,lib/vtls/wolfssl.c,222,FP,"gnm[] is NULL-terminated initializer-bounded const table; idiomatic, advisory",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/wolfssl.c,247,FP,wssl_bio_cf_destroy bound to wolfSSL BIO_meth_set_destroy fn-pointer typedef; const not addable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/wolfssl.c,254,FP,wssl_bio_cf_ctrl ptr param fixed by BIO_meth_set_ctrl typedef signature,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/vtls/wolfssl.c,270,FP,"no dead code; break inside switch case, USE_FULL_BIO conditional stmt before it",curl_full_audit_0.4.35,med
CON03-C,curl,lib/vtls/wolfssl.c,377,FP,BIO method singleton set once at init before threads; not a shared-mutation hazard,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/wolfssl.c,407,FP,Curl_wssl_cache_session checks !session at line 422 before any use,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/wolfssl.c,409,FP,"curl never uses C99 array-param syntax; advisory style, ssl_peer_key const char*",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/wolfssl.c,412,FP,advisory conformant-array style; curl convention never applies,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/wolfssl.c,413,FP,advisory conformant-array style; quic_tp/len; curl convention never applies,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vtls/wolfssl.c,449,FP,sdata freed here; sdata_ptr aliases sdata (not a separate alloc); qtp_clone is NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/wolfssl.c,464,FP,sc_session set by create2 only on !result; put is guarded by if(!result),curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vtls/wolfssl.c,470,FP,out: frees sdata; sdata_ptr is an alias not separate alloc; no leak,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/wolfssl.c,518,FP,wss param is passed to wolfSSL_set_session via wss->ssl; deref/mutation through it,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/wolfssl.c,521,FP,"sess_reuse_cb is a fn-pointer typedef, invoking it is not const-violation",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/wolfssl.c,523,FP,Curl_ssl_cf_get_config returns properly-aligned struct; no real misalignment,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/wolfssl.c,545,FP,ssl_config from cf_get_config always valid for active filter; idiomatic unchecked deref,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/wolfssl.c,547,FP,!strcmp boolean idiom; idiomatic version comparison,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,571,FP,"552 free is on error path that goto out, skips 571; no double-free",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/wolfssl.c,571,FP,duplicate of above; error-path free at 552 does goto out skipping 571,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/wolfssl.c,584,FP,store param passed to wolfSSL store APIs; treated mutable by callees,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/vtls/wolfssl.c,588,FP,conn_config from cf_get_primary_config always valid for active filter; idiomatic,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/wolfssl.c,593,FP,config accessor returns aligned struct; no genuine alignment violation,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/wolfssl.c,602,FP,ssl_config always valid for active filter; idiomatic unchecked deref,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/wolfssl.c,644,FP,"ssl_cafile is const char* path passed by pointer, not a char sign-extended to int",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/wolfssl.c,645,FP,ssl_capath is const char* path passed by pointer; no char-to-int conversion,curl_full_audit_0.4.35,high
MSC41-C,curl,lib/vtls/wolfssl.c,677,FP,hash-key string 'tls:wssl:x509:share' is not a credential/secret,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/wolfssl.c,685,FP,advisory conformant-array; hash dtor key param; curl convention never applies,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/wolfssl.c,685,FP,wssl_x509_share_free is a Curl_hash dtor fixed by hash typedef signature,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/wolfssl.c,685,FP,advisory conformant-array on hash dtor key param,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/wolfssl.c,689,FP,!memcmp inside DEBUGASSERT key-equality check; idiomatic,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/wolfssl.c,716,FP,conn_config always valid for active filter; idiomatic unchecked deref,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/wolfssl.c,773,FP,conn_config always valid for active filter; idiomatic unchecked deref,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/wolfssl.c,792,FP,"cf only used via accessors that are robust; internal filter fn, cf never null",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/wolfssl.c,797,FP,config accessor returns aligned struct; no alignment violation,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/wolfssl.c,806,FP,conn_config always valid for active filter; idiomatic unchecked deref,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/wolfssl.c,809,FP,ssl_config always valid for active filter; idiomatic unchecked deref,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/wolfssl.c,824,FP,store ownership transferred via wolfSSL_CTX_set_cert_store at 829; not leaked,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/wolfssl.c,842,FP,store owned by CTX (set_cert_store) and freed via CTX teardown; not a return leak,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/wolfssl.c,863,FP,str non-null inside for-loop guarded by (str=...)!=NULL condition,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/wolfssl.c,892,FP,res assigned at 890 by SetMinVersion before the 892 read; fallthrough switch fully assigns,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/wolfssl.c,902,FP,wssl_legacy_CTX_set_max_proto_version ctx is macro-aliased to wolfSSL API signature,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/wolfssl.c,912,FP,ssl_config read-only here but matches sibling backends' mutable signature convention,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/wolfssl.c,913,FP,wctx mutated via wctx->ssl_ctx calls inside client_certificate; deref through it,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/wolfssl.c,1007,FP,conn_config read-only here but matches mutable accessor-return convention,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/wolfssl.c,1008,FP,wctx mutated via wctx->ssl_ctx set_min/max_proto_version calls,curl_full_audit_0.4.35,med
API00-C,curl,lib/vtls/wolfssl.c,1077,FP,"Curl_wssl_ctx_init cf/data are internal-filter params, never null in call paths",curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/wolfssl.c,1077,FP,"data param internal, never null; siblings do not null-check either",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/wolfssl.c,1080,FP,peer->sni read but peer is part of mutable filter ctx convention,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/wolfssl.c,1082,FP,cb_setup is a fn-pointer typedef param; invoking is not const-violation,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/wolfssl.c,1087,FP,config accessor returns aligned struct; no alignment violation,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/wolfssl.c,1125,FP,wctx->ssl_ctx freed in out: cleanup on error; success keeps it for connection lifetime,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1126,FP,sqc flow inverted: 1126 use precedes out: free at 1439; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1140,FP,use precedes out:-label free; sqc misreads goto-cleanup control flow,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1176,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/wolfssl.c,1183,FP,1178 dyn_free is on failure path with goto out skipping 1183; no double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1203,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1219,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1227,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1241,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1253,FP,"x509_store_setup is a bool flag, not freed memory; spurious UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1258,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/wolfssl.c,1277,FP,wctx->ssl freed in out: on error; success path retains for connection; not leaked,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1277,FP,wolfSSL_new(wctx->ssl_ctx) reads valid ctx; out: free happens later only on error,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1278,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1285,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1291,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1296,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/wolfssl.c,1310,FP,alpns filled by Curl_alpn_copy at 1107 before alpns.count read,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1315,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1329,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1331,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1337,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1363,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1397,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1421,FP,use precedes out:-label free; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1434,FP,wctx->ssl read in out: guard before its own free at 1435; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1438,FP,wctx->ssl_ctx read in out: guard before its own free at 1439; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1439,FP,single free of ssl_ctx; entry DEBUGASSERT(!ssl_ctx) and 1123 guard preclude prior free,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/wolfssl.c,1479,FP,conn_config always valid for active filter; idiomatic unchecked deref,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/wolfssl.c,1492,FP,bio ownership transferred to ssl via wolfSSL_set_bio at 1497; freed by ssl teardown,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/wolfssl.c,1518,FP,"*buf='\0' is a literal null assignment to char, no sign-extension",curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/wolfssl.c,1530,FP,Curl_wssl_verify_pinned cf internal-filter param never null; matches siblings,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/wolfssl.c,1532,FP,wssl mutated via wssl->ssl in wolfSSL_get_peer_certificate; deref through it,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/vtls/wolfssl.c,1649,FP,"line 1649 is assignment result=wssl_send_earlydata(), not a use of uninit value",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1695,FP,wssl->ssl alive throughout handshake; no free precedes this read,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/wolfssl.c,1701,FP,conn_config always valid for active filter; idiomatic unchecked deref,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1704,FP,wssl->ssl alive; cert (not ssl) is freed at 1714; spurious,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1756,FP,"wssl->io_result is a CURLcode value field, never freed; spurious UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1757,FP,"io_result is a value enum field, not heap; spurious UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1762,FP,"io_result is a value enum field, not heap; spurious UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/wolfssl.c,1773,FP,wssl->ssl alive in handshake error path; no preceding free,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/wolfssl.c,1802,FP,advisory conformant-array on send buf/blen; curl convention never applies,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/wolfssl.c,1967,FP,wssl_close is a Curl_ssl vtable close_one impl; signature fixed by struct,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/wolfssl.c,1967,FP,vtable close_one impl signature fixed; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/wolfssl.c,1988,FP,advisory conformant-array on recv buf/blen; vtable signature fixed,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/wolfssl.c,2046,TP,Curl_wssl_version falls off end without return if neither preprocessor branch active,curl_full_audit_0.4.35,low
API05-C,curl,lib/vtls/wolfssl.c,2046,FP,advisory conformant-array on buffer/size; curl convention never applies,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/wolfssl.c,2077,FP,wssl_data_pending is vtable data_pending impl; signature fixed by struct,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/wolfssl.c,2093,FP,wssl mutated via wssl->ssl getters; matches exported-fn convention,curl_full_audit_0.4.35,med
EXP30-C,curl,lib/vtls/wolfssl.c,2097,FP,"two read-only wolfSSL getters as args; no shared side effects, order irrelevant",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/wolfssl.c,2212,FP,wssl_random is vtable random impl; data signature fixed by struct,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/wolfssl.c,2213,FP,advisory conformant-array on entropy/length; vtable signature fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/wolfssl.c,2228,FP,advisory conformant-array on sha256 input; vtable signature fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/wolfssl.c,2230,FP,advisory conformant-array on sha256sum output; vtable signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/wolfssl.c,2242,FP,wssl_get_internals is vtable get_internals impl; signature fixed by struct,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/ldap.c,127,FP,LDAP_TRACE macro param used only in printf-style varargs; parenthesizing inapplicable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ldap.c,206,FP,"data passed to curl APIs that mutate via struct; const not addable, vtable-shaped",curl_full_audit_0.4.35,high
MEM03-C,curl,lib/ldap.c,256,FP,"passwd is borrowed conn->passwd pointer, not a local buffer to scrub here",curl_full_audit_0.4.35,med
EXP34-C,curl,lib/ldap.c,418,FP,ludp non-NULL after rc==0 guard (parse_low returns err if calloc fails),curl_full_audit_0.4.35,high
EXP33-C,curl,lib/ldap.c,447,FP,name assigned by curlx_convert before use; sqc #ifdef branch confusion,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,468,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,501,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,508,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,510,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,511,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ldap.c,511,FP,"per-error-branch cleanup then goto quit; branches mutually exclusive, no double free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,512,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,521,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,522,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ldap.c,522,FP,"per-error-branch cleanup then goto quit; branches mutually exclusive, no double free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,523,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,531,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,533,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,533,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,534,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,534,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,534,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,534,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,535,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,535,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,538,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,539,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ldap.c,539,FP,"per-error-branch cleanup then goto quit; branches mutually exclusive, no double free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,540,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ldap.c,548,FP,val_b64 set by base64_encode and guarded by val_b64_sz>0,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,552,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,553,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ldap.c,553,FP,"per-error-branch cleanup then goto quit; branches mutually exclusive, no double free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,554,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,564,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,564,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,564,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,564,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,565,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,565,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,567,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,568,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ldap.c,568,FP,"per-error-branch cleanup then goto quit; branches mutually exclusive, no double free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,569,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,579,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,580,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ldap.c,580,FP,"per-error-branch cleanup then goto quit; branches mutually exclusive, no double free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,581,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,590,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,594,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ldap.c,594,FP,"per-error-branch cleanup then goto quit; branches mutually exclusive, no double free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,595,FP,"error-branch frees followed by goto quit; mutually exclusive paths, not double-free/UAF",curl_full_audit_0.4.35,high
CON03-C,curl,lib/ldap.c,630,FP,do_trace is DEBUG_LDAP-only one-shot init; not a real threading concern,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/ldap.c,634,FP,env passed to curlx_str_number which handles parsing; DEBUG_LDAP only,curl_full_audit_0.4.35,med
CON34-C,curl,lib/ldap.c,634,FP,getenv in DEBUG_LDAP trace init; not security/thread sensitive,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/ldap.c,635,FP,"e is modified by curlx_str_number(&env,&e,...) via pointer",curl_full_audit_0.4.35,high
ENV30-C,curl,lib/ldap.c,636,FP,"curlx_str_number advances pointer, does not modify string contents",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ldap.c,673,FP,num_entries(p) called only when *p true; p non-NULL,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ldap.c,695,FP,"data passed to curl APIs that mutate via struct; const not addable, vtable-shaped",curl_full_audit_0.4.35,high
EXP40-C,curl,lib/ldap.c,732,FP,char *dn=p / *filter=p where p is char* (non-const); no const cast,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ldap.c,770,FP,*q++=0 write of literal / char-pointer idiom; no sign-extension bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ldap.c,773,FP,*q++=0 write of literal / char-pointer idiom; no sign-extension bug,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,782,FP,ludp/lud_attrs never freed in this fn; reads precede frees in free_urldesc loop,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,798,FP,unescaped freshly allocated by Curl_urldecode then either freed or ownership-transferred,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,798,FP,unescaped freshly allocated by Curl_urldecode then either freed or ownership-transferred,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,806,FP,ludp/lud_attrs never freed in this fn; reads precede frees in free_urldesc loop,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,806,FP,ludp/lud_attrs never freed in this fn; reads precede frees in free_urldesc loop,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,809,FP,"unescaped freed once per loop iter (Win32); reassigned each iteration, no double free",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ldap.c,809,FP,"per-error-branch cleanup then goto quit; branches mutually exclusive, no double free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,811,FP,ludp/lud_attrs never freed in this fn; reads precede frees in free_urldesc loop,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,816,FP,ludp/lud_attrs never freed in this fn; reads precede frees in free_urldesc loop,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,819,FP,ludp/lud_attrs never freed in this fn; reads precede frees in free_urldesc loop,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ldap.c,832,FP,*q++=0 write of literal / char-pointer idiom; no sign-extension bug,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,836,FP,ludp/lud_attrs never freed in this fn; reads precede frees in free_urldesc loop,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,841,FP,ludp/lud_attrs never freed in this fn; reads precede frees in free_urldesc loop,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ldap.c,851,FP,*q++=0 write of literal / char-pointer idiom; no sign-extension bug,curl_full_audit_0.4.35,high
EXP40-C,curl,lib/ldap.c,854,FP,char *dn=p / *filter=p where p is char* (non-const); no const cast,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/ldap.c,855,FP,unescaped assigned by Curl_urldecode before use; early-return on failure,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,861,FP,unescaped freshly allocated by Curl_urldecode then either freed or ownership-transferred,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,861,FP,unescaped freshly allocated by Curl_urldecode then either freed or ownership-transferred,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,870,FP,unescaped freshly allocated by Curl_urldecode then either freed or ownership-transferred,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,873,FP,"unescaped freed once per loop iter (Win32); reassigned each iteration, no double free",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ldap.c,873,FP,"per-error-branch cleanup then goto quit; branches mutually exclusive, no double free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,875,FP,ludp/lud_attrs never freed in this fn; reads precede frees in free_urldesc loop,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/ldap.c,896,FP,"lud_attrs stored in caller-owned ludp, freed by ldap_free_urldesc_low",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/ldap.c,915,FP,"ludp is calloc heap allocation, not stack address",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,927,FP,ludp/lud_attrs never freed in this fn; reads precede frees in free_urldesc loop,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,929,FP,ludp/lud_attrs never freed in this fn; reads precede frees in free_urldesc loop,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,930,FP,ludp/lud_attrs never freed in this fn; reads precede frees in free_urldesc loop,curl_full_audit_0.4.35,high
API05-C,curl,lib/ldap.c,939,FP,advisory C99 array-param style; curl never uses it,curl_full_audit_0.4.35,high
FLP03-C,curl,lib/ldap.c,956,FP,"integer division on api.ldapai_vendor_version (int), no floating point",curl_full_audit_0.4.35,high
FLP03-C,curl,lib/ldap.c,958,FP,"integer division on api.ldapai_vendor_version (int), no floating point",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,966,FP,api fields freed once in mutually-exclusive __OS400__/else branches,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,968,FP,api fields freed once in mutually-exclusive __OS400__/else branches,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ldap.c,968,FP,api fields freed once in mutually-exclusive __OS400__/else branches,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/ldap.c,1008,FP,Curl_scheme_ldap/ldaps referenced externally by scheme table; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/ldap.c,1008,FP,const scheme struct with required external linkage; cannot be function-local,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/ldap.c,1024,FP,Curl_scheme_ldap/ldaps referenced externally by scheme table; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/ldap.c,1024,FP,const scheme struct with required external linkage; cannot be function-local,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/ftp.c,80,FP,"function-like macro, simple lvalue args, no side effects; idiomatic",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/ftp.c,80,FP,"macro arg is plain pointer lvalue, no multiple-eval hazard",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/ftp.c,84,FP,"function-like macro, simple lvalue args, no side effects; idiomatic",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/ftp.c,84,FP,"macro arg is plain pointer lvalue, no multiple-eval hazard",curl_full_audit_0.4.35,high
ARR02-C,curl,lib/ftp.c,88,FP,initializer-sized array; explicit bounds advisory only,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/ftp.c,127,FP,"function-like macro, simple lvalue args, no side effects; idiomatic",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/ftp.c,127,FP,"macro arg is plain pointer lvalue, no multiple-eval hazard",curl_full_audit_0.4.35,high
API02-C,curl,lib/ftp.c,171,FP,pointer+separate-size already; C99 array syntax not curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,171,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,172,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftp.c,187,FP,pointer guarded non-null on this path / callee NULL-safe,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,207,TP,static helper never writes through ftp; const addable,curl_full_audit_0.4.35,low
MEM30-C,curl,lib/ftp.c,221,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,221,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,221,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,226,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,231,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,242,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,245,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,245,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/ftp.c,249,FP,"sizeof(*ss) is full struct type, not decayed array",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,249,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,250,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,268,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,268,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/ftp.c,275,FP,"sizeof(*ss) is full struct type, not decayed array",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/ftp.c,277,FP,var is CURLcode / ownership transferred to dtor; no stack leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,281,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,282,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,282,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,292,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,304,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/ftp.c,313,FP,var is CURLcode / ownership transferred to dtor; no stack leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,318,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/ftp.c,329,FP,idiomatic !strncmp/!memcmp or correct ==1 inet_pton test,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,329,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/ftp.c,336,FP,var is CURLcode / ownership transferred to dtor; no stack leak,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,345,TP,static non-vtable helper only reads ftpc->transfertype,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/ftp.c,373,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,374,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/ftp.c,421,FP,"blen is size_t, not pointer; chunk_len within same buffer",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,459,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftp.c,471,FP,pointer guarded non-null on this path / callee NULL-safe,curl_full_audit_0.4.35,high
INT13-C,curl,lib/ftp.c,491,FP,idiomatic flag bit-test on socket select mask,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/ftp.c,510,FP,variable written by callee via out-param before use,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,575,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,575,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,576,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,576,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,594,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/ftp.c,603,FP,variable written by callee via out-param before use,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,633,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,741,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
CON34-C,curl,lib/ftp.c,757,FP,"debug-only getenv, advisory; not a concurrency bug here",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,803,TP,pathlen() static helper only reads ftpc->dirs,curl_full_audit_0.4.35,low
ARR00-C,curl,lib/ftp.c,807,FP,index bounded by DEBUGASSERT/guard or within buffer,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,810,TP,pathpiece() static helper only reads ftpc fields,curl_full_audit_0.4.35,low
MSC04-C,curl,lib/ftp.c,823,FP,"intentional bounded FTP state-machine dispatch, not unbounded recursion",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/ftp.c,856,FP,args are pure reads of distinct fields; no unsequenced modification,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,882,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,883,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,885,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,886,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,887,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,888,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,902,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/ftp.c,914,FP,index bounded by DEBUGASSERT/guard or within buffer,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/ftp.c,934,FP,idiomatic !strncmp/!memcmp or correct ==1 inet_pton test,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/ftp.c,973,FP,idiomatic void* meta round-trip; alignment preserved,curl_full_audit_0.4.35,high
STR31-C,curl,lib/ftp.c,979,FP,explicit NUL written immediately after memcpy,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftp.c,979,FP,pointer guarded non-null on this path / callee NULL-safe,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/ftp.c,980,FP,index bounds-checked before access / loop bounded by source,curl_full_audit_0.4.35,high
CON43-C,curl,lib/ftp.c,983,FP,"switch on function return value, no shared double-fetch",curl_full_audit_0.4.35,high
STR31-C,curl,lib/ftp.c,991,FP,explicit NUL written immediately after memcpy,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/ftp.c,992,FP,index bounds-checked before access / loop bounded by source,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,993,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,998,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,1015,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,1018,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,1019,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/ftp.c,1030,FP,"sizeof(*ss) is full struct type, not decayed array",curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,1049,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,1058,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/ftp.c,1092,FP,"'result' is a CURLcode, not a file descriptor",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/ftp.c,1109,FP,"pointer set to heap/list element, not stack local",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,1119,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftp.c,1137,FP,pointer guarded non-null on this path / callee NULL-safe,curl_full_audit_0.4.35,high
POS02-C,curl,lib/ftp.c,1147,FP,curl is not setuid; no privilege to drop,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/ftp.c,1156,FP,"sizeof(*ss) is full struct type, not decayed array",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/ftp.c,1185,FP,"sizeof(*ss) is full struct type, not decayed array",curl_full_audit_0.4.35,high
POS02-C,curl,lib/ftp.c,1203,FP,curl is not setuid; no privilege to drop,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,1218,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/ftp.c,1222,FP,initializer-sized array; explicit bounds advisory only,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/ftp.c,1222,FP,initializer-sized array; explicit bounds advisory only,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/ftp.c,1228,FP,variable is written via Curl_printable_address,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/ftp.c,1228,FP,"compile-time-constant array size, not a VLA",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/ftp.c,1290,FP,"compile-time-constant array size, not a VLA",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/ftp.c,1295,FP,index bounds-checked before access / loop bounded by source,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,1297,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
MEM33-C,curl,lib/ftp.c,1299,FP,"*dest=*source is char assignment, not flexible-array struct",curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,1299,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,1299,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,1299,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,1303,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
INT08-C,curl,lib/ftp.c,1304,FP,port shift cast to int; no overflow,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/ftp.c,1338,FP,buffer bounds-checked against length before copy,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/ftp.c,1349,FP,variable written by callee via out-param before use,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftp.c,1369,FP,pointer guarded non-null on this path / callee NULL-safe,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftp.c,1379,FP,pointer guarded non-null on this path / callee NULL-safe,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/ftp.c,1409,FP,var is CURLcode / ownership transferred to dtor; no stack leak,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/ftp.c,1431,FP,initializer-sized array; explicit bounds advisory only,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/ftp.c,1431,FP,initializer-sized array; explicit bounds advisory only,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/ftp.c,1459,FP,"intentional bounded FTP state-machine dispatch, not unbounded recursion",curl_full_audit_0.4.35,high
MSC04-C,curl,lib/ftp.c,1500,FP,"intentional bounded FTP state-machine dispatch, not unbounded recursion",curl_full_audit_0.4.35,high
MSC04-C,curl,lib/ftp.c,1521,FP,"intentional bounded FTP state-machine dispatch, not unbounded recursion",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,1543,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,1571,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,1571,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/ftp.c,1599,FP,"intentional bounded FTP state-machine dispatch, not unbounded recursion",curl_full_audit_0.4.35,high
MSC04-C,curl,lib/ftp.c,1607,FP,"intentional bounded FTP state-machine dispatch, not unbounded recursion",curl_full_audit_0.4.35,high
MSC04-C,curl,lib/ftp.c,1615,FP,"intentional bounded FTP state-machine dispatch, not unbounded recursion",curl_full_audit_0.4.35,high
MSC04-C,curl,lib/ftp.c,1623,FP,"intentional bounded FTP state-machine dispatch, not unbounded recursion",curl_full_audit_0.4.35,high
MSC04-C,curl,lib/ftp.c,1656,FP,"intentional bounded FTP state-machine dispatch, not unbounded recursion",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/ftp.c,1730,FP,"compile-time-constant array size, not a VLA",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/ftp.c,1730,FP,variable written by callee via out-param before use,curl_full_audit_0.4.35,high
INT18-C,curl,lib/ftp.c,1795,FP,"compared variable is signed curl_off_t, not unsigned",curl_full_audit_0.4.35,high
MSC04-C,curl,lib/ftp.c,1861,FP,"intentional bounded FTP state-machine dispatch, not unbounded recursion",curl_full_audit_0.4.35,high
INT18-C,curl,lib/ftp.c,1933,FP,"compared variable is signed curl_off_t, not unsigned",curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,2023,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/ftp.c,2027,FP,variable written by callee via out-param before use,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,2028,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,2032,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,2079,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ftp.c,2086,FP,freed on error label / ownership transferred to dtor; no leak,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ftp.c,2095,FP,freed on error label / ownership transferred to dtor; no leak,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ftp.c,2120,FP,freed on error label / ownership transferred to dtor; no leak,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ftp.c,2129,FP,freed on error label / ownership transferred to dtor; no leak,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ftp.c,2143,FP,freed on error label / ownership transferred to dtor; no leak,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ftp.c,2147,FP,freed on error label / ownership transferred to dtor; no leak,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/ftp.c,2162,FP,variable written by callee via out-param before use,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/ftp.c,2172,FP,variable written by callee via out-param before use,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ftp.c,2174,FP,freed on error label / ownership transferred to dtor; no leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,2186,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,2186,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,2191,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,2195,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ftp.c,2197,FP,freed on error label / ownership transferred to dtor; no leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,2208,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ftp.c,2208,FP,freed on error label / ownership transferred to dtor; no leak,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ftp.c,2209,FP,freed on error label / ownership transferred to dtor; no leak,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ftp.c,2212,FP,freed on error label / ownership transferred to dtor; no leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,2228,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,2234,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,2235,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ftp.c,2237,FP,freed on error label / ownership transferred to dtor; no leak,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,2240,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,2244,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ftp.c,2244,FP,freed on error label / ownership transferred to dtor; no leak,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/ftp.c,2277,FP,idiomatic void* meta round-trip; alignment preserved,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/ftp.c,2384,FP,intentional empty body chaining else-if (commented),curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,2435,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,2505,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,2522,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/ftp.c,2660,FP,"intentional bounded FTP state-machine dispatch, not unbounded recursion",curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,2709,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftp.c,2709,FP,pointer guarded non-null on this path / callee NULL-safe,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/ftp.c,2712,FP,"pointer walks within recvbuf array, bounded by guard",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/ftp.c,2714,FP,"pointer walks within recvbuf array, bounded by guard",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/ftp.c,2715,FP,index bounded by DEBUGASSERT/guard or within buffer,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/ftp.c,2715,FP,"pointer walks within recvbuf array, bounded by guard",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/ftp.c,2716,FP,"pointer walks within recvbuf array, bounded by guard",curl_full_audit_0.4.35,high
INT18-C,curl,lib/ftp.c,2733,FP,"compared variable is signed curl_off_t, not unsigned",curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,2881,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftp.c,2881,FP,pointer guarded non-null on this path / callee NULL-safe,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/ftp.c,2884,FP,idiomatic !strncmp/!memcmp or correct ==1 inet_pton test,curl_full_audit_0.4.35,high
INT18-C,curl,lib/ftp.c,2891,FP,"compared variable is signed curl_off_t, not unsigned",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ftp.c,3105,FP,pointer guarded non-null on this path / callee NULL-safe,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3115,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3117,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3118,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3118,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3119,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3119,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3122,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/ftp.c,3138,FP,initializer-sized array; explicit bounds advisory only,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/ftp.c,3193,FP,idiomatic void* meta round-trip; alignment preserved,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3355,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3382,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3388,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3395,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3395,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3397,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/ftp.c,3404,FP,args are pure reads of distinct fields; no unsequenced modification,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3404,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3405,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3406,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3421,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3421,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3424,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/ftp.c,3426,FP,args are pure reads of distinct fields; no unsequenced modification,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3426,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3427,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3428,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3434,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/ftp.c,3442,FP,args are pure reads of distinct fields; no unsequenced modification,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3442,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3443,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3444,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3457,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3463,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3468,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3490,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,3516,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,3584,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/ftp.c,3590,FP,index bounds-checked before access / loop bounded by source,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/ftp.c,3641,FP,idiomatic void* meta round-trip; alignment preserved,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3703,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/ftp.c,3705,FP,intentional empty body chaining else-if (commented),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3705,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3708,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3708,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3712,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3717,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3717,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3717,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,3718,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/ftp.c,3791,FP,intentional empty body chaining else-if (commented),curl_full_audit_0.4.35,high
INT18-C,curl,lib/ftp.c,3797,FP,"compared variable is signed curl_off_t, not unsigned",curl_full_audit_0.4.35,high
INT18-C,curl,lib/ftp.c,3810,FP,"compared variable is signed curl_off_t, not unsigned",curl_full_audit_0.4.35,high
MSC04-C,curl,lib/ftp.c,3844,FP,"intentional bounded FTP state-machine dispatch, not unbounded recursion",curl_full_audit_0.4.35,high
EXP40-C,curl,lib/ftp.c,3918,FP,"void* param assignment, no const involved",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ftp.c,3970,FP,freed on error label / ownership transferred to dtor; no leak,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/ftp.c,4007,FP,"code after return is a goto label target, reachable",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/ftp.c,4018,FP,"for(;;) loop; every case returns, end unreachable",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/ftp.c,4208,FP,idiomatic void* meta round-trip; alignment preserved,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/ftp.c,4325,FP,idiomatic void* meta round-trip; alignment preserved,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,4342,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,4342,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,4342,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,4351,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,4351,FP,param flows to mutating callee or vtable-locked signature,curl_full_audit_0.4.35,high
API05-C,curl,lib/ftp.c,4351,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,4362,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,4362,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,4362,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/ftp.c,4363,FP,struct-member free or free-then-reassign propagated to whole struct; not UAF,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ftp.c,4366,TP,type_url_check never writes ftp struct fields,curl_full_audit_0.4.35,low
EXP20-C,curl,lib/ftp.c,4371,FP,idiomatic !strncmp/!memcmp or correct ==1 inet_pton test,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/ftp.c,4373,FP,"pointer walks within recvbuf array, bounded by guard",curl_full_audit_0.4.35,high
STR34-C,curl,lib/ftp.c,4375,FP,char/pointer copy or ptr subtraction; no sign-extension bug,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/ftp.c,4402,FP,variable written by callee via out-param before use,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/ftp.c,4407,FP,variable written by callee via out-param before use,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/ftp.c,4410,FP,var is CURLcode / ownership transferred to dtor; no stack leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/ftp.c,4417,FP,var is CURLcode / ownership transferred to dtor; no stack leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/ftp.c,4426,FP,var is CURLcode / ownership transferred to dtor; no stack leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/ftp.c,4442,FP,var is CURLcode / ownership transferred to dtor; no stack leak,curl_full_audit_0.4.35,high
API00-C,curl,lib/ftp.c,4445,FP,"thin internal helper; callees handle pointers, siblings same",curl_full_audit_0.4.35,high
API00-C,curl,lib/ftp.c,4445,FP,"thin internal helper; callees handle pointers, siblings same",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/ftp.c,4488,FP,intentionally external; referenced from scheme table in url.c,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/ftp.c,4488,FP,file-scope scheme struct must have external linkage,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/ftp.c,4507,FP,intentionally external; referenced from scheme table in url.c,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/ftp.c,4507,FP,file-scope scheme struct must have external linkage,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/setopt.c,81,FP,"Curl_* exported, used externally (e.g. OS400 ccsidcurl.c); cannot be static",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/setopt.c,81,FP,"Curl_* exported symbol, referenced outside this TU; not file-local",curl_full_audit_0.4.35,high
STR34-C,curl,lib/setopt.c,92,FP,"char* string assignment, not signed-char sign-extension; idiomatic",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/setopt.c,92,FP,curlx_* declared via included curlx/strdup.h; not implicit decl,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/setopt.c,100,FP,"Curl_* exported, used externally (e.g. OS400 ccsidcurl.c); cannot be static",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/setopt.c,100,FP,"Curl_* exported symbol, referenced outside this TU; not file-local",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/setopt.c,113,FP,curlx_* declared via included curlx/strdup.h; not implicit decl,curl_full_audit_0.4.35,high
INT14-C,curl,lib/setopt.c,113,FP,flags&MASK ? len : 0 inside malloc size; readability advisory not a bug,curl_full_audit_0.4.35,high
INT14-C,curl,lib/setopt.c,113,FP,flags&MASK ? len : 0 inside malloc size; readability advisory not a bug,curl_full_audit_0.4.35,high
MEM33-C,curl,lib/setopt.c,117,FP,curl_blob has no flexible array member; plain struct copy is correct,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/setopt.c,120,FP,"(char*)nblob + sizeof: byte offset on char*, correct not double-scaled",curl_full_audit_0.4.35,high
MEM03-C,curl,lib/setopt.c,135,FP,"passwd is local char* ownership-transferred to *passwdp, not a buffer to zero",curl_full_audit_0.4.35,high
STR34-C,curl,lib/setopt.c,143,FP,"char* string assignment, not signed-char sign-extension; idiomatic",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/setopt.c,153,FP,curlx_* declared via included curlx/strdup.h; not implicit decl,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/setopt.c,154,FP,"value is heap pointer from parse/strdup, not stack address; persists",curl_full_audit_0.4.35,high
STR34-C,curl,lib/setopt.c,154,FP,"char* string assignment, not signed-char sign-extension; idiomatic",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/setopt.c,156,FP,curlx_* declared via included curlx/strdup.h; not implicit decl,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/setopt.c,157,FP,"value is heap pointer from parse/strdup, not stack address; persists",curl_full_audit_0.4.35,high
STR34-C,curl,lib/setopt.c,157,FP,"char* string assignment, not signed-char sign-extension; idiomatic",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/setopt.c,180,FP,curlx_* declared via included curlx/strdup.h; not implicit decl,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/setopt.c,181,FP,"value is heap pointer from parse/strdup, not stack address; persists",curl_full_audit_0.4.35,high
STR34-C,curl,lib/setopt.c,181,FP,"char* string assignment, not signed-char sign-extension; idiomatic",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/setopt.c,183,FP,curlx_* declared via included curlx/strdup.h; not implicit decl,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/setopt.c,184,FP,"value is heap pointer from parse/strdup, not stack address; persists",curl_full_audit_0.4.35,high
STR34-C,curl,lib/setopt.c,184,FP,"char* string assignment, not signed-char sign-extension; idiomatic",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/setopt.c,186,FP,curlx_* declared via included curlx/strdup.h; not implicit decl,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/setopt.c,187,FP,"value is heap pointer from parse/strdup, not stack address; persists",curl_full_audit_0.4.35,high
STR34-C,curl,lib/setopt.c,187,FP,"char* string assignment, not signed-char sign-extension; idiomatic",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/setopt.c,218,FP,pointer guarded non-NULL before pass / callee handles NULL,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/setopt.c,227,FP,str++ only modification; && is a sequence point,curl_full_audit_0.4.35,high
INT13-C,curl,lib/setopt.c,266,FP,& operand auth is unsigned long; bitcheck is shift amount only,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/setopt.c,322,FP,param stored into / written through struct member; const breaks store; fixed dispatch sig,curl_full_audit_0.4.35,med
MSC07-C,curl,lib/setopt.c,478,FP,case label after return/break is reachable via switch dispatch,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/setopt.c,844,FP,param stored into / written through struct member; const breaks store; fixed dispatch sig,curl_full_audit_0.4.35,med
MSC37-C,curl,lib/setopt.c,973,FP,every compiled path returns (switch default + #else arm); not fallthrough,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/setopt.c,994,FP,case label after return/break is reachable via switch dispatch,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/setopt.c,1029,FP,every compiled path returns (switch default + #else arm); not fallthrough,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/setopt.c,1065,FP,every compiled path returns (switch default + #else arm); not fallthrough,curl_full_audit_0.4.35,high
DCL18-C,curl,lib/setopt.c,1178,FP,0777 intentional Unix file-permission octal; idiomatic,curl_full_audit_0.4.35,high
DCL18-C,curl,lib/setopt.c,1203,FP,0777 intentional Unix file-permission octal; idiomatic,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/setopt.c,1303,FP,initializer-sized const function-pointer table; advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/setopt.c,1323,FP,param stored into / written through struct member; const breaks store; fixed dispatch sig,curl_full_audit_0.4.35,med
MEM30-C,curl,lib/setopt.c,1442,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1443,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MSC39-C,curl,lib/setopt.c,1453,FP,"va_list passed by value to dispatch helper; caller returns, no reuse; idiomatic",curl_full_audit_0.4.35,low
MEM30-C,curl,lib/setopt.c,1468,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1469,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1494,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1498,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1498,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1498,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1503,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1503,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1503,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1507,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1507,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1507,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1508,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1508,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1508,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1510,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1510,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1511,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1512,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1515,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1515,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1528,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1531,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1535,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1539,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1542,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1546,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1547,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1642,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,1650,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/setopt.c,1684,FP,pointer guarded non-NULL before pass / callee handles NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/setopt.c,1689,FP,pointer guarded non-NULL before pass / callee handles NULL,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/setopt.c,1788,FP,case label after return/break is reachable via switch dispatch,curl_full_audit_0.4.35,high
INT18-C,curl,lib/setopt.c,1845,FP,postfieldsize is signed curl_off_t; == -1 valid; not unsigned compare,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/setopt.c,1846,FP,pointer guarded non-NULL before pass / callee handles NULL,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/setopt.c,1883,FP,result assigned by setopt_cptr_proxy before read on compiled path,curl_full_audit_0.4.35,med
MSC07-C,curl,lib/setopt.c,1908,FP,case label after return/break is reachable via switch dispatch,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,2504,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/setopt.c,2512,FP,cleanup/free of distinct member then null; not use-after-free,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/setopt.c,2549,FP,!strcmp option-dispatch idiom; FP per brief,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/setopt.c,2551,FP,!strcmp option-dispatch idiom; FP per brief,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/setopt.c,2553,FP,!strcmp option-dispatch idiom; FP per brief,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/setopt.c,2555,FP,!strcmp option-dispatch idiom; FP per brief,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/setopt.c,2557,FP,!strcmp option-dispatch idiom; FP per brief,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/setopt.c,2562,FP,!strcmp option-dispatch idiom; FP per brief,curl_full_audit_0.4.35,high
MSC39-C,curl,lib/setopt.c,2574,FP,"va_list passed by value to dispatch helper; caller returns, no reuse; idiomatic",curl_full_audit_0.4.35,low
MSC07-C,curl,lib/setopt.c,2631,FP,case label after return/break is reachable via switch dispatch,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/setopt.c,2900,FP,case label after return/break is reachable via switch dispatch,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/setopt.c,2918,FP,"Curl_* exported, used externally (e.g. OS400 ccsidcurl.c); cannot be static",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/setopt.c,2918,FP,"Curl_* exported symbol, referenced outside this TU; not file-local",curl_full_audit_0.4.35,high
MSC39-C,curl,lib/setopt.c,2918,FP,"va_list passed by value to dispatch helper; caller returns, no reuse; idiomatic",curl_full_audit_0.4.35,low
EXP47-C,curl,lib/setopt.c,2948,FP,va_arg char promotion advisory; not a defect here,curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_cb_hdr.c,33,FP,8-char header-name collision is advisory; no modern filesystem limit applies,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_hdr.c,63,FP,curl never uses C99 conformant-array param syntax; stylistic by convention,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_cb_hdr.c,72,FP,getenv result IS checked: if(vver) guard on next line,curl_full_audit_0.4.35,high
CON34-C,curl,src/tool_cb_hdr.c,72,FP,CLI single-threaded init path; getenv static-storage threading not applicable,curl_full_audit_0.4.35,med
ENV30-C,curl,src/tool_cb_hdr.c,76,FP,"curlx_str_number takes const char**, advances pointer only; does not modify env string",curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_cb_hdr.c,79,FP,num set by curlx_str_number on success path before short-circuit use; sqc dataflow miss,curl_full_audit_0.4.35,high
INT30-C,curl,src/tool_cb_hdr.c,91,FP,llen guarded nonzero by while(llen && ...) before llen-1 indexing,curl_full_audit_0.4.35,high
INT30-C,curl,src/tool_cb_hdr.c,91,FP,duplicate; llen>0 guaranteed by loop condition,curl_full_audit_0.4.35,high
INT30-C,curl,src/tool_cb_hdr.c,92,FP,--llen guarded by while(llen && ...) condition; cannot underflow,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_cb_hdr.c,120,FP,!strcmp idiom in scheme dispatch; idiomatic curl style,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_cb_hdr.c,120,FP,scheme non-NULL: curl_url_get success at 117 guarantees output set or goto locout,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_cb_hdr.c,121,FP,!strcmp idiom; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_cb_hdr.c,122,FP,!strcmp idiom; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_cb_hdr.c,123,FP,!strcmp idiom; idiomatic,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_cb_hdr.c,126,FP,finalurl non-NULL: curl_url_get success at 114 sets it or goto locout,curl_full_audit_0.4.35,high
ERR00-C,curl,src/tool_cb_hdr.c,135,FP,best-effort fallback display write to terminal; error handling not meaningful here,curl_full_audit_0.4.35,med
ERR33-C,curl,src/tool_cb_hdr.c,135,FP,"display fallback write; unchecked fwrite to stdout is idiomatic, not a bug",curl_full_audit_0.4.35,med
EXP34-C,curl,src/tool_cb_hdr.c,139,FP,curl_free is NULL-safe (free wrapper); inside if(u) block anyway,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_cb_hdr.c,140,FP,curl_free is NULL-safe,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_hdr.c,150,FP,conformant-array style; curl convention,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,165,FP,"stop=*p stores char into char (stop), no widening sign-extension issue",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,165,FP,duplicate; char-to-char assignment,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,172,FP,"*q='\0' is char store, not widening conversion",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,179,FP,*q='\0' char store,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,182,FP,*q='\0' char store,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,210,FP,*q='\0' char store,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,214,FP,*q='\0' char store,curl_full_audit_0.4.35,high
INT32-C,curl,src/tool_cb_hdr.c,217,FP,strlen(p)+1 of substring within bounded heap copy; cannot overflow,curl_full_audit_0.4.35,high
EXP05-C,curl,src/tool_cb_hdr.c,217,FP,"no const cast present; memmove(copy,p,...) where both are char*",curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_cb_hdr.c,230,FP,"copy is heap (curlx_memdup0/sanitize), not automatic storage",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cb_hdr.c,230,FP,copy not freed on this path; all tool_safefree branches return earlier,curl_full_audit_0.4.35,high
DCL00-C,curl,src/tool_cb_hdr.c,235,FP,h is mutated in loop (h=h->next); not const-eligible,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_cb_hdr.c,255,FP,etag_save->stream written via fwrite/ftruncate; pointer used non-const,curl_full_audit_0.4.35,med
ARR36-C,curl,src/tool_cb_hdr.c,259,FP,etag_h and endp/eot point into same header buffer; valid comparison,curl_full_audit_0.4.35,high
ARR36-C,curl,src/tool_cb_hdr.c,264,FP,"same buffer (eot=endp-1, etag_h within it); valid",curl_full_audit_0.4.35,high
ARR36-C,curl,src/tool_cb_hdr.c,265,FP,eot-etag_h within same header buffer; valid subtraction,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,265,FP,pointer subtraction yields ptrdiff; no char sign-extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,265,FP,"pointer subtraction, not char widening",curl_full_audit_0.4.35,high
ERR00-C,curl,src/tool_cb_hdr.c,279,FP,"etag write to user file; fflush follows, idiomatic best-effort",curl_full_audit_0.4.35,med
ERR33-C,curl,src/tool_cb_hdr.c,279,TP,[adv-fix] sqc correctly flagged unchecked fwrite at save_etag:279,curl_full_audit_0.4.35,med
FIO18-C,curl,src/tool_cb_hdr.c,279,FP,"etag_length correctly derived from trimmed pointer span, not raw strlen",curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_hdr.c,294,FP,conformant-array style; convention,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_hdr.c,294,FP,conformant-array style; convention,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,304,FP,"p=&str[9] is pointer assignment, not char widening; str is char*, not array[9]",curl_full_audit_0.4.35,high
ARR36-C,curl,src/tool_cb_hdr.c,306,FP,p and end point into same str header buffer; valid comparison,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_cb_hdr.c,311,FP,curlx_free declared via included curl headers; sqc no-preprocessor miss,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_cb_hdr.c,315,FP,curlx_free declared in headers,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_cb_hdr.c,320,FP,curlx_free declared in headers,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cb_hdr.c,321,FP,outs->filename freshly assigned by curl_maprintf at 318; reads new value not freed,curl_full_audit_0.4.35,high
ARR00-C,curl,src/tool_cb_hdr.c,333,FP,str is char* param not array[9]; str+20 valid (cb>20 guard); sqc array misparse,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_cb_hdr.c,337,FP,filename assigned by parse_filename at 358 before use; sqc dataflow miss,curl_full_audit_0.4.35,high
ARR36-C,curl,src/tool_cb_hdr.c,340,FP,p and end same buffer; valid,curl_full_audit_0.4.35,high
ARR36-C,curl,src/tool_cb_hdr.c,347,FP,p and end same buffer; valid,curl_full_audit_0.4.35,high
ARR36-C,curl,src/tool_cb_hdr.c,349,FP,p and end same buffer; valid,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_cb_hdr.c,362,FP,curlx_free declared in headers,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_cb_hdr.c,366,FP,curlx_free declared in headers,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_cb_hdr.c,371,FP,curlx_free declared in headers,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cb_hdr.c,372,FP,outs->filename freshly assigned at 369; reads new value,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cb_hdr.c,383,FP,"outs is &per->outs, never freed; no UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cb_hdr.c,385,FP,outs never freed; struct lives in per_transfer,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cb_hdr.c,385,FP,outs->stream just opened by tool_create_output_file; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cb_hdr.c,390,FP,outs->stream live; never freed in this function,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cb_hdr.c,392,FP,outs->stream live; not freed,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_cb_hdr.c,404,FP,curlx_free declared in included curl headers; sqc no-preprocessor miss,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_cb_hdr.c,426,FP,libcurl callback contract guarantees ptr non-NULL; fixed CURLOPT_HEADERFUNCTION signature,curl_full_audit_0.4.35,med
API00-C,curl,src/tool_cb_hdr.c,426,FP,size always 1 per contract; cb=size*nmemb bounded by libcurl,curl_full_audit_0.4.35,med
API05-C,curl,src/tool_cb_hdr.c,426,FP,callback signature fixed by libcurl typedef; cannot use array syntax,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_hdr.c,426,FP,fixed callback typedef; conformant-array N/A,curl_full_audit_0.4.35,high
FIO18-C,curl,src/tool_cb_hdr.c,459,FP,header data is binary stream not C string; nmemb is correct count,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,459,FP,ptr passed to fwrite as void*; no char widening conversion,curl_full_audit_0.4.35,high
EXP15-C,curl,src/tool_cb_hdr.c,475,FP,empty body intentional (only-care comment); else-if chain handles real work,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,482,FP,&str[5] pointer arith and endp pointer; no char-to-int widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,482,FP,"pointer args, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,482,FP,"pointer args, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,493,FP,str/end are pointers passed to content_disposition; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,493,FP,pointer args,curl_full_audit_0.4.35,high
PRE32-C,curl,src/tool_cb_hdr.c,519,FP,"#ifdef _WIN32 inside if-condition block, not inside a memchr macro call",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,525,FP,namelen=value-ptr is pointer subtraction; no char widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_cb_hdr.c,525,FP,pointer subtraction,curl_full_audit_0.4.35,high
INT31-C,curl,src/tool_cb_hdr.c,526,FP,namelen bounded by header len <= CURL_MAX_HTTP_HEADER; (int) cast safe,curl_full_audit_0.4.35,med
ERR00-C,curl,src/tool_cb_hdr.c,528,FP,"display fwrite to user stream; best-effort, idiomatic",curl_full_audit_0.4.35,med
ERR33-C,curl,src/tool_cb_hdr.c,528,FP,display fwrite return unchecked; idiomatic terminal output,curl_full_audit_0.4.35,med
FIO09-C,curl,src/tool_cb_hdr.c,528,FP,"writing HTTP header text bytes, not structured binary; no portability issue",curl_full_audit_0.4.35,high
ARR00-C,curl,src/tool_cb_hdr.c,528,FP,"cb is size_t, namelen=value-ptr (same buffer); not cross-array pointer subtraction",curl_full_audit_0.4.35,high
INT00-C,curl,src/tool_cb_hdr.c,528,FP,cb>=namelen+1 since value(':')<end within buffer of length cb,curl_full_audit_0.4.35,high
INT30-C,curl,src/tool_cb_hdr.c,528,FP,value found within ptr[0..cb); cb-namelen-1 >= 0 guaranteed,curl_full_audit_0.4.35,high
ARR00-C,curl,src/tool_cb_hdr.c,531,FP,"cb size_t minus namelen ptrdiff; same buffer, not cross-array",curl_full_audit_0.4.35,high
INT00-C,curl,src/tool_cb_hdr.c,531,FP,cb>=namelen+1 by construction,curl_full_audit_0.4.35,high
INT30-C,curl,src/tool_cb_hdr.c,531,FP,value within buffer; no underflow,curl_full_audit_0.4.35,high
ERR00-C,curl,src/tool_cb_hdr.c,535,FP,display fwrite best-effort,curl_full_audit_0.4.35,med
ERR33-C,curl,src/tool_cb_hdr.c,535,FP,display fwrite return unchecked; idiomatic,curl_full_audit_0.4.35,med
FIO09-C,curl,src/tool_cb_hdr.c,535,FP,"header text bytes, not structured binary",curl_full_audit_0.4.35,high
ARR00-C,curl,src/tool_cb_hdr.c,535,FP,same-buffer arithmetic; not cross-array subtraction,curl_full_audit_0.4.35,high
INT00-C,curl,src/tool_cb_hdr.c,535,FP,cb>=namelen+1 by construction,curl_full_audit_0.4.35,high
INT30-C,curl,src/tool_cb_hdr.c,535,FP,no underflow; value within buffer,curl_full_audit_0.4.35,high
ERR00-C,curl,src/tool_cb_hdr.c,540,FP,display fwrite best-effort fallback,curl_full_audit_0.4.35,med
ERR33-C,curl,src/tool_cb_hdr.c,540,FP,display fwrite return unchecked; idiomatic,curl_full_audit_0.4.35,med
DCL30-C,curl,lib/http_aws_sigv4.c,76,FP,"returns Curl_checkheaders result (pointer into header list), not automatic storage",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_aws_sigv4.c,81,FP,trim_headers mutates list node data in place; cannot be const,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http_aws_sigv4.c,86,FP,store assigned from value before any read on every path,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/http_aws_sigv4.c,88,FP,Curl_strntolower params not restrict; intentional in-place lowercasing,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/http_aws_sigv4.c,99,FP,loop bounded by NUL terminator of value string; standard string walk,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_aws_sigv4.c,109,FP,"char store/value copy; no widening, idiomatic char move",curl_full_audit_0.4.35,high
MEM33-C,curl,lib/http_aws_sigv4.c,112,FP,no flexible-array struct here; *store++=*value++ is char copy,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_aws_sigv4.c,112,FP,"char-to-char copy, no integer widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_aws_sigv4.c,112,FP,"char-to-char copy, no widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_aws_sigv4.c,112,FP,"char-to-char copy, no widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_aws_sigv4.c,114,FP,*store=0 NUL terminate; no sign-extension issue,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_aws_sigv4.c,134,FP,dyn_array_free mutates db entries via curlx_dyn_free; not const,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_aws_sigv4.c,150,FP,curl convention; no C99 array-param syntax used project-wide,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_aws_sigv4.c,151,FP,db[MAX_QUERY_COMPONENTS] uses compile-time macro size; advisory only,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_aws_sigv4.c,155,FP,strlen(source) takes const char*; no char sign-extension,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/http_aws_sigv4.c,213,FP,c reassigned each loop iteration; cannot be const-qualified usefully,curl_full_audit_0.4.35,med
API05-C,curl,lib/http_aws_sigv4.c,228,FP,curl convention; advisory array-param syntax,curl_full_audit_0.4.35,high
INT31-C,curl,lib/http_aws_sigv4.c,238,FP,"hexval nibbles 0-15; (n<<4)|n fits a byte, cast to uchar safe",curl_full_audit_0.4.35,high
INT14-C,curl,lib/http_aws_sigv4.c,238,FP,"string is pointer indexing; readability advisory, not a defect",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/http_aws_sigv4.c,316,FP,colon_a/colon_b are within their own a/b strings; valid same-array subtraction,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_aws_sigv4.c,374,FP,curl convention; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_aws_sigv4.c,375,FP,curl convention; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_aws_sigv4.c,376,FP,curl convention; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_aws_sigv4.c,378,FP,curl convention; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_aws_sigv4.c,379,FP,curl convention; advisory,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http_aws_sigv4.c,402,FP,"!Curl_checkheaders boolean idiom; returns presence pointer, idiomatic",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http_aws_sigv4.c,444,FP,dupdata assigned by strdup before use; guarded by NULL check,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http_aws_sigv4.c,445,FP,ptr assigned in for-init before use,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_aws_sigv4.c,469,FP,date_header pointer assignment; no char widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_aws_sigv4.c,475,FP,date_header pointer assignment from maprintf; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_aws_sigv4.c,484,FP,date_header set to NULL; no char widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_aws_sigv4.c,500,FP,date_header set NULL; no widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_aws_sigv4.c,533,FP,*tmp=0 NUL terminate of char*; no sign-extension,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_aws_sigv4.c,556,FP,curl convention; advisory,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/http_aws_sigv4.c,584,FP,"returns value pointing into header (Curl_checkheaders result), not local",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/http_aws_sigv4.c,584,FP,"value is const char* into header storage, not a local array",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/http_aws_sigv4.c,587,FP,data->set.postfields read but Curl_easy threaded through; convention non-const,curl_full_audit_0.4.35,med
EXP36-C,curl,lib/http_aws_sigv4.c,600,FP,"cast char* to const uchar* for hashing; byte access, no alignment need",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/http_aws_sigv4.c,609,FP,all paths set ret and reach fail: return ret; no fall-through,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_aws_sigv4.c,611,FP,curl convention; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_aws_sigv4.c,613,FP,curl convention; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_aws_sigv4.c,614,FP,curl convention; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/http_aws_sigv4.c,614,FP,curl convention; advisory,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_aws_sigv4.c,666,FP,"strcmp(curlx_dyn_ptr,curlx_dyn_ptr): pure getters, no side effects",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_aws_sigv4.c,678,FP,strcmp of two dyn_ptr getters; no side effects between args,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_aws_sigv4.c,683,FP,"canon_path is UNITTEST helper; q passed to curlx_str_assign, internal caller-controlled",curl_full_audit_0.4.35,med
API05-C,curl,lib/http_aws_sigv4.c,683,FP,curl convention; advisory,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/http_aws_sigv4.c,713,FP,line is dynbuf query_array[] decl; no getenv involved,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/http_aws_sigv4.c,714,FP,line is pair encoded_query_array[] decl; no getenv involved,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http_aws_sigv4.c,722,FP,split_to_dyn_array initializes elements and sets num before reads (callee-filled out-param),curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http_aws_sigv4.c,730,FP,num_query_components set by split_to_dyn_array (always sets *num_splits_out) before loop,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/http_aws_sigv4.c,734,FP,query_array filled by split_to_dyn_array for index<num before read,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/http_aws_sigv4.c,735,FP,query_array filled by callee before read,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_aws_sigv4.c,739,FP,query_part is dyn_ptr of populated dynbuf; non-NULL after dyn_addn,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_aws_sigv4.c,742,FP,in_key=query_part already established non-NULL,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/http_aws_sigv4.c,748,FP,"encoded_query_array element being initialized here (curlx_dyn_init), not read",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/http_aws_sigv4.c,748,FP,curlx_dyn_init writes the element; this is the initialization site,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/http_aws_sigv4.c,750,FP,"curlx_dyn_init of value member; initialization, not read",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/http_aws_sigv4.c,756,FP,normalize_query writes into .key after init; element initialized above,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/http_aws_sigv4.c,767,FP,normalize_query writes .value; element initialized at 748/750,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/http_aws_sigv4.c,774,FP,curlx_dyn_init of value; initialization site,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/http_aws_sigv4.c,775,FP,dyn_addn into initialized value member,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/http_aws_sigv4.c,793,FP,"reads dyn_ptr of element index<num, populated in prior loop",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/http_aws_sigv4.c,794,FP,reads value of populated element index<num,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/http_aws_sigv4.c,795,FP,dyn_len of populated element index<num,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/http_aws_sigv4.c,841,FP,content_sha256_hdr array written via memcpy at 980; not const-able,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/http_aws_sigv4.c,841,FP,CONTENT_SHA256_HDR_LEN is compile-time macro constant; not a VLA,curl_full_audit_0.4.35,high
MEM03-C,curl,lib/http_aws_sigv4.c,844,FP,credential_scope is heap pointer freed at fail; not stack sensitive buffer; scope not secret,curl_full_audit_0.4.35,med
DCL00-C,curl,lib/http_aws_sigv4.c,845,FP,str_to_sign reassigned/written by Curl_strntoupper; not const-able,curl_full_audit_0.4.35,high
MEM03-C,curl,lib/http_aws_sigv4.c,847,FP,"secret is heap pointer freed via curlx_free; curl does not zero it (potential hardening, but not CERT stack-buffer case)",curl_full_audit_0.4.35,low
EXP30-C,curl,lib/http_aws_sigv4.c,926,FP,curlx_str/curlx_strlen are pure getters on same struct; no unsequenced side effects,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_aws_sigv4.c,936,FP,pure getter args to calc_s3_payload_hash; no side effects,curl_full_audit_0.4.35,high
ENV34-C,curl,lib/http_aws_sigv4.c,951,FP,DEBUGBUILD-only getenv used immediately for branch; not stored long-term,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/http_aws_sigv4.c,951,FP,getenv result checked: if(force_timestamp) branch handles NULL,curl_full_audit_0.4.35,high
CON34-C,curl,lib/http_aws_sigv4.c,951,FP,DEBUGBUILD-only single-threaded test hook; static storage not shared concern,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/http_aws_sigv4.c,955,FP,time(NULL) for timestamp; (time_t)-1 still feeds gmtime which is checked at 960,curl_full_audit_0.4.35,med
ERR33-C,curl,lib/http_aws_sigv4.c,958,FP,time(NULL); failure flows to curlx_gmtime check at 960,curl_full_audit_0.4.35,med
EXP30-C,curl,lib/http_aws_sigv4.c,969,FP,make_headers args are pure getters; no unsequenced side effects,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_aws_sigv4.c,990,FP,canon_path args pure getters/strlen; no side effects,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_aws_sigv4.c,998,FP,curl_maprintf with dyn_ptr/curlx_str getters; no side effects between args,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_aws_sigv4.c,1004,FP,"method set by Curl_http_method; non-NULL for valid request, maprintf %s on it",curl_full_audit_0.4.35,med
EXP43-C,curl,lib/http_aws_sigv4.c,1025,FP,Curl_strntolower not restrict; intentional in-place lowercasing of request_type,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_aws_sigv4.c,1027,FP,curl_maprintf with pure getter args; no side effects,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_aws_sigv4.c,1059,FP,Curl_strntoupper with curlx_str/strlen getters; no unsequenced side effects,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_aws_sigv4.c,1071,FP,pure getter args; no side effects,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_aws_sigv4.c,1074,FP,HMAC_SHA256 macro args are getters; no unsequenced side effects,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_aws_sigv4.c,1076,FP,getter args; no side effects,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_aws_sigv4.c,1085,FP,curl_maprintf with getter/dyn_ptr args; no side effects,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/http_aws_sigv4.c,1105,FP,result is CURLcode value not alloc; make_headers frees its own allocations internally,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/http_aws_sigv4.c,1108,FP,Curl_strntoupper getter args; no side effects,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_aws_sigv4.c,1111,FP,free(userpwd) then reassign to auth_headers at 1112; free-then-reassign not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_aws_sigv4.c,1111,FP,data->state freed-pointer claim spurious; only userpwd freed then replaced,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_aws_sigv4.c,1112,FP,"assigns userpwd=auth_headers after free; write to replaced field, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_aws_sigv4.c,1112,FP,data->state member write after free; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_aws_sigv4.c,1113,FP,authhost.done=TRUE write; unrelated to freed userpwd,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/http_aws_sigv4.c,1113,FP,data->state member write; not freed memory,curl_full_audit_0.4.35,high
PRE08-C,curl,lib/vauth/digest.c,35,FP,"Header-name 8-char collision is advisory; curl builds fine, not actionable",curl_full_audit_0.4.35,high
MSC41-C,curl,lib/vauth/digest.c,54,FP,"QOP/key-name protocol constant, not a hard-coded credential",curl_full_audit_0.4.35,high
MSC41-C,curl,lib/vauth/digest.c,55,FP,"QOP/key-name protocol constant, not a hard-coded credential",curl_full_audit_0.4.35,high
MSC41-C,curl,lib/vauth/digest.c,56,FP,"QOP/key-name protocol constant, not a hard-coded credential",curl_full_audit_0.4.35,high
MEM33-C,curl,lib/vauth/digest.c,67,FP,"No flexible-array struct; plain char copy *p++=*q++, misparse",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest.c,67,FP,char-to-char assignment or pointer assign; no sign-extending widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest.c,67,FP,char-to-char assignment or pointer assign; no sign-extending widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest.c,67,FP,char-to-char assignment or pointer assign; no sign-extending widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest.c,68,FP,char-to-char assignment or pointer assign; no sign-extending widening,curl_full_audit_0.4.35,high
CON43-C,curl,lib/vauth/digest.c,82,FP,"Single-threaded string parse; *str not shared, no double-fetch",curl_full_audit_0.4.35,high
MEM33-C,curl,lib/vauth/digest.c,120,FP,"No flexible-array struct; plain char copy *p++=*q++, misparse",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest.c,120,FP,char-to-char assignment or pointer assign; no sign-extending widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest.c,120,FP,char-to-char assignment or pointer assign; no sign-extending widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest.c,120,FP,char-to-char assignment or pointer assign; no sign-extending widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest.c,125,FP,char-to-char assignment or pointer assign; no sign-extending widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest.c,126,FP,char-to-char assignment or pointer assign; no sign-extending widening,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vauth/digest.c,135,FP,'dest' is written via dest[i*2] in loop; cannot be const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vauth/digest.c,145,FP,'dest' is written via dest[i*2] in loop; cannot be const,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/vauth/digest.c,159,FP,"Loop bounded by NUL terminator / curlx_str API, not unbounded",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,178,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,178,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,179,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest.c,194,FP,char-to-char assignment or pointer assign; no sign-extending widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest.c,194,FP,char-to-char assignment or pointer assign; no sign-extending widening,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,270,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,271,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,272,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,273,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
MSC41-C,curl,lib/vauth/digest.c,282,FP,"QOP/key-name protocol constant, not a hard-coded credential",curl_full_audit_0.4.35,high
MSC41-C,curl,lib/vauth/digest.c,286,FP,"QOP/key-name protocol constant, not a hard-coded credential",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest.c,288,FP,char-to-char assignment or pointer assign; no sign-extending widening,curl_full_audit_0.4.35,high
MSC41-C,curl,lib/vauth/digest.c,292,FP,"QOP/key-name protocol constant, not a hard-coded credential",curl_full_audit_0.4.35,high
MSC41-C,curl,lib/vauth/digest.c,296,FP,"QOP/key-name protocol constant, not a hard-coded credential",curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/digest.c,333,FP,Internal callers pass non-NULL; curl convention omits param NULL-checks,curl_full_audit_0.4.35,med
API00-C,curl,lib/vauth/digest.c,333,FP,Internal callers pass non-NULL; curl convention omits param NULL-checks,curl_full_audit_0.4.35,med
API00-C,curl,lib/vauth/digest.c,333,FP,Internal callers pass non-NULL; curl convention omits param NULL-checks,curl_full_audit_0.4.35,med
API00-C,curl,lib/vauth/digest.c,333,FP,Internal callers pass non-NULL; curl convention omits param NULL-checks,curl_full_audit_0.4.35,med
MEM05-C,curl,lib/vauth/digest.c,344,FP,"Fixed-size array (constant MD5_DIGEST_LEN expr), not a VLA",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vauth/digest.c,345,FP,"Fixed-size array (constant MD5_DIGEST_LEN expr), not a VLA",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vauth/digest.c,346,FP,"Fixed-size array (constant MD5_DIGEST_LEN expr), not a VLA",curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vauth/digest.c,353,FP,"Local char[] used read-only; const advisory, not actionable",curl_full_audit_0.4.35,med
DCL00-C,curl,lib/vauth/digest.c,354,FP,"Local char[] used read-only; const advisory, not actionable",curl_full_audit_0.4.35,med
ARR02-C,curl,lib/vauth/digest.c,355,FP,char qop[]=string-literal initializer; implicit bound idiomatic,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/digest.c,372,FP,Filled by out-param callee (decode/rand/MD5_final/convert) before read,curl_full_audit_0.4.35,high
INT13-C,curl,lib/vauth/digest.c,379,FP,qop_values small flag bitmask; signed bitwise benign idiom,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/digest.c,383,FP,Filled by out-param callee (decode/rand/MD5_final/convert) before read,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/digest.c,395,FP,Filled by out-param callee (decode/rand/MD5_final/convert) before read,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/digest.c,408,FP,Filled by out-param callee (decode/rand/MD5_final/convert) before read,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest.c,417,FP,digest[] filled by Curl_MD5_final before loop reads it,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/digest.c,417,FP,Filled by out-param callee (decode/rand/MD5_final/convert) before read,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest.c,417,FP,digest[] filled by Curl_MD5_final before loop reads it,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest.c,440,FP,digest[] filled by Curl_MD5_final before loop reads it,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/digest.c,440,FP,Filled by out-param callee (decode/rand/MD5_final/convert) before read,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest.c,440,FP,digest[] filled by Curl_MD5_final before loop reads it,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest.c,470,FP,digest[] filled by Curl_MD5_final before loop reads it,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/digest.c,470,FP,Filled by out-param callee (decode/rand/MD5_final/convert) before read,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest.c,470,FP,digest[] filled by Curl_MD5_final before loop reads it,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/digest.c,508,FP,Internal callers pass non-NULL; curl convention omits param NULL-checks,curl_full_audit_0.4.35,med
ENV01-C,curl,lib/vauth/digest.c,521,FP,"value/content are parse buffers, not getenv targets; misfire",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/vauth/digest.c,522,FP,"value/content are parse buffers, not getenv targets; misfire",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,533,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,545,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,551,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/vauth/digest.c,562,FP,"Loop bounded by NUL terminator / curlx_str API, not unbounded",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,578,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,584,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,591,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,643,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,647,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,651,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,651,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,679,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,680,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,681,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,682,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,684,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest.c,702,FP,char-to-char assignment or pointer assign; no sign-extending widening,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/digest.c,716,FP,Filled by out-param callee (decode/rand/MD5_final/convert) before read,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/digest.c,739,FP,Filled by out-param callee (decode/rand/MD5_final/convert) before read,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/digest.c,814,FP,Filled by out-param callee (decode/rand/MD5_final/convert) before read,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,816,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,817,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vauth/digest.c,817,FP,hashthis reassigned (maprintf) before each next free; no double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,825,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,825,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,826,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,842,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,842,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest.c,843,FP,free-then-strdup reassign or read of reassigned member; not UAF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vauth/digest.c,843,FP,hashthis reassigned (maprintf) before each next free; no double-free,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest.c,949,FP,char-to-char assignment or pointer assign; no sign-extending widening,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,984,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,985,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,986,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,987,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest.c,989,FP,"C99 conformant-array-param syntax; curl style, advisory only",curl_full_audit_0.4.35,high
ARR02-C,curl,lib/doh.c,44,FP,Implicit bounds from initializer is valid idiomatic C,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,72,FP,Curl convention; never uses C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,74,FP,Curl convention; never uses C99 array-param syntax,curl_full_audit_0.4.35,high
STR34-C,curl,lib/doh.c,78,FP,strlen(host) takes const char*; no sign-extension defect,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/doh.c,130,FP,while(*hostp) bounded by NUL and label-length checks,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/doh.c,144,FP,dnsp output buffer distinct from hostp input; no overlap,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,169,FP,Curl convention; callback signature fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,170,FP,Curl convention; callback signature fixed,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/doh.c,174,FP,Curl_meta_get returns void*; idiomatic struct cast,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,190,FP,Curl convention; never uses array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,191,FP,Curl convention; never uses array-param syntax,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/doh.c,193,FP,hexstr buffer unrelated to any env var,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/doh.c,239,FP,Args are pure getters on distinct objects; no conflict,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,257,FP,Dtor signature fixed by Curl_meta_set typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/doh.c,257,FP,Dtor signature fixed by function-pointer typedef; const impossible,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,257,FP,Dtor signature fixed by typedef,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/doh.c,264,FP,Normal free in destructor; not use-after-free,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/doh.c,292,FP,doh_req assigned by calloc then NULL-checked before use,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/doh.c,321,FP,"result is CURLcode; Curl_open is not open(2), no fd",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/doh.c,327,FP,doh non-null after Curl_open success guard,curl_full_audit_0.4.35,high
STR30-C,curl,lib/doh.c,329,FP,setopt does not modify the string literal,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/doh.c,406,FP,doh allocated and checked before this point,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/doh.c,417,FP,doh allocated and checked before this point,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/doh.c,421,FP,"Success return; ownership transferred, no leak",curl_full_audit_0.4.35,high
MSC07-C,curl,lib/doh.c,423,FP,"error: label reached via goto, not unreachable",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/doh.c,427,FP,error path frees doh and doh_req via dtor,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/doh.c,459,FP,dohp stored in data->state.async.doh; freed by Curl_doh_cleanup,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/doh.c,514,FP,Success return; dohp owned by data->state.async.doh,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/doh.c,516,FP,"error: label reached via goto, not unreachable",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/doh.c,518,FP,error path calls Curl_doh_cleanup which frees dohp,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,521,FP,Curl convention; never uses array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,522,FP,Curl convention; never uses array-param syntax,curl_full_audit_0.4.35,high
INT14-C,curl,lib/doh.c,529,FP,DNS label-length mask/compare; readability advisory only,curl_full_audit_0.4.35,high
INT08-C,curl,lib/doh.c,538,FP,length<=255 added to bounded index; guarded by dohlen check,curl_full_audit_0.4.35,high
INT08-C,curl,lib/doh.c,540,FP,"1+length on unsigned char; promoted to int, bounded",curl_full_audit_0.4.35,high
INT14-C,curl,lib/doh.c,548,FP,16-bit assembly from bytes; idiomatic,curl_full_audit_0.4.35,high
INT14-C,curl,lib/doh.c,555,FP,doh is pointer increment; not bitwise/arith mix bug,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/doh.c,571,FP,"index validated by caller (dohlen>=index+rdlength), guarded store",curl_full_audit_0.4.35,high
ARR38-C,curl,lib/doh.c,583,FP,memcpy 16 into ip.v6 which is exactly 16 bytes,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/doh.c,583,FP,index bounds-checked by caller before doh_rdata,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/doh.c,594,FP,"h written through (h->val, h->len); not const-eligible",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/doh.c,595,FP,index bounds-checked by caller; len validated,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,605,FP,Curl convention; never uses array-param syntax,curl_full_audit_0.4.35,high
EXP40-C,curl,lib/doh.c,615,FP,dynbuf member assignment; const-correctness advisory only,curl_full_audit_0.4.35,high
INT14-C,curl,lib/doh.c,620,FP,DNS compression-pointer mask check; idiomatic,curl_full_audit_0.4.35,high
INT14-C,curl,lib/doh.c,623,FP,index arithmetic in bounds check; readability advisory,curl_full_audit_0.4.35,high
INT08-C,curl,lib/doh.c,627,FP,"14-bit offset assembly; promoted, bounded by dohlen",curl_full_audit_0.4.35,high
INT08-C,curl,lib/doh.c,641,FP,index+length compared to dohlen; bounds-checked,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,655,FP,Curl convention; never uses array-param syntax,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/doh.c,683,FP,rc assigned by doh_store_https before the if(rc) read,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/doh.c,705,FP,de is real struct dohentry*; sizeof(*de) correct,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,711,FP,Curl convention; never uses array-param syntax,curl_full_audit_0.4.35,high
INT08-C,curl,lib/doh.c,785,FP,index+rdlength compared to dohlen immediately; bounds-checked,curl_full_audit_0.4.35,high
INT08-C,curl,lib/doh.c,811,FP,index+rdlength bounds-checked against dohlen,curl_full_audit_0.4.35,high
INT08-C,curl,lib/doh.c,833,FP,index+rdlength bounds-checked against dohlen,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/doh.c,851,FP,return reached normally; not unreachable code,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/doh.c,869,FP,buffer is written through ptr in the loop; not const,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/doh.c,880,FP,ptr points into buffer[]; valid pointer arithmetic,curl_full_audit_0.4.35,high
STR34-C,curl,lib/doh.c,927,FP,strlen(hostname) on const char*; no sign-extension,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/doh.c,956,FP,(char*)ai+sizeof correct byte arithmetic; no double scaling,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/doh.c,957,FP,(char*)ai->ai_addr+ss_size correct byte arithmetic,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/doh.c,981,FP,de is real struct ptr; sizeof of member array is valid,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/doh.c,990,FP,de is real struct ptr; sizeof of member array is valid,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/doh.c,1005,FP,"*aip points to caller storage; firstai is heap, not local addr",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/doh.c,1036,FP,de_cleanup frees each https_rrs[i].val once in loop,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,1056,FP,Curl convention; never uses array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,1057,FP,Curl convention; never uses array-param syntax,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/doh.c,1086,FP,"rem is size_t, not a pointer; analyzer mislabel",curl_full_audit_0.4.35,high
INT08-C,curl,lib/doh.c,1086,FP,clen<=255 unsigned char; clen<rem checked just above,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/doh.c,1093,FP,*buf set to cp which points into caller's input buffer,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/doh.c,1094,FP,rem is size_t; not pointer arithmetic,curl_full_audit_0.4.35,high
STR34-C,curl,lib/doh.c,1095,FP,curlx_dyn_ptr returns char*; no sign-extension defect,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,1100,FP,Curl convention; never uses array-param syntax,curl_full_audit_0.4.35,high
API00-C,curl,lib/doh.c,1104,FP,Internal unittest fn; data used via getters that NULL-tolerate,curl_full_audit_0.4.35,high
API00-C,curl,lib/doh.c,1104,FP,cp from validated caller (de.https_rrs->val); internal fn,curl_full_audit_0.4.35,high
API05-C,curl,lib/doh.c,1105,FP,Curl convention; never uses array-param syntax,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/doh.c,1127,FP,dnsname set on CURLE_OK path before junkscan; non-null,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/doh.c,1150,FP,"*hrr set to heap lhrr, not address of local",curl_full_audit_0.4.35,high
MSC07-C,curl,lib/doh.c,1152,FP,"err: label reached via goto, not unreachable",curl_full_audit_0.4.35,high
API00-C,curl,lib/doh.c,1162,FP,Debug-only print fn; DEBUGASSERT(hrr) guards; data via infof,curl_full_audit_0.4.35,high
API00-C,curl,lib/doh.c,1162,FP,hrr guarded by DEBUGASSERT; debug-only function,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/doh.c,1166,FP,hrr asserted non-null at function entry (debug build),curl_full_audit_0.4.35,high
API00-C,curl,lib/doh.c,1199,FP,data is internal handle always valid; siblings don't check either,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/doh.c,1231,FP,Args are pure dynbuf getters on same body; no conflict,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/doh.c,1235,FP,TRC macro args are pure getters; no side-effect ordering bug,curl_full_audit_0.4.35,high
API00-C,curl,lib/doh.c,1297,FP,Internal teardown; data always valid handle,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/doh.c,1297,FP,Teardown cycle guarded by mid/state; not infinite recursion,curl_full_audit_0.4.35,high
API00-C,curl,lib/doh.c,1325,FP,Internal cleanup; data always valid handle,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/doh.c,1325,FP,Teardown cycle guarded by state nulling; not infinite recursion,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/doh.c,1334,FP,Curl_safefree frees+nulls async.doh once; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/doh.c,1334,FP,Single free of async.doh via safefree; not double-free/UAF,curl_full_audit_0.4.35,high
API01-C,curl,lib/smb.c,67,FP,"challenge[8] is fixed wire-protocol struct layout (packed SMB), not reorderable buffer",curl_full_audit_0.4.35,high
DCL40-C,curl,lib/smb.c,162,FP,sqc misparses PACK macro (__attribute__((packed))) as redeclared object; distinct structs,curl_full_audit_0.4.35,high
DCL38-C,curl,lib/smb.c,178,FP,char bytes[1] is intentional trailing array with GCC pragma; curl wire-format idiom,curl_full_audit_0.4.35,med
STR31-C,curl,lib/smb.c,178,FP,"bytes[1] is binary trailing member, not a string buffer; size deliberate",curl_full_audit_0.4.35,high
DCL40-C,curl,lib/smb.c,181,FP,PACK macro misparsed as object; struct andx distinct type,curl_full_audit_0.4.35,high
DCL40-C,curl,lib/smb.c,187,FP,PACK macro misparsed as object; distinct struct,curl_full_audit_0.4.35,high
DCL40-C,curl,lib/smb.c,201,FP,PACK macro misparsed as object; distinct struct,curl_full_audit_0.4.35,high
DCL40-C,curl,lib/smb.c,210,FP,PACK macro misparsed as object; distinct struct,curl_full_audit_0.4.35,high
DCL40-C,curl,lib/smb.c,229,FP,PACK macro misparsed as object; distinct struct,curl_full_audit_0.4.35,high
DCL40-C,curl,lib/smb.c,246,FP,PACK macro misparsed as object; distinct struct,curl_full_audit_0.4.35,high
DCL40-C,curl,lib/smb.c,259,FP,PACK macro misparsed as object; distinct struct,curl_full_audit_0.4.35,high
DCL40-C,curl,lib/smb.c,276,FP,PACK macro misparsed as object; distinct struct,curl_full_audit_0.4.35,high
DCL40-C,curl,lib/smb.c,283,FP,PACK macro misparsed as object; distinct struct,curl_full_audit_0.4.35,high
FIO50-C,curl,lib/smb.c,302,FP,"'x' is unsigned short int param in smb_swap16, not a FILE stream",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/smb.c,302,FP,duplicate; 'x' is integer not FILE stream,curl_full_audit_0.4.35,high
FIO50-C,curl,lib/smb.c,307,FP,"'x' is unsigned int param in smb_swap32, not a FILE stream",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/smb.c,307,FP,'x' is integer arg not a FILE stream,curl_full_audit_0.4.35,high
FIO50-C,curl,lib/smb.c,307,FP,duplicate; 'x' is integer not FILE stream,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/smb.c,328,FP,names[] sized by initializer list; implicit bounds idiomatic and safe,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/smb.c,349,FP,"Curl_meta_get returns void*; entry was originally allocated as smb_request, aligned",curl_full_audit_0.4.35,med
ARR02-C,curl,lib/smb.c,353,FP,names[] sized by initializer list; idiomatic,curl_full_audit_0.4.35,high
API05-C,curl,lib/smb.c,374,FP,curl never uses C99 conformant-array syntax; dtor signature fixed by callback typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smb.c,374,FP,smb_easy_dtor matches hash-dtor function-pointer typedef; const cannot be added,curl_full_audit_0.4.35,high
API05-C,curl,lib/smb.c,374,FP,conformant-array syntax not used in curl; callback signature fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/smb.c,385,FP,smb_conn_dtor signature fixed by callback typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smb.c,385,FP,dtor signature fixed by typedef; key param unused but const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/smb.c,385,FP,conformant-array syntax not used; callback signature fixed,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/smb.c,411,FP,Curl_urldecode returns CURLE_OK only with non-NULL path; result checked at 407,curl_full_audit_0.4.35,high
STR34-C,curl,lib/smb.c,430,FP,*slash++ = 0 stores constant 0 into char; no sign-extension into wider type,curl_full_audit_0.4.35,high
STR34-C,curl,lib/smb.c,435,FP,*slash = '\\' stores constant char; no signed-char read into wider type,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/smb.c,449,FP,smbc assigned from curlx_calloc at 449 and NULL-checked at 450 before use,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/smb.c,455,FP,req assigned from curlx_calloc at 455 and NULL-checked at 456 before use,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/smb.c,458,FP,"smbc/req registered via meta_set with dtors; freed by conn/easy cleanup, not leaked",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/smb.c,461,FP,smbc/req owned by meta registry with dtors; not stack-local leak,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smb.c,464,FP,"smb_connect matches connect_it vtable signature; const not addable, data is mutated indirectly",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smb.c,464,FP,done is out-param written elsewhere; vtable signature fixed,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/smb.c,485,FP,recv_buf/send_buf are smbc members freed by smb_conn_dtor; not a leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/smb.c,496,FP,smbc buffers freed by registered dtor; struct-member alloc not leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/smb.c,503,FP,smbc buffers freed by registered dtor; not leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/smb.c,506,FP,smbc buffers freed by registered dtor; not leak,curl_full_audit_0.4.35,high
INT30-C,curl,lib/smb.c,527,FP,"got+=bytes_read bounded; recv len=MAX_MESSAGE_SIZE-got, cannot exceed buffer/wrap",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/smb.c,561,FP,"buf points to smbc->recv_buf (heap), not a local; *msg outlives function validly",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smb.c,571,FP,smb_format_message reads smbc fields only; could be const but matches local-helper convention curl skips,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/smb.c,572,FP,req only read; curl does not const-qualify such helper params project-wide,curl_full_audit_0.4.35,med
EXP05-C,curl,lib/smb.c,578,FP,"memset(h,0,sizeof(*h)) has no cast away from const; sizeof misparsed as cast",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/smb.c,578,FP,"h is pointer to single smb_header object, not decayed array; sizeof(*h) correct",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/smb.c,579,FP,"h points to one struct; sizeof(*h) is intended struct size, not array decay",curl_full_audit_0.4.35,high
INT08-C,curl,lib/smb.c,579,FP,len bounded by MAX_MESSAGE_SIZE check in smb_send_message before this call; cast to ushort intentional wire field,curl_full_audit_0.4.35,high
API05-C,curl,lib/smb.c,637,FP,conformant-array syntax not used in curl; const void* msg idiomatic,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/smb.c,639,FP,integer size comparison (MAX_MESSAGE_SIZE - sizeof(header)) < msg_len; no pointer scaling,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/smb.c,663,FP,meta_get returns originally smb_conn-allocated block; alignment preserved,curl_full_audit_0.4.35,med
DCL22-C,curl,lib/smb.c,665,FP,"p is normal local pointer into msg.bytes; no volatile needed, no signal/setjmp",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/smb.c,665,FP,p = msg.bytes takes address of stack array; msg need not be initialized to take member address,curl_full_audit_0.4.35,high
INT32-C,curl,lib/smb.c,686,FP,sizeof(msg)-sizeof(msg.bytes) is positive compile-time constant; cannot overflow,curl_full_audit_0.4.35,high
STR30-C,curl,lib/smb.c,694,FP,"msg.lengths[0]=... writes a struct array member, not a string literal",curl_full_audit_0.4.35,high
STR30-C,curl,lib/smb.c,695,FP,"msg.lengths[1] assignment to struct member, not string literal",curl_full_audit_0.4.35,high
EXP05-C,curl,lib/smb.c,696,FP,"memcpy(p,lm,sizeof(lm)); p is char*, no const cast away",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/smb.c,697,FP,"p += sizeof(lm) advances char* by byte count of lm[24]; correct, not double scaling",curl_full_audit_0.4.35,high
EXP05-C,curl,lib/smb.c,698,FP,"memcpy(p,nt,...); no const qualifier cast away",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/smb.c,699,FP,p += sizeof(nt) advances char* by byte count; correct pointer arithmetic,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/smb.c,700,FP,p += msnprintf return (bytes written) on char*; not sizeof scaling,curl_full_audit_0.4.35,high
ERR02-C,curl,lib/smb.c,700,FP,curl_msnprintf cannot fail here (buffer pre-validated > byte_count); return is byte count,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/smb.c,720,FP,p = msg.bytes takes address of stack member; msg zeroed at 727 before content use,curl_full_audit_0.4.35,high
INT32-C,curl,lib/smb.c,727,FP,sizeof(msg)-sizeof(msg.bytes) compile-time positive constant,curl_full_audit_0.4.35,high
ERR02-C,curl,lib/smb.c,732,FP,"curl_msnprintf into validated buffer; return is byte count, not error-prone here",curl_full_audit_0.4.35,med
EXP33-C,curl,lib/smb.c,752,FP,msg is stack struct; byte_count from req->path; msg zeroed at 755 before use,curl_full_audit_0.4.35,high
INT32-C,curl,lib/smb.c,755,FP,sizeof(msg)-sizeof(msg.bytes) compile-time positive constant,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/smb.c,841,FP,"sizeof(*msg)-sizeof(msg->h)+upload_size is size_t length arg, not pointer scaling",curl_full_audit_0.4.35,high
INT30-C,curl,lib/smb.c,864,FP,"upload_size -= nread; nread capped at min(upload_size,MAX) so no underflow",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/smb.c,887,FP,meta_get returns originally smb_request-allocated block; alignment preserved,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/smb.c,901,FP,result assigned at 900 by Curl_conn_connect before use at 901 within same branch,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/smb.c,931,FP,sizeof(*nrsp) does not dereference nrsp; nrsp assigned at 936 before actual deref,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/smb.c,956,FP,no unreachable code; switch cases with break are normal control flow,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/smb.c,1002,FP,meta_get returns originally smb_request-allocated block; alignment preserved,curl_full_audit_0.4.35,med
ARR39-C,curl,lib/smb.c,1091,FP,(unsigned char*)msg + sizeof(header) + 11 is correct byte offset into received buffer,curl_full_audit_0.4.35,high
INT30-C,curl,lib/smb.c,1091,FP,constant small offset added to valid heap pointer; cannot wrap,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/smb.c,1093,FP,byte offset into received buffer; correct char pointer arithmetic,curl_full_audit_0.4.35,high
INT30-C,curl,lib/smb.c,1093,FP,constant small offset on valid pointer; no wrap,curl_full_audit_0.4.35,high
INT08-C,curl,lib/smb.c,1096,FP,off+sizeof(uint)+len computed in size_t (sizeof promotes); bounds-checked vs smbc->got,curl_full_audit_0.4.35,med
ARR39-C,curl,lib/smb.c,1102,FP,"(char*)msg + off + sizeof(uint) byte offset, bounds-checked at 1096; correct",curl_full_audit_0.4.35,high
INT08-C,curl,lib/smb.c,1102,FP,"off arithmetic in size_t, validated against got at 1096 before use",curl_full_audit_0.4.35,med
INT30-C,curl,lib/smb.c,1102,FP,"bounded offset on valid pointer; guarded by 1096 check, no wrap",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/smb.c,1120,FP,byte offset into received buffer with constant +5; correct char* arithmetic,curl_full_audit_0.4.35,high
INT30-C,curl,lib/smb.c,1120,FP,constant small offset on valid pointer; no wrap,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/smb.c,1149,FP,"'result' is CURLcode from smb_send_open, not a file descriptor; no open() call",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smb.c,1193,FP,"smb_do matches do_it vtable signature; data used to fetch conn/meta, const not addable",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/smb.c,1234,FP,Curl_scheme_smb has external linkage by design; referenced from scheme table in other TUs,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/smb.c,1234,FP,exported scheme descriptor must be file-scope/external; cannot be narrowed,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/smb.c,1250,FP,Curl_scheme_smbs exported by design; external linkage required,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/smb.c,1250,FP,exported scheme descriptor must remain file-scope/external,curl_full_audit_0.4.35,high
API05-C,curl,lib/mqtt.c,94,FP,Conformant-array-syntax style advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mqtt.c,94,FP,'key' param fixed by Curl_meta_dtor function-pointer typedef; const impossible.,curl_full_audit_0.4.35,high
API05-C,curl,lib/mqtt.c,94,FP,Conformant-array-syntax style advisory.,curl_full_audit_0.4.35,high
API05-C,curl,lib/mqtt.c,104,FP,Conformant-array-syntax style advisory.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mqtt.c,104,FP,'key' param fixed by dtor typedef; unused anyway.,curl_full_audit_0.4.35,high
API05-C,curl,lib/mqtt.c,104,FP,Conformant-array-syntax style advisory.,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/mqtt.c,118,FP,'mqtt' assigned by calloc on same line; the deref is the assignment use.,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/mqtt.c,125,FP,mqtt already owned by conn meta (dtor); meta_set frees on failure. No leak.,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/mqtt.c,129,FP,mq/mqtt are meta-managed; Curl_meta_set frees via dtor on failure.,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/mqtt.c,130,FP,Success path: ownership transferred to easy/conn meta. No leak.,curl_full_audit_0.4.35,high
API05-C,curl,lib/mqtt.c,134,FP,Conformant-array-syntax style advisory.,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/mqtt.c,138,FP,"Curl_meta_get returns void*, not char*; heap calloc is suitably aligned.",curl_full_audit_0.4.35,high
API05-C,curl,lib/mqtt.c,172,FP,Conformant-array-syntax style advisory.,curl_full_audit_0.4.35,high
API05-C,curl,lib/mqtt.c,189,FP,Conformant-array-syntax style advisory.,curl_full_audit_0.4.35,high
API05-C,curl,lib/mqtt.c,190,FP,Conformant-array-syntax style advisory.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,201,FP,'start' is internally computed offset into correctly sized calloc buffer.,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/mqtt.c,203,FP,memcpy dest &pkt[start+2]; pkt is non-const char*. No cast away const.,curl_full_audit_0.4.35,high
API05-C,curl,lib/mqtt.c,208,FP,Conformant-array-syntax style advisory.,curl_full_audit_0.4.35,high
API05-C,curl,lib/mqtt.c,209,FP,Conformant-array-syntax style advisory.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,219,FP,'start' internally computed offset into sized buffer.,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/mqtt.c,221,FP,pkt non-const; no const cast-away in memcpy dest.,curl_full_audit_0.4.35,high
API05-C,curl,lib/mqtt.c,226,FP,Conformant-array-syntax style advisory.,curl_full_audit_0.4.35,high
API05-C,curl,lib/mqtt.c,227,FP,Conformant-array-syntax style advisory.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,231,FP,'start' internally computed; buffer sized to fit client id.,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/mqtt.c,233,FP,pkt non-const; no const cast-away.,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/mqtt.c,244,FP,memcpy remain_pos<=4 into packet[1..]; sized via packetlen. In bounds.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,250,FP,Wrong buffer attribution: conflated with packet[2] at line814; here sized packetlen.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,252,FP,Misattributed buffer size 2; packet is calloc(packetlen).,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,253,FP,Misattributed buffer size 2; packet sized to fit header.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,254,FP,Misattributed buffer size 2.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,255,FP,Misattributed buffer size 2.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,257,FP,Misattributed buffer size 2.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,259,FP,Misattributed buffer size 2.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,261,FP,Misattributed buffer size 2.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,262,FP,Misattributed buffer size 2.,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/mqtt.c,278,FP,client_id is modified by Curl_rand_alnum write; cannot be const.,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/mqtt.c,278,FP,"MQTT_CLIENTID_LEN is #define constant; fixed-size array, not VLA.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mqtt.c,284,FP,Line is strlen(username); no char-to-int conversion present.,curl_full_audit_0.4.35,high
MEM03-C,curl,lib/mqtt.c,286,FP,"'passwd' is const char* alias of aptr.passwd, not a clearable local buffer.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mqtt.c,287,FP,Line is strlen(passwd); no signed-char widening.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/mqtt.c,354,FP,Curl_safefree nulls then frees aptr.user once; not a UAF.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/mqtt.c,354,FP,safefree of distinct member; no use after free.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/mqtt.c,355,FP,"safefree of aptr.passwd, distinct member; not UAF.",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/mqtt.c,355,FP,safefree nulls arg; no double-free or UAF.,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/mqtt.c,366,FP,void* meta_get assigned to struct*; heap alloc aligned.,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/mqtt.c,391,FP,void* meta_get to struct*; aligned heap.,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/mqtt.c,404,FP,void* meta_get to struct*; aligned heap.,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/mqtt.c,426,FP,ptr=dyn_ptr after DEBUGASSERT/recv_atleast guaranteeing >=CONNACK_LEN; non-NULL.,curl_full_audit_0.4.35,high
API05-C,curl,lib/mqtt.c,437,FP,Conformant-array-syntax style advisory.,curl_full_audit_0.4.35,high
DCL22-C,curl,lib/mqtt.c,459,FP,No setjmp/longjmp context; volatile not required.,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/mqtt.c,475,FP,topiclen set via &topiclen out-param of mqtt_get_topic before use.,curl_full_audit_0.4.35,high
INT14-C,curl,lib/mqtt.c,475,FP,Readability advisory on length shift; benign.,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/mqtt.c,477,FP,encodedsize is char[4] written by mqtt_encode_len; not read uninit.,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/mqtt.c,487,FP,'n' is size_t arg to memcpy; no const cast-away.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,489,FP,Misattributed size-2 buffer; packet is malloc(packetlen).,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,490,FP,Misattributed size-2 buffer; packet sized packetlen.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,491,FP,Misattributed size-2 buffer.,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/mqtt.c,492,FP,&packet[5+n] memcpy dest; packet non-const. No cast-away.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mqtt.c,492,FP,Misattributed size-2 buffer; packet sized topiclen+5+n+1.,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/mqtt.c,492,FP,topic non-NULL when result==0 from mqtt_get_topic (urldecode succeeded).,curl_full_audit_0.4.35,med
MSC37-C,curl,lib/mqtt.c,506,FP,All paths set result and reach 'fail: return result'.,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/mqtt.c,508,FP,void* meta_get to struct*; aligned heap.,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/mqtt.c,532,FP,ptr=dyn_ptr after recv_atleast/DEBUGASSERT >= SUBACK_LEN; non-NULL.,curl_full_audit_0.4.35,high
DCL22-C,curl,lib/mqtt.c,554,FP,No setjmp context; volatile unnecessary for 'i'.,curl_full_audit_0.4.35,high
INT14-C,curl,lib/mqtt.c,574,FP,Readability advisory on topiclen shift; benign.,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/mqtt.c,574,FP,topiclen set by mqtt_get_topic out-param before use.,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/mqtt.c,594,FP,topic non-NULL when mqtt_get_topic returned success.,curl_full_audit_0.4.35,med
ARR38-C,curl,lib/mqtt.c,596,FP,pkt sized remaininglength+1+encodelen >= payloadlen offset; memcpy in bounds.,curl_full_audit_0.4.35,high
API05-C,curl,lib/mqtt.c,607,FP,Conformant-array-syntax style advisory.,curl_full_audit_0.4.35,high
INT14-C,curl,lib/mqtt.c,615,FP,Readability advisory on decode bitwise/arith; benign.,curl_full_audit_0.4.35,high
INT08-C,curl,lib/mqtt.c,619,FP,(encoded&127)*mult promoted to size_t; bounded by MQTT 4-byte cap. No overflow.,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/mqtt.c,628,FP,statenames[] initializer-sized array (debug only); idiomatic.,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/mqtt.c,662,FP,Switch has default; all paths reach 'end: return result'.,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/mqtt.c,669,FP,void* meta_get to struct*; aligned heap.,curl_full_audit_0.4.35,high
DCL41-C,curl,lib/mqtt.c,677,FP,Intentional goto-label before first case (legal C); not a stray statement.,curl_full_audit_0.4.35,med
MEM05-C,curl,lib/mqtt.c,722,FP,"buffer[4*1024] is constant-sized array, not VLA.",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/mqtt.c,733,FP,nread is out-param of Curl_xfer_recv; set before read (error returns first).,curl_full_audit_0.4.35,high
INT30-C,curl,lib/mqtt.c,747,FP,nread<=rest<=npacket (recv capped to mq->npacket); subtraction cannot underflow.,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/mqtt.c,764,FP,void* meta_get to struct*; aligned heap.,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/mqtt.c,785,FP,void* meta_get to struct*; aligned heap.,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/mqtt.c,798,FP,void* meta_get to struct*; aligned heap.,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/mqtt.c,829,FP,void* meta_get to struct*; aligned heap.,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/mqtt.c,842,FP,dyn_ptr and dyn_len are pure reads of same buffer; no unsequenced side effects.,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/mqtt.c,877,FP,nread out-param of Curl_xfer_recv; loop breaks before use on error.,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/mqtt.c,1015,FP,"Curl_scheme_mqtts is exported, referenced in scheme table elsewhere; needs extern linkage.",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/mqtt.c,1015,FP,Exported scheme symbol; cannot be function-local.,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/mqtt.c,1032,FP,Curl_scheme_mqtt exported symbol; needs external linkage.,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/mqtt.c,1032,FP,Exported scheme symbol; cannot be function-local.,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,32,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,32,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,32,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,33,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,33,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_libinfo.c,33,FP,"Pointer (const char*) assignment, not a signed-char read; no sign extension",curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,35,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,35,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,35,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,37,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,37,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,38,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,38,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,39,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,39,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,40,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,40,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,41,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,41,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,42,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,42,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,43,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,43,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,44,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,44,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,45,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,45,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_libinfo.c,54,FP,"NULL-terminated table initializer; idiomatic, size inferred correctly",curl_full_audit_0.4.35,med
CON03-C,curl,src/tool_libinfo.c,67,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,67,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,67,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,68,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,68,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,68,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,69,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,69,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,69,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,70,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,70,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,70,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,71,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,71,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,71,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,72,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,72,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,72,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,73,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,73,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,73,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,74,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,74,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,74,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,75,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,75,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,75,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,76,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,76,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,76,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,77,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,77,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,77,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,78,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,78,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,78,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,79,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,79,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,79,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,80,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,80,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,80,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,81,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,81,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,81,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_libinfo.c,82,FP,"CLI startup module, single-threaded init; globals not thread-shared",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,82,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,82,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_libinfo.c,88,FP,"NULL-terminated table initializer; idiomatic, size inferred correctly",curl_full_audit_0.4.35,med
MEM05-C,curl,src/tool_libinfo.c,123,FP,"fnames sized by CURL_ARRAYSIZE compile-time constant, not a VLA",curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_libinfo.c,124,FP,Declared extern in tool_libinfo.h; intentional external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,src/tool_libinfo.c,124,FP,Program-wide global used by proto_token and tool; cannot narrow scope,curl_full_audit_0.4.35,high
CON07-C,curl,src/tool_libinfo.c,136,FP,get_libcurl_info runs once at single-threaded startup; no concurrency,curl_full_audit_0.4.35,high
MEM33-C,curl,src/tool_libinfo.c,155,FP,Plain pointer assignment (*tokenp = *builtin); no flexible array member,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_libinfo.c,155,FP,"Pointer (const char*) assignment, not a signed-char read; no sign extension",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_libinfo.c,155,FP,"Pointer (const char*) assignment, not a signed-char read; no sign extension",curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_libinfo.c,165,FP,p assigned in for-init (p=maybe_feature) before any use; not uninitialized,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_libinfo.c,170,FP,"Pointer (const char*) assignment, not a signed-char read; no sign extension",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_libinfo.c,171,FP,"Pointer (const char*) assignment, not a signed-char read; no sign extension",curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_libinfo.c,188,FP,Idiomatic !strncmp boolean test for feature detection,curl_full_audit_0.4.35,high
API05-C,curl,lib/cookie.c,73,FP,curl never uses C99 array-param syntax; advisory style,curl_full_audit_0.4.35,high
API05-C,curl,lib/cookie.c,75,FP,conformant-array advisory; curl convention does not use it,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cookie.c,77,FP,strlen(hostname) takes const char*; no signed-char promotion bug,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/cookie.c,106,FP,pathmatch always returns via ret; all paths covered,curl_full_audit_0.4.35,high
API05-C,curl,lib/cookie.c,161,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/cookie.c,190,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/cookie.c,193,FP,h is mutated in loop (h += h<<5; h^=j); not const-able,curl_full_audit_0.4.35,med
STR34-C,curl,lib/cookie.c,196,FP,"Curl_raw_toupper(*domain) handles char; idiomatic, no sign bug",curl_full_audit_0.4.35,med
STR34-C,curl,lib/cookie.c,196,FP,same Curl_raw_toupper call; macro handles signedness,curl_full_audit_0.4.35,med
INT14-C,curl,lib/cookie.c,197,FP,DJB2 hash; bitwise+arithmetic on h is intentional idiom,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cookie.c,220,FP,len filled by get_top_domain via &len (init 0 in callee),curl_full_audit_0.4.35,high
API05-C,curl,lib/cookie.c,226,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cookie.c,229,FP,len guarded (len &&) before cookie_path[0] deref; caller passes valid,curl_full_audit_0.4.35,high
API05-C,curl,lib/cookie.c,259,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/cookie.c,259,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cookie.c,266,FP,curlx_memdup0 takes void*/char*; no signed-char widening,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/cookie.c,284,FP,"time(NULL) for cookie expiry; (time_t)-1 harmless, not security-relevant",curl_full_audit_0.4.35,med
DCL00-C,curl,lib/cookie.c,303,FP,e reassigned in loop (e=Curl_node_next); cannot be const,curl_full_audit_0.4.35,high
API05-C,curl,lib/cookie.c,327,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cookie.c,335,FP,dot-domain is pointer subtraction (dot-domain); no char widening,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cookie.c,335,FP,"pointer arithmetic on domain, not signed-char conversion",curl_full_audit_0.4.35,high
API05-C,curl,lib/cookie.c,354,FP,conformant-array advisory; curl convention,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cookie.c,385,FP,curlx_str/curlx_strlen are pure accessors; no unsequenced side effects,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cookie.c,388,FP,pure accessor args; no shared mutation,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cookie.c,413,FP,pure accessor args; no shared mutation,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cookie.c,430,FP,co written via storecookie (co->name etc); not const-able,curl_full_audit_0.4.35,med
STR34-C,curl,lib/cookie.c,442,FP,strlen(ptr) on const char*; no signed-char widening,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cookie.c,473,FP,"invalid_octets reads only; pure accessor args, no unsequenced UB",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cookie.c,474,FP,pure accessor args; no shared mutation,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cookie.c,488,FP,infof variadic args are pure curlx_strlen reads,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cookie.c,495,FP,memchr/curlx_str/curlx_strlen pure reads; no UB,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cookie.c,501,FP,!strncmp prefix idiom; conventional and clear,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cookie.c,503,FP,!strncmp prefix idiom; conventional,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cookie.c,550,FP,bad_domain reads only; pure accessor args,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cookie.c,558,FP,!strncmp comparison idiom; clear,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cookie.c,558,FP,strncmp args are pure reads; no unsequenced mutation,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cookie.c,560,FP,cookie_tailmatch pure-read args; no UB,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/cookie.c,593,FP,"time(NULL) for cookie max-age base; -1 harmless, not security path",curl_full_audit_0.4.35,med
ENV01-C,curl,lib/cookie.c,623,FP,dbuf sized to MAX_DATE_LENGTH; val len guarded <MAX_DATE_LENGTH at 616; no env var,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/cookie.c,623,FP,"dbuf is fixed-size [MAX_DATE_LENGTH+1], not a VLA",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cookie.c,625,FP,memcpy args pure reads (curlx_str/curlx_strlen),curl_full_audit_0.4.35,high
ERR33-C,curl,lib/cookie.c,635,FP,"time(NULL) expiry base; -1 harmless, not checked-return-critical",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cookie.c,651,FP,"ci->running read; co written through; parse_netscape mutates co not ci, but signature shared",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cookie.c,775,FP,"co read for PSL; tied to caller pattern, low value; not actionable",curl_full_audit_0.4.35,med
EXP34-C,curl,lib/cookie.c,790,FP,domain guarded non-NULL at 786 (domain && ...) before strlen,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cookie.c,790,FP,strlen(domain) on const char*; no signed-char widening,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cookie.c,834,FP,!strcmp name-equality idiom; conventional,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cookie.c,875,FP,!strcmp name-equality idiom; conventional,curl_full_audit_0.4.35,high
API00-C,curl,lib/cookie.c,934,FP,ci always non-NULL (DEBUGASSERT data; caller inits ci); internal API,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/cookie.c,959,FP,sizeof(comem) misparsed as cast; memset has no const cast-away,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/cookie.c,979,FP,intentional empty-then/else-goto idiom for __Host- validation; commented logic,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cookie.c,979,FP,"!strcmp path==""/"" idiom; conventional",curl_full_audit_0.4.35,high
MSC07-C,curl,lib/cookie.c,1042,FP,fail: label reached via goto; not unreachable,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cookie.c,1104,FP,"!strcmp(file,""-"") stdin idiom; conventional",curl_full_audit_0.4.35,high
FIO42-C,curl,lib/cookie.c,1107,FP,fp assigned to handle; handle closed via curlx_fclose at 1146,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/cookie.c,1107,FP,fopen not open(); duplicate; handle closed at 1146,curl_full_audit_0.4.35,high
API00-C,curl,lib/cookie.c,1234,FP,"conn->scheme deref; internal fn, conn guaranteed by callers; idiomatic",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cookie.c,1234,TP,conn only read (conn->scheme->protocol); could be const struct connectdata*,curl_full_audit_0.4.35,low
EXP20-C,curl,lib/cookie.c,1238,FP,!strcmp host loopback idiom; conventional,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cookie.c,1239,FP,"!strcmp host ""::1"" idiom; conventional",curl_full_audit_0.4.35,high
API00-C,curl,lib/cookie.c,1253,FP,data deref internal; callers guarantee non-NULL; idiomatic,curl_full_audit_0.4.35,high
API00-C,curl,lib/cookie.c,1253,FP,conn passed to Curl_secure_context; caller-guaranteed; internal,curl_full_audit_0.4.35,high
API00-C,curl,lib/cookie.c,1253,FP,host used by cookiehash which NULL-checks; internal API,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cookie.c,1261,FP,cookiehash(host) on const char*; no signed-char widening,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/cookie.c,1350,FP,fail: label reached via goto fail at 1327; not unreachable,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/cookie.c,1368,FP,"c is a pointer used as element handle; const adds no value, sqc misreads",curl_full_audit_0.4.35,high
DCL00-C,curl,lib/cookie.c,1369,FP,e reassigned (n=e) in loop; not const-able,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/cookie.c,1393,FP,e reassigned (n=e) in loop; not const-able,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/cookie.c,1477,FP,"!strcmp(""-"",filename) stdout idiom; conventional",curl_full_audit_0.4.35,high
FIO42-C,curl,lib/cookie.c,1483,FP,out closed via curlx_fclose at 1532 and in error block at 1550,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/cookie.c,1483,FP,Curl_fopen not open(); duplicate; out closed on all paths,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/cookie.c,1488,FP,"adjacent string-literal concatenation, no preprocessor directive in args",curl_full_audit_0.4.35,high
PRE32-C,curl,lib/cookie.c,1488,FP,string concatenation misread as directive; no UB,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cookie.c,1491,FP,out is stdout or Curl_fopen result checked (error goto) before fputs,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cookie.c,1528,FP,1520 free is followed by goto error skipping 1528; no double free,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cookie.c,1528,FP,distinct paths; 1520 goto error bypasses 1528 normal free,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/cookie.c,1546,FP,"success path; tempstore freed at 1545, array already freed; no leak",curl_full_audit_0.4.35,high
MSC07-C,curl,lib/cookie.c,1548,FP,error: label reached via goto error; not unreachable,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cookie.c,1552,FP,unlink(tempstore) before free; tempstore not yet freed; no UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cookie.c,1553,FP,single free of tempstore in error block; no double free,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cookie.c,1553,FP,single free in error path; success path frees at 1545; mutually exclusive,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/cookie.c,1555,FP,error path frees tempstore+array; out closed at 1550; no leak,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/cookie.c,1574,FP,"c is element-handle pointer used for fields; sqc misread, not const-worthy",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cookie.c,1575,FP,line assigned at 1578 before use at 1579; not uninitialized,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/cookie.c,1602,FP,"returns pointer VALUE list (heap slist), not address of local",curl_full_audit_0.4.35,high
API00-C,curl,lib/cookie.c,1630,FP,"data deref under lock; internal fn, caller-guaranteed non-NULL",curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.c,67,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,76,FP,data only passed to Curl_pgrs_now; internal caller always provides valid data,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/vquic/vquic.c,88,FP,getenv return p IS checked: if(p) before use,curl_full_audit_0.4.35,high
CON34-C,curl,lib/vquic/vquic.c,88,FP,DEBUGBUILD-only one-shot init; not a real threading hazard,curl_full_audit_0.4.35,med
ENV30-C,curl,lib/vquic/vquic.c,91,FP,"curlx_str_number advances a const-ptr copy, does not modify env string",curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,106,FP,internal setter; pnow always valid from Curl_pgrs_now,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,112,FP,internal setter; pnow always valid,curl_full_audit_0.4.35,high
API02-C,curl,lib/vquic/vquic.c,118,FP,pkt already has explicit pktlen size param; advisory style,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.c,121,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/vquic/vquic.c,124,FP,"bounded one-level fallback no-GSO retry, not unbounded recursion",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vquic/vquic.c,124,FP,all paths reach out: return result; both ifdef arms return,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.c,127,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL39-C,curl,lib/vquic/vquic.c,162,FP,"sendmsg is kernel syscall, not a curl trust-boundary leak; struct msghdr standard",curl_full_audit_0.4.35,med
MSC07-C,curl,lib/vquic/vquic.c,172,FP,"case label after return is reachable via switch, not dead code",curl_full_audit_0.4.35,high
MSC04-C,curl,lib/vquic/vquic.c,236,FP,bounded one-level GSO-failure fallback; terminates,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.c,239,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vquic/vquic.c,245,FP,"VERBOSE(size_t calls=0) macro expansion; type present, sqc cannot expand",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/vquic.c,254,FP,sent written by do_sendmsg(*psent=0) on every path before read at 254,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.c,267,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,297,FP,cf deref via internal callers always valid; cfilter pattern,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/vquic.c,316,FP,sent set to 0 in do_sendmsg before CURLE_AGAIN return; always written,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,329,FP,thin wrapper to vquic_flush; internal cfilter caller valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,329,FP,data not dereffed here; passed through to flush,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,336,FP,internal cfilter caller always provides cf,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,336,FP,data passed through to flush; internal valid,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,336,FP,tail_len is a length subtracted from bufq_len guarded by DEBUGASSERT; no overflow,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vquic/vquic.c,352,FP,gso_size is reassigned via memcpy in loop; not const-able,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vquic/vquic.c,382,FP,"qctx->sockfd read but struct mutated elsewhere; signature shared, callback family",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/vquic.c,384,FP,recv_cb is function pointer typedef; const not applicable,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.c,384,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vquic/vquic.c,396,FP,size bounded by MMSG_NUM*CMSG_SPACE macro constants; small fixed stack,curl_full_audit_0.4.35,med
ARR32-C,curl,lib/vquic/vquic.c,396,FP,size is macro-constant bounded (16/64 * small); not runtime-attacker-controlled,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/vquic/vquic.c,418,FP,"msg_iov[i] is being WRITTEN here, not read",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vquic/vquic.c,420,FP,mmsg memset at 416 then fields written; not uninitialized read,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/vquic.c,420,FP,msg_iov[i] assigned at 418 before address-taken at 420,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vquic/vquic.c,422,FP,"remote_addr[i] address taken to fill via recvmmsg; out-param, write not read",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/vquic.c,422,FP,remote_addr filled by recvmmsg kernel; out-param,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vquic/vquic.c,423,FP,"sizeof(remote_addr[i]) only reads size, not contents",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vquic/vquic.c,424,FP,msg_ctrl address taken as out-buffer for recvmmsg; write not read,curl_full_audit_0.4.35,high
INT18-C,curl,lib/vquic/vquic.c,428,FP,"mcount is int (signed); comparison to -1 is correct, not unsigned",curl_full_audit_0.4.35,high
INT18-C,curl,lib/vquic/vquic.c,431,FP,mcount is signed int; ==-1 valid,curl_full_audit_0.4.35,high
FLP03-C,curl,lib/vquic/vquic.c,467,FP,"integer division on size_t, not floating-point",curl_full_audit_0.4.35,high
INT33-C,curl,lib/vquic/vquic.c,467,FP,gso_size forced nonzero at 459-460 (=msg_len>0 guaranteed by 454 continue),curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/vquic.c,482,FP,qctx struct accessed/mutated; shared recv signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/vquic.c,484,FP,recv_cb is function pointer; const N/A,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.c,484,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vquic/vquic.c,488,FP,"buf[64*1024] is fixed-size array, not a VLA",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vquic/vquic.c,495,FP,"msg_ctrl[CMSG_SPACE(sizeof(int))] macro-constant size, not runtime VLA",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vquic/vquic.c,562,FP,qctx accessed via shared recv signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/vquic.c,564,FP,recv_cb function pointer; const N/A,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.c,564,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vquic/vquic.c,566,FP,"buf[64*1024] fixed-size array, not VLA",curl_full_audit_0.4.35,high
INT18-C,curl,lib/vquic/vquic.c,577,FP,rv is ssize_t (signed); ==-1 comparison correct,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,624,FP,"thin dispatch wrapper; data passed through, valid from caller",curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,624,FP,recv_cb passed through to impl; not dereffed here,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.c,628,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,656,FP,data->set.new_file_perms used but caller always valid; internal API,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,656,FP,scid read in loop guarded by scidlen; caller provides valid scid,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vquic/vquic.c,656,FP,data->set.new_file_perms read; data not const-able (struct fields read),curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.c,657,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/vquic.c,657,TP,scid only read (scid[i]); could be const unsigned char*; minor,curl_full_audit_0.4.35,low
API05-C,curl,lib/vquic/vquic.c,659,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/vquic/vquic.c,680,FP,"qlogfd intentionally returned via *qlogfdp; not leaked, caller owns fd",curl_full_audit_0.4.35,high
ENV30-C,curl,lib/vquic/vquic.c,691,FP,qlog_dir from curl_getenv is heap copy; curlx_free is correct,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,699,FP,dispatch wrapper; pcf passed through to impl,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,699,FP,data passed through; not dereffed in wrapper,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,699,FP,conn passed through to impl,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,699,FP,ai passed through to impl,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vquic/vquic.c,699,FP,every #if/#elif/#else arm returns; sqc not expanding preprocessor,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,747,FP,error_code compared to bounds; switch on it; no unguarded arithmetic,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.c,798,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/vquic.c,798,FP,ngtcp2_mem allocator signature fixed by external typedef; const N/A,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/vquic.c,804,FP,ngtcp2 free callback signature fixed by typedef; const N/A,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.c,810,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/vquic.c,810,FP,calloc callback signature fixed by ngtcp2 typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.c,816,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/vquic.c,816,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/vquic.c,816,FP,realloc callback signature fixed by ngtcp2 typedef,curl_full_audit_0.4.35,high
CON03-C,curl,lib/vquic/vquic.c,823,FP,vquic_ngtcp2_mem is immutable static allocator table; read-only after init,curl_full_audit_0.4.35,high
CON03-C,curl,lib/vquic/vquic.c,837,FP,vquic_nghttp3_mem is immutable static allocator table,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/vquic.c,854,FP,"stub impl; data only used in DEBUGF infof, all params (void)-cast",curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_getparam.c,31,FP,8-char header-name collision advisory; modern fs,curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_getparam.c,34,FP,8-char header-name collision advisory; modern fs,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,47,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,48,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,54,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,54,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_getparam.c,61,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_getparam.c,61,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,65,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,66,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,72,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_getparam.c,80,FP,initializer-sized const table; implicit bounds idiomatic,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,387,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,392,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,393,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,405,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,405,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,411,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_getparam.c,417,FP,"out-param assigned heap/strdup ptr (getstr), not local addr",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,417,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_getparam.c,419,FP,NUL-terminated string walk; bounded by '\0',curl_full_audit_0.4.35,high
EXP43-C,curl,src/tool_getparam.c,421,FP,memcpy src/dst from distinct buffers (param vs malloc); non-overlapping,curl_full_audit_0.4.35,high
CON43-C,curl,src/tool_getparam.c,426,FP,single-threaded CLI parse; switch on *ptr not concurrent double-fetch,curl_full_audit_0.4.35,high
CON43-C,curl,src/tool_getparam.c,431,FP,single-threaded CLI parse; switch on *ptr not concurrent double-fetch,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,433,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,436,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,440,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,444,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
MEM33-C,curl,src/tool_getparam.c,445,FP,"plain char writes via pointer, not flexible-array-struct assign",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,445,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,445,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,445,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,464,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,473,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,473,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,485,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,492,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,525,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_getparam.c,526,FP,"out-param assigned heap/strdup ptr (getstr), not local addr",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,526,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,528,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_getparam.c,529,FP,"out-param assigned heap/strdup ptr (getstr), not local addr",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,529,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_getparam.c,543,FP,initializer-sized const table; implicit bounds idiomatic,curl_full_audit_0.4.35,high
STR00-C,curl,src/tool_getparam.c,553,FP,char masked with 0x20 for case-fold; idiomatic,curl_full_audit_0.4.35,high
INT07-C,curl,src/tool_getparam.c,583,FP,plain char in numeric op; idiomatic ASCII handling,curl_full_audit_0.4.35,high
INT14-C,curl,src/tool_getparam.c,583,FP,bit/arith mix on size unit char; readability advisory,curl_full_audit_0.4.35,high
INT07-C,curl,src/tool_getparam.c,588,FP,plain char in numeric op; idiomatic ASCII handling,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_getparam.c,612,FP,"'mul' init=1, only set to nonzero su->mul; never zero",curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_getparam.c,618,FP,"'mul' init=1, only set to nonzero su->mul; never zero",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,632,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
MSC37-C,curl,src/tool_getparam.c,644,FP,switch covers all enum cases / returns in all arms,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_getparam.c,644,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_getparam.c,645,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,665,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,665,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
INT07-C,curl,src/tool_getparam.c,670,FP,plain char in numeric op; idiomatic ASCII handling,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_getparam.c,676,FP,idiomatic !strcmp boolean test in option dispatch,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_getparam.c,681,FP,FILE* closed via curlx_fclose guarded by file!=stdin,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_getparam.c,681,FP,FILE* closed via curlx_fclose guarded by file!=stdin,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_getparam.c,699,FP,postdata non-NULL after !p guard / alloc-then-use; safe,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,705,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
INT31-C,curl,src/tool_getparam.c,711,FP,"(int)size from escaped len, bounded MAX_DATAURLENCODE",curl_full_audit_0.4.35,med
DCL30-C,curl,src/tool_getparam.c,738,FP,"out-param assigned heap/strdup ptr (getstr), not local addr",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,738,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
MSC07-C,curl,src/tool_getparam.c,741,FP,defensive break/return after switch arm; harmless,curl_full_audit_0.4.35,med
MSC37-C,curl,src/tool_getparam.c,754,FP,switch covers all enum cases / returns in all arms,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_getparam.c,760,FP,NUL-terminated string walk; bounded by '\0',curl_full_audit_0.4.35,high
CON43-C,curl,src/tool_getparam.c,769,FP,single-threaded CLI parse; switch on *ptr not concurrent double-fetch,curl_full_audit_0.4.35,high
MEM05-C,curl,src/tool_getparam.c,830,FP,"fixed-size stack array, not a VLA",curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_getparam.c,831,FP,singles_done static in single-threaded CLI init,curl_full_audit_0.4.35,high
INT08-C,curl,src/tool_getparam.c,840,FP,"'l' is alias-table index byte, bounded; no overflow",curl_full_audit_0.4.35,high
INT07-C,curl,src/tool_getparam.c,845,FP,plain char in numeric op; idiomatic ASCII handling,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_getparam.c,853,FP,initializer-sized const table; implicit bounds idiomatic,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,906,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,916,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,920,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_getparam.c,949,FP,idiomatic !strcmp boolean test in option dispatch,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_getparam.c,955,FP,FILE* closed via curlx_fclose guarded by file!=stdin,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_getparam.c,955,FP,FILE* closed via curlx_fclose guarded by file!=stdin,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,980,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
CON43-C,curl,src/tool_getparam.c,1037,FP,single-threaded CLI parse; switch on *ptr not concurrent double-fetch,curl_full_audit_0.4.35,high
EXP15-C,curl,src/tool_getparam.c,1065,FP,intentional empty if(err); arm of if/else chain in set_rate,curl_full_audit_0.4.35,high
ARR01-C,curl,src/tool_getparam.c,1081,FP,"CURL_ARRAYSIZE on real array in scope, not decayed param",curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_getparam.c,1136,FP,idiomatic !strcmp boolean test in option dispatch,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_getparam.c,1142,FP,FILE* closed via curlx_fclose guarded by file!=stdin,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_getparam.c,1142,FP,FILE* closed via curlx_fclose guarded by file!=stdin,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_getparam.c,1249,FP,idiomatic !strcmp boolean test in option dispatch,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_getparam.c,1253,FP,FILE* closed via curlx_fclose guarded by file!=stdin,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_getparam.c,1253,FP,FILE* closed via curlx_fclose guarded by file!=stdin,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_getparam.c,1266,FP,tmpcfg guarded: file2string err returns before use,curl_full_audit_0.4.35,med
DCL31-C,curl,src/tool_getparam.c,1267,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_getparam.c,1288,FP,idiomatic !strcmp boolean test in option dispatch,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_getparam.c,1289,FP,FILE* closed via curlx_fclose guarded by file!=stdin,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,1451,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,1452,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,1453,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_getparam.c,1458,FP,NUL-terminated string walk; bounded by '\0',curl_full_audit_0.4.35,high
STR30-C,curl,src/tool_getparam.c,1521,FP,set_trace_config takes const char*; literal not modified,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_getparam.c,1526,FP,verbose_nopts file-static zero-init by C rules,curl_full_audit_0.4.35,high
STR30-C,curl,src/tool_getparam.c,1529,FP,set_trace_config takes const char*; literal not modified,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,1536,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,1537,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,1538,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,1541,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,1541,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
STR30-C,curl,src/tool_getparam.c,1548,FP,set_trace_config takes const char*; literal not modified,curl_full_audit_0.4.35,high
STR30-C,curl,src/tool_getparam.c,1554,FP,set_trace_config takes const char*; literal not modified,curl_full_audit_0.4.35,high
STR30-C,curl,src/tool_getparam.c,1559,FP,set_trace_config takes const char*; literal not modified,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_getparam.c,1581,FP,idiomatic !strcmp boolean test in option dispatch,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_getparam.c,1587,FP,FILE* closed via curlx_fclose guarded by file!=stdin,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_getparam.c,1587,FP,FILE* closed via curlx_fclose guarded by file!=stdin,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,1594,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,1599,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
CON43-C,curl,src/tool_getparam.c,1613,FP,single-threaded CLI parse; switch on *ptr not concurrent double-fetch,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,1636,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_getparam.c,1639,FP,value set by getfiletime before use under !rc,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_getparam.c,1657,FP,initializer-sized const table; implicit bounds idiomatic,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_getparam.c,1671,FP,NUL-terminated string walk; bounded by '\0',curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_getparam.c,1688,FP,idiomatic !strcmp boolean test in option dispatch,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_getparam.c,1725,FP,'a' NULL-checked at dispatch (2943/2985) before deref,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_getparam.c,1745,FP,'a' NULL-checked at dispatch (2943/2985) before deref,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_getparam.c,1825,FP,'a' NULL-checked at dispatch (2943/2985) before deref,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_getparam.c,2214,FP,'a' NULL-checked at dispatch (2943/2985) before deref,curl_full_audit_0.4.35,high
MSC04-C,curl,src/tool_getparam.c,2221,FP,config-file recursion bounded by max_recursive counter,curl_full_audit_0.4.35,med
EXP34-C,curl,src/tool_getparam.c,2231,FP,'a' NULL-checked at dispatch (2943/2985) before deref,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_getparam.c,2349,FP,initializer-sized const table; implicit bounds idiomatic,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_getparam.c,2359,FP,'a' NULL-checked at dispatch (2943/2985) before deref,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2387,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2395,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2402,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2415,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
DCL18-C,curl,src/tool_getparam.c,2415,FP,0777 intentional octal file mode,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2420,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2421,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2426,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2431,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2435,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2438,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2451,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2455,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2459,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2463,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
ARR01-C,curl,src/tool_getparam.c,2472,FP,"CURL_ARRAYSIZE on real array in scope, not decayed param",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2476,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2480,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2483,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2486,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2489,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2492,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2501,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MSC07-C,curl,src/tool_getparam.c,2511,FP,defensive break/return after switch arm; harmless,curl_full_audit_0.4.35,med
MEM30-C,curl,src/tool_getparam.c,2512,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2515,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2519,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2523,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2527,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2530,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2534,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2538,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2542,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2546,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2552,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2555,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2558,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2561,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2564,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2566,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2569,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2572,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2575,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2576,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2576,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2582,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2594,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2597,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2600,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2606,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2612,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2617,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2622,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2626,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,2643,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_getparam.c,2645,FP,idiomatic !strcmp boolean test in option dispatch,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2655,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2661,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2664,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2667,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2670,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2672,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_getparam.c,2672,FP,idiomatic !strcmp boolean test in option dispatch,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2672,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2680,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2683,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2685,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2685,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2693,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2699,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2705,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2711,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2712,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2712,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2717,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2720,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2726,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2732,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2738,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2739,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2740,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2745,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2748,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2751,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2754,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2757,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2760,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2763,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2769,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2769,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2772,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2776,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2784,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2787,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2795,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2809,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2813,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2817,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2823,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2827,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2828,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2833,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2837,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2838,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2843,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_getparam.c,2844,FP,"getstr/numeric-setter into &config->member: free-then-strdup reassign, not UAF",curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_getparam.c,2851,FP,init via macro/branch sqc cannot connect,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_getparam.c,2888,FP,internal dispatcher; NULL/overflow handled by design,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_getparam.c,2888,FP,internal dispatcher; NULL/overflow handled by design,curl_full_audit_0.4.35,high
CON07-C,curl,src/tool_getparam.c,2888,FP,verbose_nopts single-threaded parse-time static,curl_full_audit_0.4.35,high
MSC04-C,curl,src/tool_getparam.c,2888,FP,config-file recursion bounded by max_recursive counter,curl_full_audit_0.4.35,med
EXP34-C,curl,src/tool_getparam.c,2908,FP,'a' NULL-checked at dispatch (2943/2985) before deref,curl_full_audit_0.4.35,high
ARR00-C,curl,src/tool_getparam.c,2910,FP,flag is string ptr with >=2 chars guaranteed by flag[1] check,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_getparam.c,2916,FP,idiomatic !strcmp boolean test in option dispatch,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_getparam.c,2922,FP,idiomatic !strcmp boolean test in option dispatch,curl_full_audit_0.4.35,high
ENV01-C,curl,src/tool_getparam.c,2933,FP,tempword fixed 27-byte buffer bounded by MAX_OPTION_LEN,curl_full_audit_0.4.35,high
MEM05-C,curl,src/tool_getparam.c,2933,FP,"fixed-size stack array, not a VLA",curl_full_audit_0.4.35,high
EXP30-C,curl,src/tool_getparam.c,2934,FP,memcpy args are read-only accessors; no unsequenced side effects,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_getparam.c,2984,FP,'a' NULL-checked at dispatch (2943/2985) before deref,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,2998,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_getparam.c,2998,FP,plain char read/copy or char** deref; idiomatic sign-extension noise,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_getparam.c,3048,FP,curlx_free/strdup/malloc declared via included curlx headers,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_getparam.c,3052,FP,internal dispatcher; NULL/overflow handled by design,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_getparam.c,3052,FP,argv is standard main-signature array; const not idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_getparam.c,3068,FP,idiomatic !strcmp boolean test in option dispatch,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_getparam.c,3094,FP,"config->next linked into global config chain, freed by cleanup",curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_getparam.c,3148,FP,"config->next linked into global config chain, freed by cleanup",curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sha512_256.c,133,FP,curl never uses C99 array-param syntax; advisory style,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_sha512_256.c,133,FP,HMAC vtable callback signature fixed by function-pointer typedef; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sha512_256.c,134,FP,conformant array syntax advisory; not curl convention,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/curl_sha512_256.c,162,FP,"size is compile-time macro constant, not a VLA",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curl_sha512_256.c,165,FP,ret assigned at lines 163-164 before the if at 165,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sha512_256.c,214,FP,conformant array syntax advisory; not curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sha512_256.c,215,FP,conformant array syntax advisory; not curl convention,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/curl_sha512_256.c,222,FP,"uint8_t alignment is 1 not 4; byte read, no alignment issue",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_sha512_256.c,277,FP,"crypto load macro; side-effect-free ptr args, idiomatic",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_sha512_256.c,277,FP,multiple-eval only matters with side-effecting args; not here,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_sha512_256.c,287,FP,"crypto store macro; side-effect-free args, idiomatic",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_sha512_256.c,287,FP,args are plain pointer/value with no side effects,curl_full_audit_0.4.35,med
INT14-C,curl,lib/curl_sha512_256.c,304,FP,stylistic bitwise/arith mix advisory on unsigned rotate,curl_full_audit_0.4.35,high
INT14-C,curl,lib/curl_sha512_256.c,308,FP,value is uint64_t (unsigned); shift not signed,curl_full_audit_0.4.35,high
INT34-C,curl,lib/curl_sha512_256.c,308,FP,bits%=64 and bits!=0 guard make shift amount 1..63,curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_sha512_256.c,308,FP,"'value' is uint64_t, not a FILE stream; bogus",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_sha512_256.c,308,FP,"'value' is uint64_t, not a FILE stream; bogus",curl_full_audit_0.4.35,high
INT34-C,curl,lib/curl_sha512_256.c,308,FP,64-bits is 1..63 given bits guarded to 1..63,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sha512_256.c,430,FP,"H size is compile-time macro constant, not runtime param",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,436,FP,H is uint64_t[8] param; valid indices 0-7 not 0-0,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_sha512_256.c,437,FP,c is SHA working var modified via SHA2STEP64RV macro,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,437,FP,H is uint64_t[8]; index 2 in bounds,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,438,FP,H is uint64_t[8]; index 3 in bounds,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_sha512_256.c,439,FP,e modified via macro; sqc cannot see through SHA2STEP64RV,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,439,FP,H is uint64_t[8]; index 4 in bounds,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,440,FP,H is uint64_t[8]; index 5 in bounds,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_sha512_256.c,441,FP,g modified via macro rotation; not const-eligible,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,441,FP,H is uint64_t[8]; index 6 in bounds,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_sha512_256.c,442,FP,h modified via macro rotation; not const-eligible,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,442,FP,H is uint64_t[8]; index 7 in bounds,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_sha512_256.c,450,FP,Ch macro; side-effect-free working-var args,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_sha512_256.c,450,FP,args are plain locals; multiple-eval harmless,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_sha512_256.c,451,FP,Maj macro; side-effect-free args,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_sha512_256.c,451,FP,args are plain locals; no side effects,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_sha512_256.c,455,FP,SIG0 macro; side-effect-free arg,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_sha512_256.c,455,FP,arg is plain local; multiple-eval harmless,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_sha512_256.c,457,FP,SIG1 macro; side-effect-free arg,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_sha512_256.c,457,FP,arg is plain local; no side effects,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_sha512_256.c,459,FP,sig0 macro; side-effect-free arg,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_sha512_256.c,459,FP,arg is plain local; multiple-eval harmless,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_sha512_256.c,461,FP,sig1 macro; side-effect-free arg,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_sha512_256.c,461,FP,arg is plain local; no side effects,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_sha512_256.c,521,FP,SHA2STEP64 macro; side-effect-free working-var args,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_sha512_256.c,521,FP,args are plain locals; documented deliberate macro,curl_full_audit_0.4.35,med
PRE00-C,curl,lib/curl_sha512_256.c,530,FP,SHA2STEP64RV macro; side-effect-free args,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_sha512_256.c,530,FP,args plain locals; rotation macro intentional,curl_full_audit_0.4.35,med
PRE02-C,curl,lib/curl_sha512_256.c,548,FP,expands to fully-parenthesized CURL_GET_64BIT_BE(...) expression,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/curl_sha512_256.c,548,FP,"t is loop var, initialized in for-init at line 554",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,554,FP,t initialized by for(t=0;...) at this line; not uninitialized,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_sha512_256.c,564,FP,"Wgen macro; w arg is plain array, side-effect-free",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_sha512_256.c,564,FP,arg is W array name; multiple-eval harmless,curl_full_audit_0.4.35,med
ARR30-C,curl,lib/curl_sha512_256.c,573,FP,"t & 15 is 0-15; W has 16 elements, always in bounds",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,579,FP,H is uint64_t[8]; index 0 in bounds,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,580,FP,H is uint64_t[8]; index 1 in bounds,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,581,FP,H is uint64_t[8]; index 2 in bounds,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,582,FP,H is uint64_t[8]; index 3 in bounds,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,583,FP,H is uint64_t[8]; index 4 in bounds,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,584,FP,H is uint64_t[8]; index 5 in bounds,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,585,FP,H is uint64_t[8]; index 6 in bounds,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curl_sha512_256.c,586,FP,H is uint64_t[8]; index 7 in bounds,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sha512_256.c,597,FP,conformant array syntax advisory; not curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sha512_256.c,598,FP,conformant array syntax advisory; not curl convention,curl_full_audit_0.4.35,high
INT14-C,curl,lib/curl_sha512_256.c,613,FP,BLOCK_SIZE-1 mask is documented modulo idiom on unsigned,curl_full_audit_0.4.35,high
EXP07-C,curl,lib/curl_sha512_256.c,617,FP,"legit >>61 carry computation, no constant assumption",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/curl_sha512_256.c,637,FP,byte-count pointer increment on unsigned char*; no sizeof scaling,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_sha512_256.c,669,FP,vtable callback signature; digest is the written output param,curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_sha512_256.c,680,FP,"ctx->count is integer, not a FILE stream; bogus",curl_full_audit_0.4.35,high
INT14-C,curl,lib/curl_sha512_256.c,684,FP,BLOCK_SIZE-1 mask modulo idiom on unsigned; stylistic,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/curl_sha512_256.c,717,FP,byte-offset arithmetic on unsigned char*; no sizeof present,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/curl_sha512_256.c,717,FP,byte-offset arithmetic on unsigned char*; no double scaling,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/curl_sha512_256.c,720,FP,byte-offset arithmetic on unsigned char*; no sizeof present,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/curl_sha512_256.c,720,FP,byte-offset arithmetic on unsigned char*; no double scaling,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/curl_sha512_256.c,720,FP,byte-offset arithmetic on unsigned char*; no double scaling,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_sha512_256.c,750,FP,"thin entry; input handled by update/EVP, siblings also unchecked",curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sha512_256.c,750,FP,conformant array syntax advisory; not curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_sha512_256.c,750,FP,conformant array syntax advisory; not curl convention,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curl_sha512_256.c,756,FP,init writes ctx (assigns H/EVP_create); does not read uninitialized,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/curl_sha512_256.c,788,FP,implicit size from single-element HMAC_params initializer; idiomatic curl table,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/select.c,55,FP,both #ifdef branches end in return select(...); all paths return,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/select.c,249,FP,r assigned by r=poll(...) at line 248 before this read,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/select.c,256,FP,"i is the for-loop induction variable, initialized at loop entry",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/select.c,257,FP,"if ufds NULL, fds_none stays TRUE and fn returns at 227 before reaching here",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/select.c,337,FP,static_pfds stored into cpfds->pfds (non-const handle kept); const inappropriate,curl_full_audit_0.4.35,med
ARR01-C,curl,lib/select.c,341,FP,"cpfds is pointer-to-struct; sizeof(*cpfds) is full struct size, intended",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/select.c,357,FP,curlx_free declared in curlx memory header; sqc lacks preprocessor,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/select.c,359,FP,"sizeof(*cpfds) is struct size for memset of whole struct, correct",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/select.c,367,FP,curlx_calloc declared in curlx header; header-provided,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/select.c,371,FP,"new_fds sized count+inc; copy of count elems fits, bounded internal counts",curl_full_audit_0.4.35,high
INT32-C,curl,lib/select.c,371,FP,"count is small bounded unsigned (pollfd capacity), no overflow",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/select.c,373,FP,curlx_free header-provided declaration,curl_full_audit_0.4.35,high
API00-C,curl,lib/select.c,404,FP,thin wrapper; cpfds_add_sock DEBUGASSERTs/handles; internal API,curl_full_audit_0.4.35,high
API00-C,curl,lib/select.c,431,FP,DEBUGASSERT(cwfds) and DEBUGASSERT(static_wfds||!count) guard internal init,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/select.c,432,FP,static_wfds stored into cwfds->wfds (mutable handle retained),curl_full_audit_0.4.35,med
ARR01-C,curl,lib/select.c,437,FP,"sizeof(*cwfds) full struct size for memset, intended",curl_full_audit_0.4.35,high
ARR38-C,curl,lib/select.c,497,FP,ps->actions sized to count; memset of count elems is exact,curl_full_audit_0.4.35,high
INT32-C,curl,lib/select.c,497,FP,"count is small bounded socket-set size, element-size mul cannot overflow",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/select.c,497,FP,"sizeof(ps->actions[0]) is element size, correct for memset stride",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/select.c,514,FP,curlx_calloc header-provided,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/select.c,526,FP,curlx_free header-provided,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/select.c,527,FP,free(ps->sockets) then reassign ps->sockets=def_sockets; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/select.c,529,FP,reads ps->actions (distinct member) to decide free; not freed memory,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/select.c,529,FP,"ps->def_actions is the static default buffer, never freed",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/select.c,530,FP,curlx_free header-provided,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/select.c,531,FP,"def_actions is default static buffer, not freed; reassignment target",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/select.c,533,FP,def_sockets never freed; CURL_ARRAYSIZE reads only its type/size,curl_full_audit_0.4.35,high
API00-C,curl,lib/select.c,537,FP,internal move; callees DEBUGASSERT; not externally-facing untrusted pointer,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/select.c,551,FP,both buffers are def arrays of identical CURL_ARRAYSIZE; copy bounded,curl_full_audit_0.4.35,high
INT32-C,curl,lib/select.c,551,FP,to->count==CURL_ARRAYSIZE(def) small constant; no overflow,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/select.c,551,FP,"sizeof(to->sockets[0]) element size, correct",curl_full_audit_0.4.35,high
ARR38-C,curl,lib/select.c,552,FP,def actions array; bounded copy of count elements,curl_full_audit_0.4.35,high
INT32-C,curl,lib/select.c,552,FP,count is small constant default size; no overflow,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/select.c,552,FP,"sizeof(to->actions[0]) element size, correct",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/select.c,561,FP,"Curl_pollset_change declared in select.h, used in multi.c/libssh/pingpong",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/select.c,561,FP,"has external linkage, called from multiple other TUs",curl_full_audit_0.4.35,high
ARR38-C,curl,lib/select.c,585,FP,"memmove within ps->sockets, count (ps->n-(i+1)) < capacity; in-bounds",curl_full_audit_0.4.35,high
INT32-C,curl,lib/select.c,585,FP,ps->n bounded small; (n-(i+1)) nonneg under i+1<n guard; no overflow,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/select.c,586,FP,"sizeof(ps->sockets[0]) element size, correct memmove stride",curl_full_audit_0.4.35,high
ARR38-C,curl,lib/select.c,587,FP,"memmove within ps->actions, bounded by capacity",curl_full_audit_0.4.35,high
INT32-C,curl,lib/select.c,587,FP,"bounded count, no overflow",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/select.c,588,FP,"sizeof(ps->actions[0]) element size, correct",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/select.c,606,FP,curlx_calloc header-provided,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/select.c,606,FP,"sizeof(nsockets[0]) reads type only, does not read nsockets value",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/select.c,609,FP,curlx_calloc header-provided,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/select.c,611,FP,curlx_free header-provided,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/select.c,612,FP,nsockets is freed on this branch; nactions failed alloc (NULL); no leak,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/select.c,614,FP,nsockets sized new_count>ps->count; copy of count elems fits,curl_full_audit_0.4.35,high
INT32-C,curl,lib/select.c,614,FP,ps->count small bounded; element-size mul no overflow,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/select.c,614,FP,"sizeof(ps->sockets[0]) element size, correct",curl_full_audit_0.4.35,high
ARR38-C,curl,lib/select.c,615,FP,nactions sized new_count; copy of count elems fits,curl_full_audit_0.4.35,high
INT32-C,curl,lib/select.c,615,FP,"bounded count, no overflow",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/select.c,615,FP,"sizeof(ps->actions[0]) element size, correct",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/select.c,617,FP,curlx_free header-provided,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/select.c,619,FP,ps->actions only freed when !=def_actions; read decides free; def never freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/select.c,619,FP,"def_actions is static default buffer, never freed",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/select.c,620,FP,curlx_free header-provided,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/select.c,624,FP,"ps->count is a scalar field, not freed memory",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/select.c,625,FP,"ps->count scalar, not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/select.c,626,FP,ps->sockets reassigned to nsockets at 618 before this write; not freed ptr,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/select.c,627,FP,ps->actions reassigned to nactions at 621 before this write; not freed ptr,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/select.c,631,FP,nsockets/nactions ownership transferred to ps->sockets/actions; no leak,curl_full_audit_0.4.35,high
API00-C,curl,lib/select.c,634,FP,thin wrapper to Curl_pollset_change; never derefs data itself,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/select.c,634,FP,"Curl_pollset_set declared in select.h, externally linked",curl_full_audit_0.4.35,high
API00-C,curl,lib/select.c,645,FP,data cast to void/DEBUGASSERT only; internal poll API,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/select.c,646,FP,ps members read but signature uniform across pollset API family,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/select.c,660,FP,curlx_calloc header-provided,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/select.c,660,FP,sizeof(*pfds) reads type only; pfds assigned by the calloc itself,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/select.c,681,FP,curlx_free header-provided,curl_full_audit_0.4.35,high
API00-C,curl,lib/select.c,685,FP,"internal check fn; ps iterated with bounded loop, DEBUGASSERT guards",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/select.c,685,FP,data unused (void-cast) but uniform pollset API signature,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/select.c,686,FP,ps read-only here but shared signature across pollset family; const churn,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/select.c,703,FP,data void-cast; uniform pollset accessor signature,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/select.c,704,FP,ps read-only but shared signature family,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/select.c,716,FP,data void-cast; uniform pollset accessor signature,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/select.c,717,FP,ps read-only but shared signature family,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/ws.c,292,FP,dec IS written (dec->head[0]=) via callers; ws_dec_info reads but sig shared,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,324,FP,conformant-array-syntax advisory; curl convention never uses it,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ws.c,369,FP,Curl_bufq_peek returns true guarantees inbuf non-NULL before deref,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,488,FP,"write_cb is function-pointer typedef param, not const-qualifiable; vtable-fixed",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,594,FP,ws_cw_init is Curl_cwtype vtable impl; signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,595,FP,writer->ctx accessed; vtable-fixed signature; not const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,603,FP,ws_cw_close vtable impl; signature fixed by Curl_cwtype typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,603,FP,writer param of vtable impl; signature fixed by typedef,curl_full_audit_0.4.35,high
API02-C,curl,lib/ws.c,619,FP,ws_enc_send has buflen size param already; advisory array-cap misfire,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,621,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,631,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,667,FP,ws_cw_dec_next is callback typedef; array-syntax not applicable,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,671,FP,conformant-array-syntax advisory; callback signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,671,FP,user_data is callback typedef void* param; signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,714,FP,ws_cw_write vtable impl; writer->ctx used; signature fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,715,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
INT14-C,curl,lib/ws.c,787,FP,firstbyte&WSBIT_FIN vs payload_len arithmetic are distinct members; style only,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/ws.c,903,FP,"enc->mask is real uint8_t[4] struct member, not decayed param; sizeof correct",curl_full_audit_0.4.35,high
CON34-C,curl,lib/ws.c,908,FP,getenv only in DEBUGBUILD test hook; not production thread-safety concern,curl_full_audit_0.4.35,med
ARR01-C,curl,lib/ws.c,910,FP,enc->mask is struct array member; sizeof(enc->mask)=4 correct,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,949,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/ws.c,966,FP,c is loop temp whose address is taken (Curl_bufq_write &c); const-able but idiomatic,curl_full_audit_0.4.35,med
MSC37-C,curl,lib/ws.c,982,FP,ws_enc_add_pending all paths reach out: return result; analyzer misparse,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/ws.c,1018,FP,ws->pending is struct member; sizeof(ws->pending) correct for memset,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,1026,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1128,FP,cr_ws_init Curl_crtype vtable impl; signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1128,FP,reader param of vtable impl; signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1135,FP,cr_ws_close vtable impl; signature fixed by Curl_crtype typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1135,FP,reader param of vtable impl; signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1142,FP,cr_ws_read vtable impl; reader->ctx used; signature fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,1143,FP,conformant-array-syntax advisory; callback signature,curl_full_audit_0.4.35,high
API00-C,curl,lib/ws.c,1245,FP,Curl_ws_request internal; data always valid (req derived); siblings don't check,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/ws.c,1254,FP,"heads[] sized by initializer; idiomatic, CURL_ARRAYSIZE used for bound",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/ws.c,1275,FP,keyval filled by curlx_strcopy(1289) before read via heads[i].val(1293),curl_full_audit_0.4.35,high
EXP20-C,curl,lib/ws.c,1292,FP,!Curl_checkheaders boolean idiom; standard curl option/header dispatch,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,1302,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1302,FP,ws_conn_dtor key param is Curl_meta_dtor typedef; signature fixed,curl_full_audit_0.4.35,med
API05-C,curl,lib/ws.c,1302,FP,conformant-array-syntax advisory; dtor callback signature,curl_full_audit_0.4.35,high
API00-C,curl,lib/ws.c,1316,FP,Curl_ws_accept internal; DEBUGASSERT(data->conn); data always valid here,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,1317,FP,conformant-array-syntax advisory; mem buffer param,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/ws.c,1334,FP,return value checked: if(p) at line 1335 before use,curl_full_audit_0.4.35,high
CON34-C,curl,lib/ws.c,1334,FP,getenv only in DEBUGBUILD test hook; not production thread-safety concern,curl_full_audit_0.4.35,med
ENV30-C,curl,lib/ws.c,1337,FP,"curlx_str_number(&p,...) advances local ptr copy; env string not modified",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/ws.c,1381,FP,ws_dec_writer freed at out: label (1442) on every error path,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ws.c,1385,FP,Curl_cwriter_create result checked (1383); ws_dec_writer non-NULL here,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/ws.c,1417,FP,Curl_creader_create result checked (1415); ws_enc_reader non-NULL here,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,1466,FP,ws_client_collect callback; conformant-array-syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,1470,FP,conformant-array-syntax advisory; callback signature,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,1522,FP,nw_in_recv callback; conformant-array-syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,1523,FP,conformant-array-syntax advisory; callback signature,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,1530,FP,curl_ws_recv public API; conformant-array-syntax advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1530,FP,buffer is output buffer written by memcpy(ctx->buffer..); not const,curl_full_audit_0.4.35,high
MEM33-C,curl,lib/ws.c,1611,FP,line is *nread=ws->recvframe.len; no flexible-array struct assignment present,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/ws.c,1638,FP,return value checked: if(p) at line 1639 before use,curl_full_audit_0.4.35,high
CON34-C,curl,lib/ws.c,1638,FP,getenv only in DEBUGBUILD test hook; not production thread-safety concern,curl_full_audit_0.4.35,med
ENV30-C,curl,lib/ws.c,1641,FP,"curlx_str_number(&p,...) advances local ptr copy; env string not modified",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1686,FP,ws_send_raw_blocking takes ws but (void)ws; could be const but unused/idiomatic,curl_full_audit_0.4.35,med
API05-C,curl,lib/ws.c,1687,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,1726,FP,ws_send_raw; conformant-array-syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,1763,FP,curl_ws_send public API; conformant-array-syntax advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1764,FP,sent is output param (*pnsent written); not const,curl_full_audit_0.4.35,high
API00-C,curl,lib/ws.c,1851,FP,curl_ws_meta guards via GOOD_EASY_HANDLE(data) before deref,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/ws.c,1866,FP,curl_ws_meta returns NULL at end; all paths return value,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1940,FP,curl_ws_recv stub (disabled build); param unused (void)curl; public API sig fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,1940,FP,conformant-array-syntax advisory; public API signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1940,FP,buffer is public API param of stub; signature fixed by header,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1941,FP,nread is output param of public API; signature fixed by header,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1952,FP,curl_ws_send stub public API param; signature fixed by header,curl_full_audit_0.4.35,high
API05-C,curl,lib/ws.c,1952,FP,conformant-array-syntax advisory; public API signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1953,FP,sent is output param of public API; signature fixed by header,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1966,FP,curl_ws_meta stub public API param; signature fixed by header,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ws.c,1972,FP,curl_ws_start_frame stub public API param; signature fixed by header,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/ws.c,1984,FP,Curl_scheme_ws needs external linkage; referenced in scheme table elsewhere,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/ws.c,1984,FP,Curl_scheme_ws is exported scheme descriptor; cannot reduce scope,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/ws.c,1999,FP,Curl_scheme_wss needs external linkage; referenced elsewhere,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/ws.c,1999,FP,Curl_scheme_wss is exported scheme descriptor; cannot reduce scope,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/imap.c,169,FP,"resptag is a real char[5] struct member, not a decayed parameter; sizeof correct",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/imap.c,224,FP,"while(*str) NUL-terminated string scan; idiomatic, bounded by terminator",curl_full_audit_0.4.35,high
API05-C,curl,lib/imap.c,242,FP,conformant-array-syntax advisory; curl never uses C99 array params,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/imap.c,260,FP,"returns the const char* parameter 'line', not a local; misparse",curl_full_audit_0.4.35,high
API05-C,curl,lib/imap.c,277,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/imap.c,277,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/imap.c,280,FP,strlen(cmd) involves no signed-char-to-wider promotion,curl_full_audit_0.4.35,high
API05-C,curl,lib/imap.c,316,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/imap.c,316,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/imap.c,319,FP,Curl_conn_meta_get returns properly-aligned alloc'd struct; idiomatic meta access,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/imap.c,331,FP,!memcmp comparison idiom; standard curl convention,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/imap.c,335,FP,!memcmp comparison idiom,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/imap.c,337,FP,!memcmp comparison idiom,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/imap.c,346,FP,!memcmp comparison idiom,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/imap.c,399,FP,!memcmp comparison idiom,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/imap.c,425,FP,data is the universal mutable easy-handle context; curl never consts it,curl_full_audit_0.4.35,med
STR30-C,curl,lib/imap.c,454,FP,Curl_bufref_set stores literal with NULL free-fn; literal not modified,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/imap.c,471,FP,names[] initializer-sized debug table; intentional,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/imap.c,548,FP,all paths return: USE_SSL out:return and #else return CURLE_NOT_BUILT_IN,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/imap.c,592,TP,"static helper, conn only read (user/passwd), never written; could be const",curl_full_audit_0.4.35,low
MEM03-C,curl,lib/imap.c,596,FP,"passwd is a heap atom-copy pointer, not stack buffer; curl does not zero these",curl_full_audit_0.4.35,low
DCL13-C,curl,lib/imap.c,737,TP,"static helper, imap only read; could be const-qualified",curl_full_audit_0.4.35,low
DCL13-C,curl,lib/imap.c,772,FP,imap_perform_select reads imap->mailbox but pattern modifies imapc; data context mutable,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/imap.c,810,TP,"static helper, imap only read; could be const-qualified",curl_full_audit_0.4.35,low
DCL13-C,curl,lib/imap.c,853,TP,"static helper, imap only read; could be const-qualified",curl_full_audit_0.4.35,low
DCL13-C,curl,lib/imap.c,962,TP,"static helper, imap only read; could be const-qualified",curl_full_audit_0.4.35,low
EXP20-C,curl,lib/imap.c,879,FP,!Curl_checkheaders boolean idiom; standard curl convention,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/imap.c,912,FP,ulflag[] initializer-sized lookup table with NULL sentinel; intentional,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/imap.c,1186,FP,while(ISDIGIT(*params)) bounded by NUL check; idiomatic string scan,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/imap.c,1198,TP,"static helper is_custom_fetch_listing, imap read-only; could be const",curl_full_audit_0.4.35,low
EXP36-C,curl,lib/imap.c,1225,FP,meta_get returns aligned alloc'd struct; idiomatic,curl_full_audit_0.4.35,high
STR34-C,curl,lib/imap.c,1239,FP,"memchr/pointer-diff, no signed-char promotion bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/imap.c,1239,FP,no signed-char-to-wider conversion present,curl_full_audit_0.4.35,high
STR34-C,curl,lib/imap.c,1239,FP,no signed-char-to-wider conversion present,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/imap.c,1244,FP,ptr walks within recvbuf buffer returned by imap_find_literal; valid,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/imap.c,1273,FP,"size and CURL_OFF_T_MAX are integers, not pointers; misparse",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/imap.c,1357,FP,"line is recvbuf ptr, guarded by len>=18 before &line[2]; non-NULL",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/imap.c,1421,FP,ptr++ walks within recvbuf buffer; valid pointer arithmetic on buffer,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/imap.c,1562,FP,meta_get returns aligned alloc'd struct; idiomatic,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/imap.c,1731,TP,"imap_parse_url_options reads conn->options only, writes imapc; conn could be const",curl_full_audit_0.4.35,low
ARR30-C,curl,lib/imap.c,1738,FP,while(ptr && *ptr) option-string scan bounded by NUL; idiomatic,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/imap.c,1743,FP,ptr walks conn->options string buffer; valid,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/imap.c,1745,FP,ptr+1 arithmetic on option string buffer; valid,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/imap.c,1748,FP,ptr walks option string buffer; valid,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/imap.c,1766,FP,ptr++ over option string buffer; valid,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/imap.c,1805,FP,ptr++ scans URL path buffer; valid string walk,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/imap.c,1810,FP,end[-1] guarded by end>begin; valid in-bounds access,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/imap.c,1810,FP,end[-1] on path buffer guarded by end>begin; valid,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/imap.c,1811,FP,end-- on path buffer pointer; valid,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/imap.c,1822,FP,while(*ptr==';') param loop advances ptr internally; NUL-bounded,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/imap.c,1828,FP,++ptr walks path buffer; valid,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/imap.c,1830,FP,ptr++ walks path buffer; valid,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/imap.c,1842,FP,++ptr walks path buffer; valid,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/imap.c,1844,FP,ptr++ walks path buffer; valid,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/imap.c,1861,FP,"value from Curl_urldecode success path, guarded valuelen>0; non-NULL",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/imap.c,1894,FP,free at 1886 is in else-branch that returns; 1894 free is mutually exclusive,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/imap.c,1920,FP,data is mutable easy-handle context; curl never consts it,curl_full_audit_0.4.35,med
EXP36-C,curl,lib/imap.c,2001,FP,meta_get returns aligned alloc'd struct; idiomatic,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/imap.c,2054,FP,meta_get returns aligned alloc'd struct; idiomatic,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/imap.c,2113,TP,imap_dophase_done reads imap->transfer only; could be const-qualified,curl_full_audit_0.4.35,low
EXP36-C,curl,lib/imap.c,2168,FP,meta_get returns aligned alloc'd struct; idiomatic,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/imap.c,2218,FP,meta_get returns aligned alloc'd struct; idiomatic,curl_full_audit_0.4.35,high
API05-C,curl,lib/imap.c,2236,FP,dtor signature fixed by hash callback typedef; cannot change to array syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/imap.c,2236,FP,imap_easy_dtor signature fixed by hash-dtor function-pointer typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/imap.c,2236,FP,callback-typedef-fixed signature; array syntax inapplicable,curl_full_audit_0.4.35,high
API05-C,curl,lib/imap.c,2245,FP,imap_conn_dtor signature fixed by dtor typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/imap.c,2245,FP,imap_conn_dtor signature fixed by hash-dtor function-pointer typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/imap.c,2245,FP,callback-typedef-fixed signature; array syntax inapplicable,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/imap.c,2277,FP,line 2277 is the calloc assignment to imapc itself; not an uninit deref,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/imap.c,2297,FP,"imapc already registered (2291) with conn dtor; owned, not leaked",curl_full_audit_0.4.35,med
MEM12-C,curl,lib/imap.c,2299,FP,imapc owned by conn meta; imap registered via meta_set with dtor on success,curl_full_audit_0.4.35,med
DCL15-C,curl,lib/imap.c,2331,FP,"Curl_scheme_imap is intentionally external, referenced cross-file via header",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/imap.c,2331,FP,exported scheme handler; external linkage required,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/imap.c,2349,FP,"Curl_scheme_imaps is intentionally external, referenced cross-file",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/imap.c,2349,FP,exported scheme handler; external linkage required,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,71,FP,conformant array syntax advisory; curl never uses C99 array params,curl_full_audit_0.4.35,high
CON03-C,curl,lib/vquic/curl_quiche.c,99,FP,DEBUG_QUICHE-only one-time init guard; not a real concurrency hazard,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vquic/curl_quiche.c,100,FP,argp fixed by quiche_enable_debug_logging callback typedef; const cannot be added,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,207,FP,user_data fixed by Curl_uint32_hash_visit callback typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,217,FP,cf deref read-only but passed mutably downstream; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,218,FP,multi passed to non-const hash visit; cannot const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,219,FP,do_cb function-pointer arg; not const-able,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,220,FP,user_data opaque passthrough,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,234,FP,user_data fixed by cf_quiche_svisit typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,248,FP,user_data fixed by cf_quiche_svisit typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,258,FP,cf used as cf->ctx then passed mutably; curl convention,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_quiche.c,262,FP,"H3_STREAM_CTX hash-lookup cast; void* value, not real misalignment",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_quiche.c,308,FP,H3_STREAM_CTX hash-lookup cast; not real misalignment,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,329,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,351,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
CON43-C,curl,lib/vquic/curl_quiche.c,354,FP,local hdr pointer in single-threaded header scan; no double-fetch,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,364,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,365,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,366,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,366,FP,argp fixed by quiche_h3_event_for_each_header callback typedef,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vquic/curl_quiche.c,378,FP,!strncmp idiom in pseudo-header match; idiomatic,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vquic/curl_quiche.c,390,FP,"dyn_ptr/dyn_len args read same dynbuf, no interfering side effects",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vquic/curl_quiche.c,411,FP,dyn_ptr/dyn_len args have no order-dependent side effects,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,428,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,428,FP,reader_ctx fixed by Curl_bufq reader callback typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,429,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,578,FP,user_data fixed by hash visit callback typedef,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vquic/curl_quiche.c,613,FP,ev written by quiche_h3_conn_poll via &ev output param; sqc misses,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,640,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,642,FP,remote_addr fixed by vquic_recv_packets callback typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,644,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vquic/curl_quiche.c,646,FP,"r reassigned via ++r->pkts target; const-local advisory, curl convention",curl_full_audit_0.4.35,med
ARR39-C,curl,lib/vquic/curl_quiche.c,660,FP,"buflen-offset are size_t, no sizeof scaling; misfire",curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,738,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,739,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
INT10-C,curl,lib/vquic/curl_quiche.c,837,FP,timeout_ns is non-negative nanosecond timeout; modulo well-defined in practice,curl_full_audit_0.4.35,med
EXP36-C,curl,lib/vquic/curl_quiche.c,849,FP,H3_STREAM_CTX hash-lookup cast; not real misalignment,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,886,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,886,FP,buf fixed by cfilter cf_recv vtable signature,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_quiche.c,889,FP,H3_STREAM_CTX hash-lookup cast; not real misalignment,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,932,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,977,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_quiche.c,981,FP,H3_STREAM_CTX hash-lookup cast; not real misalignment,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vquic/curl_quiche.c,1028,FP,"e loop-local entry pointer; const-local advisory, curl convention",curl_full_audit_0.4.35,med
EXP34-C,curl,lib/vquic/curl_quiche.c,1029,FP,"e=getn(i) with i<count; in-bounds, non-NULL",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vquic/curl_quiche.c,1081,FP,"guarded by if(blen); buf is function param, callee passes to quiche",curl_full_audit_0.4.35,high
API05-C,curl,lib/vquic/curl_quiche.c,1097,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_quiche.c,1101,FP,H3_STREAM_CTX hash-lookup cast; not real misalignment,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,1155,FP,"cf used as cf->ctx, passed mutably; curl convention",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_quiche.c,1159,FP,H3_STREAM_CTX hash-lookup cast; not real misalignment,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_quiche.c,1178,FP,H3_STREAM_CTX hash-lookup cast; not real misalignment,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,1194,FP,cf fixed by cfilter cntrl/data_pause path; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,1209,FP,arg2 fixed by cfilter cntrl vtable signature,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vquic/curl_quiche.c,1226,FP,H3_STREAM_CTX hash-lookup cast; not real misalignment,curl_full_audit_0.4.35,high
STR31-C,curl,lib/vquic/curl_quiche.c,1228,FP,"body[1] is a single sentinel byte, not a string; len 0 sent",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_quiche.c,1267,FP,ctx->cfg struct member freed by cf_quiche_ctx_close on teardown,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vquic/curl_quiche.c,1315,FP,sockaddr populated by socket_peek; error returns before use at 1303,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_quiche.c,1320,FP,ctx->cfg freed by ctx_close on connection teardown; not leaked,curl_full_audit_0.4.35,high
STR30-C,curl,lib/vquic/curl_quiche.c,1329,FP,quiche_conn_set_qlog_fd takes const char* titles; literals not modified,curl_full_audit_0.4.35,high
STR30-C,curl,lib/vquic/curl_quiche.c,1329,FP,duplicate of qlog title/desc literal; const char* params,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/vquic/curl_quiche.c,1338,FP,array with initializer has well-defined implicit bounds; idiomatic,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/vquic/curl_quiche.c,1342,FP,sizeof(alpn_protocols) on real array = byte count; no double scaling,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_quiche.c,1352,FP,ctx->cfg freed by ctx_close; struct member not stack leak,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/vquic/curl_quiche.c,1385,FP,"line is CURLcode result assignment, not an fd; misattribution",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_quiche.c,1409,FP,ctx->h3config struct member freed by cf_quiche_ctx_close,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_quiche.c,1445,FP,ctx->h3config freed by ctx_close on teardown; not leaked,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vquic/curl_quiche.c,1448,FP,cf_quiche_shutdown returns on all paths via out:; branch-merge misfire,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vquic/curl_quiche.c,1505,FP,data fixed by cfilter destroy vtable signature,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vquic/curl_quiche.c,1568,FP,*palpn is char** assigned char*; not a signed-char read,curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/curl_quiche.c,1634,FP,"exported create fn; pcf only written, callers pass valid pointers",curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/curl_quiche.c,1634,FP,"data passed downstream, not dereffed here; thin create wrapper",curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/curl_quiche.c,1634,FP,"conn only stored (cf->conn=conn), not dereffed",curl_full_audit_0.4.35,high
API00-C,curl,lib/vquic/curl_quiche.c,1634,FP,"ai passed to udp_create, not dereffed here",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vquic/curl_quiche.c,1650,FP,cf freed via Curl_conn_cf_discard_chain in out: error block,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vquic/curl_quiche.c,1653,FP,cf non-NULL after Curl_cf_create success (result==0 reaches 1653),curl_full_audit_0.4.35,high
PRE00-C,curl,lib/conncache.c,39,FP,"CPOOL_IS_LOCKED args always plain vars; advisory style, no side-effect operands",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/conncache.c,39,FP,"Multi-eval of 'c' harmless; arg is always a plain variable, no side effects",curl_full_audit_0.4.35,med
PRE00-C,curl,lib/conncache.c,41,FP,"CPOOL_LOCK needs macro (DEBUGASSERT/lvalue assign); plain-var args, advisory only",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/conncache.c,41,FP,"Multi-eval of 'c' harmless; arg always plain variable, assigns lvalue (c)->locked",curl_full_audit_0.4.35,med
PRE00-C,curl,lib/conncache.c,52,FP,"CPOOL_UNLOCK needs lvalue assignment; plain-var args, advisory style only",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/conncache.c,52,FP,"Multi-eval of 'c' harmless; plain-var arg, assigns (c)->locked lvalue",curl_full_audit_0.4.35,med
DCL38-C,curl,lib/conncache.c,66,TP,Struct-hack char dest[1]; CERT prefers flexible array member [],curl_full_audit_0.4.35,low
STR31-C,curl,lib/conncache.c,66,FP,dest[1] is over-allocated flexible buffer (calloc sizeof+dest_len-1); not too small,curl_full_audit_0.4.35,high
STR34-C,curl,lib/conncache.c,72,FP,strlen(dest) on const char*; no signed-char-to-int conversion present,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/conncache.c,74,FP,curlx_calloc declared in curl headers; sqc lacks preprocessor view,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/conncache.c,74,FP,bundle assigned curlx_calloc result on this same line before any use,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/conncache.c,80,FP,"bundle is heap-allocated via calloc, not automatic storage",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/conncache.c,86,FP,curlx_free declared in curl headers; sqc lacks preprocessor view,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,99,FP,[adv] static helper reads bundle->conns only; could be const (not fn-ptr-bound),curl_full_audit_0.4.35,adversarial-flip
EXP34-C,curl,lib/conncache.c,103,FP,"internal helper; conn caller-guaranteed non-null, only DEBUGASSERT use",curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,113,FP,idata only stored after DEBUGASSERT(idata); not dereferenced unchecked,curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,113,FP,share merely stored to cpool->share; never dereferenced here,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,115,FP,"share stored into non-const cpool->share field; const would mismatch, public API",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,148,TP,static cpool_find_bundle reads conn->destination only; conn could be const,curl_full_audit_0.4.35,low
EXP34-C,curl,lib/conncache.c,151,FP,internal helper; conn caller-guaranteed non-null in connection pool path,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,155,TP,static cpool_remove_bundle reads bundle->dest/dest_len only; could be const,curl_full_audit_0.4.35,low
EXP34-C,curl,lib/conncache.c,165,FP,"internal helper; conn caller-guaranteed non-null, DEBUGASSERT(cpool) present",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/conncache.c,194,FP,DEBUGASSERT(!conn->bits.in_cpool); conn caller-guaranteed non-null,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,256,FP,cpool_get_instance returns non-const &data->share->cpool; const data breaks return,curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,269,FP,data passed to cpool_get_instance which null-checks; DEBUGASSERT(cpool),curl_full_audit_0.4.35,high
EXP36-C,curl,lib/conncache.c,271,FP,cpool is real struct member &data->multi->cpool; no char* reinterpretation,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,292,TP,static cpool_add_bundle reads conn->destination only; conn could be const,curl_full_audit_0.4.35,low
DCL30-C,curl,lib/conncache.c,305,FP,"bundle is heap-allocated via cpool_bundle_create, not automatic storage",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/conncache.c,351,FP,conn assigned Curl_node_elem(curr) before use inside same loop body,curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,370,FP,data null-checked via cpool_get_instance; conn caller-guaranteed,curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,370,FP,conn only dereferenced after cpool found; caller-guaranteed non-null,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/conncache.c,373,FP,"cpool is real struct member pointer; alignment misparse, no char* cast",curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,466,FP,data null-checked via cpool_get_instance + if(!cpool) return,curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,466,FP,conn DEBUGASSERT(conn); caller-guaranteed non-null in add path,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/conncache.c,466,FP,"Curl_cpool_add is public API declared in conncache.h, needs external linkage",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/conncache.c,471,FP,"cpool is real struct member pointer; alignment misparse, no char* cast",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/conncache.c,539,FP,"func is a function-pointer parameter being invoked, not undeclared function",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/conncache.c,539,FP,"==1 intentional per documented func contract (0 continue, 1 abort)",curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,553,FP,conn caller-guaranteed; data null-checked at if(!data) return,curl_full_audit_0.4.35,med
EXP36-C,curl,lib/conncache.c,558,FP,"cpool is real struct member pointer; alignment misparse, no char* cast",curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,595,FP,data null-checked via cpool_get_instance + if(!cpool) return,curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,595,FP,destination only used via strlen after bundle pick; caller-guaranteed,curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,595,FP,conn_cb guarded by DEBUGASSERT(conn_cb) before use,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,598,FP,done_cb is a function-pointer typedef param; const not applicable,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/conncache.c,601,FP,"cpool is real struct member pointer; alignment misparse, no char* cast",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/conncache.c,621,FP,"conn_cb is a function-pointer parameter being invoked, not undeclared fn",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/conncache.c,629,FP,"done_cb is a function-pointer parameter being invoked, not undeclared fn",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/conncache.c,639,FP,"cpool is real struct member pointer; alignment misparse, no char* cast",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/conncache.c,651,FP,conn use guarded by CONN_INUSE(conn) branch; caller-guaranteed non-null,curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,718,FP,data null-checked via cpool_get_instance + if(!cpool) return,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/conncache.c,720,FP,"cpool is real struct member pointer; alignment misparse, no char* cast",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,741,FP,conn_upkeep signature fixed by cpool_foreach func-ptr type; param is (void)param,curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,748,FP,data null-checked via cpool_get_instance + if(!cpool) return,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/conncache.c,750,FP,"cpool is real struct member pointer; alignment misparse, no char* cast",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,766,FP,cpool_find_conn signature fixed by cpool_foreach func-ptr typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,767,FP,conn param signature fixed by cpool_foreach func-ptr type; cannot const,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/conncache.c,781,FP,"cpool is real struct member pointer; alignment misparse, no char* cast",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,801,FP,cpool_do_conn signature fixed by cpool_foreach func-ptr type,curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,812,FP,data null-checked via cpool_get_instance + if(!cpool) return,curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,812,FP,cb stored then invoked inside callback under lock; caller-guaranteed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,813,FP,cb is a function-pointer typedef param; const not applicable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,813,FP,cbdata is opaque void* userdata passed through; const would break callback ABI,curl_full_audit_0.4.35,med
EXP36-C,curl,lib/conncache.c,815,FP,"cpool is real struct member pointer; alignment misparse, no char* cast",curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,828,FP,data passed to cpool_get_instance which null-checks; if(cpool) guard,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,830,FP,cb is a function-pointer typedef param; const not applicable,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/conncache.c,832,FP,"cpool is real struct member pointer; alignment misparse, no char* cast",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,842,FP,cpool_mark_stale signature fixed by cpool_foreach func-ptr type,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,843,FP,param signature fixed by func-ptr type; (void)param unused,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,852,FP,cpool_reap_no_reuse signature fixed by cpool_foreach func-ptr type,curl_full_audit_0.4.35,high
API00-C,curl,lib/conncache.c,862,FP,data passed to cpool_get_instance which null-checks; if(cpool) guard,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/conncache.c,864,FP,"cpool is real struct member pointer; alignment misparse, no char* cast",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/conncache.c,877,FP,Curl_cpool_print is inside #if 0 dead debug code; not compiled,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/conncache.c,893,FP,inside #if 0 dead debug code; conn assigned before use anyway,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_urlglob.c,31,FP,"Conformant-array-syntax advisory; curl never uses C99 array params, idiomatic",curl_full_audit_0.4.35,high
API05-C,curl,src/tool_urlglob.c,39,FP,"Conformant-array-syntax advisory on char*/size_t signature, idiomatic",curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_urlglob.c,46,FP,curlx_malloc is a macro/wrapper from curlx headers; sqc cannot see declaration,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_urlglob.c,53,FP,Frees elem array after elem[0] alloc fails then returns; not a UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_urlglob.c,53,FP,"Same free site; freeing pat->c.set.elem on error, no later access",curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_urlglob.c,82,FP,sum assigned in same #else arm before division; branch-merge confusion,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_urlglob.c,90,FP,"Conformant-array-syntax advisory, idiomatic",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_urlglob.c,99,FP,"char** deref to const char* pointer copy, no sign-extension to wider int",curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_urlglob.c,107,FP,while(!done) over NUL-terminated string; '\0' case breaks loop,curl_full_audit_0.4.35,high
CON43-C,curl,src/tool_urlglob.c,108,FP,"Single-threaded parser; no concurrency, no double-fetch race",curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_urlglob.c,138,FP,curlx_malloc macro wrapper; declaration in curlx headers,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_urlglob.c,141,FP,curlx_realloc macro wrapper; declaration in curlx headers,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_urlglob.c,155,FP,curlx_strdup macro wrapper; declaration in curlx headers,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_urlglob.c,190,FP,"pattern points into caller's URL string, not a local; out-param returns position",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_urlglob.c,190,FP,"Pointer-to-pointer assignment, not char-to-int sign extension",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_urlglob.c,192,FP,Struct member pointer assignment; no signed-char widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_urlglob.c,192,FP,Misparse of pat field assignment; no sign extension,curl_full_audit_0.4.35,high
MEM12-C,curl,src/tool_urlglob.c,200,FP,"Success path; elem ownership transferred to pat->c.set.elem, not leaked",curl_full_audit_0.4.35,high
MSC07-C,curl,src/tool_urlglob.c,201,FP,"'error:' is a reachable goto label, not unreachable post-return code",curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_urlglob.c,207,FP,curlx_free macro wrapper; declaration in curlx headers,curl_full_audit_0.4.35,high
MEM12-C,curl,src/tool_urlglob.c,208,FP,Error path correctly frees elem[i] then elem array; no leak,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_urlglob.c,211,FP,"Conformant-array-syntax advisory, idiomatic",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_urlglob.c,222,FP,char** deref to const char* copy; no sign extension,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_urlglob.c,225,FP,Pointer assignment of pat field; no char widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_urlglob.c,225,FP,"Misparse; pointer assignment, no sign extension",curl_full_audit_0.4.35,high
DCL00-C,curl,src/tool_urlglob.c,231,FP,min_c IS modified at line 239 (min_c=pattern[0]); not const-eligible,curl_full_audit_0.4.35,med
DCL00-C,curl,src/tool_urlglob.c,232,FP,max_c modified at line 240; not const-eligible,curl_full_audit_0.4.35,med
DCL00-C,curl,src/tool_urlglob.c,233,FP,end_c modified at line 241; not const-eligible,curl_full_audit_0.4.35,med
STR34-C,curl,src/tool_urlglob.c,246,FP,const char *p = &pattern[4] pointer init; no char-to-int widening,curl_full_audit_0.4.35,high
ARR36-C,curl,src/tool_urlglob.c,261,FP,pattern and *patternp point into same URL string; valid ptr difference,curl_full_audit_0.4.35,high
ARR36-C,curl,src/tool_urlglob.c,265,FP,"min_c/max_c are chars not pointers; comparison is value, not cross-array ptr",curl_full_audit_0.4.35,high
ARR36-C,curl,src/tool_urlglob.c,265,FP,"max_c-min_c is char arithmetic, not pointer subtraction; misparse",curl_full_audit_0.4.35,high
INT07-C,curl,src/tool_urlglob.c,265,FP,char range arithmetic guarded to a-z window; plain char idiomatic here,curl_full_audit_0.4.35,med
INT08-C,curl,src/tool_urlglob.c,265,FP,max_c-min_c bounded by ('z'-'a') guard; no overflow possible,curl_full_audit_0.4.35,med
INT07-C,curl,src/tool_urlglob.c,265,FP,min_c char arithmetic bounded; idiomatic ASCII range handling,curl_full_audit_0.4.35,med
ARR36-C,curl,src/tool_urlglob.c,266,FP,"char value subtraction, not pointer subtraction; misparse",curl_full_audit_0.4.35,high
INT07-C,curl,src/tool_urlglob.c,266,FP,char range arithmetic bounded by guard; idiomatic,curl_full_audit_0.4.35,med
INT08-C,curl,src/tool_urlglob.c,266,FP,(max_c-min_c) bounded by 'z'-'a'; no overflow,curl_full_audit_0.4.35,med
INT07-C,curl,src/tool_urlglob.c,266,FP,min_c char arithmetic bounded; idiomatic,curl_full_audit_0.4.35,med
FLP03-C,curl,src/tool_urlglob.c,275,FP,"Integer division on curl_off_t, not floating point; no FP exception",curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_urlglob.c,293,FP,c walks NUL-terminated string via ISDIGIT guard; valid pointer increment,curl_full_audit_0.4.35,high
ARR36-C,curl,src/tool_urlglob.c,317,FP,pattern and *patternp into same URL string; valid difference,curl_full_audit_0.4.35,high
FLP03-C,curl,src/tool_urlglob.c,331,FP,"Integer division on curl_off_t, not floating point",curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_urlglob.c,339,FP,"pattern points into caller's URL string, not local; valid out-param",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_urlglob.c,339,FP,"Pointer assignment, not char widening",curl_full_audit_0.4.35,high
API05-C,curl,src/tool_urlglob.c,345,FP,"Conformant-array-syntax advisory, idiomatic",curl_full_audit_0.4.35,high
ENV01-C,curl,src/tool_urlglob.c,352,FP,"hostname[128] used with strchr-derived hlen, no getenv involved",curl_full_audit_0.4.35,high
ARR38-C,curl,src/tool_urlglob.c,371,FP,hlen guarded <MAX_IP6LEN(128); memcpy into 128-byte buf bounded,curl_full_audit_0.4.35,high
STR31-C,curl,src/tool_urlglob.c,371,FP,Explicit hostname[hlen]=0 terminator added next line; bounded,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_urlglob.c,394,FP,curlx_realloc macro wrapper; declaration in curlx headers,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_urlglob.c,406,FP,"Conformant-array-syntax advisory, idiomatic",curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_urlglob.c,417,FP,while(*pattern) over NUL-terminated string; terminator-bounded,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_urlglob.c,418,FP,Inner while(*pattern) NUL-terminator-bounded; not unbounded,curl_full_audit_0.4.35,high
EXP30-C,curl,src/tool_urlglob.c,456,FP,"glob_fixed(glob, dyn_ptr(&buf), dyn_len(&buf)): args read same buf, no write side effects",curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_urlglob.c,486,FP,glob_inuse reads glob->palloc; could be const but matches glob_* family signature convention,curl_full_audit_0.4.35,med
API00-C,curl,src/tool_urlglob.c,491,FP,"glob_url memsets glob, internal CLI caller always passes valid url; thin entry",curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_urlglob.c,503,FP,curlx_malloc macro wrapper; declaration in curlx headers,curl_full_audit_0.4.35,high
STR00-C,curl,src/tool_urlglob.c,543,FP,"elem is curl_off_t loop index 0..size, not a char used as array index",curl_full_audit_0.4.35,med
MEM30-C,curl,src/tool_urlglob.c,544,FP,"Frees elem[] entries then elem array; correct teardown order, no UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_urlglob.c,544,FP,Sequential member free in cleanup; not double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_urlglob.c,544,FP,glob->pattern still valid here; freed only at line 547 after loop,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_urlglob.c,549,FP,glob->buf freed once via dyn_free inside guarded block; not UAF,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_urlglob.c,558,FP,"*globbed=NULL pointer assignment, not char sign extension",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_urlglob.c,628,FP,"*globbed = strdup(...) pointer assignment, not char widening",curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_urlglob.c,629,FP,curlx_strdup macro wrapper; declaration in curlx headers,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_urlglob.c,638,FP,filename guarded by while(*filename); internal CLI caller passes valid ptr,curl_full_audit_0.4.35,high
MSC37-C,curl,src/tool_urlglob.c,638,FP,"Both #if/#else branches return; all paths covered, misparse of preprocessor",curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_urlglob.c,639,FP,glob read-only here but matches glob_* family non-const signature convention,curl_full_audit_0.4.35,med
STR34-C,curl,src/tool_urlglob.c,642,FP,"*output=NULL pointer assignment, not char sign extension",curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_urlglob.c,654,FP,"num filled by curlx_str_number(&filename,&num,...); used only on success(0)",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_urlglob.c,708,FP,"*output=sanitized pointer assignment, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_urlglob.c,712,FP,"*output=dyn_ptr pointer assignment, not char widening",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,145,FP,"conn passed through to sasl parser; project convention, not const-able idiomatically",curl_full_audit_0.4.35,med
ARR30-C,curl,lib/smtp.c,151,FP,"NUL-terminated string scan (*ptr guard); standard C string idiom, not unbounded",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,182,FP,data is Curl_easy mutated downstream via meta/state; not const-able,curl_full_audit_0.4.35,high
STR34-C,curl,lib/smtp.c,186,FP,"pointer init from path[1], no char-to-int sign-extension assignment here",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/smtp.c,187,FP,"localhost buffer sized HOSTNAME_MAX+1 for gethostname, not getenv",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/smtp.c,187,FP,"fixed-size stack array, compile-time HOSTNAME_MAX bound; not a VLA",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,207,FP,data mutated via Curl_urldecode writing smtp->custom; not const,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/smtp.c,262,FP,fqma+1 is valid string-tail pointer after fqma[0]=='<' check; not OOB,curl_full_audit_0.4.35,high
STR34-C,curl,lib/smtp.c,276,FP,"*addressend='\0' is a store, no sign-extension read",curl_full_audit_0.4.35,high
STR34-C,curl,lib/smtp.c,277,FP,"*suffix assigned pointer (addressend+1), no char sign-extension",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/smtp.c,284,FP,guarded by if(host->name) before deref,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/smtp.c,296,FP,"dup is heap (curlx_strdup), not stack; *address=dup is valid escape",curl_full_audit_0.4.35,high
STR34-C,curl,lib/smtp.c,296,FP,"*address=dup is pointer store, no sign extension",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,312,FP,cr_eob_init is creader vtable signature; fixed by Curl_crtype typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,313,FP,reader->ctx written; vtable signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,324,FP,cr_eob_close vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,324,FP,reader vtable param; signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,337,FP,"cr_eob_read vtable signature; reader->ctx used, fixed by typedef",curl_full_audit_0.4.35,high
API05-C,curl,lib/smtp.c,338,FP,curl never uses C99 array-param syntax; advisory style,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/smtp.c,366,FP,i and start index same buf; i-start is valid same-array subtraction,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/smtp.c,389,FP,nread-start same buffer; valid same-array subtraction,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,439,FP,cr_eob_total_length vtable signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,440,FP,reader vtable param; fixed signature,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/smtp.c,469,FP,reader set by Curl_creader_create under if(!result); non-NULL on add,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,484,FP,smtp_endofresp is endofresp vtable handler; signature fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/smtp.c,485,FP,advisory array-syntax; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/smtp.c,485,FP,advisory array-syntax; curl convention,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/smtp.c,509,FP,"index is 3 or 5, both < tmpline[6]; in-bounds",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,534,FP,smtp_get_message vtable handler; data used for conn meta,curl_full_audit_0.4.35,high
STR30-C,curl,lib/smtp.c,563,FP,Curl_bufref_set stores ptr+free fn (NULL here); does not modify literal,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/smtp.c,580,FP,"const string array sized by initializer; explicit size unnecessary, idiomatic",curl_full_audit_0.4.35,med
MSC37-C,curl,lib/smtp.c,681,FP,both #ifdef USE_SSL and #else branches return; macro-branch artifact,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,826,FP,smtp passed but smtp->rcpt traversal; called from non-const dispatch chain,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/smtp.c,859,FP,"address is out-param of smtp_parse_address, always set to dup; result checked",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/smtp.c,870,FP,!strcmp boolean idiom in option dispatch; idiomatic,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,899,FP,smtp->rcpt traversed; part of non-const perform dispatch family,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/smtp.c,933,FP,address non-NULL after smtp_parse_address success; result checked at goto out,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/smtp.c,940,FP,address non-NULL out-param; result checked,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/smtp.c,962,FP,inner-block address (decl 956) distinct from FROM-block address; not freed yet,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/smtp.c,963,FP,address just (re)assigned by parse; not freed; scope conflation,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/smtp.c,971,FP,"address live, single free at 984; sqc conflates separate blocks",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/smtp.c,976,FP,address used before its single free at 984; not UAF,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/smtp.c,976,FP,address non-NULL out-param after parse success,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/smtp.c,983,FP,address used in else-branch before single free; not UAF,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/smtp.c,983,FP,address non-NULL out-param after parse success,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/smtp.c,984,FP,single free of inner-block address per execution; not double-free,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/smtp.c,984,FP,only one curlx_free(address) for this block; if/else exclusive paths,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/smtp.c,1010,FP,!Curl_checkheaders presence-test idiom; idiomatic boolean use,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,1090,FP,"smtp->rcpt traversed; perform dispatch family, not const convention",curl_full_audit_0.4.35,med
EXP34-C,curl,lib/smtp.c,1107,FP,address non-NULL out-param after smtp_parse_address; result checked,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/smtp.c,1112,FP,address non-NULL out-param; result checked at line 1101,curl_full_audit_0.4.35,high
INT30-C,curl,lib/smtp.c,1240,FP,len-- inside while(len && ...) guard; len>0 guaranteed,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/smtp.c,1512,FP,Curl_meta_get returns properly-aligned stored struct; opaque-cast artifact,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/smtp.c,1717,FP,meta_get returns aligned struct pointer; not a char* reinterpret,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,1812,FP,"smtp->transfer written at 1817; param IS modified, not const-able",curl_full_audit_0.4.35,med
EXP36-C,curl,lib/smtp.c,1872,FP,meta_get returns aligned struct; alignment preserved,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/smtp.c,1924,FP,meta_get returns aligned struct pointer; opaque-cast artifact,curl_full_audit_0.4.35,high
API05-C,curl,lib/smtp.c,1942,FP,dtor vtable signature; advisory array syntax not used in curl,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,1942,FP,smtp_easy_dtor key is dtor-callback signature fixed by Curl_meta typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/smtp.c,1942,FP,dtor vtable signature; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/smtp.c,1950,FP,smtp_conn_dtor vtable signature; advisory array syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/smtp.c,1950,FP,dtor-callback key param fixed by meta typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/smtp.c,1950,FP,dtor vtable signature; advisory,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/smtp.c,1967,FP,smtpc assigned by curlx_calloc same statement region; calloc macro opacity,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/smtp.c,1974,FP,smtp assigned by curlx_calloc before use; macro opacity,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/smtp.c,1981,FP,smtpc/smtp owned by meta system via dtors (smtp_conn_dtor/smtp_easy_dtor); not leaked,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/smtp.c,2012,FP,"Curl_scheme_smtp has external linkage by design (referenced in smtps upgrade, scheme table)",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/smtp.c,2012,FP,exported scheme handler must be file-scope external; minimal-scope N/A,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/smtp.c,2029,FP,Curl_scheme_smtps external by design (set as conn->scheme in TLS upgrade),curl_full_audit_0.4.35,high
DCL19-C,curl,lib/smtp.c,2029,FP,exported scheme symbol; must have external linkage,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cf-h2-proxy.c,106,FP,tunnel_stream_clear frees distinct members sequentially then memset; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cf-h2-proxy.c,107,FP,frees distinct struct member sendbuf; no access to freed memory,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/cf-h2-proxy.c,109,FP,sizeof(*ts) on struct pointer is correct memset idiom; ts not an array,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cf-h2-proxy.c,161,FP,Curl_safefree of single member proxyuserpwd; no subsequent use,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cf-h2-proxy.c,161,FP,"data->state member free; nulled by safefree, no UAF",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/cf-h2-proxy.c,197,FP,sizeof(*ctx) on struct pointer is correct memset idiom,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h2-proxy.c,209,TP,static helper drain_tunnel reads cf only; const valid but curl idiom,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/cf-h2-proxy.c,211,TP,"static helper, tunnel read-only; const addable but curl idiom",curl_full_audit_0.4.35,low
API05-C,curl,lib/cf-h2-proxy.c,220,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-h2-proxy.c,221,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-h2-proxy.c,249,FP,"o initialized via nghttp2_option_new out-param, guarded by rc check",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h2-proxy.c,261,TP,static helper reads ctx->h2 only; const addable but curl idiom,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/cf-h2-proxy.c,396,FP,nghttp2 send callback signature fixed by typedef; const impossible,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-h2-proxy.c,397,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-h2-proxy.c,398,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h2-proxy.c,429,FP,nghttp2 on_frame_send callback signature fixed by typedef,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/cf-h2-proxy.c,442,FP,len=msnprintf return bounded by sizeof-1=255; buffer[len] in bounds,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h2-proxy.c,449,FP,nghttp2 on_frame_recv callback signature fixed by typedef,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/cf-h2-proxy.c,465,FP,len=msnprintf return bounded by sizeof-1; buffer[len] in bounds,curl_full_audit_0.4.35,high
FLP03-C,curl,lib/cf-h2-proxy.c,509,FP,status/100 is integer division on int status; not floating point,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h2-proxy.c,529,FP,nghttp2 on_header callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-h2-proxy.c,531,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-h2-proxy.c,532,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-h2-proxy.c,534,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cf-h2-proxy.c,574,FP,"resp set by Curl_http_resp_make, guarded by if(result) return",curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-h2-proxy.c,598,FP,conformant array syntax advisory; nghttp2 callback signature,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-h2-proxy.c,599,FP,conformant array syntax advisory; nghttp2 callback signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h2-proxy.c,600,FP,nghttp2 tunnel_send_callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-h2-proxy.c,601,FP,conformant array syntax advisory; nghttp2 callback signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h2-proxy.c,636,FP,nghttp2 recv callback signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-h2-proxy.c,638,FP,conformant array syntax advisory; nghttp2 callback signature,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-h2-proxy.c,638,FP,conformant array syntax advisory; nghttp2 callback signature,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h2-proxy.c,638,FP,userp in nghttp2 callback signature; fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h2-proxy.c,665,FP,nghttp2 on_stream_close callback signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h2-proxy.c,689,FP,"cf is (void)cf unused param; const trivial but cosmetic, not a violation",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-h2-proxy.c,696,FP,read_ctx stored into data_prd.source.ptr (void*); not const-able cleanly,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/cf-h2-proxy.c,759,FP,"req set by create_CONNECT, guarded by if(result) goto out before use",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cf-h2-proxy.c,761,FP,req non-NULL after success guard; passed safely,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/cf-h2-proxy.c,807,FP,Curl_safefree(newurl) then state change; no access to freed newurl,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-h2-proxy.c,901,FP,rc is int return; cbs freed at out: via callbacks_del; no leak,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-h2-proxy.c,904,FP,cbs freed unconditionally at out: label on all goto paths,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-h2-proxy.c,921,FP,rc is int; ctx->h2 alloc freed by cf_h2_proxy_ctx_clear; no leak,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cf-h2-proxy.c,921,FP,"cbs set by callbacks_new, guarded by if(rc) goto out before use",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-h2-proxy.c,924,FP,session in ctx->h2 freed by ctx_clear/ctx_free; not leaked on goto,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-h2-proxy.c,941,FP,"ctx->h2 owned by ctx, freed at destroy; rc is int return",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-h2-proxy.c,951,FP,"ctx->h2 owned by ctx, freed at destroy; no leak on goto",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-h2-proxy.c,961,FP,"ctx->h2 owned by ctx structure, freed by ctx_free; not a local leak",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-h2-proxy.c,987,FP,save initialized by CF_DATA_SAVE macro sqc cannot expand,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-h2-proxy.c,1025,FP,save initialized by CF_DATA_SAVE macro sqc cannot expand,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h2-proxy.c,1034,FP,cf_h2_proxy_destroy vtable signature; data param fixed by Curl_cftype,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-h2-proxy.c,1058,FP,save initialized by CF_DATA_SAVE macro sqc cannot expand,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h2-proxy.c,1089,FP,cf_h2_proxy_data_pending vtable signature; cf fixed by Curl_cftype,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-h2-proxy.c,1122,FP,save initialized by CF_DATA_SAVE macro sqc cannot expand,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-h2-proxy.c,1174,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-h2-proxy.c,1203,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-h2-proxy.c,1211,FP,save initialized by CF_DATA_SAVE macro sqc cannot expand,curl_full_audit_0.4.35,high
API05-C,curl,lib/cf-h2-proxy.c,1249,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-h2-proxy.c,1259,FP,save initialized by CF_DATA_SAVE macro sqc cannot expand,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cf-h2-proxy.c,1307,FP,trace-macro args are read-only nghttp2 query/bufq_len calls; no shared side effects,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-h2-proxy.c,1326,FP,save initialized by CF_DATA_SAVE macro sqc cannot expand,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/cf-h2-proxy.c,1339,FP,trace-macro args are read-only query functions; ordering irrelevant,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-h2-proxy.c,1397,FP,save initialized by CF_DATA_SAVE macro sqc cannot expand,curl_full_audit_0.4.35,high
STR34-C,curl,lib/cf-h2-proxy.c,1428,FP,*palpn=NULL assigns null to const char*; no sign extension,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-h2-proxy.c,1441,FP,cf_h2_proxy_cntrl vtable signature; arg2 is (void)arg2 unused,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-h2-proxy.c,1451,FP,save initialized by CF_DATA_SAVE macro sqc cannot expand,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-h2-proxy.c,1479,FP,insert_after passes cf onward without dereferencing it itself; caller-validated,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-h2-proxy.c,1480,FP,exported API signature; data is (void)data unused,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-h2-proxy.c,1487,FP,ctx=calloc then guarded by if(!ctx) goto out; sizeof(*ctx) not a deref,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_trc.c,48,FP,conformant-array-syntax advisory; curl never uses C99 array params,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/curl_trc.c,59,FP,"7 string initializers each fit [3]; not excess elements, dim0 inferred",curl_full_audit_0.4.35,high
ERR00-C,curl,lib/curl_trc.c,65,FP,verbose-trace fwrite to stderr; ignoring return is idiomatic logging,curl_full_audit_0.4.35,med
ERR33-C,curl,lib/curl_trc.c,65,FP,trace output fwrite; unchecked write to debug stream acceptable,curl_full_audit_0.4.35,med
ERR00-C,curl,lib/curl_trc.c,66,FP,verbose-trace fwrite to stderr; idiomatic unchecked logging,curl_full_audit_0.4.35,med
ERR33-C,curl,lib/curl_trc.c,66,FP,trace output fwrite; unchecked write to debug stream acceptable,curl_full_audit_0.4.35,med
CON03-C,curl,lib/curl_trc.c,83,FP,static config feat struct set once at init; not a concurrency defect,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_trc.c,91,FP,data read via macros and conn deref; const-param not project convention,curl_full_audit_0.4.35,med
API05-C,curl,lib/curl_trc.c,91,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_trc.c,108,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_trc.c,126,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/curl_trc.c,129,FP,"7 two-char initializers fit [3]; outer dim inferred, no overflow",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/curl_trc.c,131,FP,buf is fixed trace line buffer; no getenv involved here,curl_full_audit_0.4.35,high
ERR02-C,curl,lib/curl_trc.c,138,FP,curl_msnprintf not sprintf; return used to advance len safely,curl_full_audit_0.4.35,high
ERR00-C,curl,lib/curl_trc.c,160,FP,trace fwrite to err stream; idiomatic unchecked logging,curl_full_audit_0.4.35,med
ERR33-C,curl,lib/curl_trc.c,160,FP,trace fwrite; unchecked write to debug stream acceptable,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/curl_trc.c,160,FP,"buf declared at 131, len set at 159 before fwrite; initialized",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curl_trc.c,160,FP,len assigned by trc_print_ids at 159 before use; initialized,curl_full_audit_0.4.35,high
ERR00-C,curl,lib/curl_trc.c,163,FP,trace fwrite to err stream; idiomatic unchecked logging,curl_full_audit_0.4.35,med
ERR33-C,curl,lib/curl_trc.c,163,FP,trace fwrite; unchecked write acceptable,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/curl_trc.c,163,FP,type constrained by switch cases TEXT/HEADER_* all < CURLINFO_END,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_trc.c,163,FP,type bounded by enclosing switch to valid CURLINFO values,curl_full_audit_0.4.35,high
ERR00-C,curl,lib/curl_trc.c,164,FP,trace fwrite to err stream; idiomatic unchecked logging,curl_full_audit_0.4.35,med
ERR33-C,curl,lib/curl_trc.c,164,FP,trace fwrite; unchecked write acceptable,curl_full_audit_0.4.35,med
MSC07-C,curl,lib/curl_trc.c,166,FP,break ends case then default follows; not unreachable code,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_trc.c,176,FP,"internal logging fn; data always valid from caller, DEBUGASSERT guards",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/curl_trc.c,176,FP,Curl_failf is exported API used across translation units; needs linkage,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/curl_trc.c,182,FP,"error[CURL_ERROR_SIZE+2] is fixed-size array, not a VLA",curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_trc.c,197,FP,thin internal fn; data always valid from caller,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_trc.c,235,FP,"feat read only but matches internal trc_infof sig; const advisory, not violation",curl_full_audit_0.4.35,med
ENV01-C,curl,lib/curl_trc.c,240,FP,buf is fixed trace line buffer; no getenv at this site,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curl_trc.c,243,FP,buf written by trc_print_ids via out-param before any read; len starts 0,curl_full_audit_0.4.35,high
ERR02-C,curl,lib/curl_trc.c,245,FP,curl_msnprintf not sprintf; return accumulated into len safely,curl_full_audit_0.4.35,high
ERR02-C,curl,lib/curl_trc.c,248,FP,curl_msnprintf not sprintf; return used safely,curl_full_audit_0.4.35,high
ERR02-C,curl,lib/curl_trc.c,251,FP,curl_msnprintf not sprintf; return used safely,curl_full_audit_0.4.35,high
ERR02-C,curl,lib/curl_trc.c,253,FP,curl_mvsnprintf not sprintf; return used safely,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_trc.c,258,FP,"logging fn; data always valid, guarded by Curl_trc_is_verbose",curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_trc.c,269,FP,logging fn; data valid from caller,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_trc.c,269,FP,cf guarded by DEBUGASSERT(cf) and verbose check,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/curl_trc.c,281,FP,"implicit-bounds string array with initializer; idiomatic, size used via ARRAYSIZE",curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_trc.c,318,FP,internal fn; data valid from caller,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_trc.c,321,FP,e is reassigned in while loop (e=Curl_node_next); not const-eligible,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/curl_trc.c,323,FP,Curl_pgrs_now returns properly aligned struct curltime*; no char* misalignment,curl_full_audit_0.4.35,med
ARR02-C,curl,lib/curl_trc.c,334,FP,implicit-bounds string array with initializer; idiomatic,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_trc.c,361,FP,internal logging fn; data valid,curl_full_audit_0.4.35,high
CON03-C,curl,lib/curl_trc.c,508,FP,trc_feats config table set once at startup via trc_opt; not concurrency defect,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/curl_trc.c,508,FP,implicit-bounds initializer array; size via ARRAYSIZE,curl_full_audit_0.4.35,high
CON03-C,curl,lib/curl_trc.c,537,FP,trc_cfts config table set once at startup; not concurrency defect,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/curl_trc.c,537,FP,implicit-bounds initializer array; size via ARRAYSIZE,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_trc.c,639,FP,config NULL-checked via ternary before trc_opt; param can be NULL safely,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/curl_trc.c,645,FP,getenv result explicitly checked: if(dbg_config) before use,curl_full_audit_0.4.35,high
CON34-C,curl,lib/curl_trc.c,645,FP,DEBUGBUILD-only one-time init read of getenv; no threading concern,curl_full_audit_0.4.35,med
ENV30-C,curl,lib/curl_trc.c,647,FP,trc_opt takes const char* and does not modify the getenv string,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/curl_trc.c,653,FP,both #ifdef arms return; all paths covered,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_trc.c,669,FP,"CURL_DISABLE_VERBOSE stub; data unused-cast, matches exported prototype, const cannot change ABI",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_trc.c,675,FP,"exported-API stub; prototype fixed, const-param not applicable",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_trc.c,683,FP,exported-API stub; prototype fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_trc.c,689,FP,exported-API stub; prototype fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_trc.c,695,FP,exported-API stub; prototype fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_trc.c,701,FP,exported-API stub; prototype fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_trc.c,708,FP,exported-API stub; prototype fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_trc.c,715,FP,exported-API stub; prototype fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_trc.c,722,FP,exported-API stub; prototype fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_trc.c,729,FP,exported-API stub; prototype fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_trc.c,736,FP,exported-API stub; prototype fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_trc.c,743,FP,exported-API stub; prototype fixed,curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_paramhlp.c,27,FP,8-char-filename ambiguity is obsolete DOS concern; FP by convention,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_paramhlp.c,35,FP,config deref guarded; CLI never passes NULL config,curl_full_audit_0.4.35,high
CON07-C,curl,src/tool_paramhlp.c,35,FP,outnum is CLI single-thread parse counter; no concurrency,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_paramhlp.c,37,FP,curlx_calloc declared via included curlx headers; macro/inline wrapper,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_paramhlp.c,40,FP,outnum single-threaded CLI arg parsing; no thread visibility issue,curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_paramhlp.c,57,FP,"ISCRLF multi-eval of x; arg is always *ptr lvalue, no side effects",curl_full_audit_0.4.35,med
PRE12-C,curl,src/tool_paramhlp.c,57,FP,ISCRLF arg has no side effects at call sites; idiomatic char macro,curl_full_audit_0.4.35,med
API05-C,curl,src/tool_paramhlp.c,69,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_paramhlp.c,69,TP,static memcrlf reads orig only; const char* would be correct,curl_full_audit_0.4.35,low
EXP33-C,curl,src/tool_paramhlp.c,92,FP,buffer filled by fread at 94 before read at 100-101,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_paramhlp.c,94,FP,fread result used; ferror checked immediately after at line 95,curl_full_audit_0.4.35,high
ARR38-C,curl,src/tool_paramhlp.c,94,FP,"fread(buffer,1,sizeof) reading bytes; element size 1 is correct",curl_full_audit_0.4.35,high
FIO17-C,curl,src/tool_paramhlp.c,94,FP,"raw byte read into dynbuf, not a C-string; no null-term needed",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_paramhlp.c,97,FP,"char**/char* deref; categorical STR34 FP, no widening sign-extension bug",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_paramhlp.c,102,FP,ptr passed to memcrlf as char*; no integer widening of plain char,curl_full_audit_0.4.35,high
INT30-C,curl,src/tool_paramhlp.c,105,FP,nlen<=nread by memcrlf contract (counts within max); no underflow,curl_full_audit_0.4.35,high
INT30-C,curl,src/tool_paramhlp.c,111,FP,nlen<=nread (memcrlf bounded by passed nread); no wrap,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_paramhlp.c,116,FP,char** assignment; categorical STR34 FP,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_paramhlp.c,120,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_paramhlp.c,146,FP,fread result used; ferror checked at 147,curl_full_audit_0.4.35,high
ARR38-C,curl,src/tool_paramhlp.c,146,FP,"fread(buffer,1,sizeof) byte read; element size 1 correct",curl_full_audit_0.4.35,high
FIO17-C,curl,src/tool_paramhlp.c,146,FP,"raw byte read into dynbuf, not string",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_paramhlp.c,150,FP,char** assignment; categorical STR34 FP,curl_full_audit_0.4.35,high
ARR00-C,curl,src/tool_paramhlp.c,165,FP,buffer filled by fread at 146; throwaway<nread so &buffer[throwaway] valid,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_paramhlp.c,165,FP,throwaway<nread<=4096 guaranteed by branch at 162; in bounds,curl_full_audit_0.4.35,high
ARR39-C,curl,src/tool_paramhlp.c,172,FP,"endo-offset is plain curl_off_t arithmetic, no sizeof scaling",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_paramhlp.c,184,FP,char** assignment; categorical STR34 FP,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_paramhlp.c,188,FP,char** assignment; categorical STR34 FP,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_paramhlp.c,193,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_paramhlp.c,273,FP,str passed to str2unum which is NULL-tolerant via str2num/DEBUGASSERT chain,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_paramhlp.c,301,FP,implicit-bounds initializer array digs[]; idiomatic,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_paramhlp.c,326,FP,digs[len-1] entries all nonzero powers of ten; len clamped >=1 by loop,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_paramhlp.c,355,FP,"pointer comparison/index, categorical STR34 FP",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_paramhlp.c,355,FP,"pointer comparison, categorical STR34 FP",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_paramhlp.c,369,FP,"pointer comparison, categorical STR34 FP",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_paramhlp.c,369,FP,"pointer comparison, categorical STR34 FP",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_paramhlp.c,372,FP,"pointer assignment, categorical STR34 FP",curl_full_audit_0.4.35,high
API00-C,curl,src/tool_paramhlp.c,395,FP,val is const char** read via for(;*val;val++); NULL would loop zero times anyway,curl_full_audit_0.4.35,med
MEM05-C,curl,src/tool_paramhlp.c,400,FP,"protoset[MAX_PROTOS+1] is fixed-size array, not VLA",curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_paramhlp.c,417,FP,while(*str) NUL-terminated parse; str bounded by string end and strchr,curl_full_audit_0.4.35,high
CON43-C,curl,src/tool_paramhlp.c,433,FP,single-threaded CLI parse; switch(*str++) no double-fetch race,curl_full_audit_0.4.35,high
INT32-C,curl,src/tool_paramhlp.c,457,FP,proto_count<=MAX_PROTOS asserted at 402-404; (count+1)*ptr cannot overflow,curl_full_audit_0.4.35,high
EXP05-C,curl,src/tool_paramhlp.c,457,FP,"(char*)protoset cast for memcpy dst; copies into local, no const object modified illegally",curl_full_audit_0.4.35,high
EXP05-C,curl,src/tool_paramhlp.c,457,FP,duplicate of same memcpy cast finding; same site FP,curl_full_audit_0.4.35,high
EXP05-C,curl,src/tool_paramhlp.c,496,FP,(char*)protoset cast for qsort of local array; not modifying const object,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_paramhlp.c,508,FP,curlx_free declared via included curlx headers,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_paramhlp.c,509,FP,char** deref; categorical STR34 FP,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_paramhlp.c,548,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_paramhlp.c,551,FP,conformant-array-syntax advisory; curl convention,curl_full_audit_0.4.35,high
DCL00-C,curl,src/tool_paramhlp.c,567,FP,passwd[2048] written by getpass_r at 586; not const-eligible,curl_full_audit_0.4.35,high
MEM03-C,curl,src/tool_paramhlp.c,567,TP,"passwd holds prompted password, not zeroed before scope exit; minor hygiene",curl_full_audit_0.4.35,low
STR34-C,curl,src/tool_paramhlp.c,573,FP,*osep='\0' char store; categorical STR34 FP,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_paramhlp.c,588,FP,*osep=';' char store; categorical STR34 FP,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_paramhlp.c,594,FP,curlx_free declared via included headers,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_paramhlp.c,595,FP,char** deref assignment; categorical STR34 FP,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_paramhlp.c,605,FP,newlist from curl_slist_append is heap-allocated; *list=newlist stores valid heap ptr not local addr,curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_paramhlp.c,652,FP,isheadersep multi-eval; call site arg head->data[thislen] has no side effects,curl_full_audit_0.4.35,med
PRE12-C,curl,src/tool_paramhlp.c,652,FP,isheadersep arg side-effect-free at call site; idiomatic char macro,curl_full_audit_0.4.35,med
STR34-C,curl,src/tool_paramhlp.c,660,FP,strlen on checkfor; no plain-char widening bug,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_paramhlp.c,673,FP,config always valid from CLI caller; members deref'd safely,curl_full_audit_0.4.35,high
MSC41-C,curl,src/tool_paramhlp.c,692,FP,"""host"" is a label string (purpose kind), not a hardcoded credential",curl_full_audit_0.4.35,high
MSC41-C,curl,src/tool_paramhlp.c,696,FP,"""proxy"" is a label string, not a hardcoded credential",curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_paramhlp.c,715,FP,implicit-bounds struct array with initializer; size via ARRAYSIZE,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_paramhlp.c,726,FP,!strcmp string-match idiom; intentional equality test,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/telnet.c,61,FP,Internal macro always called with simple identifier (tn); no multi-eval bug,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/telnet.c,61,FP,Internal macro arg is always plain identifier; precedence not an issue,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/telnet.c,61,FP,Idiomatic internal accessor macro; style advisory only,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/telnet.c,62,FP,Internal macro always called with simple identifier (tn); no multi-eval bug,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/telnet.c,62,FP,Idiomatic internal accessor macro; style advisory only,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/telnet.c,67,FP,Internal macro always called with simple identifier (tn); no multi-eval bug,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/telnet.c,67,FP,Idiomatic internal accessor macro; style advisory only,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/telnet.c,73,FP,Internal macro always called with simple identifier (tn); no multi-eval bug,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/telnet.c,74,FP,Internal macro always called with simple identifier (tn); no multi-eval bug,curl_full_audit_0.4.35,high
PRE12-C,curl,lib/telnet.c,74,FP,Idiomatic internal accessor macro; style advisory only,curl_full_audit_0.4.35,high
API01-C,curl,lib/telnet.c,126,FP,subbuffer access bounds-checked via CURL_SB_ACCUM; idiomatic struct layout,curl_full_audit_0.4.35,med
API05-C,curl,lib/telnet.c,169,FP,Curl never uses C99 array-param syntax; convention FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/telnet.c,169,FP,Signature fixed by Curl_hash_elem_dtor typedef; const cannot be added,curl_full_audit_0.4.35,high
API05-C,curl,lib/telnet.c,169,FP,Curl never uses C99 array-param syntax; convention FP,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/telnet.c,175,FP,Sequential free of distinct struct members in dtor; no UAF,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,195,FP,Index is small CURL_TELOPT_* constant (<40) into [256] array; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,196,FP,Index is small CURL_TELOPT_* constant (<40) into [256] array; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,203,FP,Index is small CURL_TELOPT_* constant (<40) into [256] array; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,204,FP,Index is small CURL_TELOPT_* constant (<40) into [256] array; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,212,FP,Index is small CURL_TELOPT_* constant (<40) into [256] array; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,225,FP,Index is small CURL_TELOPT_* constant (<40) into [256] array; in bounds,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,253,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,253,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,253,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,255,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,255,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,255,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,264,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,264,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,264,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,267,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,267,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,267,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,276,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,276,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,276,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,281,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,281,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,281,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,288,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,288,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,288,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,294,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,294,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,294,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,299,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,299,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,299,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,304,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,304,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,304,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,310,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,310,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,310,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,312,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,312,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,312,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,326,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,326,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,326,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,328,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,328,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,328,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,337,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,337,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,337,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,340,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,340,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,340,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,349,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,349,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,349,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,354,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,354,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,354,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,361,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,361,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,361,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,367,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,367,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,367,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,372,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,372,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,372,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,377,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,377,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,377,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,383,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,383,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,383,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,385,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,385,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,385,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,413,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,413,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,415,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,415,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,416,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,416,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,429,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,429,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,432,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,432,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,436,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,436,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,437,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,437,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,443,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,443,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,445,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,445,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,448,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,448,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,449,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,449,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,459,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,459,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,459,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,465,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,465,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,465,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,470,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,470,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,470,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,472,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,472,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,472,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,476,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,476,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,476,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,477,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,477,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,477,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,484,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,484,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,484,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,486,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,486,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,486,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,489,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,489,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,489,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,490,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,490,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,490,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
API05-C,curl,lib/telnet.c,499,FP,Curl never uses C99 array-param syntax; convention FP,curl_full_audit_0.4.35,high
API05-C,curl,lib/telnet.c,613,FP,Curl never uses C99 array-param syntax; convention FP,curl_full_audit_0.4.35,high
STR31-C,curl,lib/telnet.c,647,FP,"pfd is struct pollfd[1], not a char string array; misfire",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,648,FP,pfd fields .fd/.events set before Curl_poll reads them,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/telnet.c,694,FP,uc points to 2-byte short; byte-indexed endian access is valid,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/telnet.c,695,FP,uc points to 2-byte short; byte-indexed endian access is valid,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/telnet.c,696,FP,uc points to 2-byte short; byte-indexed endian access is valid,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/telnet.c,697,FP,uc points to 2-byte short; byte-indexed endian access is valid,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/telnet.c,711,FP,err assigned from SOCKERRNO and used only inside same if-block,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,728,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,728,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,730,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,730,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,731,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,731,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,733,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,733,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,737,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,737,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,739,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,739,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,752,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,752,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,755,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,755,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,759,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,759,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,760,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,760,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,766,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,766,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,768,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,768,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,769,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,769,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,775,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,775,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,776,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,776,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,786,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,786,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,786,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,792,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,792,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,792,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,797,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,797,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,797,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,799,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,799,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,799,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,803,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,803,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,803,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,804,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,804,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,804,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,811,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,811,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,811,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,813,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,813,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,813,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,816,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,816,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,816,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,817,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,817,FP,option is int 0-255 (unsigned char from telrcv) indexing [256] arrays; in bounds,curl_full_audit_0.4.35,high
STR00-C,curl,lib/telnet.c,817,FP,"'option' param is declared int, not char; value bounded 0-255",curl_full_audit_0.4.35,high
STR34-C,curl,lib/telnet.c,827,FP,Idiomatic plain-char read in nonascii scan; no real conversion bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/telnet.c,827,FP,Idiomatic plain-char read in nonascii scan; no real conversion bug,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,857,FP,Index is small CURL_TELOPT_* constant (<40) into [256] array; in bounds,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,860,FP,"head is for-loop init var, guarded non-NULL by loop condition",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/telnet.c,863,FP,arg assigned and used only inside if(sep) block,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,875,FP,Index is small CURL_TELOPT_* constant (<40) into [256] array; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,885,FP,Index is small CURL_TELOPT_* constant (<40) into [256] array; in bounds,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/telnet.c,895,FP,beg assigned before every use,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,900,FP,Index is small CURL_TELOPT_* constant (<40) into [256] array; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,921,FP,Index is small CURL_TELOPT_* constant (<40) into [256] array; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,935,FP,Index is small CURL_TELOPT_* constant (<40) into [256] array; in bounds,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,936,FP,Index is small CURL_TELOPT_* constant (<40) into [256] array; in bounds,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/telnet.c,1006,FP,err assigned from SOCKERRNO inside same if-block before use,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/telnet.c,1034,FP,v assigned in for-init; loop guard ensures defined,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/telnet.c,1034,FP,for(v=...;v;...) guard ensures v non-NULL before deref,curl_full_audit_0.4.35,high
ERR02-C,curl,lib/telnet.c,1042,FP,"curl_msnprintf return value is used (len += ...), not ignored",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,1042,FP,temp filled by msnprintf before any read; bounded by size check,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,1042,FP,len bounded by len+tmplen<sizeof(temp)-6 guard at line 1039,curl_full_audit_0.4.35,high
STR34-C,curl,lib/telnet.c,1045,FP,"vlen is pointer subtraction (s - v->data), not char conversion",curl_full_audit_0.4.35,high
ERR02-C,curl,lib/telnet.c,1046,FP,"curl_msnprintf return value is used (len += ...), not ignored",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/telnet.c,1046,FP,temp filled by msnprintf before any read; bounded by size check,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,1046,FP,len bounded by len+tmplen<sizeof(temp)-6 guard at line 1039,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/telnet.c,1052,FP,len bounded by prior size-check guard; within temp[2048],curl_full_audit_0.4.35,high
API05-C,curl,lib/telnet.c,1068,FP,Curl never uses C99 array-param syntax; convention FP,curl_full_audit_0.4.35,high
PRE02-C,curl,lib/telnet.c,1078,FP,Local helper macro used as full statement; advisory only,curl_full_audit_0.4.35,med
PRE10-C,curl,lib/telnet.c,1078,FP,Macro must return from enclosing fn; cannot be do-while wrapped,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/telnet.c,1208,FP,result assigned at line 1207 immediately before the if(result) test,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/telnet.c,1250,FP,"buffer[4*1024] is a constant-size array, not a VLA",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/telnet.c,1407,FP,buffer filled by Curl_xfer_recv before telrcv reads it,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/telnet.c,1597,FP,"Curl_scheme_telnet is extern, referenced in scheme table; must not be static",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/telnet.c,1597,FP,Exported scheme object; cannot have file-only scope,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/vtls/x509asn1.c,97,FP,Array initialized with explicit terminator; implicit size idiomatic,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/x509asn1.c,170,FP,Curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/x509asn1.c,170,FP,Curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,181,FP,beg/end delimit same single ASN.1 buffer; not distinct arrays,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,182,FP,beg/end delimit same single ASN.1 buffer; not distinct arrays,curl_full_audit_0.4.35,high
INT14-C,curl,lib/vtls/x509asn1.c,182,FP,Readability advisory on pointer arithmetic; idiomatic,curl_full_audit_0.4.35,high
INT08-C,curl,lib/vtls/x509asn1.c,190,FP,b masked into small fixed range; no overflow risk,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,197,FP,beg/end same buffer,curl_full_audit_0.4.35,high
EXP45-C,curl,lib/vtls/x509asn1.c,202,FP,Intentional assign-and-test idiom (b&=0x7F); clear in context,curl_full_audit_0.4.35,med
ARR36-C,curl,lib/vtls/x509asn1.c,208,FP,beg/end same buffer,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,213,FP,beg/end same buffer,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,218,FP,beg/end same buffer,curl_full_audit_0.4.35,high
INT14-C,curl,lib/vtls/x509asn1.c,224,FP,Readability advisory; idiomatic length decode,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,229,FP,beg/end same buffer,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/x509asn1.c,252,FP,!strcmp OID-match idiom; idiomatic,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vtls/x509asn1.c,253,FP,"Returns OIDtable entry (static storage), not local; op is pointer",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/x509asn1.c,263,FP,"getASN1Element is a function, not uninitialized variable; misparse",curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,278,FP,beg/end same buffer,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,293,FP,beg/end same buffer,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,316,FP,beg/end same buffer,curl_full_audit_0.4.35,high
INT14-C,curl,lib/vtls/x509asn1.c,316,FP,Readability advisory; idiomatic,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/x509asn1.c,316,FP,"Reads via (unsigned char*); already unsigned, no sign extension",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/x509asn1.c,316,FP,Reads via (unsigned char*) cast; no sign extension,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,330,FP,beg/end same buffer,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,345,FP,from/end same buffer,curl_full_audit_0.4.35,high
INT14-C,curl,lib/vtls/x509asn1.c,345,FP,Readability advisory; idiomatic,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/x509asn1.c,345,FP,Reads via (unsigned char*) cast,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/x509asn1.c,345,FP,Reads via (unsigned char*) cast,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,377,FP,from/end same buffer,curl_full_audit_0.4.35,high
FIO50-C,curl,lib/vtls/x509asn1.c,401,FP,"'wc' is a local int, not a FILE*; misparse",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/vtls/x509asn1.c,401,FP,"'wc' is a local int, not a FILE*; misparse",curl_full_audit_0.4.35,high
INT14-C,curl,lib/vtls/x509asn1.c,433,FP,y/40 readability advisory; idiomatic OID decode,curl_full_audit_0.4.35,high
INT14-C,curl,lib/vtls/x509asn1.c,434,FP,x readability advisory; idiomatic,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,441,FP,beg/end same buffer,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,464,FP,beg/end same buffer,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vtls/x509asn1.c,508,FP,fracp[-2] is pointer-relative within buffer (fracp>=beg+14); valid,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vtls/x509asn1.c,511,FP,fracp[-1] pointer-relative; valid given switch guard,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,524,FP,"tzp/end same buffer; ""GMT"" attribution is misparse",curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,537,FP,tzp/end same buffer; misparse,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,548,FP,tzp in-buffer here (+/- branch); end-tzp same buffer,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,552,FP,tzp in-buffer here; end-tzp same buffer,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/vtls/x509asn1.c,555,FP,curlx_dyn_addf not restrict; args don't overlap,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/x509asn1.c,565,FP,UNITTESTS wrapper forwarding to GTime2str which bounds-checks,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/x509asn1.c,565,FP,UNITTESTS wrapper; callee handles params,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,588,FP,tzp/sec both in same buffer; literal attribution misparse,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/vtls/x509asn1.c,609,FP,curlx_dyn_addf not restrict; no overlap,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/x509asn1.c,621,FP,elem written via ASN1tostr path; vtable-style helper,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vtls/x509asn1.c,676,FP,dn fields read but signature matches helper convention,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/vtls/x509asn1.c,692,FP,getASN1Element is a function call; misparse,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/x509asn1.c,782,FP,getASN1Element function call; misparse,curl_full_audit_0.4.35,high
INT07-C,curl,lib/vtls/x509asn1.c,805,FP,defaultVersion=0 const used only as ptr bounds; not numeric op,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,856,FP,tbsCertificate.beg/end same buffer,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,863,FP,same buffer,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,871,FP,same buffer,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/x509asn1.c,895,FP,getASN1Element function call; misparse,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/x509asn1.c,901,FP,beg/end same buffer,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/x509asn1.c,918,FP,strlen of value; no signed-char conversion issue,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/x509asn1.c,968,FP,param is output element filled by getASN1Element; not const,curl_full_audit_0.4.35,med
MEM05-C,curl,lib/vtls/x509asn1.c,986,FP,q[] is compile-time constant size (sizeof expr); not VLA,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/x509asn1.c,996,FP,getASN1Element function call; misparse,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/vtls/x509asn1.c,996,FP,getASN1Element no restrict; pk/pubkey distinct,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vtls/x509asn1.c,1021,FP,r[] compile-time constant size; not VLA,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/x509asn1.c,1240,FP,certptr set by base64_encode on !result; error path goto done,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/vtls/mbedtls.c,108,FP,b used as b[0] array subscript; no precedence issue,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/mbedtls.c,121,FP,strlen(line); no signed-char widening bug,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/mbedtls.c,130,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/mbedtls.c,131,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/mbedtls.c,150,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/mbedtls.c,150,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/mbedtls.c,254,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/vtls/mbedtls.c,267,FP,str/end from same cipher-list string; walk_str invariant,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/mbedtls.c,267,FP,cipher name chars; benign,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/mbedtls.c,267,FP,cipher name chars; benign,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/mbedtls.c,267,FP,cipher name chars; benign,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/mbedtls.c,267,FP,cipher name chars; benign,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/mbedtls.c,297,FP,curlx_malloc declared in curlx header; misparse,curl_full_audit_0.4.35,high
INT30-C,curl,lib/vtls/mbedtls.c,297,FP,"supported_len is mbedtls cipher count, tiny bounded; no wrap",curl_full_audit_0.4.35,med
INT36-C,curl,lib/vtls/mbedtls.c,334,FP,(int)(end-ptr) is ptrdiff for printf width; not ptr storage,curl_full_audit_0.4.35,high
INT36-C,curl,lib/vtls/mbedtls.c,344,FP,(int)(end-ptr) printf width; not pointer storage,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/mbedtls.c,378,FP,curlx_free declared in header; misparse,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/mbedtls.c,402,FP,"strcspn use; p is char* buffer scan, benign",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/mbedtls.c,454,FP,conn_config from cf_get_primary_config returns non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/mbedtls.c,479,FP,conn_config non-NULL in this backend path,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/mbedtls.c,486,FP,"cf->ctx cast chain; properly aligned struct, not char*",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/mbedtls.c,578,FP,alignment misparse on cf->ctx cast,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/mbedtls.c,579,FP,ssl_config from cf_get_config non-NULL,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/mbedtls.c,657,FP,alignment misparse on cf->ctx cast,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/mbedtls.c,663,FP,ssl_config non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/mbedtls.c,701,FP,else-branch implies key_blob non-NULL (guarded by if at 663),curl_full_audit_0.4.35,high
MEM03-C,curl,lib/vtls/mbedtls.c,702,FP,"passwd is borrowed ssl_config->key_passwd, not owned buffer",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/mbedtls.c,744,FP,alignment misparse on cf->ctx cast,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/mbedtls.c,745,FP,ssl_config non-NULL,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/mbedtls.c,753,FP,"ssl_crlfile is char*; used as filename, no char widening",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/mbedtls.c,786,FP,alignment misparse on cf->ctx cast,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/mbedtls.c,838,FP,mbed_set_ssl_version_min_max defined above; declared,curl_full_audit_0.4.35,high
INT32-C,curl,lib/vtls/mbedtls.c,852,FP,"ret is mbedtls negative errcode, never INT_MIN; display only",curl_full_audit_0.4.35,high
INT32-C,curl,lib/vtls/mbedtls.c,903,FP,-ret on mbedtls errcode; never INT_MIN,curl_full_audit_0.4.35,high
INT32-C,curl,lib/vtls/mbedtls.c,908,FP,-ret on mbedtls errcode; never INT_MIN,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/mbedtls.c,978,FP,conn_config non-NULL,curl_full_audit_0.4.35,high
INT30-C,curl,lib/vtls/mbedtls.c,1107,FP,size guarded >0 and <=PUB_DER_MAX_BYTES; no underflow,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/mbedtls.c,1110,FP,mbedtls_x509_crt_free(p) frees internals; curlx_free(p) frees once,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/mbedtls.c,1110,FP,crt_free frees fields not p; single free of p; no double-free,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vtls/mbedtls.c,1113,FP,p and pubkey freed at lines 1109-1111 before return,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vtls/mbedtls.c,1125,FP,"p,pubkey freed before this return",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vtls/mbedtls.c,1132,FP,"p,pubkey freed at pinnedpubkey_error before return",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/mbedtls.c,1189,FP,sc_session set only when !result; Curl_ssl_session_create guards,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/mbedtls.c,1199,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/mbedtls.c,1347,FP,cf/data are vtable callback signature; fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/mbedtls.c,1347,FP,vtable callback signature; const cannot be added,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/mbedtls.c,1363,FP,"config freed here is distinct member; ciphersuites freed prior, no UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/mbedtls.c,1364,FP,ssl is distinct member; not the freed ciphersuites,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/mbedtls.c,1370,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/mbedtls.c,1416,FP,both #ifdef arms return; all paths covered,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/mbedtls.c,1416,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/mbedtls.c,1429,FP,data is vtable callback signature; fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/mbedtls.c,1430,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/mbedtls.c,1540,FP,cf vtable callback signature; fixed by typedef,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/mbedtls.c,1552,FP,both #ifdef arms return a value; covered,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/mbedtls.c,1552,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/mbedtls.c,1554,FP,Curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/mbedtls.c,1572,FP,connssl deref'd to backend; helper not vtable but reads only,curl_full_audit_0.4.35,med
EXP00-C,curl,lib/vtls/mbedtls.c,1585,FP,SSLSUPP flag OR with #ifdef interleave; precedence not ambiguous,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/mbedtls.c,243,FP,mbedtls_ssl_conf_min_tls_version declared in mbedtls/ssl.h; misparse,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/mbedtls.c,244,FP,mbedtls_ssl_conf_max_tls_version declared in mbedtls/ssl.h; misparse,curl_full_audit_0.4.35,high
API05-C,curl,lib/altsvc.c,65,FP,Advisory C99 array-param style; curl never uses it. Categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/altsvc.c,67,FP,Advisory C99 array-param style; categorical FP.,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/altsvc.c,96,FP,"(char*)as + sizeof(struct) is byte offset, char* not scaled. No double scaling.",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/altsvc.c,100,FP,"char* pointer arithmetic; sizeof gives byte offset, correct flexible-tail layout.",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/altsvc.c,109,FP,"'as' is calloc'd heap memory, not automatic storage. Misread.",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/altsvc.c,123,FP,curlx_str/curlx_strlen are pure accessors; no unsequenced side effects.,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/altsvc.c,145,FP,"Intentional parse-chain idiom; empty if body, work done in else branch.",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/altsvc.c,166,FP,"dbuf is fixed-size from MAX_ALTSVC_DATELEN, not from getenv. Bound enforced by parser.",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/altsvc.c,166,FP,"dbuf is compile-time fixed-size array, not a VLA.",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/altsvc.c,171,FP,memcpy args are pure accessors; no unsequenced side effects.,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/altsvc.c,174,FP,"'as' appended to asi->list, owned and freed by Curl_altsvc_cleanup. Not leaked.",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/altsvc.c,186,FP,On null 'as' nothing allocated; on success appended to list. No leak.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/altsvc.c,206,FP,"free(asi->filename) then strdup-reassign; classic free-then-realloc, not UAF.",curl_full_audit_0.4.35,high
FIO42-C,curl,lib/altsvc.c,209,FP,fp closed via curlx_fclose(fp) at line 224 on all paths where opened.,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/altsvc.c,209,FP,fopen not open(); fp closed at 224. Duplicate misfire.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/altsvc.c,233,FP,altsvc_out reads as->* only but matches no const convention; curl idiom non-const.,curl_full_audit_0.4.35,med
EXP20-C,curl,lib/altsvc.c,246,FP,inet_pton documented to return exactly 1 on success; ==1 is correct.,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/altsvc.c,250,FP,inet_pton returns 1 on success; ==1 correct test.,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/altsvc.c,256,FP,printf-arg Curl_alpnid2str calls are pure; no unsequenced writes.,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/altsvc.c,270,FP,stamp filled by curlx_gmtime on success path before use; early-return on error.,curl_full_audit_0.4.35,high
API00-C,curl,lib/altsvc.c,304,FP,Thin wrapper with DEBUGASSERT(asi); delegates to altsvc_load. Categorical FP.,curl_full_audit_0.4.35,high
API00-C,curl,lib/altsvc.c,304,FP,file passed through to altsvc_load which strdup-copies; wrapper. FP.,curl_full_audit_0.4.35,high
API00-C,curl,lib/altsvc.c,313,FP,DEBUGASSERT(data) present; thin ctrl. FP.,curl_full_audit_0.4.35,high
API00-C,curl,lib/altsvc.c,352,FP,"data only used in Curl_fopen; DEBUGASSERT not needed, asi guarded. FP.",curl_full_audit_0.4.35,high
FIO42-C,curl,lib/altsvc.c,371,FP,out closed via curlx_fclose(out) at line 385 on the success-open branch.,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/altsvc.c,371,FP,Curl_fopen not open(); out closed at 385. Duplicate misfire.,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/altsvc.c,375,FP,"Adjacent string-literal concatenation, no preprocessor directive in args.",curl_full_audit_0.4.35,high
PRE32-C,curl,lib/altsvc.c,375,FP,"String literal contains '#' as text, not a preprocessor directive.",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/altsvc.c,377,FP,out non-NULL inside if(!result) guard after Curl_fopen succeeded.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/altsvc.c,401,FP,strlen(host) takes char*; no char-to-int sign-extension at this call.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/altsvc.c,402,FP,strlen(check); no signed-char widening here.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/altsvc.c,434,FP,unused is a callback-signature param (void*) cast to void; const irrelevant.,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/altsvc.c,436,FP,[adv] getenv result used in if(timestr) guard immediately; technically checked. Borderline; debug-only.,curl_full_audit_0.4.35,adversarial-flip
CON34-C,curl,lib/altsvc.c,436,FP,"getenv static-storage; single-threaded debug helper, value used immediately. FP.",curl_full_audit_0.4.35,med
ENV30-C,curl,lib/altsvc.c,440,FP,"curlx_str_number advances a local pointer copy, does not modify env string contents.",curl_full_audit_0.4.35,high
API00-C,curl,lib/altsvc.c,460,FP,DEBUGASSERT(asi) at 471; internal caller always passes valid asi. FP.,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/altsvc.c,540,FP,vp assigned curlx_str(&val) at 551 before any use at 552.,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/altsvc.c,578,FP,altsvc_createid args are pure accessors (strlen/curlx_str); no side effects.,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/altsvc.c,584,FP,"time(NULL) for cache expiry; (time_t)-1 harmless here, idiomatic uncheck.",curl_full_audit_0.4.35,med
EXP30-C,curl,lib/altsvc.c,593,FP,infof printf-style; arg accessors pure. No unsequenced side effects.,curl_full_audit_0.4.35,high
API00-C,curl,lib/altsvc.c,624,FP,DEBUGASSERT(asi/srchost/dstentry) present; internal entry point. FP.,curl_full_audit_0.4.35,high
API00-C,curl,lib/altsvc.c,624,FP,srchost DEBUGASSERTed; FP.,curl_full_audit_0.4.35,high
API00-C,curl,lib/altsvc.c,624,FP,dstentry DEBUGASSERTed; FP.,curl_full_audit_0.4.35,high
API00-C,curl,lib/altsvc.c,624,FP,psame_destination written unconditionally at 638; internal caller. FP.,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/altsvc.c,633,FP,"time(NULL) for expiry comparison; idiomatic uncheck, -1 benign.",curl_full_audit_0.4.35,med
MEM30-C,curl,lib/altsvc.c,648,FP,free at 645 only in expired branch followed by continue; match block on un-freed 'as'.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/altsvc.c,648,FP,Free is in disjoint continue branch; no UAF on this 'as'.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/altsvc.c,649,FP,hostcompare(as->src.host) reached only when not freed (expired branch continues).,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/altsvc.c,649,FP,Disjoint free branch; not UAF.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/altsvc.c,649,FP,Disjoint free branch; not UAF.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/altsvc.c,650,FP,as->src.port read on un-freed object; free path continues earlier.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/altsvc.c,650,FP,Disjoint free branch; not UAF.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/altsvc.c,651,FP,as->dst.alpnid read on un-freed object; not UAF.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/altsvc.c,651,FP,Disjoint free branch; not UAF.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/altsvc.c,654,FP,as->dst.port read on un-freed object; not UAF.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/altsvc.c,654,FP,Disjoint free branch; not UAF.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/altsvc.c,655,FP,hostcompare(as->dst.host) on un-freed object; not UAF.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/altsvc.c,655,FP,Disjoint free branch; not UAF.,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/altsvc.c,655,FP,Disjoint free branch; not UAF.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strparse.c,32,FP,Advisory C99 array-param style; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strparse.c,40,FP,Advisory C99 array-param style; categorical FP.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,43,FP,"const char *s = *linep is pointer copy, no char widening at assignment.",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/curlx/strparse.c,49,FP,s walks a NUL-terminated string buffer; pointer increment is idiomatic and bounded by *s/max.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,56,FP,"out->str = *linep pointer assignment, not char widening.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,56,FP,"Pointer assignment, no sign extension. Duplicate.",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curlx/strparse.c,58,FP,"*linep = s points into caller-owned buffer, not a local's address.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,58,FP,*linep = s pointer assignment; no char widening.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strparse.c,64,FP,Advisory array-param style; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strparse.c,71,FP,Advisory array-param style; categorical FP.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,74,FP,"Pointer copy assignment, no char widening.",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/curlx/strparse.c,80,FP,s walks NUL-terminated buffer; bounded by *s and max counter.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,86,FP,"Pointer assignment, no sign extension.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,86,FP,Pointer assignment. Duplicate.,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curlx/strparse.c,88,FP,"*linep = s points into caller buffer, not local address.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,88,FP,"Pointer assignment, no char widening.",curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strparse.c,94,FP,Advisory array-param style; categorical FP.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,97,FP,"Pointer copy assignment, no char widening.",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/curlx/strparse.c,104,FP,s walks quoted string; bounded by *s and max.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curlx/strparse.c,105,FP,Loop bounded by *s NUL terminator and ++len>max check; not unbounded.,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/curlx/strparse.c,106,FP,s[1] reads next byte of escaped-quote pair inside NUL-bounded string.,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/curlx/strparse.c,107,FP,s++ over escape char inside bounded string scan.,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/curlx/strparse.c,111,FP,"s++ idiomatic string walk, bounded.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,119,FP,"out->str = (*linep)+1 pointer arithmetic, no char widening.",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/curlx/strparse.c,119,FP,*linep = s+1 advances within NUL-terminated buffer; idiomatic.,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curlx/strparse.c,142,FP,valid_digit args are *p (no side effects at call sites); multiple-eval harmless. Advisory.,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curlx/strparse.c,142,FP,Macro multiple-eval of x; all call sites pass *p (no side effect). Idiomatic.,curl_full_audit_0.4.35,med
DCL15-C,curl,lib/curlx/strparse.c,148,FP,curlx_hexasciitable is referenced by curlx_hexval in other TU; needs external linkage.,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/curlx/strparse.c,148,FP,Shared lookup table needs file/external scope; cannot narrow.,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/curlx/strparse.c,148,FP,"Initializer-sized const table; explicit bound advisory, indexing guarded by macro.",curl_full_audit_0.4.35,med
STR34-C,curl,lib/curlx/strparse.c,168,FP,"p = *linep pointer assignment, no char widening.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,168,FP,Pointer assignment; no sign extension. Duplicate.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curlx/strparse.c,169,FP,valid_digit guards index x-'0' with x>='0'&&x<=m(<='f'); within 55-elem table.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,174,FP,"curlx_hexval(*p) takes char; widening masked by table lookup, value 0-15. Benign.",curl_full_audit_0.4.35,med
ARR37-C,curl,lib/curlx/strparse.c,174,FP,p++ walks digit string bounded by valid_digit loop condition.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,174,FP,hexval arg widening benign; duplicate of same site.,curl_full_audit_0.4.35,med
INT32-C,curl,lib/curlx/strparse.c,175,FP,max<base branch: num bounded by max(<base<=16); product cannot overflow.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curlx/strparse.c,178,FP,valid_digit guard bounds table index; safe.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,182,FP,hexval arg widening benign; value 0-15.,curl_full_audit_0.4.35,med
ARR37-C,curl,lib/curlx/strparse.c,182,FP,p++ bounded by valid_digit loop condition.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,182,FP,Duplicate widening at same site; benign.,curl_full_audit_0.4.35,med
INT33-C,curl,lib/curlx/strparse.c,183,FP,"base is 8/10/16 (DEBUGASSERTed), never zero. No div-by-zero.",curl_full_audit_0.4.35,high
INT32-C,curl,lib/curlx/strparse.c,185,FP,Overflow checked BEFORE add via num>((max-n)/base) at line 183. Proper guard.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curlx/strparse.c,186,FP,valid_digit guard bounds index; safe.,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curlx/strparse.c,189,FP,"*linep = p points into caller buffer, not local address.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,189,FP,"Pointer assignment, no char widening.",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curlx/strparse.c,239,FP,str (struct Curl_str*) is read-only here but matches no const convention; could be const but idiomatic non-const.,curl_full_audit_0.4.35,med
STR34-C,curl,lib/curlx/strparse.c,241,FP,strlen(check) takes char*; no char-to-int widening here.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,241,FP,No signed-char widening at strnequal call.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curlx/strparse.c,247,FP,str read-only but non-const idiom; cosmetic.,curl_full_audit_0.4.35,med
STR34-C,curl,lib/curlx/strparse.c,250,FP,strlen(check); no char widening.,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/curlx/strparse.c,251,FP,!strncmp boolean idiom for match; idiomatic and correct.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,273,FP,"out->str = s pointer assignment, no char widening.",curl_full_audit_0.4.35,high
MEM33-C,curl,lib/curlx/strparse.c,281,FP,*linep = &s[len] / out->str = s are pointer assignments; no flexible-array struct copy.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,281,FP,"Pointer assignment, no char widening.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,281,FP,"&s[len] address-of, no char widening.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strparse.c,281,FP,"Pointer arithmetic, no sign extension.",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/curlx/strparse.c,281,FP,&s[len] computes end pointer of scanned span; bounded by strcspn result.,curl_full_audit_0.4.35,high
DCL31-C,curl,src/var.c,43,FP,curlx_free is declared via curl alloc-wrapper header; sqc can't resolve macro,curl_full_audit_0.4.35,high
DCL31-C,curl,src/var.c,44,FP,curlx_free declared in header; macro-wrapper opacity,curl_full_audit_0.4.35,high
API05-C,curl,src/var.c,48,FP,curl never uses C99 array-param syntax; style advisory,curl_full_audit_0.4.35,high
EXP20-C,curl,src/var.c,52,FP,idiomatic !strncmp boolean test in list match,curl_full_audit_0.4.35,high
DCL30-C,curl,src/var.c,53,FP,"returns heap list node pointer, not automatic-storage local",curl_full_audit_0.4.35,high
PRE00-C,curl,src/var.c,60,FP,ENDOFFUNC multi-eval but args side-effect-free constants,curl_full_audit_0.4.35,low
PRE12-C,curl,src/var.c,60,FP,macro multi-eval; called only with side-effect-free args,curl_full_audit_0.4.35,low
PRE00-C,curl,src/var.c,61,FP,"FUNCMATCH multi-eval; args are constants, no side effects",curl_full_audit_0.4.35,low
PRE01-C,curl,src/var.c,61,FP,"len used in strncmp arg and index; constant args, no precedence bug",curl_full_audit_0.4.35,low
PRE12-C,curl,src/var.c,61,FP,macro multi-eval; constant-len call sites,curl_full_audit_0.4.35,low
API05-C,curl,src/var.c,75,FP,style advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,src/var.c,77,FP,style advisory; curl convention,curl_full_audit_0.4.35,high
ARR30-C,curl,src/var.c,86,FP,while(*f) bounded by NUL terminator of function string,curl_full_audit_0.4.35,high
ARR30-C,curl,src/var.c,94,FP,"ptr[len] after strncmp match; within string, macro-opacity",curl_full_audit_0.4.35,high
EXP34-C,curl,src/var.c,99,FP,c NULL only when clen==0; guarded by if(clen),curl_full_audit_0.4.35,high
ARR30-C,curl,src/var.c,113,FP,macro FUNCMATCH bounded access; opacity,curl_full_audit_0.4.35,high
ARR30-C,curl,src/var.c,123,FP,macro FUNCMATCH bounded access; opacity,curl_full_audit_0.4.35,high
EXP33-C,curl,src/var.c,127,FP,enc initialized at declaration from curl_easy_escape,curl_full_audit_0.4.35,high
ARR30-C,curl,src/var.c,141,FP,macro FUNCMATCH bounded access; opacity,curl_full_audit_0.4.35,high
EXP05-C,curl,src/var.c,147,FP,char* to uint8_t* cast; no const removed (c is non-const),curl_full_audit_0.4.35,high
EXP33-C,curl,src/var.c,154,FP,elen filled by base64_encode; read only after success check,curl_full_audit_0.4.35,high
ARR30-C,curl,src/var.c,161,FP,macro FUNCMATCH bounded access; opacity,curl_full_audit_0.4.35,high
DCL31-C,curl,src/var.c,189,FP,curlx_free macro-wrapper; declared in header,curl_full_audit_0.4.35,high
DCL31-C,curl,src/var.c,200,FP,curlx_free macro-wrapper; declared in header,curl_full_audit_0.4.35,high
MEM30-C,curl,src/var.c,200,FP,c reassigned to fresh memdup0 after each loop free; not double-free,curl_full_audit_0.4.35,high
ARR36-C,curl,src/var.c,216,FP,envp and line both point into same string from strstr,curl_full_audit_0.4.35,high
ARR00-C,curl,src/var.c,216,FP,envp[-1] accessed only when envp>line; index valid,curl_full_audit_0.4.35,high
EXP34-C,curl,src/var.c,216,FP,envp NULL-checked via short-circuit (envp>line),curl_full_audit_0.4.35,high
ARR36-C,curl,src/var.c,220,FP,same-string pointer subtraction envp-line,curl_full_audit_0.4.35,high
STR34-C,curl,src/var.c,228,FP,"misparse: line=&envp[2] is pointer assignment, no char widening",curl_full_audit_0.4.35,high
STR34-C,curl,src/var.c,228,FP,misparse of pointer arithmetic; no sign extension,curl_full_audit_0.4.35,high
ENV01-C,curl,src/var.c,231,FP,"name[] holds variable name, not getenv result",curl_full_audit_0.4.35,high
EXP33-C,curl,src/var.c,231,FP,name[] filled by memcpy before read at line 271,curl_full_audit_0.4.35,high
ARR36-C,curl,src/var.c,256,FP,same-string pointer subtraction,curl_full_audit_0.4.35,high
ARR30-C,curl,src/var.c,268,FP,nlen<sizeof(name) enforced at line 253 before name[nlen],curl_full_audit_0.4.35,high
STR34-C,curl,src/var.c,295,FP,clp/funcp are char* pointers; subtraction not char widening,curl_full_audit_0.4.35,high
STR34-C,curl,src/var.c,295,FP,pointer subtraction misparse,curl_full_audit_0.4.35,high
STR34-C,curl,src/var.c,321,FP,misparse: line=&clp[2] pointer assignment,curl_full_audit_0.4.35,high
STR34-C,curl,src/var.c,321,FP,pointer arithmetic misparse,curl_full_audit_0.4.35,high
API05-C,curl,src/var.c,342,FP,style advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,src/var.c,344,FP,style advisory; curl convention,curl_full_audit_0.4.35,high
DCL31-C,curl,src/var.c,354,FP,curlx_calloc macro-wrapper; declared in header,curl_full_audit_0.4.35,high
DCL31-C,curl,src/var.c,367,FP,curlx_free macro-wrapper; declared in header,curl_full_audit_0.4.35,high
ENV01-C,curl,src/var.c,383,FP,"buf[] holds copied var name (bounded nlen<MAX_VAR_LEN), not getenv result",curl_full_audit_0.4.35,high
ARR36-C,curl,src/var.c,394,FP,line and name both within input string,curl_full_audit_0.4.35,high
EXP43-C,curl,src/var.c,404,FP,buf is separate stack array; name in input; no overlap,curl_full_audit_0.4.35,high
STR31-C,curl,src/var.c,404,FP,explicit buf[nlen]=0 null-terminates next line,curl_full_audit_0.4.35,high
ENV34-C,curl,src/var.c,408,FP,getenv result consumed immediately and copied via memdup0 in addvariable,curl_full_audit_0.4.35,med
CON34-C,curl,src/var.c,408,FP,curl CLI single-thread; duplicate of getenv concern,curl_full_audit_0.4.35,high
EXP15-C,curl,src/var.c,434,FP,intentional empty if(content); part of else-if chain,curl_full_audit_0.4.35,high
EXP20-C,curl,src/var.c,442,FP,"idiomatic !strcmp(line,""-"") test",curl_full_audit_0.4.35,high
FIO42-C,curl,src/var.c,446,FP,file closed at line 460-461 (curlx_fclose when not stdin),curl_full_audit_0.4.35,high
FIO42-C,curl,src/var.c,446,FP,FILE* closed via curlx_fclose; not an fd,curl_full_audit_0.4.35,high
ENV30-C,curl,src/var.c,455,FP,"content here is NULL/file-filled, not getenv (mutually-exclusive branch)",curl_full_audit_0.4.35,high
INT30-C,curl,src/var.c,476,FP,clen-1 only when startoffset<clen so clen>0; bounded by strlen,curl_full_audit_0.4.35,high
INT30-C,curl,src/var.c,477,FP,offsets bounded by strlen; no practical wrap,curl_full_audit_0.4.35,high
DCL31-C,curl,src/var.c,489,FP,curlx_free macro-wrapper; declared in header,curl_full_audit_0.4.35,high
ENV30-C,curl,src/var.c,489,FP,"content freed here is contalloc heap, not getenv pointer",curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/digest_sspi.c,84,FP,internal auth fn; callers pass valid data; chlg used after len-check,curl_full_audit_0.4.35,med
API00-C,curl,lib/vauth/digest_sspi.c,84,FP,internal auth fn; service guaranteed non-NULL by callers,curl_full_audit_0.4.35,med
EXP43-C,curl,lib/vauth/digest_sspi.c,157,FP,Windows SSPI AcquireCredentialsHandle signature; distinct params,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/digest_sspi.c,242,FP,internal helper; chlg traversed safely with while(*chlg),curl_full_audit_0.4.35,med
ENV01-C,curl,lib/vauth/digest_sspi.c,250,FP,"value[] is digest-pair parse buffer, not getenv result",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/vauth/digest_sspi.c,251,FP,"content[] is digest-pair parse buffer, not getenv result",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/digest_sspi.c,263,FP,domain assigned from convert_UTF8_to_tchar before use,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/digest_sspi.c,267,FP,dup_domain assigned from tcsdup before use,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/digest_sspi.c,312,FP,strlen(chlg) used; internal caller guarantees non-NULL,curl_full_audit_0.4.35,med
STR34-C,curl,lib/vauth/digest_sspi.c,315,FP,misparse: strlen(chlg) not a char-to-int assignment,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/vauth/digest_sspi.c,325,FP,"value[] digest-pair buffer, not getenv",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/vauth/digest_sspi.c,326,FP,"content[] digest-pair buffer, not getenv",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest_sspi.c,384,FP,style advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest_sspi.c,385,FP,style advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest_sspi.c,386,FP,style advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest_sspi.c,387,FP,style advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/digest_sspi.c,389,FP,style advisory; curl convention,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,436,FP,"Curl_safefree nulls ptr; if() reads NULL, not freed memory",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest_sspi.c,447,FP,chlg_buf is SecBuffer[5]; index 2 valid; sqc misread size as 2,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest_sspi.c,448,FP,chlg_buf[5]; index 2 valid,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest_sspi.c,449,FP,chlg_buf[5]; index 3 valid,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest_sspi.c,450,FP,chlg_buf[5]; index 3 valid,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest_sspi.c,451,FP,chlg_buf[5]; index 3 valid,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest_sspi.c,452,FP,chlg_buf[5]; index 4 valid,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest_sspi.c,453,FP,chlg_buf[5]; index 4 valid,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest_sspi.c,454,FP,chlg_buf[5]; index 4 valid,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,456,FP,http_context non-NULL & valid in this branch; not freed,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest_sspi.c,459,FP,chlg_buf[5]; index 4 valid,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/digest_sspi.c,459,FP,chlg_buf[4].cbBuffer set at 454 / by MakeSignature before read,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,462,FP,http_context valid here; deleted then safefreed (nulled),curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,463,FP,Curl_safefree nulls; subsequent if() guards reuse,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,467,FP,"reads NULL after safefree; guard, not freed-memory access",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,477,FP,Curl_safefree nulls user; not double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,478,FP,Curl_safefree nulls passwd; not double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,488,FP,"input_token read (memdup'd in decode), not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,505,FP,digest->user just assigned via strdup; read not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,515,FP,digest->passwd just assigned via strdup; read not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,518,FP,Curl_safefree nulls; safe re-free,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/vauth/digest_sspi.c,524,FP,Windows SSPI AcquireCredentialsHandle signature; distinct params,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,541,FP,input_token valid (memdup'd); read into buffer,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,542,FP,"input_token_len is size_t value, not freed pointer",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest_sspi.c,546,FP,chlg_buf[5]; index 2 valid,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest_sspi.c,547,FP,chlg_buf[5]; index 2 valid,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vauth/digest_sspi.c,548,FP,chlg_buf[5]; index 2 valid,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,570,FP,http_context just calloc'd at 569; not freed,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/digest_sspi.c,575,FP,output_token freed at 574 before return; http_context owned by digest,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,583,FP,http_context valid here (just created); InitializeSecurityContext arg,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,598,FP,Curl_safefree nulls; single free,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/digest_sspi.c,601,FP,output_token freed at 596; http_context safefreed at 598,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/digest_sspi.c,606,FP,output_token freed at 596 before return,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/digest_sspi.c,618,FP,output_token freed at 616 before this return,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vauth/digest_sspi.c,622,FP,"resp is heap memdup0, not local address; valid to return via outptr",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/digest_sspi.c,622,FP,misparse: *outptr=resp is pointer assignment,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/digest_sspi.c,624,FP,output_token freed at 616; resp ownership transferred to caller,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,646,FP,http_context valid in cleanup; deleted then safefreed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/digest_sspi.c,647,FP,http_context passed to DeleteSecurityContext before free; valid,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/getinfo.c,70,FP,curlx_free declared via included header (curlx); macro/header-opaque to sqc,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/getinfo.c,73,FP,curlx_free declared via included header; not an implicit declaration,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/getinfo.c,93,FP,param_charp NULL-guarded by caller (Curl_getinfo line 640) before call,curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,93,FP,"*param_charp is char* pointer assignment, not signed-char widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,123,FP,"pointer assignment to char**, no char sign extension",curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,127,FP,"pointer assignment, not char widening",curl_full_audit_0.4.35,high
EXP40-C,curl,lib/getinfo.c,130,FP,assigns pointer value via explicit cast; not modifying a const object,curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,130,FP,"pointer assignment, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,138,FP,"pointer assignment, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,143,FP,"pointer assignment, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,147,FP,"pointer assignment, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,151,FP,"pointer assignment, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,156,FP,"pointer assignment, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,160,FP,"pointer assignment, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,162,FP,"pointer assignment of NULL, not char widening",curl_full_audit_0.4.35,high
MSC07-C,curl,lib/getinfo.c,165,FP,case label after break is reachable via switch dispatch; not dead code,curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,166,FP,"pointer assignment, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,170,FP,"pointer assignment, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,172,FP,"pointer assignment of NULL, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,177,FP,"pointer assignment, not char widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/getinfo.c,179,FP,"pointer assignment of NULL, not char widening",curl_full_audit_0.4.35,high
ENV34-C,curl,lib/getinfo.c,205,FP,getenv value consumed immediately in DEBUGBUILD; not stored long-term,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/getinfo.c,205,FP,return checked by if(envstr) on next line before use,curl_full_audit_0.4.35,high
CON34-C,curl,lib/getinfo.c,205,FP,debug-only build path; documented single-thread use,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/getinfo.c,208,FP,"curlx_str_number advances a local cursor copy, does not mutate env string",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/getinfo.c,209,FP,param_longp NULL-guarded by caller (line 645) before call,curl_full_audit_0.4.35,high
ENV34-C,curl,lib/getinfo.c,215,FP,getenv consumed immediately in DEBUGBUILD,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/getinfo.c,215,FP,return checked by if(envstr) before use,curl_full_audit_0.4.35,high
CON34-C,curl,lib/getinfo.c,215,FP,debug-only path; single-thread documented,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/getinfo.c,218,FP,"str_number advances local cursor copy, does not modify env data",curl_full_audit_0.4.35,high
WIN04-C,curl,lib/getinfo.c,239,FP,"LONG_MIN is a constant macro, not a function pointer being stored",curl_full_audit_0.4.35,high
DCL37-C,curl,lib/getinfo.c,239,FP,"LONG_MIN is standard limits.h macro, not a reserved-identifier misuse",curl_full_audit_0.4.35,high
DCL01-C,curl,lib/getinfo.c,243,FP,"no shadow; param_longp is the function param, not redeclared here",curl_full_audit_0.4.35,med
MSC07-C,curl,lib/getinfo.c,245,FP,"case label after break is reachable switch target, not dead code",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/getinfo.c,384,FP,data dereffed/passed to fns expecting non-const; matches sibling getinfo_* signatures,curl_full_audit_0.4.35,high
ENV34-C,curl,lib/getinfo.c,401,FP,getenv consumed immediately in DEBUGBUILD,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/getinfo.c,401,FP,return checked by if(envstr) before use,curl_full_audit_0.4.35,high
CON34-C,curl,lib/getinfo.c,401,FP,debug-only path; single-thread documented,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/getinfo.c,404,FP,str_number advances local cursor copy,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/getinfo.c,405,FP,param_offt NULL-guarded by caller (line 655) before call,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/getinfo.c,484,FP,data passed to non-const sinks; uniform getinfo_* signature,curl_full_audit_0.4.35,high
ENV34-C,curl,lib/getinfo.c,500,FP,getenv consumed immediately in DEBUGBUILD,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/getinfo.c,500,FP,return checked by if(envstr) before use,curl_full_audit_0.4.35,high
CON34-C,curl,lib/getinfo.c,500,FP,debug-only path; single-thread documented,curl_full_audit_0.4.35,high
ENV30-C,curl,lib/getinfo.c,503,FP,str_number advances local cursor copy,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/getinfo.c,504,FP,param_doublep NULL-guarded by caller (line 650),curl_full_audit_0.4.35,high
FLP34-C,curl,lib/getinfo.c,504,FP,curl_off_t to double widening; no precision/range loss path of concern,curl_full_audit_0.4.35,high
FLP34-C,curl,lib/getinfo.c,532,FP,"curl_off_t to double cast of size counter; idiomatic, no range issue",curl_full_audit_0.4.35,high
FLP34-C,curl,lib/getinfo.c,535,FP,size counter to double; no overflow risk,curl_full_audit_0.4.35,high
FLP34-C,curl,lib/getinfo.c,538,FP,speed counter to double; no range issue,curl_full_audit_0.4.35,high
FLP34-C,curl,lib/getinfo.c,541,FP,speed counter to double; no range issue,curl_full_audit_0.4.35,high
FLP34-C,curl,lib/getinfo.c,545,FP,total_size to double; no range issue,curl_full_audit_0.4.35,high
FLP34-C,curl,lib/getinfo.c,549,FP,total_size to double; no range issue,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/getinfo.c,572,FP,param_slistp NULL-guarded by caller (line 660),curl_full_audit_0.4.35,high
EXP34-C,curl,lib/getinfo.c,610,FP,param_socketp NULL-guarded by caller (line 665),curl_full_audit_0.4.35,high
DCL38-C,curl,lib/memdebug.c,40,FP,"mem[1] is intentional max-alignment union, not a flexible array member",curl_full_audit_0.4.35,high
STR31-C,curl,lib/memdebug.c,44,FP,"union member, not a string buffer; not used for string storage",curl_full_audit_0.4.35,high
CON03-C,curl,lib/memdebug.c,58,FP,"debug-only tool, documented single-thread use; lock infra exists where needed",curl_full_audit_0.4.35,med
CON03-C,curl,lib/memdebug.c,59,FP,debug-only single-thread tool; memlimit set once at init,curl_full_audit_0.4.35,med
CON03-C,curl,lib/memdebug.c,60,FP,debug-only single-thread tool,curl_full_audit_0.4.35,med
CON03-C,curl,lib/memdebug.c,66,FP,memwidx guarded under curl_dbg_lock for realloc path; debug tool,curl_full_audit_0.4.35,med
CON03-C,curl,lib/memdebug.c,69,FP,init-once flag in debug tool,curl_full_audit_0.4.35,med
ERR00-C,curl,lib/memdebug.c,106,FP,best-effort log flush at atexit cleanup; nothing actionable on error,curl_full_audit_0.4.35,med
ERR33-C,curl,lib/memdebug.c,106,FP,"atexit log-flush; partial write unrecoverable, debug-only",curl_full_audit_0.4.35,med
FIO18-C,curl,lib/memdebug.c,106,FP,"membuf is binary log accumulator; memwidx is correct byte count, not a C string",curl_full_audit_0.4.35,high
ERR00-C,curl,lib/memdebug.c,108,FP,"fclose at atexit cleanup; nothing to recover, debug-only",curl_full_audit_0.4.35,med
ERR33-C,curl,lib/memdebug.c,108,FP,"atexit cleanup fclose; unactionable error, debug-only",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/memdebug.c,120,FP,error_bt_callback matches libbacktrace callback typedef; signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/memdebug.c,130,FP,full_callback matches libbacktrace backtrace_full callback typedef; fixed,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/memdebug.c,142,FP,btstate is a static (zero-init); set by backtrace_create_state before dump_bt,curl_full_audit_0.4.35,high
ERR07-C,curl,lib/memdebug.c,157,FP,setbuf used intentionally to disable buffering in debug log; idiomatic,curl_full_audit_0.4.35,med
EXP43-C,curl,lib/memdebug.c,167,FP,backtrace_create_state args are distinct; no aliased restrict output/input,curl_full_audit_0.4.35,high
CON07-C,curl,lib/memdebug.c,184,FP,countcheck compound op on debug-tool statics; single-thread documented,curl_full_audit_0.4.35,med
ERR33-C,curl,lib/memdebug.c,196,FP,"fflush before potential crash; best-effort debug flush, unactionable",curl_full_audit_0.4.35,med
API00-C,curl,lib/memdebug.c,208,FP,"DEBUGASSERT guards size!=0; wrapper passes to real malloc, no overflow arith",curl_full_audit_0.4.35,high
API05-C,curl,lib/memdebug.c,209,FP,curl convention; no C99 array-param syntax used project-wide,curl_full_audit_0.4.35,high
API00-C,curl,lib/memdebug.c,235,FP,calloc wrapper; DEBUGASSERT guards; product computed but matches real calloc,curl_full_audit_0.4.35,med
API00-C,curl,lib/memdebug.c,235,FP,calloc wrapper for wanted_size; debug allocator passes through,curl_full_audit_0.4.35,med
API05-C,curl,lib/memdebug.c,237,FP,curl convention; no conformant array syntax,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/memdebug.c,285,FP,"returns mem (heap from curl_dbg_malloc), not address of automatic storage",curl_full_audit_0.4.35,high
ARR38-C,curl,lib/memdebug.c,305,FP,"memcpy size is strlen(str)+1 of source, fits allocated len; bounded",curl_full_audit_0.4.35,high
STR31-C,curl,lib/memdebug.c,305,FP,len includes +1 for null terminator; strdup copies full string,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/memdebug.c,311,FP,"returns mem (heap), not automatic storage; wcsdup path",curl_full_audit_0.4.35,high
API00-C,curl,lib/memdebug.c,317,FP,realloc wrapper; DEBUGASSERT guards size; passes to real realloc,curl_full_audit_0.4.35,med
API05-C,curl,lib/memdebug.c,317,FP,curl convention; no conformant array syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/memdebug.c,318,FP,curl convention; no conformant array syntax,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/memdebug.c,341,FP,"offsetof yields byte offset; pointer arith on char* is correct, no double scaling",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/memdebug.c,351,FP,"mem here is realloc RESULT (new block), not freed old pointer; valid access",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/memdebug.c,356,FP,returns mem->mem of realloc result block; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/memdebug.c,356,FP,"mem is live realloc result, no use-after-free",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/memdebug.c,376,FP,"offsetof byte offset on char*; correct unwrap, no double scaling",curl_full_audit_0.4.35,high
API00-C,curl,lib/memdebug.c,466,FP,"source is optional log tag, NULL-tolerant by design; not dereffed unguarded",curl_full_audit_0.4.35,high
API00-C,curl,lib/memdebug.c,472,FP,mode passed straight to fopen which handles it; thin wrapper,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/memdebug.c,481,FP,"res is a FILE* value from fopen, not address of automatic storage",curl_full_audit_0.4.35,high
API00-C,curl,lib/memdebug.c,484,FP,"mode/fh passed straight to freopen; thin wrapper, no own deref",curl_full_audit_0.4.35,high
API00-C,curl,lib/memdebug.c,484,FP,fh passed through to freopen; thin wrapper,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/memdebug.c,493,FP,"res is FILE* return value, not automatic storage address",curl_full_audit_0.4.35,high
API00-C,curl,lib/memdebug.c,496,FP,mode passed through to fdopen; thin wrapper,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/memdebug.c,504,FP,"res is FILE* return value, not automatic storage address",curl_full_audit_0.4.35,high
ERR33-C,curl,lib/memdebug.c,517,FP,fclose result captured in res and returned to caller for checking,curl_full_audit_0.4.35,med
ERR00-C,curl,lib/memdebug.c,517,FP,res is returned to caller; error handling delegated up the stack,curl_full_audit_0.4.35,med
CON07-C,curl,lib/memdebug.c,525,FP,memwidx op under lock in realloc path; debug-only single-thread tool,curl_full_audit_0.4.35,med
STR34-C,curl,lib/memdebug.c,528,FP,"fmt passed as printf format string, not widened to integer",curl_full_audit_0.4.35,high
ERR00-C,curl,lib/memdebug.c,536,FP,"debug log flush; partial write unrecoverable, best-effort",curl_full_audit_0.4.35,med
ERR33-C,curl,lib/memdebug.c,536,FP,debug log fwrite; unactionable on short write,curl_full_audit_0.4.35,med
FIO18-C,curl,lib/memdebug.c,536,FP,"membuf is binary accumulator; memwidx is correct byte count, not a string",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/memdebug.c,536,FP,membuf is static (zero-init) and filled by memcpy before any fwrite,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/memdebug.c,536,FP,callers (curl_dbg_log/_locked) return early if curl_dbg_logfile is NULL,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/memdebug.c,537,FP,"debug log fflush; best-effort, unactionable",curl_full_audit_0.4.35,med
EXP33-C,curl,lib/memdebug.c,544,FP,buf filled by curl_mvsnprintf before memcpy reads nchars bytes,curl_full_audit_0.4.35,high
INT33-C,curl,lib/tftp.c,186,FP,"retry_max clamped to [3,50] at lines 179-183; never zero",curl_full_audit_0.4.35,high
ERR33-C,curl,lib/tftp.c,195,FP,"time(NULL) used as relative timer baseline; curl never checks, failure impossible in practice",curl_full_audit_0.4.35,med
API05-C,curl,lib/tftp.c,230,FP,conformant-array-syntax advisory; curl never uses C99 array params,curl_full_audit_0.4.35,high
API05-C,curl,lib/tftp.c,236,FP,conformant-array-syntax advisory convention FP,curl_full_audit_0.4.35,high
API05-C,curl,lib/tftp.c,237,FP,conformant-array-syntax advisory convention FP,curl_full_audit_0.4.35,high
API05-C,curl,lib/tftp.c,237,FP,conformant-array-syntax advisory convention FP,curl_full_audit_0.4.35,high
STR34-C,curl,lib/tftp.c,246,FP,"*option=buf is pointer assignment (char**), no sign extension",curl_full_audit_0.4.35,high
MEM33-C,curl,lib/tftp.c,253,FP,"*value=&buf[..] pointer assignment, not flexible-array copy",curl_full_audit_0.4.35,high
STR34-C,curl,lib/tftp.c,253,FP,"pointer assignment, no char sign extension",curl_full_audit_0.4.35,high
STR34-C,curl,lib/tftp.c,253,FP,"pointer assignment, no char sign extension",curl_full_audit_0.4.35,high
STR34-C,curl,lib/tftp.c,253,FP,"pointer assignment, no char sign extension",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/tftp.c,255,FP,loc bounded by len checks; buf is param not the 64B stack buf misattributed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/tftp.c,327,FP,state buffer written via spacket.data[index]/curlx_strcopy; const wrong,curl_full_audit_0.4.35,med
API05-C,curl,lib/tftp.c,328,FP,conformant-array-syntax advisory convention FP,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/tftp.c,330,FP,index bounds-checked at line 333 before subscript,curl_full_audit_0.4.35,high
STR34-C,curl,lib/tftp.c,331,FP,strlen(option) no sign-extension issue,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/tftp.c,396,FP,sbytes assigned by sendto at 391 before check at 396,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/tftp.c,407,FP,"time(NULL) timer baseline; curl idiom, unchecked by design",curl_full_audit_0.4.35,med
INT30-C,curl,lib/tftp.c,432,FP,sbytes bounded by loop guard < blksize; no wrap,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/tftp.c,432,FP,cb is out-param set by Curl_client_read at 428 before use,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/tftp.c,566,FP,time(NULL) timer baseline; curl idiom,curl_full_audit_0.4.35,med
ERR33-C,curl,lib/tftp.c,586,FP,time(NULL) timer baseline; curl idiom,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/tftp.c,605,FP,sbytes assigned by sendto at 601 before check,curl_full_audit_0.4.35,high
INT18-C,curl,lib/tftp.c,676,FP,infilesize is signed curl_off_t; comparison to -1 is correct,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/tftp.c,695,FP,Curl_urldecode success (result==0) guarantees filename non-NULL,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/tftp.c,702,FP,filename used in msnprintf then freed at 705; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/tftp.c,705,FP,free at 697 is on disjoint return path; single free per path,curl_full_audit_0.4.35,high
INT18-C,curl,lib/tftp.c,712,FP,infilesize signed; -1 compare correct,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/tftp.c,751,FP,sbytes set at 701 before sendto,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/tftp.c,754,FP,senddata assigned by sendto at 750 before compare,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/tftp.c,761,FP,"break at 759 ends a case; 761 is next case label, reachable",curl_full_audit_0.4.35,high
API05-C,curl,lib/tftp.c,881,FP,dtor signature fixed by Curl_hash dtor typedef; advisory FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/tftp.c,881,FP,tftp_conn_dtor signature fixed by hash-dtor function pointer typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/tftp.c,881,FP,conformant-array-syntax advisory convention FP,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/tftp.c,886,FP,"Curl_safefree of distinct member; nulls arg, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/tftp.c,887,FP,Curl_safefree of distinct member spacket.data; not UAF,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/tftp.c,909,FP,sizeof(*state) is not a deref; state assigned by calloc here,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/tftp.c,928,FP,state owned by conn meta (dtor registered at 911); freed by tftp_conn_dtor,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/tftp.c,935,FP,state+packets owned by conn meta dtor; not stack-local leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/tftp.c,952,FP,state owned by conn meta dtor; freed on disconnect,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/tftp.c,959,FP,state owned by conn meta dtor; not leaked,curl_full_audit_0.4.35,high
POS02-C,curl,lib/tftp.c,975,FP,client UDP bind to ephemeral port; not a privileged op needing drop,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/tftp.c,981,FP,state owned by conn meta dtor; not leaked,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/tftp.c,990,FP,state owned by conn meta dtor; not leaked,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/tftp.c,1051,FP,"remote_addr filled by recvfrom at 1041 (rbytes>=0,fromlen) before memcmp",curl_full_audit_0.4.35,high
ERR33-C,curl,lib/tftp.c,1146,FP,time(NULL) timer baseline; curl idiom,curl_full_audit_0.4.35,med
ERR33-C,curl,lib/tftp.c,1150,FP,time(NULL) timer baseline; curl idiom,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/tftp.c,1180,FP,event set by tftp_state_timeout (*event=NONE always at 1138),curl_full_audit_0.4.35,high
STR34-C,curl,lib/tftp.c,1315,FP,strlen(path); no sign-extension issue,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/tftp.c,1320,FP,!memcmp idiomatic boolean test,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/tftp.c,1320,FP,memcmp guarded by len>=14,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/tftp.c,1324,FP,!memcmp idiomatic boolean test,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/tftp.c,1324,FP,memcmp guarded by len>=11,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/tftp.c,1360,FP,"Curl_scheme_tftp is exported, referenced by URL scheme table; needs external linkage",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/tftp.c,1360,FP,exported global scheme symbol; cannot reduce scope,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/hsts.c,50,FP,"unused void* ignored via (void)unused; debug hook, trivial non-issue",curl_full_audit_0.4.35,med
ERR33-C,curl,lib/hsts.c,52,FP,timestr checked at line 54 before use,curl_full_audit_0.4.35,high
CON34-C,curl,lib/hsts.c,52,FP,DEBUGBUILD-only CURL_TIME test hook; not production code,curl_full_audit_0.4.35,med
ENV30-C,curl,lib/hsts.c,56,FP,"curlx_str_number advances const char** cursor, does not modify string contents",curl_full_audit_0.4.35,high
DCL00-C,curl,lib/hsts.c,68,FP,h modified via h->list init; not const,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/hsts.c,79,FP,h used to free members and h itself; not const-qualifiable,curl_full_audit_0.4.35,high
EXP40-C,curl,lib/hsts.c,79,FP,struct hsts *h = *hp is plain pointer copy; no const involved,curl_full_audit_0.4.35,high
DCL02-C,curl,lib/hsts.c,82,FP,'n' and 'h' not visually similar; bogus normalization,curl_full_audit_0.4.35,high
API05-C,curl,lib/hsts.c,95,FP,conformant-array-syntax advisory convention FP,curl_full_audit_0.4.35,high
API00-C,curl,lib/hsts.c,119,FP,internal parser; header always valid from callers,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/hsts.c,128,FP,time(NULL) baseline for expiry; curl idiom,curl_full_audit_0.4.35,med
STR34-C,curl,lib/hsts.c,129,FP,strlen(hostname); no sign-extension,curl_full_audit_0.4.35,high
API05-C,curl,lib/hsts.c,225,FP,conformant-array-syntax advisory convention FP,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/hsts.c,230,FP,time(NULL) baseline for expiry check; curl idiom,curl_full_audit_0.4.35,med
MEM30-C,curl,lib/hsts.c,251,FP,hsts_free only in expires<=now branch which continues at 249; 251 not reached after free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/hsts.c,251,FP,free path does continue; member access here is on live entry,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/hsts.c,252,FP,sts not freed on this path (continue skipped 251+); live entry,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/hsts.c,255,FP,live entry; free branch continued earlier,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/hsts.c,255,FP,sts->host on live entry; not freed here,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/hsts.c,263,FP,live entry compared; free path took continue earlier,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/hsts.c,263,FP,sts->host on live entry,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/hsts.c,264,FP,returns live (non-freed) matching entry,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/hsts.c,267,FP,"bestsub is a retained live entry, never freed",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/hsts.c,275,TP,"hsts_push static helper reads sts only; never written, not fn-pointer-bound; const valid",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/hsts.c,307,TP,"hsts_out static helper reads sts only; const-qualifiable, not fn-pointer-bound",curl_full_audit_0.4.35,med
EXP33-C,curl,lib/hsts.c,316,FP,stamp filled by curlx_gmtime (result-checked) before use,curl_full_audit_0.4.35,high
API00-C,curl,lib/hsts.c,328,FP,internal/exported save; data always valid from callers,curl_full_audit_0.4.35,high
DCL02-C,curl,lib/hsts.c,332,FP,'n' vs 'h' not confusable; bogus,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/hsts.c,349,FP,FILE* is 'out' (closed at 361); 'result' is CURLcode misidentified,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/hsts.c,349,FP,no open() here; out closed via curlx_fclose at 361,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/hsts.c,351,FP,"adjacent string-literal concatenation, not preprocessor directive",curl_full_audit_0.4.35,high
PRE32-C,curl,lib/hsts.c,351,FP,string literal concat across lines; no #directive in args,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/hsts.c,353,FP,out valid: Curl_fopen sets it only on success (!result) at 350,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/hsts.c,376,FP,sts assigned by Curl_node_elem each loop iteration before use,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/hsts.c,398,FP,intentional empty if; real work in else branch (negative parse logic),curl_full_audit_0.4.35,med
ENV01-C,curl,lib/hsts.c,407,FP,"dbuf filled from parsed file date, bounded by curlx_str_quotedword; not env",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/hsts.c,407,FP,"dbuf is fixed-size [MAX_HSTS_DATELEN+1], not a VLA",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/hsts.c,413,FP,curlx_str/curlx_strlen are pure accessors of &date; no unsequenced side effects,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/hsts.c,416,FP,!strcmp idiomatic comparison,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/hsts.c,426,FP,"accessor calls (curlx_str/strlen), no side effects",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/hsts.c,428,FP,"accessor calls, no unsequenced side effects",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/hsts.c,453,FP,"buffer fed by hsts_read callback, not env var",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/hsts.c,453,FP,"buffer is fixed-size [MAX_HSTS_HOSTLEN+1], not VLA",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/hsts.c,453,FP,buffer initialized via e.name[0]=0 and filled by callback before read,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hsts.c,472,FP,hsts_create returns CURLcode not a pointer; result is not allocated memory,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/hsts.c,483,FP,"result is CURLcode; hsts_create appends to llist, no pointer to free",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/hsts.c,503,FP,h->filename freed at 501 then reassigned via strdup at 502; not UAF,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/hsts.c,506,FP,fp closed via curlx_fclose at 528,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/hsts.c,506,FP,no open(); fp from curlx_fopen closed at 528,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/hsts.c,521,FP,curlx_dyn_ptr non-NULL after successful Curl_get_line; already deref'd at 515,curl_full_audit_0.4.35,med
API00-C,curl,lib/hsts.c,536,FP,"thin wrapper, DEBUGASSERT(h), delegates to hsts_load",curl_full_audit_0.4.35,high
API00-C,curl,lib/hsts.c,536,FP,thin wrapper; file passed through to hsts_load,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/hsts.c,536,FP,data unused ((void)data); exported API signature consistency,curl_full_audit_0.4.35,med
API00-C,curl,lib/hsts.c,554,FP,internal loader; data always valid from callers,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/openldap.c,128,FP,static const array with initializer; implicit bounds idiomatic and correct,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/openldap.c,169,FP,static const array with initializer; implicit bounds idiomatic,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/openldap.c,211,FP,"loop bounded by NUL terminator on options string, not unbounded",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,236,FP,Curl_protocol setup_connection slot; signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,252,FP,SASLproto get_message callback; signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,270,FP,SASLproto perform_auth callback; signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,295,FP,SASLproto continue_auth callback; signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,319,FP,SASLproto cancel_auth callback; signature fixed by typedef,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/openldap.c,371,FP,static const array with initializer; implicit bounds idiomatic,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,410,FP,Sockbuf_IO setup callback; signature fixed; arg stored in struct,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,423,FP,Sockbuf_IO close callback; signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,429,FP,Sockbuf_IO ctrl callback sbiod param; signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,429,FP,Sockbuf_IO ctrl callback arg param; signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,439,FP,Sockbuf_IO read callback; signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,465,FP,Sockbuf_IO write callback; signature fixed by typedef,curl_full_audit_0.4.35,high
CON03-C,curl,lib/openldap.c,491,FP,"static const vtable struct, effectively immutable; no synchronization needed",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/openldap.c,525,FP,sb is out-param filled by ldap_get_option(&sb),curl_full_audit_0.4.35,high
API05-C,curl,lib/openldap.c,551,FP,conformant array syntax advisory; curl never uses C99 array params,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,551,FP,hash dtor callback key param; signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/openldap.c,551,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/openldap.c,559,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,559,FP,hash dtor callback key param; signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/openldap.c,559,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,585,FP,Curl_protocol connect_it slot done param; signature fixed,curl_full_audit_0.4.35,high
CON03-C,curl,lib/openldap.c,594,FP,debug-only static under ifdef; not a runtime concern,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/openldap.c,639,TP,unchecked getenv passed to str parser may NULL-deref; debug-build gated,curl_full_audit_0.4.35,low
CON34-C,curl,lib/openldap.c,639,FP,getenv thread-safety; debug-only gated code,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/openldap.c,640,FP,"e modified via address-of in curlx_str_number(&env,&e)",curl_full_audit_0.4.35,high
ENV30-C,curl,lib/openldap.c,641,FP,"str_number advances pointer, does not modify getenv static buffer",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/openldap.c,661,FP,sb is out-param filled by ldap_get_option(&sb),curl_full_audit_0.4.35,high
EXP33-C,curl,lib/openldap.c,724,FP,bvals out-param filled by ldap_get_attribute_ber in for-init,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/openldap.c,922,FP,msg from ldap_result non-NULL in this state path; callee handles,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/openldap.c,925,FP,msg from ldap_result non-NULL in this state path; callee handles,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/openldap.c,929,FP,msg from ldap_result non-NULL in this state path; callee handles,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/openldap.c,941,FP,"oldap_recv is a forward-declared static function, not a variable",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/openldap.c,975,FP,all paths reach out: return result; no missing return,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/openldap.c,1006,FP,lud valid when result OK (parse success); guarded by if(result) goto out,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/openldap.c,1036,FP,"void* meta storage round-trip; idiomatic, properly aligned by allocator",curl_full_audit_0.4.35,high
API05-C,curl,lib/openldap.c,1057,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/openldap.c,1058,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/openldap.c,1059,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/openldap.c,1079,FP,"Curl_recv callback buf param; signature fixed, conformant syntax advisory",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/openldap.c,1079,FP,Curl_recv callback buf param; signature fixed by typedef,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/openldap.c,1084,FP,"void* meta storage round-trip; idiomatic, properly aligned",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/openldap.c,1151,FP,STRCONST macro expands to literal+sizeof; no unsequenced side-effects,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/openldap.c,1165,FP,bvals out-param filled by ldap_get_attribute_ber in for-init,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/openldap.c,1166,FP,STRCONST macro misparse; no unsequenced side-effecting calls,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/openldap.c,1179,FP,STRCONST macro misparse; no unsequenced side-effecting calls,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/openldap.c,1210,FP,STRCONST macro misparse; no unsequenced side-effecting calls,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/openldap.c,1215,FP,STRCONST macro misparse; no unsequenced side-effecting calls,curl_full_audit_0.4.35,high
API05-C,curl,lib/openldap.c,1242,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
FLP03-C,curl,lib/openldap.c,1249,FP,"integer division (vendor_version/10000), not floating point",curl_full_audit_0.4.35,high
FLP03-C,curl,lib/openldap.c,1251,FP,"integer arithmetic, not floating point division",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/openldap.c,1256,FP,ber_memvfree is the free itself; no access after free,curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_writeout.c,27,FP,8.3 filename collision advisory; irrelevant on modern systems,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_writeout.c,35,FP,static const array with initializer; implicit bounds idiomatic,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_writeout.c,45,FP,writeTime is in writeoutvar.writefunc table; signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_writeout.c,81,TP,urlpart static helper never writes through per; const-able but curl ignores convention,curl_full_audit_0.4.35,low
STR34-C,curl,src/tool_writeout.c,154,FP,"char* to char* pointer assignment, not char sign-extension",curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_writeout.c,168,FP,certinfo out-param filled by curl_easy_getinfo before use,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_writeout.c,195,FP,m walks http_version[] array (m=&http_version[0]),curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_writeout.c,304,FP,DEBUGASSERT does not modify; strinfo not from strerror here,curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_writeout.c,317,FP,"freestr is curl_url_get allocation, not strerror; free is correct",curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_writeout.c,317,FP,CURL_UNCONST cast macro; no modification of strerror buffer,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_writeout.c,380,FP,writeOffset is in writefunc table; signature fixed,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_writeout.c,431,FP,static const variables[] with initializer; implicit bounds idiomatic,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_writeout.c,522,FP,"FILE* output stream; not const-able, fputs takes non-const FILE*",curl_full_audit_0.4.35,high
INT14-C,curl,src/tool_writeout.c,525,FP,ptr += 6 is pointer arithmetic only; no bitwise op on ptr,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_writeout.c,544,TP,time(NULL) return unchecked; consequence cosmetic (timestamp formatting),curl_full_audit_0.4.35,low
ERR33-C,curl,src/tool_writeout.c,551,FP,getenv result checked immediately by if(timestr),curl_full_audit_0.4.35,high
CON34-C,curl,src/tool_writeout.c,551,FP,getenv thread-safety; DEBUGBUILD-only code,curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_writeout.c,554,FP,str_number advances pointer; getenv buffer not modified; guarded,curl_full_audit_0.4.35,high
INT10-C,curl,src/tool_writeout.c,556,FP,"val is non-negative (str parser, max TIME_T_MAX); modulo well-defined",curl_full_audit_0.4.35,high
INT14-C,curl,src/tool_writeout.c,568,FP,bitwise is on ptr[i+1] not i; i used only for arithmetic indexing,curl_full_audit_0.4.35,high
STR00-C,curl,src/tool_writeout.c,568,FP,ASCII case-fold |0x20 on positive letter chars; idiomatic,curl_full_audit_0.4.35,med
API05-C,curl,src/tool_writeout.c,602,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_writeout.c,602,FP,FILE* output stream; not const-able,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_writeout.c,606,FP,sep points into separator string; array/string access valid,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_writeout.c,623,FP,sep is string pointer; subscript valid,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_writeout.c,624,FP,sep is string pointer; subscript valid,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_writeout.c,627,FP,sep is string pointer; compound add valid,curl_full_audit_0.4.35,high
ARR37-C,curl,src/tool_writeout.c,632,FP,sep is string pointer; increment valid,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_writeout.c,638,TP,output_header static helper never writes through per; const-able,curl_full_audit_0.4.35,low
STR34-C,curl,src/tool_writeout.c,642,FP,"const char* pointer assignment, not char sign-extension",curl_full_audit_0.4.35,high
ARR00-C,curl,src/tool_writeout.c,646,FP,end points within writeout string; end[-1] reads valid prior char,curl_full_audit_0.4.35,med
STR34-C,curl,src/tool_writeout.c,656,FP,"pointer-difference comparison, not char sign-extension",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_writeout.c,656,FP,"pointer-difference comparison, not char sign-extension",curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_writeout.c,660,FP,!strncmp idiom for prefix match; idiomatic,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_writeout.c,661,FP,"pointer assignment, not char sign-extension",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_writeout.c,661,FP,"pointer assignment, not char sign-extension",curl_full_audit_0.4.35,high
ARR36-C,curl,src/tool_writeout.c,662,FP,end and instr both point into same writeout string,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_writeout.c,668,FP,hname[vlen] guarded by if(vlen < sizeof(hname)) at 666,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_writeout.c,681,FP,header valid only inside CURLHE_OK block; not NULL there,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_writeout.c,704,FP,"ptr points into caller's writeout string, not a local variable",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_writeout.c,704,FP,"const char* pointer assignment, not char sign-extension",curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_writeout.c,715,TP,ourWriteOut only reads config->writeout; const-able but curl ignores convention,curl_full_audit_0.4.35,low
ARR30-C,curl,src/tool_writeout.c,729,FP,while loop bounded by NUL terminator on writeout string,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_writeout.c,738,FP,end assigned in each branch before use; sqc branch-merge confusion,curl_full_audit_0.4.35,high
ARR01-C,curl,src/tool_writeout.c,756,FP,"variables is file-scope array, not a decayed parameter; sizeof valid",curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_writeout.c,799,FP,!strncmp idiom for token match; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_writeout.c,803,FP,!strncmp idiom for token match; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_writeout.c,806,FP,!strncmp idiom for token match; idiomatic,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_writeout.c,815,FP,"fname filled by memcpy before use, guarded by if(flen<sizeof)",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_writeout.c,816,FP,"pointer-difference comparison, not char sign-extension",curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_writeout.c,816,FP,"pointer-difference comparison, not char sign-extension",curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_writeout.c,820,FP,fname[flen]=0 guarded by if(flen < sizeof(fname)) at 817,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_writeout.c,821,FP,stream2 closed via fclose_stream flag at function end (line 868),curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_writeout.c,821,FP,stream2 closed via fclose_stream flag at function end (line 868),curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/rustls.c,77,FP,cr_data_pending is vtable data_pending callback; signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/rustls.c,94,FP,read_cb is rustls reader callback; signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/rustls.c,121,FP,write_cb is rustls writer callback; signature fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/rustls.c,144,FP,tls_recv_more passes cf to non-const callees; const not applicable,curl_full_audit_0.4.35,med
API05-C,curl,lib/vtls/rustls.c,188,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/rustls.c,188,FP,cr_recv vtable recv callback; plainbuf is written output buffer,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/rustls.c,301,FP,conformant array syntax advisory; convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/rustls.c,379,FP,cr_verify_none rustls verify callback; signature fixed,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/vtls/rustls.c,389,FP,f closed via curlx_fclose on all paths; wrapper unrecognized,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/vtls/rustls.c,396,FP,"fread(buf,1,sizeof) reads bytes; element-size 1 is correct",curl_full_audit_0.4.35,high
ERR00-C,curl,lib/vtls/rustls.c,396,FP,fread return rr is checked (!rr && !feof),curl_full_audit_0.4.35,high
FIO17-C,curl,lib/vtls/rustls.c,396,FP,binary read into uint8_t buf; no C-string null terminator needed,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/rustls.c,411,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/rustls.c,412,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/rustls.c,445,FP,ciphers set to non-NULL or empty string before deref,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/rustls.c,445,FP,end set by Curl_cipher_suite_walk_str before read in ptr=end,curl_full_audit_0.4.35,high
INT36-C,curl,lib/vtls/rustls.c,461,FP,"(int)(end-ptr) is ptrdiff cast for printf, not ptr-to-int",curl_full_audit_0.4.35,high
INT36-C,curl,lib/vtls/rustls.c,471,FP,(int)(end-ptr) ptrdiff cast for printf width,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/rustls.c,505,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/rustls.c,506,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/vtls/rustls.c,509,FP,clabel fixed buffer for keylog label; no getenv involved,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/vtls/rustls.c,654,FP,alpn fixed array; no getenv involved,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vtls/rustls.c,658,FP,alpn[i] written before read; same count passed to rustls,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vtls/rustls.c,683,FP,curlx_dyn_uptr/len are pure getters; no unsequenced side effects,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/rustls.c,721,FP,roots_builder freed at cleanup label on all gotos,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/rustls.c,731,FP,roots_builder freed at cleanup label,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/rustls.c,739,FP,roots_builder freed at cleanup label,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/rustls.c,745,FP,roots_builder freed at cleanup label,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/rustls.c,753,FP,roots_builder freed at cleanup label,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/rustls.c,762,FP,roots_builder freed at cleanup label,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vtls/rustls.c,871,FP,curlx_dyn_uptr/len pure getters; no unsequenced side effects,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/rustls.c,1010,FP,get_config returns ssl_config_data*; no char* alignment cast in source,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/rustls.c,1014,FP,conn_config from cf accessor always valid; curl idiom,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/vtls/rustls.c,1030,FP,config_builder non-NULL after successful init_config_builder,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/rustls.c,1037,FP,ssl_config from cf accessor always valid; curl idiom,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/vtls/rustls.c,1038,FP,config_builder non-NULL after init returns OK,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/rustls.c,1046,FP,config_builder non-NULL after init returns OK,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/rustls.c,1060,FP,config_builder non-NULL after init returns OK,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/rustls.c,1069,FP,config_builder non-NULL after init returns OK,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/rustls.c,1077,FP,config_builder non-NULL after init returns OK,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/rustls.c,1090,FP,"'rr' is rustls_result int, not pointer; rconn ownership transfers to backend",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/rustls.c,1097,FP,"error path; rconn not allocated, config freed; rr is not a pointer",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/rustls.c,1103,FP,success path; rconn stored in backend->conn freed by cr_close,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/rustls.c,1123,FP,"for(;;) never falls through; all paths return, end unreachable",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/rustls.c,1230,FP,"char* from const unsigned char*; both alignment 1, no real issue",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/rustls.c,1231,FP,char* from const unsigned char*; both alignment 1,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/rustls.c,1287,FP,cr_get_internals vtable get_internals callback; signature fixed,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/rustls.c,1335,FP,buf is output buffer written by cr_recv before read,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/rustls.c,1359,FP,cr_close vtable callback; data param fixed by typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/rustls.c,1359,FP,cr_close vtable callback; data param fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/rustls.c,1377,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/rustls.c,1383,FP,cr_random vtable random callback; signature fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/rustls.c,1383,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/bufq.c,45,FP,chunk_reset callers pass validated non-NULL chunk,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,50,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/bufq.c,57,FP,no const cast; memcpy size arg misparsed,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,64,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/bufq.c,85,FP,chunk_slurpn calls reader fn-ptr; const not applicable,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,86,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/bufq.c,98,FP,"reader is a function-pointer parameter, not undeclared function",curl_full_audit_0.4.35,high
ARR36-C,curl,lib/bufq.c,100,FP,"DEBUGASSERT(*pnread<=n): size_t values, not array pointers",curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,107,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
MEM33-C,curl,lib/bufq.c,110,FP,"*pbuf=&chunk->x.data[..] is pointer assignment, not struct copy",curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,115,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
MEM33-C,curl,lib/bufq.c,119,FP,"*pbuf pointer assignment, not flexible-array struct copy",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/bufq.c,119,FP,offset bounded by callers and DEBUGASSERT; internal helper,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/bufq.c,142,FP,curlx_free declared via curlx headers/macros,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/bufq.c,151,FP,"sizeof(*pool) is struct size; pool points to single struct, idiom",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/bufq.c,166,FP,"*pchunk=chunk from pool->spare (persistent), not local automatic",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/bufq.c,176,FP,curlx_calloc declared via curlx headers/macros,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/bufq.c,182,FP,"*pchunk=chunk from curlx_calloc heap, not local automatic",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/bufq.c,190,FP,curlx_free declared via curlx headers/macros,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/bufq.c,206,FP,bufcp_take pool modified (spare list mutated); const wrong here,curl_full_audit_0.4.35,med
ARR01-C,curl,lib/bufq.c,211,FP,"sizeof(*q) is struct size; q points to single struct, idiom",curl_full_audit_0.4.35,high
INT14-C,curl,lib/bufq.c,294,FP,member access (>=) and opts bitmask (&); readability advisory,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/bufq.c,309,FP,curlx_calloc declared via curlx headers/macros,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/bufq.c,336,FP,curlx_free declared via curlx headers/macros,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/bufq.c,364,FP,"return chunk from q->tail/get_spare (heap), not local automatic",curl_full_audit_0.4.35,high
API00-C,curl,lib/bufq.c,367,FP,"internal Curl_bufq_write; len is size_t loop bound, DEBUGASSERT guards",curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,368,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,395,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API00-C,curl,lib/bufq.c,401,FP,"internal Curl_bufq_read; len loop-bounded, callers trusted",curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,401,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API00-C,curl,lib/bufq.c,417,FP,thin wrapper to Curl_bufq_read; no deref of buf itself,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,417,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,424,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API00-C,curl,lib/bufq.c,438,FP,offset bounded by callers; internal helper,curl_full_audit_0.4.35,high
API00-C,curl,lib/bufq.c,438,FP,offset bounded by callers; internal helper,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/bufq.c,438,FP,Curl_bufq_peek_at traverses q->head list (reads); but accessor; idiom-FP,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,439,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/bufq.c,441,FP,c is reassigned c=c->next in loop; not const-eligible,curl_full_audit_0.4.35,high
API00-C,curl,lib/bufq.c,461,FP,internal Curl_bufq_skip; amount is size_t loop counter,curl_full_audit_0.4.35,high
API00-C,curl,lib/bufq.c,472,FP,writer is fn-ptr called in loop; not derefed unchecked,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/bufq.c,472,FP,writer fn-ptr param invoked; const not applicable,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,473,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/bufq.c,483,FP,"writer is function-pointer parameter, not undeclared function",curl_full_audit_0.4.35,high
API00-C,curl,lib/bufq.c,504,FP,len is size_t loop bound; internal function,curl_full_audit_0.4.35,high
API00-C,curl,lib/bufq.c,504,FP,len is size_t loop bound; internal function,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,505,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,506,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API00-C,curl,lib/bufq.c,553,FP,reader fn-ptr called via chunk_slurpn; not derefed unchecked,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,554,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,580,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API00-C,curl,lib/bufq.c,615,FP,thin wrapper to bufq_slurpn; reader fn-ptr not derefed,curl_full_audit_0.4.35,high
API05-C,curl,lib/bufq.c,616,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/curl_ntlm_core.c,74,FP,"DESKEY(x) &x: address-of, no operator-precedence hazard; parenthesizing changes nothing",curl_full_audit_0.4.35,high
PRE01-C,curl,lib/curl_ntlm_core.c,92,FP,"DESKEY(x) &x: address-of, no precedence hazard",curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_ntlm_core.c,142,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
INT08-C,curl,lib/curl_ntlm_core.c,149,FP,unsigned char b promoted to int for shifts/xor; no overflow possible,curl_full_audit_0.4.35,high
INT08-C,curl,lib/curl_ntlm_core.c,149,FP,"unsigned char promoted to int; masked parity computation, no overflow",curl_full_audit_0.4.35,high
INT08-C,curl,lib/curl_ntlm_core.c,149,FP,promoted to int; no overflow,curl_full_audit_0.4.35,high
INT08-C,curl,lib/curl_ntlm_core.c,150,FP,promoted to int; no overflow,curl_full_audit_0.4.35,high
INT08-C,curl,lib/curl_ntlm_core.c,150,FP,promoted to int; no overflow,curl_full_audit_0.4.35,high
INT08-C,curl,lib/curl_ntlm_core.c,150,FP,promoted to int; no overflow,curl_full_audit_0.4.35,high
INT08-C,curl,lib/curl_ntlm_core.c,151,FP,"promoted to int; masked, no overflow",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_ntlm_core.c,168,FP,key_56 is const unsigned char* not a FILE*; total misfire,curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_ntlm_core.c,168,FP,key_56 is a byte buffer not a stream,curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_ntlm_core.c,169,FP,"key_56 byte array, no FILE*",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_ntlm_core.c,169,FP,"key_56 byte array, no FILE*",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_ntlm_core.c,170,FP,"key_56 byte array, no FILE*",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_ntlm_core.c,170,FP,"key_56 byte array, no FILE*",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_ntlm_core.c,171,FP,"key_56 byte array, no FILE*",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_ntlm_core.c,171,FP,"key_56 byte array, no FILE*",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_ntlm_core.c,172,FP,"key_56 byte array, no FILE*",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_ntlm_core.c,172,FP,"key_56 byte array, no FILE*",curl_full_audit_0.4.35,high
INT31-C,curl,lib/curl_ntlm_core.c,173,FP,value masked &0xFF before cast to char; intentional byte truncation,curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_ntlm_core.c,173,FP,"key_56 byte array, no FILE*",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curl_ntlm_core.c,173,FP,"key_56 byte array, no FILE*",curl_full_audit_0.4.35,high
DCL40-C,curl,lib/curl_ntlm_core.c,197,FP,mutually-exclusive #elif crypto-backend defs; only one compiled per build,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/curl_ntlm_core.c,205,FP,key is local non-const char[8]; cast to uchar* casts no const away,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/curl_ntlm_core.c,223,FP,key is local non-const char[8]; no const cast away,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/curl_ntlm_core.c,227,FP,key is local non-const char[8]; no const cast away,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_ntlm_core.c,233,FP,"out is the encryption output buffer, written by the cipher; cannot be const",curl_full_audit_0.4.35,high
ARR02-C,curl,lib/curl_ntlm_core.c,357,FP,initialized magic[] table; implicit bounds idiomatic and correct,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curl_ntlm_core.c,360,FP,"strlen(password): password is char* passed to strlen, no char->int promotion",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_ntlm_core.c,363,FP,"len=CURLMIN(...,14)<=14; &pw[len] valid (at most one-past for memset 0 size)",curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_ntlm_core.c,396,FP,curl array-param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_ntlm_core.c,396,FP,curl array-param convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curl_ntlm_core.c,413,FP,strlen(password): no signed-char to int conversion at this site,curl_full_audit_0.4.35,high
INT14-C,curl,lib/curl_ntlm_core.c,449,FP,readability-only advisory on bias arithmetic; not a defect,curl_full_audit_0.4.35,high
INT14-C,curl,lib/curl_ntlm_core.c,475,FP,readability advisory on loop counter i,curl_full_audit_0.4.35,high
INT34-C,curl,lib/curl_ntlm_core.c,476,FP,"i in {24,16,8,0}; shift always within 32-bit width",curl_full_audit_0.4.35,high
INT34-C,curl,lib/curl_ntlm_core.c,477,FP,"i in {24,16,8,0}; shift within width",curl_full_audit_0.4.35,high
INT14-C,curl,lib/curl_ntlm_core.c,480,FP,readability advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_ntlm_core.c,489,FP,curl array-param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_ntlm_core.c,490,FP,curl array-param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_ntlm_core.c,502,FP,curl array-param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_ntlm_core.c,503,FP,curl array-param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_ntlm_core.c,504,FP,curl array-param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_ntlm_core.c,505,FP,curl array-param convention,curl_full_audit_0.4.35,high
INT14-C,curl,lib/curl_ntlm_core.c,515,FP,"userlen<<1 size calc, bounded by CURL_MAX_INPUT_LENGTH check; readability only",curl_full_audit_0.4.35,high
ENV34-C,curl,lib/curl_ntlm_core.c,578,FP,"DEBUGBUILD-only getenv used immediately, not retained across getenv calls",curl_full_audit_0.4.35,high
ERR33-C,curl,lib/curl_ntlm_core.c,578,FP,return value IS checked: if(force_timestamp) on next line,curl_full_audit_0.4.35,high
CON34-C,curl,lib/curl_ntlm_core.c,578,FP,DEBUGBUILD-only diagnostic getenv; thread-safety advisory not applicable,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/curl_ntlm_core.c,594,FP,"LONGQUARTET macro args are pure shift/mask, no side effects to sequence",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curl_ntlm_core.c,621,FP,"ptr points to curlx_calloc heap, not stack; *ntresp=ptr returns valid heap",curl_full_audit_0.4.35,high
ARR38-C,curl,lib/curl_ntlm_core.c,659,FP,"lmresp is 24-byte out, hmac_output is 16; memcpy 16 within bounds",curl_full_audit_0.4.35,high
ARR02-C,curl,lib/pop3.c,145,FP,initialized pop3cmds[] table; implicit bounds idiomatic,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/pop3.c,181,FP,while(*ptr && ...) over NUL-terminated conn->options; bounded by NUL,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/pop3.c,235,FP,Curl_meta_get returns the originally-allocated struct POP3*; alignment preserved,curl_full_audit_0.4.35,high
STR34-C,curl,lib/pop3.c,236,FP,"&data->state.up.path[1] is pointer init, not signed-char read",curl_full_audit_0.4.35,high
EXP36-C,curl,lib/pop3.c,253,FP,meta_get returns originally-allocated struct; alignment fine,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/pop3.c,293,FP,pop3_endofresp matches fixed endofresp callback typedef; const cannot be added,curl_full_audit_0.4.35,high
API05-C,curl,lib/pop3.c,294,FP,curl array-param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/pop3.c,294,FP,curl array-param convention,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/pop3.c,303,FP,!memcmp idiom in protocol response parsing; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/pop3.c,325,FP,!memcmp idiom; idiomatic,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/pop3.c,347,FP,pop3_get_message matches SASLproto.getmessage callback typedef; fixed signature,curl_full_audit_0.4.35,high
STR30-C,curl,lib/pop3.c,375,FP,Curl_bufref_set stores ptr+len 0 with NULL freefn; does not modify literal,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/pop3.c,393,FP,initialized names[] debug table; implicit bounds idiomatic,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/pop3.c,410,FP,(void*)pop3c for infof %p logging; not casting away const,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/pop3.c,475,FP,"all paths return: USE_SSL branch ends at out:, #else returns NOT_BUILT_IN",curl_full_audit_0.4.35,high
MEM03-C,curl,lib/pop3.c,560,FP,"secret holds APOP MD5 hex digest sent in cleartext, not the password; advisory",curl_full_audit_0.4.35,med
MEM05-C,curl,lib/pop3.c,560,FP,"MD5_DIGEST_LEN is a compile-time constant; secret[] is fixed-size, not a VLA",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/pop3.c,589,FP,secret written by msnprintf within the loop before any read; not uninitialized,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/pop3.c,589,FP,"secret is the snprintf output target, then sent; not read uninitialized",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/pop3.c,589,FP,digest filled by Curl_MD5_final at L585 before loop reads it,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/pop3.c,730,FP,meta_get returns originally-allocated struct; alignment preserved,curl_full_audit_0.4.35,high
STR34-C,curl,lib/pop3.c,822,FP,"gt/lt are const char* pointers; gt-lt is pointer subtraction, not char promotion",curl_full_audit_0.4.35,high
STR34-C,curl,lib/pop3.c,822,FP,"lt is a pointer; pointer arithmetic, no signed-char conversion",curl_full_audit_0.4.35,high
ARR38-C,curl,lib/pop3.c,823,FP,"timestamplen=gt-lt+1 with lt,gt both inside line buffer; memchr in bounds",curl_full_audit_0.4.35,high
INT30-C,curl,lib/pop3.c,887,FP,len-- guarded by while(len && ...) so len>0 at decrement,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/pop3.c,996,FP,"default: is a separate case label, not unreachable after the preceding break",curl_full_audit_0.4.35,high
API05-C,curl,lib/pop3.c,1073,FP,curl array-param convention,curl_full_audit_0.4.35,high
INT30-C,curl,lib/pop3.c,1161,FP,guarded by prev-1>0 immediately preceding in same condition; no wrap,curl_full_audit_0.4.35,high
INT30-C,curl,lib/pop3.c,1163,FP,"under strip_dot && prev-1>0 guard; prev>=2 here, no wrap",curl_full_audit_0.4.35,high
INT00-C,curl,lib/pop3.c,1198,FP,last<=nread maintained by loop invariant (last set to indices <nread),curl_full_audit_0.4.35,high
INT00-C,curl,lib/pop3.c,1200,FP,nread-last guarded by if(nread-last); last<=nread by construction,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/pop3.c,1213,FP,meta_get returns originally-allocated struct; alignment preserved,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/pop3.c,1251,FP,both arg calls only read pointer/len from same buf; no unsequenced side effects,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/pop3.c,1470,FP,meta_get returns originally-allocated struct; alignment preserved,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/pop3.c,1504,FP,meta_get returns originally-allocated struct; alignment preserved,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/pop3.c,1533,FP,pop3_dophase_done casts data to void; matches handler signature anyway,curl_full_audit_0.4.35,high
API05-C,curl,lib/pop3.c,1652,FP,pop3_easy_dtor matches Curl_meta_dtor callback typedef; signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/pop3.c,1652,FP,dtor key param fixed by Curl_meta_dtor typedef; cannot add const,curl_full_audit_0.4.35,high
API05-C,curl,lib/pop3.c,1652,FP,curl array-param convention; callback typedef fixed,curl_full_audit_0.4.35,high
API05-C,curl,lib/pop3.c,1664,FP,pop3_conn_dtor matches Curl_meta_dtor typedef; signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/pop3.c,1664,FP,dtor key param fixed by typedef,curl_full_audit_0.4.35,high
API05-C,curl,lib/pop3.c,1664,FP,curl array-param convention; callback typedef fixed,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/pop3.c,1684,FP,"L1684 is the assignment pop3c=curlx_calloc, not a dereference of uninit ptr",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/pop3.c,1687,FP,on meta_set failure Curl_meta_set itself calls dtor freeing pop3c; no leak,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/pop3.c,1689,FP,meta_set calls dtor on failure freeing pop3/pop3c; ownership transferred,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/pop3.c,1720,FP,Curl_scheme_pop3 has genuine external linkage (referenced from url.c scheme table),curl_full_audit_0.4.35,high
DCL19-C,curl,lib/pop3.c,1720,FP,exported scheme handler must be file-scope with external linkage,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/pop3.c,1737,FP,Curl_scheme_pop3s has genuine external linkage; needed by url.c,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/pop3.c,1737,FP,exported scheme handler; must be external file-scope,curl_full_audit_0.4.35,high
API05-C,curl,lib/connect.c,73,FP,Advisory conformant-array syntax; curl never uses C99 array params,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/connect.c,76,FP,!memcmp boolean idiom in alpn dispatch,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/connect.c,76,FP,"name from setopt; len-guarded, not NULL in practice",curl_full_audit_0.4.35,med
EXP20-C,curl,lib/connect.c,78,FP,!memcmp boolean idiom,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/connect.c,80,FP,!memcmp boolean idiom,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/connect.c,84,FP,!memcmp boolean idiom,curl_full_audit_0.4.35,high
API00-C,curl,lib/connect.c,139,FP,"Thin wrapper, passes data through to impl",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/connect.c,150,FP,"sockindex is FIRSTSOCKET/SECONDARY (0/1), bounded by design",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/connect.c,150,FP,"sockindex internal 0/1 invariant, not attacker-controlled",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/connect.c,168,FP,sockindex bounded 0/1 internal,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/connect.c,174,FP,sockindex bounded 0/1 internal,curl_full_audit_0.4.35,high
API00-C,curl,lib/connect.c,178,FP,"Internal fn; derefs conn (caller-asserted), data passed through",curl_full_audit_0.4.35,high
API00-C,curl,lib/connect.c,194,FP,Internal fn; data->conn invariant per siblings,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/connect.c,194,FP,data non-const by curl convention; vtable-style signature,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/connect.c,196,FP,sockindex bounded 0/1 internal,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/connect.c,196,FP,sockindex bounded 0/1 internal,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/connect.c,200,FP,data non-const by convention,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/connect.c,203,FP,sockindex bounded 0/1 internal,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/connect.c,203,FP,sockindex bounded 0/1 internal,curl_full_audit_0.4.35,high
API00-C,curl,lib/connect.c,211,FP,"addr is out-param written before read; sa derefed, public sig",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/connect.c,211,FP,Public API signature fixed; cannot const sa,curl_full_audit_0.4.35,high
API00-C,curl,lib/connect.c,268,FP,DEBUGASSERT(data); connp checked before deref,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/connect.c,301,FP,"'reason' is a parameter name, not a function; misparse",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/connect.c,301,FP,Misparse of macro-conditional param 'reason' as function,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/connect.c,316,FP,"Intentional no-op with explanatory comment, has else branch",curl_full_audit_0.4.35,high
CON03-C,curl,lib/connect.c,470,FP,"Exported global cfilter vtable; init-once const-like, not shared mutable",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/connect.c,470,FP,"Curl_cft_setup exported, used in other TUs",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/connect.c,470,FP,Exported vtable needs file scope external linkage,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/connect.c,489,FP,data non-const by convention; (void)data used,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/connect.c,498,FP,curlx_calloc declared in curlx headers,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/connect.c,498,FP,ctx assigned from calloc then NULL-checked; not uninitialized,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/connect.c,515,FP,curlx_free declared in curlx headers,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/connect.c,520,FP,All paths return result via out: label,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/connect.c,533,FP,cf set by &cf out-param in cf_setup_create (*pcf always assigned),curl_full_audit_0.4.35,high
API00-C,curl,lib/connect.c,538,FP,"cf_at passed through; data DEBUGASSERTed, internal",curl_full_audit_0.4.35,high
API00-C,curl,lib/connect.c,538,FP,DEBUGASSERT(data); internal fn,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/connect.c,538,FP,All paths return result via out:,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/connect.c,550,FP,cf set by &cf out-param before use,curl_full_audit_0.4.35,high
API00-C,curl,lib/connect.c,555,FP,DEBUGASSERT(data); internal fn,curl_full_audit_0.4.35,high
API00-C,curl,lib/connect.c,555,FP,conn->scheme DEBUGASSERTed; internal invariant,curl_full_audit_0.4.35,high
API00-C,curl,lib/connect.c,555,FP,DEBUGASSERT(dns); internal invariant,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/connect.c,567,FP,sockindex bounded 0/1 internal,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/connect.c,568,FP,sockindex bounded 0/1 internal,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/connect.c,571,FP,sockindex bounded 0/1 internal,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/connect.c,581,FP,sockindex bounded 0/1 internal,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/connect.c,588,FP,sockindex bounded 0/1 internal,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/connect.c,591,FP,sockindex bounded 0/1 internal,curl_full_audit_0.4.35,high
API00-C,curl,lib/connect.c,595,FP,"Internal fn; conn->bits checked, idiomatic",curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_fnmatch.c,77,FP,c reassigned each loop iteration; advisory const only,curl_full_audit_0.4.35,med
ARR30-C,curl,lib/curl_fnmatch.c,83,FP,i guarded by i>=sizeof(keyword) check at line 78,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_fnmatch.c,100,FP,CURLFNM_DIGIT=258 < charset size 271,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_fnmatch.c,102,FP,CURLFNM_ALNUM=257 < 271,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_fnmatch.c,104,FP,CURLFNM_ALPHA=260 < 271,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_fnmatch.c,106,FP,CURLFNM_XDIGIT=259 < 271,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_fnmatch.c,108,FP,CURLFNM_PRINT=261 < 271,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_fnmatch.c,110,FP,CURLFNM_GRAPH=264 < 271,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_fnmatch.c,112,FP,CURLFNM_SPACE=265 < 271,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_fnmatch.c,114,FP,CURLFNM_BLANK=262 < 271,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_fnmatch.c,116,FP,CURLFNM_UPPER=266 < 271,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_fnmatch.c,118,FP,CURLFNM_LOWER=263 < 271,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/curl_fnmatch.c,140,FP,c is unsigned char loaded from pointer; advisory const only,curl_full_audit_0.4.35,med
ARR30-C,curl,lib/curl_fnmatch.c,142,FP,c is unsigned char (0-255) < charset 271,curl_full_audit_0.4.35,high
STR00-C,curl,lib/curl_fnmatch.c,142,FP,"c declared unsigned char, not plain char; misparse",curl_full_audit_0.4.35,high
INT07-C,curl,lib/curl_fnmatch.c,142,FP,"c is unsigned char, not plain char",curl_full_audit_0.4.35,high
INT07-C,curl,lib/curl_fnmatch.c,150,FP,c is unsigned char,curl_full_audit_0.4.35,high
STR00-C,curl,lib/curl_fnmatch.c,152,FP,"c is unsigned char, in-range index",curl_full_audit_0.4.35,high
INT07-C,curl,lib/curl_fnmatch.c,152,FP,c is unsigned char,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curl_fnmatch.c,153,FP,"p points into caller's pattern buffer; advancing caller cursor, not local addr",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/curl_fnmatch.c,159,FP,for(;;) all paths return or goto fail->return,curl_full_audit_0.4.35,high
INT07-C,curl,lib/curl_fnmatch.c,168,FP,c is unsigned char (line 163),curl_full_audit_0.4.35,high
STR00-C,curl,lib/curl_fnmatch.c,178,FP,"c is unsigned char, valid index",curl_full_audit_0.4.35,high
INT07-C,curl,lib/curl_fnmatch.c,178,FP,c is unsigned char,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/curl_fnmatch.c,184,FP,&& provides sequence point; pp++ completes before parsekeyword call,curl_full_audit_0.4.35,high
STR00-C,curl,lib/curl_fnmatch.c,187,FP,c is unsigned char,curl_full_audit_0.4.35,high
INT07-C,curl,lib/curl_fnmatch.c,187,FP,c is unsigned char,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_fnmatch.c,194,FP,CURLFNM_NEGATE=256 < 271,curl_full_audit_0.4.35,high
STR00-C,curl,lib/curl_fnmatch.c,195,FP,c is unsigned char,curl_full_audit_0.4.35,high
INT07-C,curl,lib/curl_fnmatch.c,195,FP,c is unsigned char,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_fnmatch.c,199,FP,CURLFNM_NEGATE=256 < 271,curl_full_audit_0.4.35,high
STR00-C,curl,lib/curl_fnmatch.c,202,FP,c is unsigned char,curl_full_audit_0.4.35,high
INT07-C,curl,lib/curl_fnmatch.c,202,FP,c is unsigned char,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/curl_fnmatch.c,210,FP,'\\'=92 constant index < 256,curl_full_audit_0.4.35,high
STR00-C,curl,lib/curl_fnmatch.c,221,FP,c is unsigned char,curl_full_audit_0.4.35,high
INT07-C,curl,lib/curl_fnmatch.c,221,FP,c is unsigned char,curl_full_audit_0.4.35,high
STR00-C,curl,lib/curl_fnmatch.c,228,FP,c is unsigned char,curl_full_audit_0.4.35,high
INT07-C,curl,lib/curl_fnmatch.c,228,FP,c is unsigned char,curl_full_audit_0.4.35,high
STR00-C,curl,lib/curl_fnmatch.c,242,FP,c is unsigned char,curl_full_audit_0.4.35,high
INT07-C,curl,lib/curl_fnmatch.c,242,FP,c is unsigned char,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/curl_fnmatch.c,251,FP,"Recursion bounded by maxstars (starts 2, decremented)",curl_full_audit_0.4.35,med
MSC37-C,curl,lib/curl_fnmatch.c,251,FP,for(;;) loop always returns on every case path,curl_full_audit_0.4.35,high
CON43-C,curl,lib/curl_fnmatch.c,261,FP,"p is local pattern cursor, single-threaded; not shared",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/curl_fnmatch.c,261,FP,p=pattern NULL-checked in Curl_fnmatch line 353,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/curl_fnmatch.c,278,FP,s=string NULL-checked in Curl_fnmatch line 353,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_fnmatch.c,349,FP,ptr signature fixed by curl_fnmatch_callback typedef,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/curl_fnmatch.c,365,FP,ptr signature fixed by callback typedef,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curl_fnmatch.c,98,FP,"*pattern = p assigns caller pointer to position within caller pattern buffer, not local-address escape",curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_setopt.c,24,FP,"8-char filename collision advisory; curl uses long filenames, not a real portability issue",curl_full_audit_0.4.35,high
PRE00-C,curl,src/tool_setopt.c,40,FP,"NV macro takes enum constant; struct-initializer token macro, multi-eval of a constant is harmless",curl_full_audit_0.4.35,high
PRE01-C,curl,src/tool_setopt.c,40,FP,"value used only in {#e,e} init list with enum constants; parenthesizing pointless, no precedence risk",curl_full_audit_0.4.35,high
PRE05-C,curl,src/tool_setopt.c,40,FP,stringify-an-enum-name is the intent; two-level indirection would defeat the purpose,curl_full_audit_0.4.35,high
PRE12-C,curl,src/tool_setopt.c,40,FP,argument is always an enum constant; multiple evaluation has no side effects,curl_full_audit_0.4.35,high
PRE05-C,curl,src/tool_setopt.c,41,FP,NV1 stringifies enum name deliberately; expansion not desired,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_setopt.c,44,FP,NULL-terminated initializer table; implicit bounds are correct and idiomatic,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_setopt.c,55,FP,sentinel-terminated init table; implicit size correct,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_setopt.c,63,FP,sentinel-terminated init table; implicit size correct,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_setopt.c,68,FP,sentinel-terminated init table; implicit size correct,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_setopt.c,81,FP,sentinel-terminated init table; implicit size correct,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_setopt.c,92,FP,sentinel-terminated init table; implicit size correct,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_setopt.c,104,FP,sentinel-terminated init table; implicit size correct,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_setopt.c,114,FP,sentinel-terminated init table; implicit size correct,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_setopt.c,122,FP,sentinel-terminated init table; implicit size correct,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_setopt.c,129,FP,sentinel-terminated init table; implicit size correct,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_setopt.c,137,FP,sentinel-terminated init table; implicit size correct,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_setopt.c,147,FP,sentinel-terminated init table; implicit size correct,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_setopt.c,154,FP,sentinel-terminated init table; implicit size correct,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_setopt.c,163,FP,sentinel-terminated init table; implicit size correct,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_setopt.c,190,FP,"strlen(str) in c_escape; all callers pass valid option strings, str non-NULL in practice",curl_full_audit_0.4.35,med
EXP34-C,curl,src/tool_setopt.c,204,FP,s iterates from str under len-guarded loop; never NULL,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_setopt.c,364,TP,"slist only iterated/read in static helper, not vtable-bound; could be const-pointer",curl_full_audit_0.4.35,low
API02-C,curl,src/tool_setopt.c,395,FP,"'int *mimeno' is a scalar out-param, not an array; no size argument applicable",curl_full_audit_0.4.35,high
MEM05-C,curl,src/tool_setopt.c,401,FP,recursion bounded by user mime-tree depth; no unbounded stack risk,curl_full_audit_0.4.35,med
MSC04-C,curl,src/tool_setopt.c,401,FP,direct recursion over part->prev linked list is bounded and idiomatic,curl_full_audit_0.4.35,med
MEM30-C,curl,src/tool_setopt.c,451,FP,escaped used in addf before free at 457; not use-after-free,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_setopt.c,457,FP,block-local escaped freed once; analyzer conflates distinct per-block variables,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_setopt.c,480,FP,distinct block-local escaped; used before its single free at 482,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_setopt.c,482,FP,single free of block-local escaped; not a double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_setopt.c,487,FP,distinct block-local escaped; used before single free at 489,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_setopt.c,489,FP,single free of block-local escaped; conflated across blocks,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_setopt.c,489,FP,each escaped is a fresh local per if-block; freed exactly once,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_setopt.c,494,FP,distinct block-local escaped; used before single free at 496,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_setopt.c,496,FP,single free of block-local escaped; not double-free,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_setopt.c,496,FP,fresh local per block; freed once,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_setopt.c,501,FP,distinct block-local escaped; used before single free at 503,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_setopt.c,503,FP,single free of block-local escaped; not double-free,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_setopt.c,503,FP,fresh local per block; freed once,curl_full_audit_0.4.35,high
MSC04-C,curl,src/tool_setopt.c,523,FP,"indirect recursion over bounded mime tree; idiomatic, not actionable",curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_setopt.c,525,TP,toolmime only read (->subparts) in static helper; const-pointer candidate,curl_full_audit_0.4.35,low
API00-C,curl,src/tool_setopt.c,554,FP,internal setopt fn always called with valid curl; curl does not NULL-check internal params,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_setopt.c,554,FP,config supplied by caller; internal contract guarantees non-NULL,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_setopt.c,554,FP,mimepost passed straight to curl_easy_setopt; no unchecked deref,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_setopt.c,574,FP,list passed to curl_easy_setopt and guarded by 'list &&'; never unchecked-derefed,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_setopt.c,604,FP,!strcmp boolean idiom in option-name dispatch; idiomatic,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_setopt.c,668,FP,config derefed only conditionally for POSTFIELDS; internal caller guarantees validity,curl_full_audit_0.4.35,high
EXP47-C,curl,src/tool_setopt.c,681,FP,"va_arg(arg, char *) is a pointer fetch; no char promotion issue, analyzer misread type",curl_full_audit_0.4.35,high
CON03-C,curl,lib/cf-ip-happy.c,70,FP,table is static const at runtime (mutable only under UNITTESTS); no thread-shared mutation,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/cf-ip-happy.c,70,FP,variable already declared static at line 66,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/cf-ip-happy.c,70,FP,file-scope const lookup table shared by helpers; minimal scope already,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/cf-ip-happy.c,70,FP,initializer-sized provider table; implicit bounds correct,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-ip-happy.c,96,FP,cf_create is a function-pointer value stored into the array; const on it is meaningless,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-ip-happy.c,147,TP,iter only read in cf_ai_iter_has_more static helper; const-pointer candidate,curl_full_audit_0.4.35,low
DCL31-C,curl,lib/cf-ip-happy.c,181,FP,curlx_free declared via curl memory headers/macros sqc cannot resolve,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-ip-happy.c,186,FP,cf drives connection setup across ballers API kept deliberately non-const; project convention,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-ip-happy.c,191,FP,cf_create is a fnptr value stored to a->cf_create; const not applicable,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/cf-ip-happy.c,198,FP,curlx_calloc provided by curl memory macros; declaration invisible to sqc,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-ip-happy.c,198,FP,a is assigned from curlx_calloc then NULL-checked; not uninitialized,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/cf-ip-happy.c,207,FP,"a is heap memory from calloc, not a local's address; valid after return via *pa",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cf-ip-happy.c,231,FP,"a comes from caller's running list, always non-NULL at call sites",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-ip-happy.c,263,FP,"cf used to drive restart in non-const ballers API; project convention, not actionable",curl_full_audit_0.4.35,med
EXP34-C,curl,lib/cf-ip-happy.c,266,FP,a is a valid attempt node from the running list; not NULL,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-ip-happy.c,293,TP,cf parameter cast to void (unused) in cf_ip_ballers_clear; could be const,curl_full_audit_0.4.35,low
MEM30-C,curl,lib/cf-ip-happy.c,303,FP,"winner and running nodes are distinct allocations; 'data' is the easy handle, not freed",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-ip-happy.c,303,FP,winner freed once after running list drained; no double-free,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-ip-happy.c,309,FP,cf_create fnptr value stored to bs->cf_create; const not applicable,curl_full_audit_0.4.35,med
ARR01-C,curl,lib/cf-ip-happy.c,313,FP,"bs is a real struct pointer; sizeof(*bs) gives struct size, correct idiom, not decayed array",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/cf-ip-happy.c,368,FP,a=*panchor under loop guard *panchor; non-NULL,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-ip-happy.c,417,FP,addr explicitly initialized to NULL at declaration,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/cf-ip-happy.c,449,FP,"a is heap memory from cf_ip_attempt_new, not a stack address; valid in running list",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-ip-happy.c,453,FP,"goto out reached only on cf_ip_attempt_new failure, which already frees a internally",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-ip-happy.c,473,FP,goto out on restart serious-failure; no fresh allocation leaked at this point,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-ip-happy.c,484,FP,"goto out path; attempts owned by running list, freed by ballers_clear, not leaked",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-ip-happy.c,535,FP,bs ballers API uniformly non-const by design; mutation occurs through member nodes,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-ip-happy.c,557,FP,bs ballers API uniformly non-const by design; project convention,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-ip-happy.c,571,FP,bs ballers API uniformly non-const by design; project convention,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-ip-happy.c,585,FP,bs ballers API uniformly non-const by design; project convention,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-ip-happy.c,603,FP,bs ballers API uniformly non-const by design; project convention,curl_full_audit_0.4.35,med
EXP30-C,curl,lib/cf-ip-happy.c,675,FP,failf args are independent function calls with no shared side effects; order irrelevant,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-ip-happy.c,844,FP,cf_ip_happy_data_pending is a vtable slot; signature fixed by Curl_cftype typedef,curl_full_audit_0.4.35,high
CON03-C,curl,lib/cf-ip-happy.c,903,FP,Curl_cft_ip_happy is an immutable cfilter-type definition table; not mutated at runtime,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/cf-ip-happy.c,903,FP,Curl_cft_ip_happy has external linkage by design (referenced from other TUs),curl_full_audit_0.4.35,high
DCL19-C,curl,lib/cf-ip-happy.c,903,FP,exported cfilter-type table must be file-scope with external linkage,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-ip-happy.c,932,FP,"data cast to void (unused); marking const noise, internal creator signature",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-ip-happy.c,933,FP,conn cast to void (unused); const marking pointless,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/cf-ip-happy.c,934,FP,cf_create fnptr value stored to ctx->cf_create; const not applicable,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/cf-ip-happy.c,943,FP,curlx_calloc from curl memory macros; declaration invisible to sqc,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/cf-ip-happy.c,956,FP,curlx_free from curl memory macros; declaration invisible to sqc,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-ip-happy.c,961,FP,cf_at guarded by DEBUGASSERT and internal contract; data passed through to helpers,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-ip-happy.c,961,FP,"data is the easy handle, always valid from internal callers",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-ip-happy.c,971,FP,"get_cf_create returns a fnptr from a static table, not heap; must not be freed",curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-ip-happy.c,976,FP,result is CURLcode; created cf ownership transferred via Curl_conn_cf_insert_after,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-ip-happy.c,981,FP,cf_create not heap; cf inserted into chain on success; nothing leaked at return,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/cf-ip-happy.c,981,FP,"result is CURLcode return value, not an allocation; created cf ownership transferred to chain",curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_operate.c,24,FP,8-char header collision advisory; curl targets modern filesystems,curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_operate.c,54,FP,8-char header collision advisory; not applicable to curl build,curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_operate.c,54,FP,8-char header collision advisory; not applicable,curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_operate.c,55,FP,8-char header collision advisory; not applicable,curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_operate.c,62,FP,8-char header collision advisory; not applicable,curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_operate.c,66,FP,8-char header collision advisory; not applicable,curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_operate.c,68,FP,8-char header collision advisory; not applicable,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_operate.c,150,FP,VMS file closed via curlx_fclose at line 161,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_operate.c,150,FP,'file' is FILE* not an fd; misclassified; closed at 161,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_operate.c,157,FP,fread return assigned to ret_stat and checked in loop guard,curl_full_audit_0.4.35,med
ARR38-C,curl,src/tool_operate.c,157,FP,"fread(buffer,1,sizeof,..) reads bytes intentionally; size 1 correct",curl_full_audit_0.4.35,high
ERR00-C,curl,src/tool_operate.c,157,FP,return used as loop guard; duplicate of ERR33,curl_full_audit_0.4.35,med
FIO17-C,curl,src/tool_operate.c,157,FP,"binary byte read, buffer not used as C string; no terminator needed",curl_full_audit_0.4.35,high
INT30-C,curl,src/tool_operate.c,159,FP,curl_off_t count over local file size; practically unbounded but not a real wrap,curl_full_audit_0.4.35,med
DCL31-C,curl,src/tool_operate.c,194,FP,curlx_calloc declared via curlx headers/macro; preprocessor not run by sqc,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_operate.c,199,FP,"p is heap from curlx_calloc, not stack; global list head legitimate",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,199,FP,"p is heap-allocated, not stack array/VLA",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,202,FP,linked-list wiring of heap node; no stack escape,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_operate.c,206,FP,heap node assigned to list tail; not dangling,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,206,FP,"heap node, not stack",curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_operate.c,208,FP,*per = p stores heap pointer through out-param; valid,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_operate.c,220,FP,"transfersl is file-static, zero-initialized; DEBUGASSERT only reads",curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_operate.c,229,FP,"n is heap list node, not stack",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,229,FP,heap node assigned to global head; not stack escape,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_operate.c,234,FP,heap node to tail pointer; valid,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,234,FP,"heap node, not stack",curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,236,FP,curlx_free declared via curlx header/macro,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_operate.c,238,FP,"returns n which is a heap pointer (per->next), not stack local",curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_operate.c,267,FP,VMS branch; fileinfo filled by curlx_stat before use; guarded,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_operate.c,280,FP,per->infd closed on error (286) and in post_per_transfer; owned by struct,curl_full_audit_0.4.35,high
MEM12-C,curl,src/tool_operate.c,289,FP,infd closed at 286 before this error return; not leaked,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_operate.c,300,FP,getenv result checked: if(ev) before use,curl_full_audit_0.4.35,high
CON34-C,curl,src/tool_operate.c,300,FP,single-threaded CLI startup; getenv reentrancy not a real risk here,curl_full_audit_0.4.35,med
ENV30-C,curl,src/tool_operate.c,303,FP,curlx_str_number takes &ev and advances pointer; does not modify env buffer,curl_full_audit_0.4.35,high
INT18-C,curl,src/tool_operate.c,309,FP,uploadfilesize is signed curl_off_t initialized to -1; comparison correct,curl_full_audit_0.4.35,high
MEM12-C,curl,src/tool_operate.c,314,FP,"infd owned by per struct, closed in post_per_transfer; not leaked",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,324,FP,glob_cleanup nulls arg; distinct members freed; no UAF,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_operate.c,337,FP,config not modified here but const not applied project-wide; idiom,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_operate.c,338,FP,per read-only here but curl does not const-qualify these,curl_full_audit_0.4.35,med
ARR02-C,curl,src/tool_operate.c,443,FP,m[] sized by initializer is valid and idiomatic C,curl_full_audit_0.4.35,high
INT10-C,curl,src/tool_operate.c,493,FP,sleeptime is long but always >=0 here; modulo by 1000L benign,curl_full_audit_0.4.35,high
INT10-C,curl,src/tool_operate.c,494,FP,non-negative sleeptime; modulo well-defined,curl_full_audit_0.4.35,high
INT10-C,curl,src/tool_operate.c,495,FP,non-negative sleeptime; modulo well-defined,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_operate.c,516,FP,!strcmp idiom in method dispatch; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_operate.c,521,FP,!strcmp idiom; idiomatic,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operate.c,521,FP,header guaranteed set by preceding !curl_easy_header() success in same &&,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_operate.c,549,FP,fileinfo filled by curlx_fstat in same condition before S_ISREG read,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_operate.c,552,FP,"pre-truncate flush; data already validated, return not critical",curl_full_audit_0.4.35,med
ERR33-C,curl,src/tool_operate.c,564,FP,fseek return assigned to rc and checked at line 570,curl_full_audit_0.4.35,high
ERR00-C,curl,src/tool_operate.c,564,FP,rc checked at 570; duplicate,curl_full_audit_0.4.35,high
FIO14-C,curl,src/tool_operate.c,564,FP,"SEEK_END after ftruncate to known size; portable enough, advisory",curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_operate.c,585,FP,curl convention does not const-qualify per param,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_operate.c,619,FP,per param const not applied by curl convention,curl_full_audit_0.4.35,med
ERR33-C,curl,src/tool_operate.c,656,FP,fflush rc assigned and checked at 657,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_operate.c,667,FP,per param const not applied by curl convention,curl_full_audit_0.4.35,med
EXP33-C,curl,src/tool_operate.c,684,FP,st filled by curlx_stat in same if-condition before S_ISREG,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_operate.c,724,FP,!strcmp idiom; idiomatic,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,770,FP,distinct struct members freed via tool_safefree; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,772,FP,reading etag_save members to close stream; not freed yet,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,772,FP,"etag_save is embedded struct, not freed; no UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,772,FP,stream member read before any free,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,772,FP,embedded struct member access; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,773,FP,"curlx_fclose of stream; valid close, no prior free",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,773,FP,"embedded struct, not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,775,FP,alloc_filename flag read then filename freed; correct order,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,775,FP,"embedded struct, not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,776,FP,tool_safefree of distinct member; no UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,778,FP,"curl_easy_cleanup(per->curl) is the intended free, not UAF",curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,780,FP,curlx_free declared via curlx header/macro,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,781,FP,curlx_free declared via curlx header/macro,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,782,FP,curlx_free declared via curlx header/macro,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,783,FP,curlx_free declared via curlx header/macro,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,784,FP,"freeing headlist then setting NULL; distinct member, not UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,785,FP,"hdrcbdata.headlist=NULL after free; correct nulling, not UAF",curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,795,FP,curlx_strdup declared via curlx header/macro,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,803,FP,curlx_strdup declared via curlx header/macro,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,812,FP,curlx_strdup declared via curlx header/macro,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,821,FP,curlx_strdup declared via curlx header/macro,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operate.c,837,FP,per dereferenced; caller guarantees non-NULL per node,curl_full_audit_0.4.35,med
DCL31-C,curl,src/tool_operate.c,852,FP,curlx_free declared via curlx header/macro,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_operate.c,871,FP,file closed via curlx_fclose at 888 and 898 on all paths,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_operate.c,904,FP,config modified (sets etag_save fields indirectly); curl convention,curl_full_audit_0.4.35,med
MEM31-C,curl,src/tool_operate.c,909,FP,"create_dir_hierarchy returns CURLcode, not allocated memory",curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_operate.c,916,FP,"newfile stored in etag_save->stream, closed in post_per_transfer",curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_operate.c,921,FP,"result is CURLcode return, not allocation",curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_operate.c,934,FP,"result is CURLcode, not allocation",curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_operate.c,937,FP,config read-only but curl does not const-qualify,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_operate.c,938,FP,per param const not applied by curl convention,curl_full_audit_0.4.35,med
EXP20-C,curl,src/tool_operate.c,942,FP,!strcmp idiom; idiomatic dispatch,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_operate.c,960,FP,"create_dir_hierarchy returns CURLcode, not memory",curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operate.c,965,FP,per->prev access; caller ensures per valid,curl_full_audit_0.4.35,med
FIO42-C,curl,src/tool_operate.c,970,FP,"newfile stored in heads->stream, closed in post_per_transfer",curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_operate.c,970,FP,FILE* not fd; misclassified; ownership transferred to heads,curl_full_audit_0.4.35,high
MEM12-C,curl,src/tool_operate.c,974,FP,newfile not yet assigned on this error return; it IS closed at 968 sibling; no leak,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_operate.c,974,FP,"result is CURLcode, not allocation",curl_full_audit_0.4.35,high
MEM12-C,curl,src/tool_operate.c,987,FP,newfile ownership passed to heads on success path; no leak,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_operate.c,987,FP,"result is CURLcode, not allocation",curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operate.c,1001,FP,per non-NULL by caller contract,curl_full_audit_0.4.35,med
EXP33-C,curl,src/tool_operate.c,1005,FP,sc set by get_url_file_name out-param before read,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1037,FP,"per not freed here; tool_safefree of storefile, distinct",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1037,FP,"per->outfile reassigned, not freed-then-used",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1042,FP,per is live; safefree of storefile only,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1042,FP,per not freed; analyzer conflates storefile free with per,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1045,FP,per live; free was of per->outfile then reassigned,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1045,FP,per->outfile reassigned after free; not UAF,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,1048,FP,curlx_free declared via curlx header/macro,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1055,FP,"per live, outfile reassigned to d; not freed-then-used",curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_operate.c,1055,FP,"result is CURLcode, not allocation",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1055,FP,per->outfile is the new heap string d; valid,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1063,FP,per->outfile live (just reassigned); not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1063,FP,outfile current allocation; no prior free,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1065,FP,per live; outfile valid,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1065,FP,outfile not freed; analyzer state-conflation,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1076,FP,"per live; curlx_stat reads per->outfile, not freed",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1076,FP,per->outfile is live string passed to curlx_stat; no UAF,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_operate.c,1092,FP,"file stored in outs->stream, closed in post_close_output",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1092,FP,per live; outfile valid,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1092,FP,outfile not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1095,FP,per live; outfile valid,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1095,FP,outfile not freed,curl_full_audit_0.4.35,high
MEM12-C,curl,src/tool_operate.c,1096,FP,file ownership passed to outs->stream; freed by cleanup,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_operate.c,1096,FP,"result is CURLcode, not allocation",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1105,FP,"outs->filename=per->outfile assignment; valid, not freed",curl_full_audit_0.4.35,high
MEM12-C,curl,src/tool_operate.c,1107,FP,file owned by outs; freed by post_close_output,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_operate.c,1107,FP,"result is CURLcode, not allocation",curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_operate.c,1110,FP,config read-only here but curl convention does not const-qualify,curl_full_audit_0.4.35,med
INT13-C,curl,src/tool_operate.c,1118,FP,bitcheck used with 1UL shift; mask is unsigned; benign,curl_full_audit_0.4.35,med
EXP34-C,curl,src/tool_operate.c,1137,FP,per non-NULL by caller; DEBUGASSERT guards,curl_full_audit_0.4.35,med
EXP20-C,curl,src/tool_operate.c,1141,FP,!strcmp idiom; idiomatic,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_operate.c,1170,FP,config read-only but curl convention,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_operate.c,1172,FP,u read-only but curl convention does not const-qualify,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_operate.c,1173,FP,outs stored into hdrcbdata; not const-able,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_operate.c,1174,FP,heads stored into hdrcbdata; not const-able,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_operate.c,1175,FP,etag stored into hdrcbdata->etag_save; not const-able,curl_full_audit_0.4.35,med
EXP33-C,curl,src/tool_operate.c,1194,FP,outs assigned (=&per->outs) before use at 1296,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_operate.c,1195,FP,heads assigned (=&per->heads) before use at 1287,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_operate.c,1197,FP,curl assigned from curl_easy_init before use,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1225,FP,glob_cleanup nulls inglob; reused next iteration after repopulation,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1235,FP,glob_url repopulates urlglob; not UAF,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operate.c,1272,FP,per from add_per_transfer success; non-NULL,curl_full_audit_0.4.35,med
MEM30-C,curl,src/tool_operate.c,1273,FP,state->uploadfile live (tool_safefree nulls; reused after set),curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,1274,FP,curlx_strdup declared via curlx header/macro,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1274,FP,uploadfile is live string being duplicated; not freed,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1305,FP,urlglob repopulated by glob_url; safefree/cleanup nulls; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1306,FP,glob_next_url reads live urlglob; not UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1307,FP,"urlidx is an index field, not freed memory",curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,1308,FP,curlx_strdup declared via curlx header/macro,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,1320,FP,curlx_strdup declared via curlx header/macro,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operate.c,1336,FP,per guarded non-NULL (inside if(per->uploadfile)); callee derefs fine,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1362,FP,httpgetfields is live state field; not freed here,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operate.c,1363,FP,per non-NULL in this block,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1363,FP,httpgetfields live; passed not freed,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_operate.c,1368,FP,!strcmp idiom; idiomatic,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_operate.c,1376,FP,!strcmp idiom; idiomatic,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1391,FP,"urlidx is index field, not freed pointer",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1393,FP,glob_cleanup nulls urlglob; legitimate cleanup,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,1395,FP,tool_safefree nulls uploadfile; safe against double-free,curl_full_audit_0.4.35,high
CON07-C,curl,src/tool_operate.c,1450,FP,all_added is single-threaded multi-loop counter; no concurrency,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_operate.c,1470,FP,create_transfer returns CURLcode into result; not allocation,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_operate.c,1475,FP,"all_added is static int, zero-initialized",curl_full_audit_0.4.35,high
CON34-C,curl,src/tool_operate.c,1503,FP,DEBUGBUILD getenv at startup; single-threaded,curl_full_audit_0.4.35,med
MEM31-C,curl,src/tool_operate.c,1517,FP,create_transfer returns CURLcode; not allocation,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_operate.c,1571,FP,req is libuv callback handle; signature fixed; not const-able,curl_full_audit_0.4.35,med
DCL00-C,curl,src/tool_operate.c,1574,FP,c is a casted pointer used by libuv idiom; const adds no value,curl_full_audit_0.4.35,med
INT13-C,curl,src/tool_operate.c,1576,FP,events is libuv int bitmask; API-defined; benign,curl_full_audit_0.4.35,med
INT13-C,curl,src/tool_operate.c,1578,FP,events libuv bitmask; benign,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_operate.c,1587,FP,req is libuv timer handle; fixed callback signature,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_operate.c,1601,FP,multi unused (void); libcurl callback signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_operate.c,1621,FP,uv used to init context; not const-able in this helper,curl_full_audit_0.4.35,med
EXP33-C,curl,src/tool_operate.c,1625,FP,c assigned by curlx_malloc before deref; sqc misses assignment,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_operate.c,1633,FP,"returns c which points to heap (curlx_malloc), not stack",curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_operate.c,1636,FP,handle is libuv callback param; fixed signature,curl_full_audit_0.4.35,med
DCL00-C,curl,src/tool_operate.c,1638,FP,c is casted handle->data pointer; const-qualifying low value,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_operate.c,1642,FP,c passed to uv_close which takes non-const; not const-able,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_operate.c,1648,FP,easy unused (void); libcurl socket callback signature fixed,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_operate.c,1678,FP,c assigned (socketp or create_context) before use; branch-merge miss,curl_full_audit_0.4.35,high
ERR05-C,curl,src/tool_operate.c,1684,FP,abort() on impossible default in libuv debug callback; intentional,curl_full_audit_0.4.35,med
CON07-C,curl,src/tool_operate.c,1762,FP,all_added single-threaded multi event loop; no concurrency,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operate.c,1779,FP,ended set by curl_easy_getinfo(CURLINFO_PRIVATE) which always returns per,curl_full_audit_0.4.35,high
ERR33-C,curl,src/tool_operate.c,1806,FP,time(NULL) used as tick comparison; -1 failure harmless here,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_operate.c,1829,FP,multi unused (void); libcurl notify callback signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_operate.c,1830,FP,easy unused (void); callback signature fixed,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_operate.c,1850,FP,share passed to curl_multi/easy setopts; API non-const,curl_full_audit_0.4.35,med
ERR33-C,curl,src/tool_operate.c,1862,FP,time(NULL) initial tick; -1 failure harmless,curl_full_audit_0.4.35,med
EXP33-C,curl,src/tool_operate.c,1888,FP,all_added static int zero-initialized,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_operate.c,1940,FP,create_transfer returns CURLcode; not allocation,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_operate.c,1945,FP,result is CURLcode; not allocation,curl_full_audit_0.4.35,high
CON34-C,curl,src/tool_operate.c,1966,FP,DEBUGBUILD getenv; single-threaded,curl_full_audit_0.4.35,med
MEM31-C,curl,src/tool_operate.c,1999,FP,create_transfer returns CURLcode into returncode; not allocation,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_operate.c,2033,FP,returncode is CURLcode; not allocation,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_operate.c,2039,FP,using_schannel static cache set once at startup; single-threaded,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operate.c,2054,FP,tls_backend_info set when getinfo returns OK; deref guarded by !result,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,2091,FP,curlx_strdup declared via curlx header/macro,curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_operate.c,2092,FP,env is curl_getenv heap copy meant to be curl_free'd; not getenv buffer,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,2101,FP,curlx_strdup declared via curlx header/macro,curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_operate.c,2102,FP,curl_getenv heap copy; curl_free is correct ownership,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,2110,FP,curlx_strdup declared via curlx header/macro,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,2110,FP,env reassigned by curl_getenv at 2108 before this use; fresh alloc,curl_full_audit_0.4.35,high
ENV30-C,curl,src/tool_operate.c,2111,FP,curl_getenv heap copy; curl_free correct,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_operate.c,2111,FP,env freshly allocated at 2108; freed once here; not double-free,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_operate.c,2111,FP,env reassigned before free; single free of current alloc,curl_full_audit_0.4.35,high
MSC07-C,curl,src/tool_operate.c,2140,FP,"code after return is the 'fail:' label, reachable via goto",curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_operate.c,2243,FP,options[] static read-mostly init in single-threaded setup,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_operate.c,2255,FP,loop bounded by NUL terminator options[i]; index<=6 within size 7,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_operate.c,2256,FP,options[i] guarded by loop condition; in-bounds,curl_full_audit_0.4.35,high
CON33-C,curl,src/tool_operate.c,2271,FP,setlocale at single-threaded process startup; advisory,curl_full_audit_0.4.35,med
CON34-C,curl,src/tool_operate.c,2271,FP,duplicate of CON33 at same setlocale site,curl_full_audit_0.4.35,med
ERR33-C,curl,src/tool_operate.c,2271,FP,"setlocale(LC_ALL,"""") return intentionally ignored; cannot meaningfully fail",curl_full_audit_0.4.35,med
STR30-C,curl,src/tool_operate.c,2271,FP,setlocale takes const char*; does not modify literal,curl_full_audit_0.4.35,high
CON33-C,curl,src/tool_operate.c,2272,FP,setlocale at startup; single-threaded; advisory,curl_full_audit_0.4.35,med
CON34-C,curl,src/tool_operate.c,2272,FP,duplicate of CON33 at same site,curl_full_audit_0.4.35,med
ERR33-C,curl,src/tool_operate.c,2272,FP,"setlocale(LC_NUMERIC,""C"") return ignored; ""C"" always available",curl_full_audit_0.4.35,med
STR30-C,curl,src/tool_operate.c,2272,FP,setlocale takes const char*; literal not modified,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_operate.c,2296,FP,curlrc_path set when parseconfig succeeded (found_curlrc guard),curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_operate.c,2297,FP,curlx_free declared via curlx header/macro,curl_full_audit_0.4.35,high
EXP15-C,curl,src/tool_operate.c,2303,FP,empty body '; /* already done */' is intentional with comment,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/socks.c,71,FP,"Initializer-sized const string array; idiomatic, size implicit by design",curl_full_audit_0.4.35,high
API00-C,curl,lib/socks.c,118,FP,Internal helper always called with valid cf from connect path,curl_full_audit_0.4.35,high
API00-C,curl,lib/socks.c,118,FP,Internal helper; data never NULL on this call path,curl_full_audit_0.4.35,high
API00-C,curl,lib/socks.c,118,FP,"Internal helper; buf is caller-provided GSSAPI buffer, non-NULL",curl_full_audit_0.4.35,high
API00-C,curl,lib/socks.c,118,FP,"blen is buffer space; no overflow-prone arithmetic, just decrement",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/socks.c,118,FP,Infinite for(;;) loop exits only via return; all paths return,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/socks.c,118,FP,cf->conn/cf->next passed to non-const callees; curl does not const these,curl_full_audit_0.4.35,med
API05-C,curl,lib/socks.c,120,FP,Advisory C99 array-param syntax curl never uses,curl_full_audit_0.4.35,high
INT30-C,curl,lib/socks.c,145,FP,"pnread tracks network bytes read, bounded far below SIZE_MAX",curl_full_audit_0.4.35,high
INT30-C,curl,lib/socks.c,152,FP,blen -= nread; guarded blen!=nread and nread<=blen by recv contract,curl_full_audit_0.4.35,high
INT30-C,curl,lib/socks.c,153,FP,pnread accumulates bounded read counts; no wrap,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/socks.c,227,FP,cf forwarded to non-const recv helpers; curl convention,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/socks.c,261,FP,data param unused/(void) here; const not added project-wide,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/socks.c,389,FP,rlen is out-param set by Curl_bufq_peek before use,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/socks.c,415,FP,"Guarded: peek-fail or rlen<8 returns early; resp valid, indices in range",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/socks.c,470,FP,Switch with all cases plus default returning,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/socks.c,526,FP,result assigned by Curl_bufq_write at line 525 before test,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/socks.c,526,FP,nwritten is out-param set by Curl_bufq_write,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/socks.c,590,FP,cf (void)cast/forwarded; curl convention does not const,curl_full_audit_0.4.35,med
INT08-C,curl,lib/socks.c,617,FP,"nauths max 3, indexes req[5]; no overflow possible",curl_full_audit_0.4.35,high
INT08-C,curl,lib/socks.c,621,FP,"nauths bounded to 3, GSSAPI increment guarded",curl_full_audit_0.4.35,high
INT08-C,curl,lib/socks.c,626,FP,"nauths bounded, proxy_user increment guarded",curl_full_audit_0.4.35,high
INT08-C,curl,lib/socks.c,629,FP,"req_len = 2+nauths, nauths<=3, fits buffer",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/socks.c,645,FP,rlen out-param set by Curl_bufq_peek,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/socks.c,650,FP,Guarded by peek/rlen<2; resp[0] in range,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/socks.c,742,FP,cf (void)cast unused; curl convention,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/socks.c,750,FP,rlen out-param set by Curl_bufq_peek,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/socks.c,756,FP,Guarded by peek/rlen<2; resp[1] in range,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/socks.c,799,FP,"inet_pton ==1 is the correct success test (0=fail,-1=err)",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/socks.c,838,FP,dest[MAX_IPADR_LEN] holds printable addr; no getenv involved,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/socks.c,882,FP,while(hp && ...) is NULL-safe; loop body only on non-NULL,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/socks.c,962,FP,rlen out-param set by Curl_bufq_peek,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/socks.c,982,FP,Guarded by peek/rlen<resp_len(8); resp indices in range,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/socks.c,993,FP,Initializer-sized const lookup table; idiomatic,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/socks.c,1045,FP,Switch all cases plus default return,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/socks.c,1235,FP,"cf->ctx = sx = calloc() is two well-defined assignments, no UB",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks.c,1307,FP,"cf_free frees cf->ctx only, not cf; cf->connected access valid",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/socks.c,1308,FP,sx==cf->ctx freed by socks_proxy_cf_free at 1303; not leaked,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks.c,1346,FP,"cf_free frees cf->ctx only; cf itself not freed, do_close valid",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks.c,1346,FP,cf not freed by cf_free (only cf->ctx); member access valid,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks.c,1346,FP,cf not freed; cf->next access valid,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks.c,1346,FP,cf not freed; cf->next->cft access valid,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/socks.c,1346,FP,cf not freed; do_close member access valid,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/socks.c,1350,FP,destroy is a vtable function-pointer impl; signature fixed by typedef,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/socks.c,1356,FP,query is a vtable impl; signature fixed by Curl_cftype typedef,curl_full_audit_0.4.35,med
STR34-C,curl,lib/socks.c,1373,FP,"palpn is const char**; *palpn=NULL is pointer assign, not char",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/socks.c,1403,FP,data (void)cast unused; curl convention,curl_full_audit_0.4.35,med
DCL15-C,curl,lib/curlx/base64.c,32,FP,"curlx_base64encdec is intentionally external, used across translation units",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/curlx/base64.c,32,FP,Exported const table; external linkage required,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/curlx/base64.c,40,FP,Initializer-sized const decode table; idiomatic,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.c,61,FP,Advisory array-param syntax curl never uses,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.c,62,FP,Advisory array-param syntax,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/curlx/base64.c,99,FP,curlx_malloc declared via curlx headers from curl_setup.h,curl_full_audit_0.4.35,high
STR04-C,curl,lib/curlx/base64.c,106,FP,memcpy of binary decode table; unsigned char is correct type,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/curlx/base64.c,106,FP,"decodetable is file-scope array, not a param; sizeof valid (80)",curl_full_audit_0.4.35,high
EXP05-C,curl,lib/curlx/base64.c,106,FP,sizeof(decodetable) misparsed as cast; no cast present,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curlx/base64.c,115,FP,lookup memset 0xff and memcpy at lines 105-106 before loop reads,curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curlx/base64.c,121,FP,"'x' is an unsigned int local, not a FILE stream; misfire",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curlx/base64.c,121,FP,"'x' is a local integer, no file stream",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curlx/base64.c,140,FP,lookup initialized at 105-106 before this padding loop,curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curlx/base64.c,143,FP,"'x' is integer local, no FILE stream",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curlx/base64.c,143,FP,"'x' is integer local, no FILE stream",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curlx/base64.c,147,FP,"'x' is integer local, no FILE stream",curl_full_audit_0.4.35,high
FIO50-C,curl,lib/curlx/base64.c,147,FP,"'x' is integer local, no FILE stream",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curlx/base64.c,156,FP,"newstr is heap (curlx_malloc), ownership transferred to *outptr",curl_full_audit_0.4.35,high
MSC07-C,curl,lib/curlx/base64.c,160,FP,bad: label reachable via goto from error branches,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/curlx/base64.c,161,FP,curlx_free declared via curlx headers,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.c,165,FP,Advisory array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.c,167,FP,Advisory array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.c,168,FP,Advisory array-param syntax,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/base64.c,174,FP,*outptr=NULL pointer init; not a char sign-extension issue,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/curlx/base64.c,185,FP,curlx_malloc declared via curlx headers,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/curlx/base64.c,187,FP,"OOM return; output is NULL, base64data unset — nothing leaked",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/base64.c,190,FP,Writing ASCII base64 table char into char buffer; no sign issue,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/base64.c,191,FP,ASCII base64 char into char buffer,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/base64.c,192,FP,ASCII base64 char into char buffer,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/base64.c,193,FP,ASCII base64 char into char buffer,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/base64.c,199,FP,ASCII base64 char into char buffer,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/base64.c,201,FP,ASCII base64 char into char buffer,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/base64.c,203,FP,padbyte ('=' or 0) into char buffer; no sign issue,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/base64.c,204,FP,padbyte into char buffer,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/base64.c,209,FP,ASCII base64 char into char buffer,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/base64.c,210,FP,ASCII base64 char into char buffer,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/base64.c,212,FP,padbyte into char buffer,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/base64.c,217,FP,*output='\0' terminator; no sign-extension issue,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curlx/base64.c,220,FP,base64data is heap-allocated; ownership transferred to *outptr,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/base64.c,220,FP,"*outptr=base64data pointer assign, not char sign-extension",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/curlx/base64.c,225,FP,"Success return; base64data ownership passed to *outptr, not leaked",curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/base64.c,241,FP,Thin wrapper; base64_encode handles insize and inputbuff,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.c,241,FP,Advisory array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.c,242,FP,Advisory array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.c,263,FP,Advisory array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.c,264,FP,Advisory array-param syntax,curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_ssls.c,24,FP,curl ships these headers; long-filename ambiguity not a real defect,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_ssls.c,55,FP,"caller-guaranteed non-NULL config/share/filename; tool-internal entry, no deref crash",curl_full_audit_0.4.35,med
API00-C,curl,src/tool_ssls.c,55,FP,"caller-guaranteed non-NULL config/share/filename; tool-internal entry, no deref crash",curl_full_audit_0.4.35,med
API00-C,curl,src/tool_ssls.c,55,FP,"caller-guaranteed non-NULL config/share/filename; tool-internal entry, no deref crash",curl_full_audit_0.4.35,med
FIO42-C,curl,src/tool_ssls.c,69,FP,fp/ctx.fp closed via curlx_fclose at out: label,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_ssls.c,69,FP,fp/ctx.fp closed via curlx_fclose at out: label,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_ssls.c,86,FP,pointer guarded non-NULL (just allocated/decoded or success-checked) before use,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_ssls.c,91,FP,"writing '\0' through char*, not a sign-extending read",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_ssls.c,92,FP,tool_safefree nulls; base64_decode reallocs fresh; no UAF/double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_ssls.c,92,FP,tool_safefree nulls; base64_decode reallocs fresh; no UAF/double-free,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_ssls.c,100,FP,"writing '\0' through char*, not a sign-extending read",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_ssls.c,103,FP,tool_safefree nulls; base64_decode reallocs fresh; no UAF/double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_ssls.c,103,FP,tool_safefree nulls; base64_decode reallocs fresh; no UAF/double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_ssls.c,109,FP,tool_safefree nulls; base64_decode reallocs fresh; no UAF/double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_ssls.c,109,FP,tool_safefree nulls; base64_decode reallocs fresh; no UAF/double-free,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_ssls.c,109,FP,pointer guarded non-NULL (just allocated/decoded or success-checked) before use,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_ssls.c,109,FP,pointer guarded non-NULL (just allocated/decoded or success-checked) before use,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_ssls.c,109,FP,pointer guarded non-NULL (just allocated/decoded or success-checked) before use,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_ssls.c,128,FP,curlx_free is a macro/declared in curl headers,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_ssls.c,128,FP,tool_safefree nulls; base64_decode reallocs fresh; no UAF/double-free,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_ssls.c,129,FP,curlx_free is a macro/declared in curl headers,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_ssls.c,129,FP,tool_safefree nulls; base64_decode reallocs fresh; no UAF/double-free,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_ssls.c,138,FP,easy matches fixed curl callback typedef; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_ssls.c,138,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_ssls.c,139,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_ssls.c,140,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_ssls.c,141,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_ssls.c,143,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
PRE32-C,curl,src/tool_ssls.c,156,FP,"adjacent string-literal concatenation, no real preprocessor directive in call",curl_full_audit_0.4.35,high
PRE32-C,curl,src/tool_ssls.c,156,FP,"adjacent string-literal concatenation, no real preprocessor directive in call",curl_full_audit_0.4.35,high
FIO18-C,curl,src/tool_ssls.c,164,FP,enc_len is exact base64 output length; correct fwrite count,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_ssls.c,164,FP,pointer guarded non-NULL (just allocated/decoded or success-checked) before use,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_ssls.c,169,FP,tool_safefree nulls; base64_decode reallocs fresh; no UAF/double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_ssls.c,169,FP,tool_safefree nulls; base64_decode reallocs fresh; no UAF/double-free,curl_full_audit_0.4.35,high
FIO18-C,curl,src/tool_ssls.c,173,FP,enc_len is exact base64 output length; correct fwrite count,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_ssls.c,173,FP,tool_safefree nulls; base64_decode reallocs fresh; no UAF/double-free,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_ssls.c,183,FP,curlx_free is a macro/declared in curl headers,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_ssls.c,183,FP,tool_safefree nulls; base64_decode reallocs fresh; no UAF/double-free,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_ssls.c,187,FP,"caller-guaranteed non-NULL config/share/filename; tool-internal entry, no deref crash",curl_full_audit_0.4.35,med
API00-C,curl,src/tool_ssls.c,187,FP,"caller-guaranteed non-NULL config/share/filename; tool-internal entry, no deref crash",curl_full_audit_0.4.35,med
API00-C,curl,src/tool_ssls.c,187,FP,"caller-guaranteed non-NULL config/share/filename; tool-internal entry, no deref crash",curl_full_audit_0.4.35,med
FIO42-C,curl,src/tool_ssls.c,195,FP,fp/ctx.fp closed via curlx_fclose at out: label,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_ssls.c,195,FP,fp/ctx.fp closed via curlx_fclose at out: label,curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_ssls.c,205,FP,pointer guarded non-NULL (just allocated/decoded or success-checked) before use,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/content_encoding.c,100,FP,cwriter vtable/callback signature fixed by Curl_cwtype typedef; const not addable,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/content_encoding.c,151,FP,downcast of non-const Curl_cwriter* to writer subtype; no const removed,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/content_encoding.c,236,FP,downcast of non-const Curl_cwriter* to writer subtype; no const removed,curl_full_audit_0.4.35,high
API05-C,curl,lib/content_encoding.c,251,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/content_encoding.c,253,FP,downcast of non-const Curl_cwriter* to writer subtype; no const removed,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/content_encoding.c,273,FP,downcast of non-const Curl_cwriter* to writer subtype; no const removed,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/content_encoding.c,295,FP,downcast of non-const Curl_cwriter* to writer subtype; no const removed,curl_full_audit_0.4.35,high
API05-C,curl,lib/content_encoding.c,311,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/content_encoding.c,313,FP,downcast of non-const Curl_cwriter* to writer subtype; no const removed,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/content_encoding.c,334,FP,downcast of non-const Curl_cwriter* to writer subtype; no const removed,curl_full_audit_0.4.35,high
API01-C,curl,lib/content_encoding.c,355,FP,fixed-size decompress buffer with bounded writes; layout advisory only,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/content_encoding.c,395,FP,cwriter vtable/callback signature fixed by Curl_cwtype typedef; const not addable,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/content_encoding.c,398,FP,downcast of non-const Curl_cwriter* to writer subtype; no const removed,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/content_encoding.c,401,FP,"BrotliDecoderCreateInstance args are NULL,NULL,NULL; no aliasing",curl_full_audit_0.4.35,high
API05-C,curl,lib/content_encoding.c,407,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/content_encoding.c,409,FP,downcast of non-const Curl_cwriter* to writer subtype; no const removed,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/content_encoding.c,414,FP,r reassigned each loop iteration; cannot be const,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/content_encoding.c,450,FP,cwriter vtable/callback signature fixed by Curl_cwtype typedef; const not addable,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/content_encoding.c,453,FP,downcast of non-const Curl_cwriter* to writer subtype; no const removed,curl_full_audit_0.4.35,high
API05-C,curl,lib/content_encoding.c,481,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/content_encoding.c,481,FP,cwriter vtable/callback signature fixed by Curl_cwtype typedef; const not addable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/content_encoding.c,487,FP,cwriter vtable/callback signature fixed by Curl_cwtype typedef; const not addable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/content_encoding.c,494,FP,cwriter vtable/callback signature fixed by Curl_cwtype typedef; const not addable,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/content_encoding.c,497,FP,downcast of non-const Curl_cwriter* to writer subtype; no const removed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/content_encoding.c,515,FP,cwriter vtable/callback signature fixed by Curl_cwtype typedef; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/content_encoding.c,516,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/content_encoding.c,519,FP,downcast of non-const Curl_cwriter* to writer subtype; no const removed,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/content_encoding.c,553,FP,cwriter vtable/callback signature fixed by Curl_cwtype typedef; const not addable,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/content_encoding.c,556,FP,downcast of non-const Curl_cwriter* to writer subtype; no const removed,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/content_encoding.c,586,FP,NULL-terminated initializer array; implicit bounds idiomatic,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/content_encoding.c,602,FP,NULL-terminated initializer array; implicit bounds idiomatic,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/content_encoding.c,631,FP,cwriter vtable/callback signature fixed by Curl_cwtype typedef; const not addable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/content_encoding.c,632,FP,cwriter vtable/callback signature fixed by Curl_cwtype typedef; const not addable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/content_encoding.c,640,FP,cwriter vtable/callback signature fixed by Curl_cwtype typedef; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/content_encoding.c,641,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/content_encoding.c,653,FP,cwriter vtable/callback signature fixed by Curl_cwtype typedef; const not addable,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/content_encoding.c,654,FP,cwriter vtable/callback signature fixed by Curl_cwtype typedef; const not addable,curl_full_audit_0.4.35,high
API05-C,curl,lib/content_encoding.c,670,FP,curl never uses C99 array-param syntax; advisory,curl_full_audit_0.4.35,high
API00-C,curl,lib/content_encoding.c,697,FP,"enclist iterated NULL-safe; data is core handle, callers guarantee",curl_full_audit_0.4.35,med
API00-C,curl,lib/content_encoding.c,697,FP,"enclist iterated NULL-safe; data is core handle, callers guarantee",curl_full_audit_0.4.35,med
EXP33-C,curl,lib/content_encoding.c,721,FP,"cwt/writer assigned before use (find_writer/error_writer, cwriter_create)",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/content_encoding.c,722,FP,"cwt/writer assigned before use (find_writer/error_writer, cwriter_create)",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/content_encoding.c,807,FP,cwriter vtable/callback signature fixed by Curl_cwtype typedef; const not addable,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_addrinfo.c,70,FP,"callers guarantee non-NULL; debug/free wrappers, no crash path",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/curl_addrinfo.c,70,FP,freed/iterated through pointer; free() needs non-const; const inapplicable,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/curl_addrinfo.c,77,FP,curlx_calloc/curlx_free are macros declared in curl headers,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_addrinfo.c,95,FP,"callers guarantee non-NULL; debug/free wrappers, no crash path",curl_full_audit_0.4.35,med
API00-C,curl,lib/curl_addrinfo.c,95,FP,"callers guarantee non-NULL; debug/free wrappers, no crash path",curl_full_audit_0.4.35,med
WIN04-C,curl,lib/curl_addrinfo.c,123,FP,EncodePointer Windows-hardening advisory; not applicable here,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curl_addrinfo.c,124,FP,"ss_size/addrsize assigned in family branch; else continues/returns, use guarded",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/curl_addrinfo.c,155,FP,"(char*)p + sizeof correct byte arithmetic, not double scaling",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/curl_addrinfo.c,159,FP,"(char*)p + sizeof correct byte arithmetic, not double scaling",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curl_addrinfo.c,195,FP,"pointer assigned/returned is heap (malloc/calloc), not automatic storage",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/curl_addrinfo.c,278,FP,"(char*)p + sizeof correct byte arithmetic, not double scaling",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/curl_addrinfo.c,280,FP,"(char*)p + sizeof correct byte arithmetic, not double scaling",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/curl_addrinfo.c,305,FP,loop cond (curr=...)!=NULL guarantees non-NULL before use,curl_full_audit_0.4.35,high
WIN04-C,curl,lib/curl_addrinfo.c,360,FP,EncodePointer Windows-hardening advisory; not applicable here,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curl_addrinfo.c,361,FP,"ss_size/addrsize assigned in family branch; else continues/returns, use guarded",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/curl_addrinfo.c,367,FP,curlx_calloc/curlx_free are macros declared in curl headers,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/curl_addrinfo.c,371,FP,"(char*)p + sizeof correct byte arithmetic, not double scaling",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curl_addrinfo.c,399,FP,"pointer assigned/returned is heap (malloc/calloc), not automatic storage",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curl_addrinfo.c,411,FP,inet_pton writes 'in' (output); not read uninitialized,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/curl_addrinfo.c,428,FP,inet_pton writes 'in' (output); not read uninitialized,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_addrinfo.c,447,FP,"callers guarantee non-NULL; debug/free wrappers, no crash path",curl_full_audit_0.4.35,med
ARR39-C,curl,lib/curl_addrinfo.c,460,FP,"(char*)p + sizeof correct byte arithmetic, not double scaling",curl_full_audit_0.4.35,high
INT14-C,curl,lib/curl_addrinfo.c,476,FP,"& 0x7FFFFFFF mask of offsetof sum is intentional, not readability defect",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curl_addrinfo.c,484,FP,"pointer assigned/returned is heap (malloc/calloc), not automatic storage",curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_addrinfo.c,497,FP,"callers guarantee non-NULL; debug/free wrappers, no crash path",curl_full_audit_0.4.35,med
API00-C,curl,lib/curl_addrinfo.c,497,FP,"callers guarantee non-NULL; debug/free wrappers, no crash path",curl_full_audit_0.4.35,med
ERR33-C,curl,lib/curl_addrinfo.c,506,FP,env checked with if(env) before use,curl_full_audit_0.4.35,high
CON34-C,curl,lib/curl_addrinfo.c,506,FP,"getenv thread-static advisory; memdebug-only path, single-use",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curl_addrinfo.c,508,FP,frees are in mutually-exclusive #if/#elif/#else branches; one compiled,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curl_addrinfo.c,511,FP,frees are in mutually-exclusive #if/#elif/#else branches; one compiled,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/curl_addrinfo.c,515,FP,frees are in mutually-exclusive #if/#elif/#else branches; one compiled,curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_addrinfo.c,528,FP,"callers guarantee non-NULL; debug/free wrappers, no crash path",curl_full_audit_0.4.35,med
API00-C,curl,lib/curl_addrinfo.c,528,FP,"callers guarantee non-NULL; debug/free wrappers, no crash path",curl_full_audit_0.4.35,med
API00-C,curl,lib/curl_addrinfo.c,528,FP,"callers guarantee non-NULL; debug/free wrappers, no crash path",curl_full_audit_0.4.35,med
API00-C,curl,lib/curl_addrinfo.c,528,FP,"callers guarantee non-NULL; debug/free wrappers, no crash path",curl_full_audit_0.4.35,med
STR34-C,curl,lib/curl_addrinfo.c,535,FP,"char* passed to %s/getaddrinfo, not converted to integer",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curl_addrinfo.c,535,FP,"char* passed to %s/getaddrinfo, not converted to integer",curl_full_audit_0.4.35,high
ERR33-C,curl,lib/curl_addrinfo.c,538,FP,env checked with if(env) before use,curl_full_audit_0.4.35,high
CON34-C,curl,lib/curl_addrinfo.c,538,FP,"getenv thread-static advisory; memdebug-only path, single-use",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curl_addrinfo.c,546,FP,"char* passed to %s/getaddrinfo, not converted to integer",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curl_addrinfo.c,546,FP,"char* passed to %s/getaddrinfo, not converted to integer",curl_full_audit_0.4.35,high
API00-C,curl,lib/curl_addrinfo.c,563,FP,"callers guarantee non-NULL; debug/free wrappers, no crash path",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/curl_addrinfo.c,563,FP,freed/iterated through pointer; free() needs non-const; const inapplicable,curl_full_audit_0.4.35,med
API05-C,curl,src/tool_progress.c,32,FP,curl never uses C99 array-param syntax; advisory style convention,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_progress.c,35,FP,implicit bounds from brace initializer is idiomatic and correct,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_progress.c,89,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_progress.c,124,FP,CLI progress meter is single-threaded; no concurrency,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_progress.c,125,FP,single-threaded CLI progress accounting; no shared-thread access,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_progress.c,126,FP,single-threaded; not a concurrency concern,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_progress.c,127,FP,single-threaded; not a concurrency concern,curl_full_audit_0.4.35,high
CON07-C,curl,src/tool_progress.c,152,FP,single-threaded progress meter; no concurrent access to statics,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_progress.c,152,TP,"start only read via *start; could be const, not a fn-pointer signature",curl_full_audit_0.4.35,low
CON03-C,curl,src/tool_progress.c,155,FP,single-threaded; header static not concurrently accessed,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_progress.c,163,FP,static stamp is zero-initialized per C standard,curl_full_audit_0.4.35,high
PRE32-C,curl,src/tool_progress.c,167,FP,"adjacent string-literal concatenation, not preprocessor directive",curl_full_audit_0.4.35,high
PRE32-C,curl,src/tool_progress.c,167,FP,string-literal concatenation misread as preprocessor directive,curl_full_audit_0.4.35,high
DCL00-C,curl,src/tool_progress.c,177,FP,dlpercen written by curl_msnprintf at line 213; not const-eligible,curl_full_audit_0.4.35,high
DCL00-C,curl,src/tool_progress.c,178,FP,ulpercen written by curl_msnprintf at line 219; not const-eligible,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_progress.c,215,FP,guarded by if(dlknown && all_dltotal) at line 212,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_progress.c,216,FP,guarded non-zero all_dltotal; /100 branch only at astronomically large values,curl_full_audit_0.4.35,med
INT33-C,curl,src/tool_progress.c,221,FP,guarded by if(ulknown && all_ultotal) at line 218,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_progress.c,222,FP,guarded non-zero all_ultotal; /100 branch only at huge values,curl_full_audit_0.4.35,med
EXP33-C,curl,src/tool_progress.c,226,FP,static speedindex is zero-initialized per C standard,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_progress.c,227,FP,i=speedindex bounded <SPEEDCNT via wrap at line 230,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_progress.c,227,FP,"assigning curl_off_t value to global array element, not a stack-pointer escape",curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_progress.c,228,FP,index bounded <SPEEDCNT,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_progress.c,228,FP,scalar assignment to global array element; no pointer escape,curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_progress.c,229,FP,index bounded <SPEEDCNT,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_progress.c,229,FP,struct assignment to global array element; no pointer escape,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_progress.c,241,FP,static indexwrapped is zero-initialized per C standard,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_progress.c,243,FP,"read only when indexwrapped, i.e. all SPEEDCNT slots written",curl_full_audit_0.4.35,high
FLP03-C,curl,src/tool_progress.c,255,FP,FP exception checking advisory; not required for progress display,curl_full_audit_0.4.35,high
FLP34-C,curl,src/tool_progress.c,255,FP,integer-to-double for rate display; no overflow risk,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_progress.c,255,FP,deltams forced non-zero at lines 253-254 before division,curl_full_audit_0.4.35,high
FLP03-C,curl,src/tool_progress.c,255,FP,FP exception checking advisory,curl_full_audit_0.4.35,high
FLP34-C,curl,src/tool_progress.c,255,FP,double conversion for display; no range issue,curl_full_audit_0.4.35,high
FLP03-C,curl,src/tool_progress.c,256,FP,FP exception checking advisory,curl_full_audit_0.4.35,high
FLP34-C,curl,src/tool_progress.c,256,FP,double conversion for display; no range issue,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_progress.c,256,FP,deltams forced non-zero before division,curl_full_audit_0.4.35,high
FLP03-C,curl,src/tool_progress.c,256,FP,FP exception checking advisory,curl_full_audit_0.4.35,high
FLP34-C,curl,src/tool_progress.c,256,FP,double conversion for display; no range issue,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_progress.c,261,FP,guarded by if(dlknown && speed) at line 260,curl_full_audit_0.4.35,high
INT33-C,curl,src/tool_progress.c,262,FP,guarded by if(dlknown && speed) at line 260,curl_full_audit_0.4.35,high
EXP30-C,curl,src/tool_progress.c,274,FP,max5data calls write distinct buffer[0..2]; no aliasing/unsequenced hazard,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_progress.c,290,FP,buffer filled by max5data via snprintf before being read by printf,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_progress.c,304,FP,per always valid from caller; internal helper not exported API,curl_full_audit_0.4.35,high
API05-C,curl,lib/idn.c,52,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/idn.c,53,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,60,FP,"iconv pointer arithmetic, not a signed-char-to-int read",curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,60,FP,iconv API pointer handling; no sign-extension defect,curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,61,FP,iconv out pointer; not a char promotion,curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,85,FP,strlen on const char*; no signed-char promotion,curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,103,FP,char* assignment from strdup; not a char value sign-extension,curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,119,FP,strlen on const char*; no signed-char promotion,curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,131,FP,char* assignment from strdup; not sign-extension,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/idn.c,151,FP,WideCharToMultiByte API call; no alignment violation,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/idn.c,168,FP,"wchar_t in_w buffer used with MultiByteToWideChar, not getenv",curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,170,FP,"*out=NULL pointer init, not char sign-extension",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/idn.c,176,FP,"punycode wchar buffer for IdnToAscii, no environment variable",curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,179,FP,"char* assignment, not char sign-extension",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/idn.c,194,FP,"wchar in_w buffer with MultiByteToWideChar, no getenv",curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,196,FP,"*out=NULL pointer init, not char sign-extension",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/idn.c,202,FP,"idn wchar buffer for IdnToUnicode, no environment variable",curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,205,FP,"char* assignment, not char sign-extension",curl_full_audit_0.4.35,high
EXP00-C,curl,lib/idn.c,254,FP,preprocessor #if text merged with flag |; no real precedence bug,curl_full_audit_0.4.35,high
EXP46-C,curl,lib/idn.c,254,FP,| is bitwise flag OR of IDN2 constants; #if comparison misparsed,curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,261,FP,IDN2_LOOKUP macro args; no char sign-extension defect,curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,261,FP,char** out param to libidn2; not a char read,curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,261,FP,decoded char** to libidn2; not sign-extension,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/idn.c,278,FP,"*output=decoded assigns heap pointer value, not address of a local",curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,278,FP,char* assignment; not char sign-extension,curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,286,FP,idn2_to_unicode args; not a char read,curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,286,FP,enc char** out param; not sign-extension,curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,286,FP,char* handling; not sign-extension,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/idn.c,298,FP,"*output=enc assigns heap pointer value, not address of local",curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,298,FP,char* assignment; not sign-extension,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/idn.c,308,FP,c is a pointer reassigned to d; const-qualify is low-value advisory,curl_full_audit_0.4.35,med
ARR00-C,curl,lib/idn.c,317,FP,"d at 317 is the strdup copy (c); original freed, copy not freed",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/idn.c,317,FP,d non-NULL: idn2 success yields decoded then successful strdup copy,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/idn.c,317,FP,"no use-after-free; d points to strdup copy, not freed memory",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/idn.c,319,FP,single free of copy c; idn2_free freed distinct original,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/idn.c,319,FP,no double free; curlx_free frees strdup copy once,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/idn.c,322,FP,"*output=d assigns heap pointer value, not local address",curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,322,FP,char* assignment; not sign-extension,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/idn.c,333,FP,c is a pointer reassigned to d; const advisory low-value,curl_full_audit_0.4.35,med
DCL30-C,curl,lib/idn.c,342,FP,"*output=d assigns heap pointer value, not local address",curl_full_audit_0.4.35,high
STR34-C,curl,lib/idn.c,342,FP,char* assignment; not sign-extension,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/idn.c,349,FP,host->encalloc modified via Curl_safefree; host correctly non-const,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.c,29,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.c,30,FP,conformant array syntax advisory; curl convention,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/dynhds.c,38,FP,curlx_calloc declared via curl headers; allocator macro,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/dynhds.c,38,FP,e assigned by calloc then NULL-checked; not used uninitialized,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/dynhds.c,41,FP,(char*)e + sizeof(*e) is byte arithmetic; no double scaling,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/dynhds.c,41,FP,e is not const; cast is for byte pointer arithmetic,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/dynhds.c,42,FP,buffer sized exactly namelen+valuelen+2 at calloc line 38,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/dynhds.c,42,FP,p derived from e which was NULL-checked at line 39,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/dynhds.c,45,FP,buffer sized for valuelen at allocation; bounded,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/dynhds.c,45,FP,"dest is entry buffer, src is caller value; non-overlapping",curl_full_audit_0.4.35,high
EXP43-C,curl,lib/dynhds.c,48,FP,Curl_strntolower not restrict; in-place lowercasing is intended/safe,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/dynhds.c,49,FP,"e is heap from calloc, not automatic-storage local",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/dynhds.c,54,FP,curlx_free declared via curl headers,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/dynhds.c,97,FP,stable getter signature in vtable-style API family; curl convention,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/dynhds.c,113,FP,stable lookup signature; curl const convention not applied here,curl_full_audit_0.4.35,med
API05-C,curl,lib/dynhds.c,113,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API00-C,curl,lib/dynhds.c,131,FP,namelen bounded by max_strs_size check at line 141; no overflow,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.c,132,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.c,133,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/dynhds.c,144,FP,entry freed at out: label; set NULL on success path line 167,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/dynhds.c,155,FP,curlx_calloc declared via curl headers,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/dynhds.c,159,FP,nhds allocated nallc>=hds_len; memcpy bounded by hds_len,curl_full_audit_0.4.35,high
INT32-C,curl,lib/dynhds.c,159,FP,hds_len bounded by max_entries; no realistic overflow,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/dynhds.c,166,FP,hds reassigned to nhds at 163; old freed copy not accessed,curl_full_audit_0.4.35,high
API00-C,curl,lib/dynhds.c,183,FP,line_len validated (!line_len early return); offsets bounded,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.c,184,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/dynhds.c,208,FP,valuelen derived from line_len bounds; memchr bounded,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/dynhds.c,210,FP,valuelen bounded by line_len; memchr within bounds,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.c,226,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/dynhds.c,236,FP,stable count-name signature; curl const convention,curl_full_audit_0.4.35,med
API05-C,curl,lib/dynhds.c,237,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.c,257,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.c,258,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
API00-C,curl,lib/dynhds.c,264,FP,namelen used only in comparisons/subtraction of tracked lengths; bounded,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.c,265,FP,conformant array syntax advisory,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/dynhds.c,280,FP,len=hds_len-i remaining entries; memmove within hds array bounds,curl_full_audit_0.4.35,high
INT32-C,curl,lib/dynhds.c,280,FP,len bounded by hds_len; pointer-array size no overflow,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/dynhds.c,281,FP,"sizeof(hds[i]) is sizeof(pointer), intended element size; hds is real member",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/dynhds.c,297,FP,stable dprint signature; curl const convention,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/dynhds.c,319,FP,to_nva reads dynhds; stable API signature convention,curl_full_audit_0.4.35,med
DCL00-C,curl,lib/dynhds.c,329,FP,"e read-only loop alias; const advisory low-value, idiomatic",curl_full_audit_0.4.35,high
ARR02-C,curl,lib/vssh/vssh.c,37,FP,Implicit bounds on initialized const string array is idiomatic and safe,curl_full_audit_0.4.35,high
API00-C,curl,lib/vssh/vssh.c,109,FP,Internal state setter; callers guarantee non-NULL sshc per curl convention,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vssh/vssh.c,115,FP,"Two statename() calls only read state; no side effects, no UB",curl_full_audit_0.4.35,high
API00-C,curl,lib/vssh/vssh.c,128,FP,Internal helper; data always valid from caller,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vssh/vssh.c,128,FP,data fields read via data->conn/state; curl does not const-qualify these,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/vssh/vssh.c,147,FP,working_path_len set by Curl_urldecode out-param (macro-opaque to sqc),curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/vssh.c,147,FP,"!memcmp idiom, idiomatic in curl path handling",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/vssh.c,147,FP,working_path set by Curl_urldecode out-param before use,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vssh/vssh.c,147,FP,result-guarded: non-NULL after urldecode success return-check,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/vssh.c,155,FP,!strcmp idiom,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vssh/vssh.c,156,FP,!memcmp idiom,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vssh/vssh.c,168,FP,p=dyn_ptr guarded by 'if(len && ...)'; non-NULL when len>0,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vssh/vssh.c,171,FP,working_path freed only in error branches with return; line 171 read before any free,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vssh/vssh.c,189,FP,char deref sign-extension false alarm; categorical FP,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vssh/vssh.c,192,FP,"working_path is heap (urldecode), not local stack; valid to return",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vssh/vssh.c,192,FP,char deref sign-extension false alarm,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vssh/vssh.c,202,FP,char deref sign-extension false alarm,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vssh/vssh.c,207,FP,char deref sign-extension false alarm,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vssh/vssh.c,208,FP,char deref sign-extension false alarm,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vssh/vssh.c,219,FP,char deref sign-extension false alarm,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/vssh/vssh.c,219,FP,cp points into a string buffer; pointer arithmetic valid,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/vssh/vssh.c,222,FP,while(*cp!=quot) bounded by NUL terminator (if(!*cp) goto fail),curl_full_audit_0.4.35,high
ARR37-C,curl,lib/vssh/vssh.c,227,FP,cp traverses string buffer; valid pointer arithmetic,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/vssh/vssh.c,234,FP,cp traverses string buffer; valid,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/vssh/vssh.c,236,FP,cp traverses string buffer; valid,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/vssh/vssh.c,246,FP,cp[0] on string buffer; valid subscript,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/vssh/vssh.c,246,FP,cp[1] on string buffer; valid subscript,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/vssh/vssh.c,246,FP,cp[2] on string buffer; valid subscript,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/vssh/vssh.c,252,FP,cp+=3 on string buffer; valid,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vssh/vssh.c,268,FP,curlx_str/curlx_strlen are pure accessors on same word; no side effects,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vssh/vssh.c,277,FP,"cp points into caller's string, not a local; valid out-assignment",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vssh/vssh.c,277,FP,char deref sign-extension false alarm,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vssh/vssh.c,279,FP,char deref sign-extension false alarm,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/vssh/vssh.c,282,FP,fail: label reachable via goto; not unreachable code,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vssh/vssh.c,293,FP,char sign-extension false alarm in str_number wrapper,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vssh/vssh.c,293,FP,char sign-extension false alarm,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vssh/vssh.c,313,FP,from set by curlx_str_number out-param; overflow-checked before use,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/vssh/vssh.c,338,FP,"Curl_scheme_sftp exported, referenced via header; needs external linkage",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/vssh/vssh.c,338,FP,Exported scheme table; cannot reduce scope,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/vssh/vssh.c,352,FP,"Curl_scheme_scp exported, referenced via header",curl_full_audit_0.4.35,high
DCL19-C,curl,lib/vssh/vssh.c,352,FP,Exported scheme table; cannot reduce scope,curl_full_audit_0.4.35,high
PRE08-C,curl,src/config2setopts.c,24,FP,8-char header collision irrelevant on modern filesystems,curl_full_audit_0.4.35,high
PRE08-C,curl,src/config2setopts.c,32,FP,8-char header collision irrelevant,curl_full_audit_0.4.35,high
PRE08-C,curl,src/config2setopts.c,32,FP,8-char header collision irrelevant,curl_full_audit_0.4.35,high
PRE08-C,curl,src/config2setopts.c,32,FP,8-char header collision irrelevant,curl_full_audit_0.4.35,high
PRE08-C,curl,src/config2setopts.c,32,FP,8-char header collision irrelevant,curl_full_audit_0.4.35,high
PRE08-C,curl,src/config2setopts.c,36,FP,8-char header collision irrelevant,curl_full_audit_0.4.35,high
PRE08-C,curl,src/config2setopts.c,36,FP,8-char header collision irrelevant,curl_full_audit_0.4.35,high
PRE08-C,curl,src/config2setopts.c,36,FP,8-char header collision irrelevant,curl_full_audit_0.4.35,high
PRE08-C,curl,src/config2setopts.c,37,FP,8-char header collision irrelevant,curl_full_audit_0.4.35,high
PRE08-C,curl,src/config2setopts.c,37,FP,8-char header collision irrelevant,curl_full_audit_0.4.35,high
PRE08-C,curl,src/config2setopts.c,38,FP,8-char header collision irrelevant,curl_full_audit_0.4.35,high
DCL13-C,curl,src/config2setopts.c,62,FP,sockopt_callback signature fixed by CURLOPT_SOCKOPTFUNCTION typedef,curl_full_audit_0.4.35,high
CON03-C,curl,src/config2setopts.c,114,FP,"static ssl_ver in CLI tool; one-time benign init, not multithreaded",curl_full_audit_0.4.35,high
DCL00-C,curl,src/config2setopts.c,114,FP,ssl_ver written by msnprintf; cannot be const,curl_full_audit_0.4.35,high
CON03-C,curl,src/config2setopts.c,115,FP,static 'already' guard; CLI tool not multithreaded here,curl_full_audit_0.4.35,high
ARR00-C,curl,src/config2setopts.c,123,FP,"ssl_ver is static storage, not a local array; safe to return",curl_full_audit_0.4.35,high
STR34-C,curl,src/config2setopts.c,137,FP,char deref sign-extension false alarm,curl_full_audit_0.4.35,high
EXP34-C,curl,src/config2setopts.c,153,FP,schemep set by curl_url_get on uc==0 success; non-NULL,curl_full_audit_0.4.35,high
EXP34-C,curl,src/config2setopts.c,165,FP,curl_free is NULL-safe; schemep non-NULL anyway,curl_full_audit_0.4.35,high
STR34-C,curl,src/config2setopts.c,177,FP,char deref sign-extension false alarm,curl_full_audit_0.4.35,high
DCL13-C,curl,src/config2setopts.c,277,FP,config passed to setopt helpers; curl convention does not const-qualify,curl_full_audit_0.4.35,med
DCL13-C,curl,src/config2setopts.c,333,FP,config not const-qualified per curl setopt convention,curl_full_audit_0.4.35,med
DCL13-C,curl,src/config2setopts.c,490,FP,config not const-qualified per curl convention,curl_full_audit_0.4.35,med
STR30-C,curl,src/config2setopts.c,569,FP,""""" passed to CURLOPT_ACCEPT_ENCODING which copies; const-safe",curl_full_audit_0.4.35,high
DCL13-C,curl,src/config2setopts.c,598,FP,config not const-qualified per curl convention,curl_full_audit_0.4.35,med
DCL13-C,curl,src/config2setopts.c,623,FP,config not const-qualified per curl convention,curl_full_audit_0.4.35,med
EXP33-C,curl,src/config2setopts.c,653,FP,result assigned by MY_SETOPT_STR macro at line 631 (macro-opaque to sqc),curl_full_audit_0.4.35,high
DCL13-C,curl,src/config2setopts.c,665,FP,config not const-qualified per curl convention,curl_full_audit_0.4.35,med
EXP34-C,curl,src/config2setopts.c,694,FP,per always valid from caller; gen_cb_setopts derefs it throughout,curl_full_audit_0.4.35,high
EXP20-C,curl,src/config2setopts.c,694,FP,!strcmp idiom for stdin '.' check,curl_full_audit_0.4.35,high
EXP33-C,curl,src/config2setopts.c,751,FP,result assigned by if(config->proxy) or MY_SETOPT_STR macro before use,curl_full_audit_0.4.35,high
DCL13-C,curl,src/config2setopts.c,754,FP,config not const-qualified per curl convention,curl_full_audit_0.4.35,med
DCL13-C,curl,src/config2setopts.c,811,FP,config not const-qualified per curl convention,curl_full_audit_0.4.35,med
ENV34-C,curl,src/config2setopts.c,814,FP,getenv result used immediately in DEBUGBUILD; not stored long-term,curl_full_audit_0.4.35,high
ERR33-C,curl,src/config2setopts.c,814,FP,env checked by 'if(env)' on next line before use,curl_full_audit_0.4.35,high
CON34-C,curl,src/config2setopts.c,814,FP,DEBUGBUILD-only single-threaded use of getenv,curl_full_audit_0.4.35,high
ENV30-C,curl,src/config2setopts.c,818,FP,curlx_str_number only reads p (advances local copy); does not modify env,curl_full_audit_0.4.35,high
API00-C,curl,src/config2setopts.c,830,FP,per always valid from caller (tool_operate); internal entry point,curl_full_audit_0.4.35,high
API00-C,curl,src/config2setopts.c,830,FP,curl handle always valid from caller,curl_full_audit_0.4.35,high
EXP34-C,curl,src/config2setopts.c,836,FP,per->url valid; per guaranteed non-NULL by caller,curl_full_audit_0.4.35,high
EXP33-C,curl,src/config2setopts.c,910,FP,use_proto set by url_proto_and_rewrite out-param at line 836,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/urlapi.c,40,FP,"char-class macro evaluates [0..2]; well-known idiom, no side-effecting args",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/urlapi.c,40,FP,"char-class macro evaluates [0..2]; well-known idiom, no side-effecting args",curl_full_audit_0.4.35,med
PRE00-C,curl,lib/urlapi.c,48,FP,"char-class macro evaluates [0..2]; well-known idiom, no side-effecting args",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/urlapi.c,48,FP,"char-class macro evaluates [0..2]; well-known idiom, no side-effecting args",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/urlapi.c,86,FP,free_urlhandle writes through u (frees members); cannot be const,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,88,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,89,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,90,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,91,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,92,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,93,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,94,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,95,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,96,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,97,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,107,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/urlapi.c,117,FP,"find_host_sep returns pointer into url arg buffer, not a local",curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,130,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,151,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
STR00-C,curl,lib/urlapi.c,158,FP,"unsigned char buf for hex byte output; intentional, not a char array",curl_full_audit_0.4.35,med
API05-C,curl,lib/urlapi.c,182,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,182,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
API00-C,curl,lib/urlapi.c,223,FP,param validated via DEBUGASSERT/guarded callers; no unchecked deref,curl_full_audit_0.4.35,med
API05-C,curl,lib/urlapi.c,223,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,225,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,225,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,249,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
MEM03-C,curl,lib/urlapi.c,257,FP,"passwdp moved into u->password, not a transient secret buffer",curl_full_audit_0.4.35,med
DCL31-C,curl,lib/urlapi.c,305,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,310,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,315,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/urlapi.c,323,FP,code after return is inside other branches; tree-sitter misparse,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,325,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,326,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,327,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,343,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,361,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,361,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,380,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,382,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,390,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,394,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/urlapi.c,409,FP,h reassigned later in same scope; const would break code,curl_full_audit_0.4.35,low
STR34-C,curl,lib/urlapi.c,409,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/urlapi.c,411,FP,"!strcmp/!strncmp boolean idiom, standard curl convention",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,414,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,414,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,418,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,444,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,452,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,491,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/urlapi.c,494,FP,while(*p) on NUL-terminated string; bounded by terminator,curl_full_audit_0.4.35,high
CON43-C,curl,lib/urlapi.c,513,FP,"single-threaded URL parse switch on *c; no concurrency, no double-fetch",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,582,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/urlapi.c,595,FP,decoded/dlen/dedot/portbuf are out-params or set before use,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/urlapi.c,595,FP,decoded/dlen/dedot/portbuf are out-params or set before use,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,596,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/urlapi.c,604,FP,"ipv4_normalize switch(n) covers 0-3 exhaustively, all return",curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,605,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/urlapi.c,638,FP,"dyn_ptr+dyn_len on same dynbuf, no mutation between; well-defined",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/urlapi.c,643,FP,"dyn_ptr+dyn_len on same dynbuf, no mutation between; well-defined",curl_full_audit_0.4.35,high
API00-C,curl,lib/urlapi.c,658,FP,param validated via DEBUGASSERT/guarded callers; no unchecked deref,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/urlapi.c,671,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,682,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,684,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR00-C,curl,lib/urlapi.c,691,FP,"unsigned char buf for hex byte output; intentional, not a char array",curl_full_audit_0.4.35,med
STR34-C,curl,lib/urlapi.c,692,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
API02-C,curl,lib/urlapi.c,715,FP,"outp is char** out-param; size arg inapplicable, advisory",curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,715,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,715,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
API00-C,curl,lib/urlapi.c,716,FP,param validated via DEBUGASSERT/guarded callers; no unchecked deref,curl_full_audit_0.4.35,med
DCL15-C,curl,lib/urlapi.c,716,FP,dedotdotify is UNITTEST-exported symbol; intentionally non-static,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/urlapi.c,716,FP,dedotdotify is UNITTEST-exported symbol; intentionally non-static,curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,716,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,716,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,721,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,721,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,737,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,758,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,759,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,759,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/urlapi.c,759,FP,"subscript/increment on string pointer; valid C, points into buffer",curl_full_audit_0.4.35,med
ARR37-C,curl,lib/urlapi.c,807,FP,"subscript/increment on string pointer; valid C, points into buffer",curl_full_audit_0.4.35,med
STR34-C,curl,lib/urlapi.c,813,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,813,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,815,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,815,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,815,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,823,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,824,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,835,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,835,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,838,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/urlapi.c,848,FP,"subscript/increment on string pointer; valid C, points into buffer",curl_full_audit_0.4.35,med
ARR37-C,curl,lib/urlapi.c,848,FP,"subscript/increment on string pointer; valid C, points into buffer",curl_full_audit_0.4.35,med
STR34-C,curl,lib/urlapi.c,850,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/urlapi.c,850,FP,"subscript/increment on string pointer; valid C, points into buffer",curl_full_audit_0.4.35,med
ARR30-C,curl,lib/urlapi.c,871,FP,drive-prefix macro reads [0..2] after length guards; safe,curl_full_audit_0.4.35,med
ARR30-C,curl,lib/urlapi.c,876,FP,ptr+=9 after checkprefix matched 10-byte prefix; in bounds,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/urlapi.c,907,FP,both pointers index the same url/base buffer; subtraction valid,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/urlapi.c,917,FP,"subscript/increment on string pointer; valid C, points into buffer",curl_full_audit_0.4.35,med
ARR30-C,curl,lib/urlapi.c,917,FP,drive-prefix macro reads [0..2] after length guards; safe,curl_full_audit_0.4.35,med
ARR37-C,curl,lib/urlapi.c,917,FP,"subscript/increment on string pointer; valid C, points into buffer",curl_full_audit_0.4.35,med
ARR30-C,curl,lib/urlapi.c,918,FP,drive-prefix macro reads [0..2] after length guards; safe,curl_full_audit_0.4.35,med
ARR37-C,curl,lib/urlapi.c,924,FP,"subscript/increment on string pointer; valid C, points into buffer",curl_full_audit_0.4.35,med
ARR30-C,curl,lib/urlapi.c,924,FP,drive-prefix macro reads [0..2] after length guards; safe,curl_full_audit_0.4.35,med
ARR37-C,curl,lib/urlapi.c,924,FP,"subscript/increment on string pointer; valid C, points into buffer",curl_full_audit_0.4.35,med
ARR37-C,curl,lib/urlapi.c,926,FP,"subscript/increment on string pointer; valid C, points into buffer",curl_full_audit_0.4.35,med
DCL30-C,curl,lib/urlapi.c,930,FP,"out-param assigned pointer into caller's url/part buffer, outlives fn",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,930,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,935,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,935,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/urlapi.c,935,FP,"schemebuf passed to printf %s; const-qualify cosmetic, not a defect",curl_full_audit_0.4.35,med
API05-C,curl,lib/urlapi.c,937,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,944,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,959,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,973,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,977,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1004,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,1012,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,1036,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1059,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,1066,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1098,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1098,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1098,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/urlapi.c,1101,FP,decoded/dlen/dedot/portbuf are out-params or set before use,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1102,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/urlapi.c,1114,FP,"schemebuf/portbuf fixed buffers for scheme/port, not getenv result",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/urlapi.c,1114,FP,"fixed-size stack array schemebuf[MAX+1]/portbuf[7], not VLA",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/urlapi.c,1133,FP,"!strcmp/!strncmp boolean idiom, standard curl convention",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1144,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1144,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,1144,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/urlapi.c,1147,FP,both pointers index the same url/base buffer; subtraction valid,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,1149,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,1165,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1167,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1167,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1176,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1176,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1206,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1236,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1236,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/urlapi.c,1262,FP,cutoff/protsep both within base buffer; defined subtraction,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1290,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1297,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1297,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/urlapi.c,1297,FP,free on disjoint branch (success vs nomem); not reached twice,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/urlapi.c,1301,FP,"char-class macro evaluates [0..2]; well-known idiom, no side-effecting args",curl_full_audit_0.4.35,med
PRE01-C,curl,lib/urlapi.c,1301,FP,"DUP macro param used as struct member name, parenthesizing inapplicable",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/urlapi.c,1301,FP,"char-class macro evaluates [0..2]; well-known idiom, no side-effecting args",curl_full_audit_0.4.35,med
DCL31-C,curl,lib/urlapi.c,1312,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/urlapi.c,1329,FP,code after return is inside other branches; tree-sitter misparse,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,1362,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1362,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1368,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
EXP40-C,curl,lib/urlapi.c,1373,FP,*plus=part assigns const-stripped; intentional in/out aliasing,curl_full_audit_0.4.35,med
STR34-C,curl,lib/urlapi.c,1377,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1386,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/urlapi.c,1389,FP,decoded/dlen/dedot/portbuf are out-params or set before use,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/urlapi.c,1390,FP,decoded/dlen/dedot/portbuf are out-params or set before use,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1395,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1396,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1396,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1404,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1405,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1405,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1414,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1415,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1415,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/urlapi.c,1421,FP,"out-param assigned pointer into caller's url/part buffer, outlives fn",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1421,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/urlapi.c,1452,FP,"schemebuf/portbuf fixed buffers for scheme/port, not getenv result",curl_full_audit_0.4.35,high
MEM05-C,curl,lib/urlapi.c,1452,FP,"fixed-size stack array schemebuf[MAX+1]/portbuf[7], not VLA",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1533,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/urlapi.c,1537,FP,"out-param assigned pointer into caller's url/part buffer, outlives fn",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1537,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1552,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/urlapi.c,1592,FP,decoded/dlen/dedot/portbuf are out-params or set before use,curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1639,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
INT07-C,curl,lib/urlapi.c,1654,FP,s is char holding scheme byte for ISALNUM; range-safe,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/urlapi.c,1679,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
API05-C,curl,lib/urlapi.c,1685,FP,"C99 conformant-array-param syntax; curl never uses it, advisory style",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1704,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1728,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1737,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/urlapi.c,1805,FP,"set_url calls parseurl/redirect_url, never back to curl_url_set",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1851,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1858,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1864,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1868,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
STR00-C,curl,lib/urlapi.c,1908,FP,"unsigned char buf for hex byte output; intentional, not a char array",curl_full_audit_0.4.35,med
ARR30-C,curl,lib/urlapi.c,1922,FP,while(*p) on NUL-terminated string; bounded by terminator,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,1922,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1940,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1940,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1941,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/urlapi.c,1946,FP,free-then-reassign or Curl_safefree-null or distinct member; no UAF/DF,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1956,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1957,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
MSC07-C,curl,lib/urlapi.c,1959,FP,code after return is inside other branches; tree-sitter misparse,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/urlapi.c,1960,FP,free on disjoint branch (success vs nomem); not reached twice,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,1980,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/urlapi.c,1981,FP,ptr from dyn_ptr (non-NULL) or guarded by prior length/null check,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/urlapi.c,1981,FP,decoded/dlen/dedot/portbuf are out-params or set before use,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1983,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/urlapi.c,1994,FP,curlx_free/strdup/calloc are macros in curl_setup.h expanding to declared fns,curl_full_audit_0.4.35,high
STR34-C,curl,lib/urlapi.c,1995,FP,"char* deref/sign-extension on string bytes; idiomatic, no real bug",curl_full_audit_0.4.35,high
PRE01-C,curl,lib/vtls/openssl.c,151,FP,"BIGNUM decl macro; param use safe, no precedence issue",curl_full_audit_0.4.35,high
PRE01-C,curl,lib/vtls/openssl.c,154,FP,"BIGNUM decl macro; param use safe, no precedence issue",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/openssl.c,212,FP,char* buffer byte write/read; no real sign-extension bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/openssl.c,212,FP,char* buffer byte write/read; no real sign-extension bug,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/openssl.c,213,FP,out-param filled before read or branch-local assign,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/vtls/openssl.c,241,FP,pubkey_show macro evaluates args once each; benign,curl_full_audit_0.4.35,med
PRE05-C,curl,lib/vtls/openssl.c,241,FP,stringification macro idiomatic; works as intended,curl_full_audit_0.4.35,low
PRE12-C,curl,lib/vtls/openssl.c,241,FP,simple macro wrapper; no multi-eval hazard,curl_full_audit_0.4.35,low
API05-C,curl,lib/vtls/openssl.c,244,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/openssl.c,246,FP,char* buffer byte write/read; no real sign-extension bug,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,257,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,259,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/vtls/openssl.c,280,FP,namebuf[sizeof-1] index correct; no double scaling,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,286,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,323,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,324,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,358,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,359,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,558,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,565,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
INT31-C,curl,lib/vtls/openssl.c,670,FP,size_t bounded by int blen before narrowing,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/vtls/openssl.c,683,FP,"returns BIO_METHOD* from BIO_meth_new, not local",curl_full_audit_0.4.35,high
ENV01-C,curl,lib/vtls/openssl.c,709,FP,fixed buffer not used with getenv result,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,780,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/openssl.c,784,FP,char* buffer byte write/read; no real sign-extension bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/openssl.c,791,FP,char* buffer byte write/read; no real sign-extension bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/openssl.c,792,FP,char* buffer byte write/read; no real sign-extension bug,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/openssl.c,793,FP,char* buffer byte write/read; no real sign-extension bug,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/vtls/openssl.c,817,FP,memcpy guarded by num>klen; within buffer,curl_full_audit_0.4.35,high
MEM03-C,curl,lib/vtls/openssl.c,882,FP,"password is const char* pointer, not a buffer to clear",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,949,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,978,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,1007,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,1026,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/openssl.c,1050,FP,all execution paths return explicitly,curl_full_audit_0.4.35,high
STR30-C,curl,lib/vtls/openssl.c,1062,FP,callee takes const char*; literal not modified,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/openssl.c,1107,FP,all execution paths return explicitly,curl_full_audit_0.4.35,high
STR30-C,curl,lib/vtls/openssl.c,1117,FP,callee takes const char*; literal not modified,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/openssl.c,1193,FP,all execution paths return explicitly,curl_full_audit_0.4.35,high
STR30-C,curl,lib/vtls/openssl.c,1204,FP,callee takes const char*; literal not modified,curl_full_audit_0.4.35,high
INT07-C,curl,lib/vtls/openssl.c,1236,FP,"params is a struct, not char; misparse",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/openssl.c,1263,FP,all execution paths return explicitly,curl_full_audit_0.4.35,high
STR30-C,curl,lib/vtls/openssl.c,1273,FP,callee takes const char*; literal not modified,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/openssl.c,1408,FP,idiomatic !strcmp/!memcmp or ==1 with correct API convention,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,1429,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,1430,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/openssl.c,1430,FP,alloc stored in octx/owned by SSL or freed at cleanup label,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/openssl.c,1466,FP,char* buffer byte write/read; no real sign-extension bug,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/openssl.c,1562,FP,idiomatic !strcmp/!memcmp or ==1 with correct API convention,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/openssl.c,1567,FP,idiomatic !strcmp/!memcmp or ==1 with correct API convention,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/openssl.c,1582,FP,alloc stored in octx/owned by SSL or freed at cleanup label,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/openssl.c,1618,FP,idiomatic !strcmp/!memcmp or ==1 with correct API convention,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/openssl.c,1624,FP,alloc stored in octx/owned by SSL or freed at cleanup label,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,1643,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/openssl.c,1657,FP,all execution paths return explicitly,curl_full_audit_0.4.35,high
EXP00-C,curl,lib/vtls/openssl.c,1665,FP,flag OR combine across #if; precedence fine,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/openssl.c,1689,FP,all execution paths return explicitly,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vtls/openssl.c,1693,FP,buffer written through pointer by helper; not const,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,1699,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,1751,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,1783,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,1785,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,1786,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/vtls/openssl.c,1801,FP,fixed buffer not used with getenv result,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/vtls/openssl.c,1801,FP,"fixed-size array, not a VLA",curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vtls/openssl.c,1818,FP,pure getter args; no unsequenced side effects,curl_full_audit_0.4.35,med
EXP05-C,curl,lib/vtls/openssl.c,1818,FP,no real cast-away-const; sizeof/void* free idiom,curl_full_audit_0.4.35,med
EXP20-C,curl,lib/vtls/openssl.c,1952,FP,idiomatic !strcmp/!memcmp or ==1 with correct API convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,1992,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,1992,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,2025,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,2061,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,2062,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/openssl.c,2160,FP,idiomatic !strcmp/!memcmp or ==1 with correct API convention,curl_full_audit_0.4.35,high
EXP15-C,curl,lib/vtls/openssl.c,2172,FP,empty if-body intentional (else-if chain follows),curl_full_audit_0.4.35,high
EXP15-C,curl,lib/vtls/openssl.c,2233,FP,empty if-body intentional (else-if chain follows),curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/openssl.c,2240,FP,idiomatic !strcmp/!memcmp or ==1 with correct API convention,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,2257,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/openssl.c,2371,FP,idiomatic !strcmp/!memcmp or ==1 with correct API convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,2515,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,2515,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,2516,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
INT14-C,curl,lib/vtls/openssl.c,2582,FP,idiomatic byte/version bit extraction,curl_full_audit_0.4.35,med
INT14-C,curl,lib/vtls/openssl.c,2601,FP,idiomatic byte/version bit extraction,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/vtls/openssl.c,2658,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,2703,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,2706,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,2707,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,2729,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,2760,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,2766,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vtls/openssl.c,2767,FP,"buf freed; second ptr is aliasing cursor, no leak",curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,2849,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/openssl.c,2874,FP,out-param filled before read or branch-local assign,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vtls/openssl.c,2906,FP,out-param array filled by callee before read,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/openssl.c,2920,FP,out-param filled before read or branch-local assign,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,2935,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/openssl.c,2947,FP,idiomatic !strcmp/!memcmp or ==1 with correct API convention,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/openssl.c,2971,FP,idiomatic !strcmp/!memcmp or ==1 with correct API convention,curl_full_audit_0.4.35,high
ARR02-C,curl,lib/vtls/openssl.c,3001,FP,implicit-bounds array with initializer; idiomatic,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/openssl.c,3034,FP,char* to config struct via getter; alignment fine in practice,curl_full_audit_0.4.35,low
EXP34-C,curl,lib/vtls/openssl.c,3038,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,3043,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/openssl.c,3145,FP,char* to config struct via getter; alignment fine in practice,curl_full_audit_0.4.35,low
EXP34-C,curl,lib/vtls/openssl.c,3148,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,3155,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
MSC41-C,curl,lib/vtls/openssl.c,3204,FP,"hash key string, not a credential",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,3214,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,3214,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,3214,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
EXP40-C,curl,lib/vtls/openssl.c,3216,FP,void* p assigned to typed ptr; no const removal,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/vtls/openssl.c,3218,FP,idiomatic !strcmp/!memcmp or ==1 with correct API convention,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,3224,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,3225,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,3249,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,3251,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,3296,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,3303,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,3313,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,3314,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,3323,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,3330,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/openssl.c,3334,FP,orchestrator using DEBUGASSERT getters; siblings same,curl_full_audit_0.4.35,high
API00-C,curl,lib/vtls/openssl.c,3334,FP,orchestrator using DEBUGASSERT getters; siblings same,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/openssl.c,3339,FP,char* to config struct via getter; alignment fine in practice,curl_full_audit_0.4.35,low
EXP34-C,curl,lib/vtls/openssl.c,3348,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,3351,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,3379,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,3381,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/openssl.c,3383,FP,char* to config struct via getter; alignment fine in practice,curl_full_audit_0.4.35,low
EXP34-C,curl,lib/vtls/openssl.c,3391,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,3426,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/openssl.c,3459,FP,out-param filled before read or branch-local assign,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,3477,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,3478,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,3480,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/openssl.c,3510,FP,out-param filled before read or branch-local assign,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,3531,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/openssl.c,3618,FP,alloc stored in octx/owned by SSL or freed at cleanup label,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,3618,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,3619,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,3624,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,3628,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,3631,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vtls/openssl.c,3634,FP,free-then-NULL or reassign; no real UAF/double-free,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/openssl.c,3636,FP,alloc stored in octx/owned by SSL or freed at cleanup label,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/openssl.c,3648,FP,alloc stored in octx/owned by SSL or freed at cleanup label,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,3654,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,3661,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
CON43-C,curl,lib/vtls/openssl.c,3666,FP,single-threaded config switch; no double-fetch,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/openssl.c,3721,FP,char* to config struct via getter; alignment fine in practice,curl_full_audit_0.4.35,low
DCL31-C,curl,lib/vtls/openssl.c,3755,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,3840,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
STR30-C,curl,lib/vtls/openssl.c,3947,FP,callee takes const char*; literal not modified,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,3973,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,4018,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vtls/openssl.c,4036,FP,pure getter args; no unsequenced side effects,curl_full_audit_0.4.35,med
MEM31-C,curl,lib/vtls/openssl.c,4066,FP,alloc stored in octx/owned by SSL or freed at cleanup label,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/openssl.c,4069,FP,alloc stored in octx/owned by SSL or freed at cleanup label,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/vtls/openssl.c,4153,FP,no real cast-away-const; sizeof/void* free idiom,curl_full_audit_0.4.35,med
EXP36-C,curl,lib/vtls/openssl.c,4166,FP,char* to config struct via getter; alignment fine in practice,curl_full_audit_0.4.35,low
DCL00-C,curl,lib/vtls/openssl.c,4226,FP,buffer written through pointer by helper; not const,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vtls/openssl.c,4298,FP,buffer written through pointer by helper; not const,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,4418,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,4440,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vtls/openssl.c,4442,FP,"buf freed; second ptr is aliasing cursor, no leak",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,4450,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vtls/openssl.c,4468,FP,buffer written through pointer by helper; not const,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vtls/openssl.c,4469,FP,buffer written through pointer by helper; not const,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/openssl.c,4473,FP,out-param filled before read or branch-local assign,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/openssl.c,4477,FP,out-param filled before read or branch-local assign,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vtls/openssl.c,4498,FP,buffer written through pointer by helper; not const,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vtls/openssl.c,4529,FP,buffer written through pointer by helper; not const,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,4530,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/openssl.c,4545,FP,alloc stored in octx/owned by SSL or freed at cleanup label,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vtls/openssl.c,4563,FP,OpenSSL/curlx header function or macro; declared via include,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/vtls/openssl.c,4623,FP,buffer written through pointer by helper; not const,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/openssl.c,4648,FP,out-param filled before read or branch-local assign,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,4674,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,4675,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,4676,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,4676,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,4678,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,4704,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/vtls/openssl.c,4717,FP,curl config getter or guarded alloc; pointer non-NULL by design,curl_full_audit_0.4.35,high
EXP36-C,curl,lib/vtls/openssl.c,4757,FP,char* to config struct via getter; alignment fine in practice,curl_full_audit_0.4.35,low
PRE32-C,curl,lib/vtls/openssl.c,4839,FP,#ifdef in if-condition not memset macro invocation,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/openssl.c,4888,FP,all execution paths return explicitly,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/openssl.c,4927,FP,out-param filled before read or branch-local assign,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,5043,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/openssl.c,5051,FP,all execution paths return explicitly,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,5051,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,5053,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vtls/openssl.c,5111,FP,out-param filled before read or branch-local assign,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,5148,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/vtls/openssl.c,5269,FP,fixed buffer not used with getenv result,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/vtls/openssl.c,5273,FP,out-param array filled by callee before read,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/vtls/openssl.c,5273,FP,sockindex internally FIRST/SECONDARY socket; bounded by contract,curl_full_audit_0.4.35,med
EXP20-C,curl,lib/vtls/openssl.c,5281,FP,idiomatic !strcmp/!memcmp or ==1 with correct API convention,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/openssl.c,5340,FP,all execution paths return explicitly,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,5340,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/openssl.c,5353,FP,char* buffer byte write/read; no real sign-extension bug,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,5374,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,5390,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/openssl.c,5392,FP,curl never uses C99 array-param syntax; advisory style only,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/vtls/openssl.c,5412,FP,all execution paths return explicitly,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vtls/openssl.c,5421,FP,vtable/typedef-fixed or modified param; const not addable - categorical FP,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/mprintf.c,36,FP,public curl_* API declared in include/curl/mprintf.h; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/mprintf.c,36,FP,public exported API or file-scope const digit table; minimal scope inapplicable,curl_full_audit_0.4.35,high
STR04-C,curl,lib/mprintf.c,36,FP,"digit lookup table indexed by value, not a basic-charset string; idiomatic",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/mprintf.c,39,FP,public curl_* API declared in include/curl/mprintf.h; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/mprintf.c,39,FP,public exported API or file-scope const digit table; minimal scope inapplicable,curl_full_audit_0.4.35,high
STR04-C,curl,lib/mprintf.c,39,FP,"digit lookup table indexed by value, not a basic-charset string; idiomatic",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/mprintf.c,41,FP,OUTCHAR evaluates x once; no multiple-evaluation,curl_full_audit_0.4.35,high
EXP07-C,curl,lib/mprintf.c,76,FP,"these ARE the enum constant definitions (1<<N), not assuming a value elsewhere",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/mprintf.c,77,FP,"these ARE the enum constant definitions (1<<N), not assuming a value elsewhere",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/mprintf.c,78,FP,"these ARE the enum constant definitions (1<<N), not assuming a value elsewhere",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/mprintf.c,79,FP,"these ARE the enum constant definitions (1<<N), not assuming a value elsewhere",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/mprintf.c,80,FP,"these ARE the enum constant definitions (1<<N), not assuming a value elsewhere",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/mprintf.c,81,FP,"these ARE the enum constant definitions (1<<N), not assuming a value elsewhere",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/mprintf.c,82,FP,"these ARE the enum constant definitions (1<<N), not assuming a value elsewhere",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/mprintf.c,84,FP,"these ARE the enum constant definitions (1<<N), not assuming a value elsewhere",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/mprintf.c,85,FP,"these ARE the enum constant definitions (1<<N), not assuming a value elsewhere",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/mprintf.c,86,FP,"these ARE the enum constant definitions (1<<N), not assuming a value elsewhere",curl_full_audit_0.4.35,high
EXP07-C,curl,lib/mprintf.c,87,FP,"these ARE the enum constant definitions (1<<N), not assuming a value elsewhere",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/mprintf.c,141,FP,num set by curlx_str_number; ||-shortcircuit returns before reading on failure,curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,143,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/mprintf.c,147,FP,[adv] is_arg_used/mark_arg_used do evaluate y multiple times (real PRE advisory),curl_full_audit_0.4.35,adversarial-flip
PRE12-C,curl,lib/mprintf.c,147,FP,[adv] macro evaluates y multiple times; CERT advisory factually holds (args side-effect-free though),curl_full_audit_0.4.35,adversarial-flip
PRE00-C,curl,lib/mprintf.c,148,FP,[adv] is_arg_used/mark_arg_used do evaluate y multiple times (real PRE advisory),curl_full_audit_0.4.35,adversarial-flip
PRE12-C,curl,lib/mprintf.c,148,FP,[adv] macro evaluates y multiple times; CERT advisory factually holds (args side-effect-free though),curl_full_audit_0.4.35,adversarial-flip
DCL13-C,curl,lib/mprintf.c,172,FP,'out' IS written (out[ocount]=...); not unmodified,curl_full_audit_0.4.35,high
MSC39-C,curl,lib/mprintf.c,175,FP,"va_list passed once to parsefmt, never reused by caller; standard pattern",curl_full_audit_0.4.35,low
ENV01-C,curl,lib/mprintf.c,182,FP,fixed-size local array; no getenv involved,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/mprintf.c,182,FP,"fixed-size array (MAX_PARAMETERS/8, BUFFSIZE), not a runtime VLA",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mprintf.c,191,FP,loop bounded by NUL terminator of format string,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/mprintf.c,193,FP,iptr assigned at line 505 before use at 506,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/mprintf.c,197,FP,'width' is modified later in function,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mprintf.c,235,FP,loop bounded by NUL terminator of format string,curl_full_audit_0.4.35,high
CON43-C,curl,lib/mprintf.c,236,FP,single-threaded format parser; no concurrency/double-fetch,curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,279,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,309,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
MSC07-C,curl,lib/mprintf.c,329,FP,misparse around #if/#else in switch case 'z'; code is reachable,curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,337,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
CON43-C,curl,lib/mprintf.c,376,FP,single-threaded format parser; no concurrency/double-fetch,curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,391,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,393,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,399,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,401,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,408,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,410,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,417,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,419,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,426,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,428,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,462,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mprintf.c,467,FP,usedinput index width/8<16=sizeof; width bounded <MAX_PARAMETERS before use,curl_full_audit_0.4.35,high
INT33-C,curl,lib/mprintf.c,467,FP,"macro divisor is literal 8, not width/precision; never zero",curl_full_audit_0.4.35,high
ARR36-C,curl,lib/mprintf.c,472,FP,"operands are int counters (num/param/maxprec) or same array (w/work), not distinct arrays",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mprintf.c,477,FP,usedinput index width/8<16=sizeof; width bounded <MAX_PARAMETERS before use,curl_full_audit_0.4.35,high
INT33-C,curl,lib/mprintf.c,477,FP,"macro divisor is literal 8, not width/precision; never zero",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,480,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mprintf.c,485,FP,usedinput index width/8<16=sizeof; width bounded <MAX_PARAMETERS before use,curl_full_audit_0.4.35,high
INT33-C,curl,lib/mprintf.c,485,FP,"macro divisor is literal 8, not width/precision; never zero",curl_full_audit_0.4.35,high
ARR36-C,curl,lib/mprintf.c,490,FP,"operands are int counters (num/param/maxprec) or same array (w/work), not distinct arrays",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mprintf.c,494,FP,usedinput index width/8<16=sizeof; width bounded <MAX_PARAMETERS before use,curl_full_audit_0.4.35,high
INT33-C,curl,lib/mprintf.c,494,FP,"macro divisor is literal 8, not width/precision; never zero",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mprintf.c,509,FP,usedinput index width/8<16=sizeof; width bounded <MAX_PARAMETERS before use,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/mprintf.c,542,FP,usedinput index width/8<16=sizeof; width bounded <MAX_PARAMETERS before use,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/mprintf.c,604,FP,"cycle bounded by construction: out_double calls msnprintf with %d only, never re-enters",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/mprintf.c,606,FP,signature-constrained out_*/callback family; const cannot be applied uniformly,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/mprintf.c,610,FP,formatbuf modified via *fptr++,curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,617,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,618,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,618,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,619,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,620,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,620,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,621,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,622,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,622,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,623,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,624,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,624,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,626,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
INT36-C,curl,lib/mprintf.c,633,FP,(size_t)ptr intentional for %p hex formatting; idiomatic advisory,curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,634,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/mprintf.c,645,FP,"operands are int counters (num/param/maxprec) or same array (w/work), not distinct arrays",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,658,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,660,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,661,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,661,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,663,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,664,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,664,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,664,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,665,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,666,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,666,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,666,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,668,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,668,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,670,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/mprintf.c,696,FP,"'stream' is a function-pointer parameter, not an undeclared function",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mprintf.c,703,FP,signature-constrained out_*/callback family; const cannot be applied uniformly,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mprintf.c,705,FP,signature-constrained out_*/callback family; const cannot be applied uniformly,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mprintf.c,708,FP,signature-constrained out_*/callback family; const cannot be applied uniformly,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mprintf.c,708,FP,signature-constrained out_*/callback family; const cannot be applied uniformly,curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,714,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,721,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,724,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,726,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,730,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,735,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,739,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,741,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
EXP15-C,curl,lib/mprintf.c,744,FP,intentional empty no-op branch with explanatory comment (unsigned needs no handling),curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,744,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,757,FP,"'num' is uint64_t scalar, not a pointer",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,771,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,771,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,777,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,777,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,786,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,786,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
ARR36-C,curl,lib/mprintf.c,792,FP,"operands are int counters (num/param/maxprec) or same array (w/work), not distinct arrays",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,793,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,793,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,799,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,799,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,802,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,802,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,808,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,810,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,815,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,821,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,821,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
ARR37-C,curl,lib/mprintf.c,826,FP,fptr/w/fmt point into real local arrays (formatbuf/work/format); decay misparse,curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,830,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mprintf.c,839,FP,signature-constrained out_*/callback family; const cannot be applied uniformly,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mprintf.c,841,FP,signature-constrained out_*/callback family; const cannot be applied uniformly,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mprintf.c,843,FP,signature-constrained out_*/callback family; const cannot be applied uniformly,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/mprintf.c,852,FP,"nilstr is static const char[]=""(nil)"", a real array; sizeof correct, not decayed param",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/mprintf.c,854,FP,"nilstr is static const char[]=""(nil)"", a real array; sizeof correct, not decayed param",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,872,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,875,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,881,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,885,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT36-C,curl,lib/mprintf.c,900,FP,(size_t)ptr intentional for %p hex formatting; idiomatic advisory,curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,900,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/mprintf.c,913,FP,"nilstr is static const char[]=""(nil)"", a real array; sizeof correct, not decayed param",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,914,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
INT13-C,curl,lib/mprintf.c,919,FP,"bitwise & on local int 'flags' (copy of unsigned); idiomatic, no defect",curl_full_audit_0.4.35,high
MSC04-C,curl,lib/mprintf.c,942,FP,"cycle bounded by construction: out_double calls msnprintf with %d only, never re-enters",curl_full_audit_0.4.35,med
ENV01-C,curl,lib/mprintf.c,954,FP,fixed-size local array; no getenv involved,curl_full_audit_0.4.35,high
ENV01-C,curl,lib/mprintf.c,955,FP,fixed-size local array; no getenv involved,curl_full_audit_0.4.35,high
MEM05-C,curl,lib/mprintf.c,956,FP,"fixed-size array (MAX_PARAMETERS/8, BUFFSIZE), not a runtime VLA",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/mprintf.c,964,FP,'input' array filled by parsefmt out-param before formatf reads it,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/mprintf.c,971,FP,"'stream' is a function-pointer parameter, not an undeclared function",curl_full_audit_0.4.35,high
ARR00-C,curl,lib/mprintf.c,984,FP,'input' array filled by parsefmt out-param before formatf reads it,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/mprintf.c,1001,FP,'input' array filled by parsefmt out-param before formatf reads it,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/mprintf.c,1077,FP,public curl_* API declared in include/curl/mprintf.h; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/mprintf.c,1077,FP,public exported API or file-scope const digit table; minimal scope inapplicable,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/mprintf.c,1077,FP,"cycle bounded by construction: out_double calls msnprintf with %d only, never re-enters",curl_full_audit_0.4.35,med
API05-C,curl,lib/mprintf.c,1077,FP,C99 conformant array-param syntax; curl never uses it; advisory style,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mprintf.c,1077,FP,signature-constrained out_*/callback family; const cannot be applied uniformly,curl_full_audit_0.4.35,high
API05-C,curl,lib/mprintf.c,1077,FP,C99 conformant array-param syntax; curl never uses it; advisory style,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/mprintf.c,1102,FP,public curl_* API declared in include/curl/mprintf.h; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/mprintf.c,1102,FP,public exported API or file-scope const digit table; minimal scope inapplicable,curl_full_audit_0.4.35,high
MSC04-C,curl,lib/mprintf.c,1102,FP,"cycle bounded by construction: out_double calls msnprintf with %d only, never re-enters",curl_full_audit_0.4.35,med
API05-C,curl,lib/mprintf.c,1102,FP,C99 conformant array-param syntax; curl never uses it; advisory style,curl_full_audit_0.4.35,high
API05-C,curl,lib/mprintf.c,1102,FP,C99 conformant array-param syntax; curl never uses it; advisory style,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mprintf.c,1125,FP,'dyn' passed to curlx_dyn_free which frees/modifies it,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/mprintf.c,1134,FP,"info.merr is a char struct field on stack, not the freed dynbuf pointer; misidentified",curl_full_audit_0.4.35,high
DCL31-C,curl,lib/mprintf.c,1154,FP,curlx_strdup declared in curl header (external),curl_full_audit_0.4.35,high
DCL30-C,curl,lib/mprintf.c,1164,FP,"returns 's' = heap ptr from curl_mvaprintf, not address of a local",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,1170,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/mprintf.c,1175,FP,public curl_* API declared in include/curl/mprintf.h; needs external linkage,curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,1182,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/mprintf.c,1186,FP,signature-constrained out_*/callback family; const cannot be applied uniformly,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/mprintf.c,1190,FP,rc IS checked: 'return rc == EOF',curl_full_audit_0.4.35,high
DCL15-C,curl,lib/mprintf.c,1194,FP,public curl_* API declared in include/curl/mprintf.h; needs external linkage,curl_full_audit_0.4.35,high
API00-C,curl,lib/mprintf.c,1204,FP,thin wrapper forwarding to formatf; does not deref the param itself,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/mprintf.c,1204,FP,public curl_* API declared in include/curl/mprintf.h; needs external linkage,curl_full_audit_0.4.35,high
API00-C,curl,lib/mprintf.c,1214,FP,thin wrapper forwarding to formatf; does not deref the param itself,curl_full_audit_0.4.35,high
API00-C,curl,lib/mprintf.c,1214,FP,thin wrapper forwarding to formatf; does not deref the param itself,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/mprintf.c,1214,FP,public curl_* API declared in include/curl/mprintf.h; needs external linkage,curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,1216,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,1216,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,1216,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
STR34-C,curl,lib/mprintf.c,1217,FP,"ASCII char written/read in printf formatting; sign-extension benign, idiomatic",curl_full_audit_0.4.35,high
API00-C,curl,lib/mprintf.c,1221,FP,thin wrapper forwarding to formatf; does not deref the param itself,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/mprintf.c,1221,FP,public curl_* API declared in include/curl/mprintf.h; needs external linkage,curl_full_audit_0.4.35,high
API00-C,curl,lib/mprintf.c,1226,FP,thin wrapper forwarding to formatf; does not deref the param itself,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/mprintf.c,1226,FP,public curl_* API declared in include/curl/mprintf.h; needs external linkage,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/spnego_sspi.c,152,FP,"nego->* are struct members freed by Curl_auth_cleanup_spnego, not function-local leaks",curl_full_audit_0.4.35,high
EXP43-C,curl,lib/vauth/spnego_sspi.c,155,FP,"AcquireCredentialsHandle SSPI signature; pHandle is output-only, distinct from inputs",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/spnego_sspi.c,161,FP,Struct-member resources cleaned by cleanup function; persistent across calls,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/spnego_sspi.c,166,FP,Struct-member resources cleaned by Curl_auth_cleanup_spnego,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/spnego_sspi.c,174,FP,Struct-member resources cleaned by cleanup function,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/spnego_sspi.c,180,FP,Struct-member resources cleaned by cleanup function,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/spnego_sspi.c,186,FP,chlg_buf is a SecBuffer desc filled before use; struct populated then read,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/spnego_sspi.c,245,FP,Struct-member resources cleaned by cleanup function,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/spnego_sspi.c,247,FP,Struct-member resources cleaned by cleanup function,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/spnego_sspi.c,259,FP,Struct-member resources cleaned by cleanup function,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/spnego_sspi.c,261,FP,Struct-member resources cleaned by cleanup function,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/spnego_sspi.c,267,FP,Struct-member resources cleaned by cleanup function,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vauth/spnego_sspi.c,286,FP,"nego->output_token read into base64 encode; nego state consulted, not const-able semantically",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/spnego_sspi.c,287,FP,curl never uses C99 array-param syntax; advisory convention,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/spnego_sspi.c,323,FP,Guarded single free inside if(nego->credentials); pointer nulled after,curl_full_audit_0.4.35,high
MSC37-C,curl,src/tool_cb_rea.c,44,FP,waitfd: both #if branches return on every path,curl_full_audit_0.4.35,high
INT10-C,curl,src/tool_cb_rea.c,64,FP,waitms derived from clamped non-negative int; modulo well-defined,curl_full_audit_0.4.35,med
API00-C,curl,src/tool_cb_rea.c,79,FP,CURLOPT_READFUNCTION callback signature; buffer always non-null from libcurl,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_cb_rea.c,79,FP,Callback signature; sz bounded by libcurl,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_cb_rea.c,79,FP,Callback signature; nmemb bounded by libcurl,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_rea.c,79,FP,Callback signature; conformant array syntax not used in curl,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_cb_rea.c,79,FP,Callback signature; conformant array syntax not used in curl,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_cb_rea.c,79,FP,CURLOPT_READFUNCTION fixed callback signature; userdata cast and deref'd,curl_full_audit_0.4.35,high
INT18-C,curl,src/tool_cb_rea.c,85,FP,uploadfilesize is signed curl_off_t; comparison to -1 correct,curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_cb_rea.c,113,FP,Idiomatic !strcmp boolean test in path comparison,curl_full_audit_0.4.35,high
INT30-C,curl,src/tool_cb_rea.c,115,FP,"sz*nmemb is libcurl callback buffer size, bounded; no overflow",curl_full_audit_0.4.35,high
INT30-C,curl,src/tool_cb_rea.c,133,FP,"sz*nmemb is libcurl callback buffer size, bounded; no overflow",curl_full_audit_0.4.35,high
INT18-C,curl,src/tool_cb_rea.c,145,FP,uploadfilesize is signed curl_off_t; comparison to -1 correct,curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_cb_rea.c,164,FP,XFERINFOFUNCTION callback signature; clientp cast and deref'd,curl_full_audit_0.4.35,high
EXP33-C,curl,src/tool_cb_rea.c,178,FP,Static variable ulprev is zero-initialized by C standard,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/dynbuf.c,68,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/curlx/dynbuf.c,105,FP,curlx_realloc declared via included curl memory headers,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/curlx/dynbuf.c,115,FP,memcpy guarded by if(len); len>0 implies mem non-null via DEBUGASSERT,curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/dynbuf.c,162,FP,mem validated via len guard in dyn_nappend; null mem only with zero len,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/curlx/dynbuf.c,162,FP,Exported curlx API used across translation units; needs external linkage,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/dynbuf.c,162,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/dynbuf.c,173,FP,str validated via DEBUGASSERT(str); exported API contract,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/curlx/dynbuf.c,173,FP,Exported curlx API used across translation units,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/curlx/dynbuf.c,180,FP,str asserted non-null; strlen called after DEBUGASSERT(str),curl_full_audit_0.4.35,high
DCL15-C,curl,lib/curlx/dynbuf.c,187,FP,Exported curlx API used across translation units,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/curlx/dynbuf.c,187,FP,Exported curlx API; used by other curl source files,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/curlx/dynbuf.c,187,FP,Both #if branches return on every path,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/curlx/dynbuf.c,220,FP,Exported curlx API used across translation units,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curlx/dynbuf.c,254,FP,"ptr holds heap s->bufr (take ownership transfer), not stack-local",curl_full_audit_0.4.35,high
API05-C,curl,lib/if2ip.c,99,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
API05-C,curl,lib/if2ip.c,100,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
DCL00-C,curl,lib/if2ip.c,116,FP,scope array is written by curl_msnprintf at line 150; not constant,curl_full_audit_0.4.35,high
API00-C,curl,lib/if2ip.c,178,FP,"buf written via curlx_inet_ntop; caller-supplied output buffer, internal API",curl_full_audit_0.4.35,high
API05-C,curl,lib/if2ip.c,183,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
API05-C,curl,lib/if2ip.c,184,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/if2ip.c,202,FP,req is struct ifreq used only in len check; memset+memcpy before ioctl,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/if2ip.c,210,FP,len+1<=sizeof(ifr_name) guaranteed by len>=sizeof check at line 202,curl_full_audit_0.4.35,high
INT32-C,curl,lib/if2ip.c,210,FP,len bounded below sizeof(ifr_name); len+1 cannot overflow,curl_full_audit_0.4.35,high
DCL39-C,curl,lib/if2ip.c,218,FP,"ioctl is local kernel call, not a cross-trust serialization boundary; advisory",curl_full_audit_0.4.35,med
EXP05-C,curl,lib/if2ip.c,230,FP,in is non-const local struct in_addr; no const cast away,curl_full_audit_0.4.35,high
API05-C,curl,lib/if2ip.c,246,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
API05-C,curl,lib/if2ip.c,247,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/if2ip.c,247,FP,Stub variant; buf is output param (written in active variants); signature must match,curl_full_audit_0.4.35,med
API00-C,curl,lib/vauth/ntlm_sspi.c,78,FP,service passed to Curl_auth_build_spn which handles null; internal auth API,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/ntlm_sspi.c,78,FP,host passed to Curl_auth_build_spn which handles null,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/ntlm_sspi.c,132,FP,ntlm->* are struct members freed by Curl_auth_cleanup_ntlm,curl_full_audit_0.4.35,high
EXP43-C,curl,lib/vauth/ntlm_sspi.c,135,FP,AcquireCredentialsHandle SSPI signature; output handle distinct from inputs,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/ntlm_sspi.c,141,FP,Struct-member resources cleaned by Curl_auth_cleanup_ntlm,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/ntlm_sspi.c,146,FP,Struct-member resources cleaned by cleanup function,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/ntlm_sspi.c,150,FP,Struct-member resources cleaned by cleanup function,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/ntlm_sspi.c,171,FP,Struct-member resources cleaned by cleanup function,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/ntlm_sspi.c,173,FP,Struct-member resources cleaned by cleanup function,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/vauth/ntlm_sspi.c,177,FP,Struct-member resources cleaned by cleanup function,curl_full_audit_0.4.35,high
EXP30-C,curl,lib/vauth/ntlm_sspi.c,204,FP,"curlx_memdup0(ptr,len) getter args have no shared side effects on type2",curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/ntlm_sspi.c,249,FP,type_2_bufs SecBuffer array fully populated before being read by SSPI,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/vauth/ntlm_sspi.c,271,FP,status assigned at line 266 before read at 271 inside same if-block,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/vauth/ntlm_sspi.c,335,FP,Guarded single free inside if(ntlm->credentials); pointer nulled after,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/hostcheck.c,42,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/hostcheck.c,43,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/hostcheck.c,74,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/hostcheck.c,76,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/vtls/hostcheck.c,101,FP,patternlen is the valid length of pattern buffer; memchr bound correct,curl_full_audit_0.4.35,high
ARR38-C,curl,lib/vtls/hostcheck.c,106,FP,hostlen is the valid length of hostname buffer; memchr bound correct,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/hostcheck.c,108,FP,"Pointer subtraction (label_end - hostname), not char-to-int conversion",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/hostcheck.c,108,FP,"Pointer subtraction, not signed-char conversion",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/hostcheck.c,109,FP,"Pointer subtraction (pattern_label_end - pattern), not char conversion",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vtls/hostcheck.c,109,FP,"Pointer subtraction, not signed-char conversion",curl_full_audit_0.4.35,high
INT00-C,curl,lib/vtls/hostcheck.c,110,FP,skiphost = label_end-hostname < hostlen (label within host); difference non-negative,curl_full_audit_0.4.35,high
INT00-C,curl,lib/vtls/hostcheck.c,111,FP,skiplen = pattern_label_end-pattern < patternlen; difference non-negative,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/hostcheck.c,120,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/hostcheck.c,121,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_cfgable.c,39,FP,curlx_calloc declared via included curl memory headers,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cfgable.c,71,FP,curlx_dyn_free frees postdata buffer member; no use-after-free of distinct member,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cfgable.c,107,FP,url_list read to start loop; not previously freed,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_cfgable.c,193,FP,config_free loop while(last) safe on null; internal API,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_cfgable.c,202,FP,curlx_free declared via included curl memory headers,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cfgable.c,202,FP,Loop frees a different node each iteration (last=prev advance); not double-free,curl_full_audit_0.4.35,high
MEM31-C,curl,src/tool_cfgable.c,202,FP,Loop-iteration free conflation; each iter frees distinct list node,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cfgable.c,226,FP,"global->first assigned heap config_alloc() return, not stack array",curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_cfgable.c,239,FP,curlx_free declared via included curl memory headers,curl_full_audit_0.4.35,high
DCL31-C,curl,src/tool_cfgable.c,244,FP,curlx_free declared via included curl memory headers,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cfgable.c,259,FP,"trace_fopened/trace_stream are distinct members, read before fclose; no UAF",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cfgable.c,259,FP,trace_stream read to test then fclose; nulled at line 261; no UAF,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cfgable.c,260,FP,trace_stream passed to fclose then set NULL; correct single close,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_cfgable.c,266,FP,"global->term.buf freed once; distinct member, no prior free",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/curlx/strerr.c,44,FP,get_winsock_error: both #if branches return on all paths,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strerr.c,44,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strerr.c,52,FP,"*buf = '\0' assigns char literal, no integer widening",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/curlx/strerr.c,250,FP,curlx_strerror returns buf at end of all paths,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strerr.c,250,FP,C99 array-param syntax not used in curl,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strerr.c,265,FP,"*buf = '\0' char literal assignment, no sign extension",curl_full_audit_0.4.35,high
EXP20-C,curl,lib/curlx/strerr.c,268,FP,Idiomatic !strcmp test; Windows-only branch,curl_full_audit_0.4.35,high
PRE32-C,curl,lib/curlx/strerr.c,269,FP,"#ifdef USE_WINSOCK is inside an if() expression, not a DEBUGASSERT macro arg",curl_full_audit_0.4.35,high
CON33-C,curl,lib/curlx/strerr.c,304,FP,Deliberate fallback only when no strerror_r; return value checked; checksrc-approved,curl_full_audit_0.4.35,med
CON34-C,curl,lib/curlx/strerr.c,304,FP,Same strerror site; fallback when thread-safe variant unavailable,curl_full_audit_0.4.35,med
EXP33-C,curl,lib/curlx/strerr.c,316,FP,"p = strrchr(buf,'\n') assigned before read on line 316",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strerr.c,317,FP,"*p = '\0' char literal assignment, no integer widening",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/strerr.c,320,FP,"*p = '\0' char literal assignment, no integer widening",curl_full_audit_0.4.35,high
API00-C,curl,lib/fake_addrinfo.c,32,FP,freeaddrinfo loop while(ca) null-safe; cahead null tolerated,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/fake_addrinfo.c,32,FP,freeaddrinfo frees nodes through cahead; const-qualifying a free param is wrong,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/fake_addrinfo.c,48,FP,c-ares ares_addrinfo_callback signature fixed by external typedef,curl_full_audit_0.4.35,high
STR34-C,curl,lib/fake_addrinfo.c,69,FP,strlen(name) call; no signed-char to wide-int conversion present,curl_full_audit_0.4.35,high
STR34-C,curl,lib/fake_addrinfo.c,69,FP,strlen(name)+1; no char-to-int sign extension,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/fake_addrinfo.c,105,FP,"(char*)ca + sizeof(...) is byte-pointer arithmetic, not double scaling",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/fake_addrinfo.c,109,FP,"(char*)ai_addr + ss_size byte arithmetic on char*, correct",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/fake_addrinfo.c,110,FP,Guarded by if(namelen); namelen>0 implies name non-null (line 69),curl_full_audit_0.4.35,high
API00-C,curl,lib/fake_addrinfo.c,138,FP,node forwarded to ares_getaddrinfo which accepts null; internal API,curl_full_audit_0.4.35,high
API00-C,curl,lib/fake_addrinfo.c,138,FP,service forwarded to ares_getaddrinfo which accepts null,curl_full_audit_0.4.35,high
API00-C,curl,lib/fake_addrinfo.c,138,FP,res only written on ctx.result path; internal API,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/fake_addrinfo.c,170,FP,getenv result 'env' checked with if(env) at line 171,curl_full_audit_0.4.35,high
CON34-C,curl,lib/fake_addrinfo.c,170,FP,"One-time init-path getenv; read-immediately idiom, not retained shared storage",curl_full_audit_0.4.35,med
DCL31-C,curl,lib/multi_ntfy.c,49,FP,curlx_calloc is a curl-internal alloc declared via included headers; macro/inline indirection sqc can't trace.,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/multi_ntfy.c,54,FP,curlx_free declared via curl headers; not undeclared.,curl_full_audit_0.4.35,high
ARR01-C,curl,lib/multi_ntfy.c,59,FP,"sizeof(*chunk) on pointer-to-struct yields struct size, the intended memset size.",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/multi_ntfy.c,63,FP,data->mid is read; signature also dictated by append contract. Not const-able cleanly.,curl_full_audit_0.4.35,med
MEM31-C,curl,lib/multi_ntfy.c,80,FP,chunk is stored into mntfy->head/tail and returned; freed later in cleanup. Not leaked.,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/multi_ntfy.c,85,FP,"Returns heap pointer chunk, not address of a local object.",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/multi_ntfy.c,96,FP,"Returns heap pointer chunk, not address of a local object.",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi_ntfy.c,106,FP,"multi is internal handle, always valid at this call site.",curl_full_audit_0.4.35,high
ARR01-C,curl,lib/multi_ntfy.c,126,FP,"multi->ntfy is a struct member, not a decayed array param; sizeof correct.",curl_full_audit_0.4.35,high
API00-C,curl,lib/multi_ntfy.c,148,FP,Internal API; multi always valid from caller. Curl convention not to NULL-check.,curl_full_audit_0.4.35,med
API00-C,curl,lib/multi_ntfy.c,156,FP,Internal API; multi always valid from caller.,curl_full_audit_0.4.35,med
API00-C,curl,lib/multi_ntfy.c,164,FP,Curl_mntfy_add explicitly handles data==NULL via ternary on line 166.,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/multi_ntfy.c,182,FP,"multi internal handle, always valid; only a DEBUGASSERT context.",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_fopen.c,46,FP,[adv] IS_SEP evaluates x twice; advisory but technically true for function-like macro.,curl_full_audit_0.4.35,adversarial-flip
PRE12-C,curl,lib/curl_fopen.c,46,FP,[adv] IS_SEP macro evaluates parameter x multiple times.,curl_full_audit_0.4.35,adversarial-flip
API00-C,curl,lib/curl_fopen.c,85,FP,Internal; data passed to Curl_rand_alnum which uses it; curl convention no NULL-check.,curl_full_audit_0.4.35,med
STR34-C,curl,lib/curl_fopen.c,96,FP,"*tempname = NULL is a pointer assignment, not char sign-extension.",curl_full_audit_0.4.35,high
FIO42-C,curl,lib/curl_fopen.c,99,FP,*fh is an out-param returned open to caller by design; closed/fclosed on relevant paths.,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/curl_fopen.c,135,FP,fd becomes *fh via fdopen and returned; on fail path fd closed at line 150.,curl_full_audit_0.4.35,high
FIO42-C,curl,lib/curl_fopen.c,141,FP,*fh out-param returned open to caller on success; cleanup on fail.,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/curl_fopen.c,145,FP,"*tempname = tempstore assigns a heap pointer to out-param, not a local address.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curl_fopen.c,145,FP,"*tempname = tempstore is a pointer assignment, not char value.",curl_full_audit_0.4.35,high
MEM12-C,curl,lib/curl_fopen.c,146,FP,Success path: *fh and *tempname intentionally handed to caller; nothing leaked.,curl_full_audit_0.4.35,high
MSC07-C,curl,lib/curl_fopen.c,148,FP,'fail:' label is reachable via goto; not unreachable code.,curl_full_audit_0.4.35,high
MEM12-C,curl,lib/curl_fopen.c,155,FP,"fail path closes fd, unlinks, frees tempstore; resources properly released.",curl_full_audit_0.4.35,high
DCL38-C,curl,lib/hash.h,50,TP,char key[1] is the legacy struct-hack; modern C99 prefers []. Real but intentional.,curl_full_audit_0.4.35,med
STR31-C,curl,lib/hash.h,50,FP,"key[1] is a flexible-array-member hack, not a fixed string buffer.",curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.h,84,FP,Curl never uses C99 array-param syntax; advisory by convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.h,84,FP,"key/key_len pair; curl convention, not conformant-array syntax.",curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.h,85,FP,Curl convention; no C99 array-param syntax.,curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.h,85,FP,Curl convention; no C99 array-param syntax.,curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.h,87,FP,Curl convention; no C99 array-param syntax.,curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.h,88,FP,Curl convention; no C99 array-param syntax.,curl_full_audit_0.4.35,high
API02-C,curl,lib/hash.h,93,FP,"void* user is opaque criterium context, not an array needing a size param.",curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.h,95,FP,void* key with separate key_length; curl convention.,curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.h,96,FP,Curl convention; no C99 array-param syntax.,curl_full_audit_0.4.35,high
API05-C,curl,lib/hash.h,96,FP,Curl convention; no C99 array-param syntax.,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_digest.c,41,FP,Internal; data always valid from caller. Curl convention no NULL-check.,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/http_digest.c,41,FP,data->state members written (digest selection); struct mutated through data.,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/http_digest.c,56,FP,!checkprefix idiom is standard curl boolean usage.,curl_full_audit_0.4.35,high
API00-C,curl,lib/http_digest.c,65,FP,Internal; data always valid; curl convention.,curl_full_audit_0.4.35,med
API00-C,curl,lib/http_digest.c,65,FP,Internal; request always valid from caller.,curl_full_audit_0.4.35,med
MEM03-C,curl,lib/http_digest.c,83,FP,"passwdp points to data->state.aptr.passwd, a persistent struct field, not a sensitive stack buffer to scrub.",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_digest.c,108,FP,allocuserpwd = &data->state.aptr.userpwd; address-of-member is never NULL.,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_digest.c,118,FP,"digest = &data->state.digest; address-of-member, never NULL.",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/http_digest.c,124,FP,"authp = &data->state.authhost; address-of-member, never NULL.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_digest.c,144,FP,"tmp - uripath is pointer subtraction (ptrdiff), not a char value conversion.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/http_digest.c,161,FP,"*allocuserpwd = curl_maprintf(...) is a char* pointer assignment, not char.",curl_full_audit_0.4.35,high
API00-C,curl,lib/http_digest.c,172,FP,Internal cleanup; data always valid.,curl_full_audit_0.4.35,med
DCL37-C,curl,lib/setup-vms.h,46,FP,__name is the system getenv prototype parameter name from DEC C RTL; platform shim.,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/setup-vms.h,84,TP,vms_translate_path falls off end without returning unix_path on success branch. Real (VMS-only).,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/setup-vms.h,93,FP,Intentional const-cast to return original path in same type; documented design.,curl_full_audit_0.4.35,high
EXP05-C,curl,lib/setup-vms.h,100,FP,Intentional const-cast returning original path; documented.,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/setup-vms.h,107,FP,"vms_translate_path(__path) noop macro; substituting bare token is the intent, no precedence risk.",curl_full_audit_0.4.35,med
DCL30-C,curl,lib/setup-vms.h,125,FP,"result is a char* (from getenv/translate), not address of a local object.",curl_full_audit_0.4.35,high
ENV30-C,curl,lib/setup-vms.h,129,FP,vms_translate_path takes const char* and does not modify the getenv buffer.,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/setup-vms.h,137,FP,"result is a char* value, not address of a local.",curl_full_audit_0.4.35,high
MEM03-C,curl,lib/setup-vms.h,144,FP,"my_passwd is a pointer to a system static struct, not a sensitive stack buffer.",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/setup-vms.h,159,FP,"my_passwd is a pointer (from getpwuid/cache), not address of a local.",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/setup-vms.h,166,FP,"Returns my_passwd pointer, not a local address.",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/setup-vms.h,171,FP,"Returns my_passwd pointer, not a local address.",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/strerror.c,34,FP,curl_easy_strerror is a public exported API function; cannot be static.,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/strerror.c,34,FP,"All paths return: switch cases return and function ends with return ""Unknown error""/#else returns.",curl_full_audit_0.4.35,high
MSC37-C,curl,lib/strerror.c,326,FP,curl_multi_strerror returns on every path (switch + trailing return).,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/strerror.c,385,FP,curl_share_strerror is a public exported API function; cannot be static.,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/strerror.c,385,FP,curl_share_strerror returns on every path.,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/strerror.c,420,FP,curl_url_strerror returns on every path.,curl_full_audit_0.4.35,high
API05-C,curl,lib/strerror.c,538,FP,"char *buf, size_t buflen pair; curl convention, not C99 array syntax.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/strerror.c,549,FP,"*buf = '\0' assigns char NUL, no sign extension.",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/strerror.c,556,FP,"SEC2TXT uses sec once (case sec: txt=#sec); single evaluation, no side-effect risk.",curl_full_audit_0.4.35,high
PRE01-C,curl,lib/strerror.c,556,FP,sec only used as a case label and stringified; parenthesizing is invalid there.,curl_full_audit_0.4.35,high
PRE05-C,curl,lib/strerror.c,556,FP,Stringifying a fixed enum constant name is the intent; no expansion needed.,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/strerror.c,556,FP,sec used once in case label; no multiple evaluation.,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/gsasl.c,35,FP,Internal; mech always valid from caller.,curl_full_audit_0.4.35,med
API00-C,curl,lib/vauth/gsasl.c,35,FP,Internal; gsasl always valid from caller.,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/vauth/gsasl.c,41,FP,gsasl_init declared in <gsasl.h> included at line 33.,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vauth/gsasl.c,43,FP,gsasl_strerror declared in <gsasl.h>.,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vauth/gsasl.c,47,FP,gsasl_client_start declared in <gsasl.h>.,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vauth/gsasl.c,49,FP,gsasl_done declared in <gsasl.h>.,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/vauth/gsasl.c,65,FP,gsasl_property_set declared in <gsasl.h>.,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/gsasl.c,89,FP,Internal; gsasl always valid from caller.,curl_full_audit_0.4.35,med
API00-C,curl,lib/vauth/gsasl.c,89,FP,Internal; out always valid from caller.,curl_full_audit_0.4.35,med
DCL13-C,curl,lib/vauth/gsasl.c,91,FP,gsasl->client passed to gsasl_step; struct used; signature is curl callback convention.,curl_full_audit_0.4.35,med
EXP30-C,curl,lib/vauth/gsasl.c,98,FP,Curl_bufref_ptr/len are pure getters with no shared side effects; sequencing irrelevant.,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/gsasl.c,109,FP,Internal cleanup; gsasl always valid.,curl_full_audit_0.4.35,med
DCL31-C,curl,lib/cw-pause.c,47,FP,curlx_calloc declared via curl headers.,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/cw-pause.c,63,FP,curlx_free declared via curl headers.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cw-pause.c,73,FP,cw_pause_init signature fixed by Curl_cwtype vtable; const cannot be added.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cw-pause.c,74,FP,writer->ctx mutated (ctx->buf=NULL); param not actually const-able and vtable-fixed.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cw-pause.c,91,FP,cw_pause_close signature fixed by vtable typedef.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cw-pause.c,91,FP,writer used to get ctx and free bufs; vtable-fixed signature.,curl_full_audit_0.4.35,high
EXP40-C,curl,lib/cw-pause.c,108,FP,"plast points to ctx->buf (non-const); standard list traversal, no const circumvention.",curl_full_audit_0.4.35,high
API05-C,curl,lib/cw-pause.c,144,FP,"const char *buf, size_t blen; curl convention, not C99 array syntax.",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/cw-pause.c,206,FP,Curl_cwt_pause vtable is referenced from other TUs (cw_pause.h); needs external linkage.,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/cw-pause.c,206,FP,Exported vtable instance; cannot be function-local.,curl_full_audit_0.4.35,high
API00-C,curl,lib/cw-pause.c,215,FP,Internal; data always valid from caller.,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/splay.c,58,FP,y=t->smaller after 'if(!t->smaller) break'; y guaranteed non-NULL.,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/splay.c,64,FP,r initialized to &N then to tree nodes; never NULL.,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/splay.c,79,FP,l initialized to &N then to tree nodes; never NULL.,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/splay.c,180,FP,"x=t->samen; samen is always set (circular list), and t guaranteed non-NULL here.",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/splay.c,187,FP,"Returns x, a tree-node pointer, not address of a local object.",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/splay.c,194,FP,"Returns x (t->larger), a node pointer, not a local address.",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/splay.c,258,FP,x=t->samen always set; t non-NULL (asserted post-splay).,curl_full_audit_0.4.35,high
DCL30-C,curl,lib/splay.c,275,FP,"*newroot=x stores a heap node pointer to out-param, not a local address.",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/splay.c,281,FP,"node->ptr = payload stores payload; payload is data, intent is to store opaque ptr.",curl_full_audit_0.4.35,high
API00-C,curl,lib/splay.c,287,FP,Internal; node validated via DEBUGASSERT; always valid from caller.,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/splay.c,290,FP,node guaranteed valid by caller (DEBUGASSERT); internal accessor.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/strcase.c,76,FP,(unsigned char)in indexes touppermap[256] with 0-255; always in bounds.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/strcase.c,83,FP,(unsigned char)in indexes tolowermap[256] with 0-255; always in bounds.,curl_full_audit_0.4.35,high
API05-C,curl,lib/strcase.c,91,FP,Curl convention; no C99 array-param syntax.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/strcase.c,91,FP,dest is written through (*dest++); not const-able.,curl_full_audit_0.4.35,high
API05-C,curl,lib/strcase.c,91,FP,Curl convention; no C99 array-param syntax.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/strcase.c,97,FP,*dest++ = Curl_raw_toupper() assigns char to char; no widening conversion.,curl_full_audit_0.4.35,high
API05-C,curl,lib/strcase.c,106,FP,Curl convention; no C99 array-param syntax.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/strcase.c,106,FP,dest is written through; not const-able.,curl_full_audit_0.4.35,high
API05-C,curl,lib/strcase.c,106,FP,Curl convention; no C99 array-param syntax.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/strcase.c,112,FP,*dest++ = char-to-char assignment; no sign extension.,curl_full_audit_0.4.35,high
EXP20-C,curl,lib/strcase.c,122,FP,!strcmp idiom is standard curl boolean comparison.,curl_full_audit_0.4.35,high
PRE08-C,curl,src/tool_writeout_json.c,27,FP,"8-char filename collision is a 1980s constraint; advisory, irrelevant on modern systems.",curl_full_audit_0.4.35,high
API05-C,curl,src/tool_writeout_json.c,37,FP,"const char *in, size_t len pair; curl convention, not C99 array syntax.",curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_writeout_json.c,40,FP,"&i[len] computes one-past-end pointer for loop bound; len=strlen(in), in bounds.",curl_full_audit_0.4.35,high
ARR36-C,curl,src/tool_writeout_json.c,43,FP,i and in_end both point into the same 'in' buffer; comparison well-defined.,curl_full_audit_0.4.35,high
CON43-C,curl,src/tool_writeout_json.c,44,FP,"Single-threaded CLI string scan; no concurrency, no double-fetch risk.",curl_full_audit_0.4.35,high
STR09-C,curl,src/tool_writeout_json.c,71,FP,ASCII A-Z range check is intentional locale-independent uppercase; curl targets ASCII.,curl_full_audit_0.4.35,high
STR09-C,curl,src/tool_writeout_json.c,71,FP,"ASCII Z range check; intentional, curl assumes ASCII.",curl_full_audit_0.4.35,high
DCL13-C,curl,src/tool_writeout_json.c,84,FP,stream is a FILE* written to via fputc/fputs; cannot be const.,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_writeout_json.c,119,FP,Internal tool fn; per always valid from caller.,curl_full_audit_0.4.35,med
DCL13-C,curl,src/tool_writeout_json.c,119,FP,"per->curl read via curl_easy_nextheader; struct accessed, signature convention.",curl_full_audit_0.4.35,high
EXP34-C,curl,src/tool_writeout_json.c,127,FP,while((header=...)!=NULL) loop guard guarantees header non-NULL inside body.,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_ntlm_core.h,33,FP,[adv] SHORTPAIR(x) does evaluate x twice; function-like macro multiple-evaluation is a genuine style hazard.,curl_full_audit_0.4.35,adversarial-flip
PRE02-C,curl,lib/curl_ntlm_core.h,33,FP,"Replacement is a comma-separated arg list, not an expression; wrapping in parens would break call sites.",curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ntlm_core.h,33,FP,[adv] x evaluated multiple times; advisory but technically correct for SHORTPAIR.,curl_full_audit_0.4.35,adversarial-flip
PRE00-C,curl,lib/curl_ntlm_core.h,34,FP,[adv] LONGQUARTET(x) evaluates x four times; multiple-evaluation style hazard.,curl_full_audit_0.4.35,adversarial-flip
PRE02-C,curl,lib/curl_ntlm_core.h,34,FP,Comma-separated argument-list macro; parenthesizing whole list would break call sites.,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/curl_ntlm_core.h,34,FP,[adv] x evaluated four times; advisory multiple-evaluation correct.,curl_full_audit_0.4.35,adversarial-flip
API05-C,curl,lib/curl_ntlm_core.h,53,FP,Conformant-array-syntax advisory; curl never uses C99 array params.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_ntlm_core.h,54,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_ntlm_core.h,55,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_ntlm_core.h,56,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.h,94,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.h,104,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.h,112,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.h,125,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.h,134,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.h,135,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.h,146,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.h,147,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/dynhds.h,168,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API02-C,curl,lib/dynhds.h,180,FP,"pcount is out-count for an allocated nva array, not an input buffer needing a size param.",curl_full_audit_0.4.35,high
ARR30-C,curl,lib/strequal.c,37,FP,"Loop bounded by NUL terminator (*first); standard C-string iteration, not unbounded.",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/strequal.c,37,FP,casecompare only called when s1/s2 non-NULL (guarded in curl_strequal).,curl_full_audit_0.4.35,high
API05-C,curl,lib/strequal.c,51,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/strequal.c,51,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
ARR30-C,curl,lib/strequal.c,53,FP,Loop bounded by *first && max; bounded by both NUL and counter.,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/strequal.c,53,FP,ncasecompare only called when s1/s2 non-NULL (guarded in curl_strnequal).,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/strequal.c,76,FP,curl_strequal is a public libcurl API (curl/easy.h); requires external linkage.,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/strequal.c,87,FP,curl_strnequal is a public libcurl API; requires external linkage.,curl_full_audit_0.4.35,high
API05-C,curl,lib/strequal.c,87,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/strequal.c,87,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/transfer.h,26,FP,[adv] Curl_headersep(x) evaluates x twice; function-like macro multiple-evaluation style hazard.,curl_full_audit_0.4.35,adversarial-flip
PRE12-C,curl,lib/transfer.h,26,FP,[adv] x evaluated twice; advisory multiple-evaluation correct.,curl_full_audit_0.4.35,adversarial-flip
API05-C,curl,lib/transfer.h,29,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API02-C,curl,lib/transfer.h,37,FP,"char **url is an out-param for a single string pointer, not a sized array.",curl_full_audit_0.4.35,high
API05-C,curl,lib/transfer.h,53,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/transfer.h,65,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API02-C,curl,lib/transfer.h,117,FP,"buf has explicit blen size param; pnwritten is an out-count, not the buffer.",curl_full_audit_0.4.35,high
API05-C,curl,lib/transfer.h,118,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API02-C,curl,lib/transfer.h,126,FP,"buf has explicit blen size param; pnrcvd is an out-count, not the buffer.",curl_full_audit_0.4.35,high
API05-C,curl,lib/transfer.h,127,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_getpass.c,56,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_getpass.c,56,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
INT13-C,curl,src/tool_getpass.c,72,FP,"sts&1 tests VMS condition success bit; idiomatic VMS status check, not a real bitwise hazard.",curl_full_audit_0.4.35,med
INT13-C,curl,src/tool_getpass.c,78,FP,"VMS status low-bit success test; idiomatic, not a bitwise sign hazard.",curl_full_audit_0.4.35,med
API00-C,curl,src/tool_getpass.c,89,FP,buflen only passed to read(); no arithmetic overflow risk; no validation needed.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_getpass.c,89,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_getpass.c,89,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_getpass.c,164,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,src/tool_getpass.c,165,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_getpass.c,170,FP,fd closed at line 190 curlx_close(fd) when fd != STDIN_FILENO; stdin fallback not opened.,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_msgs.c,43,FP,"prefix is const char*; strlen(prefix) used, no signed-char-to-int sign-extension actually occurs here.",curl_full_audit_0.4.35,med
INT00-C,curl,src/tool_msgs.c,44,FP,Subtraction guarded by ternary termw > prefw before computing termw - prefw.,curl_full_audit_0.4.35,high
INT30-C,curl,src/tool_msgs.c,44,FP,Guarded by termw > prefw ternary; underflow impossible.,curl_full_audit_0.4.35,high
INT30-C,curl,src/tool_msgs.c,52,FP,"Reached only when len > width, so width < len <= 1023, width >= 1; width-1 cannot wrap.",curl_full_audit_0.4.35,high
ARR30-C,curl,src/tool_msgs.c,54,FP,cut = width-1 < len <= 1023 in this branch; ptr[cut] within buffer[1024].,curl_full_audit_0.4.35,high
INT30-C,curl,src/tool_msgs.c,60,FP,Same branch where width >= 1 (width < len); width-1 cannot wrap.,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_msgs.c,79,FP,notef declared in tool_msgs.h and used across tool sources; needs external linkage.,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_msgs.c,93,FP,warnf is widely used across tool sources; needs external linkage.,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_msgs.c,107,FP,helpf used across tool sources; needs external linkage.,curl_full_audit_0.4.35,high
DCL15-C,curl,src/tool_msgs.c,129,FP,errorf used across tool sources; needs external linkage.,curl_full_audit_0.4.35,high
DCL37-C,curl,src/tool_vms.c,36,FP,"__status is the VMS decc$ runtime prototype param name; fixed by external ABI, not curl's to rename.",curl_full_audit_0.4.35,high
DCL37-C,curl,src/tool_vms.c,37,FP,"VMS runtime decc$exit prototype param name; external ABI, cannot rename.",curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_vms.c,39,FP,vms_shell is a single-threaded init-cache flag in CLI tool; no thread concurrency.,curl_full_audit_0.4.35,high
ENV34-C,curl,src/tool_vms.c,53,FP,getenv result strcmp'd immediately and not stored beyond the call; value consumed at once.,curl_full_audit_0.4.35,med
CON34-C,curl,src/tool_vms.c,53,FP,CLI tool single-threaded; getenv static-storage thread concern inapplicable.,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_vms.c,128,FP,Array sized by NULL-terminated initializer list; implicit bound is intentional and correct.,curl_full_audit_0.4.35,high
CON03-C,curl,src/tool_vms.c,141,FP,decc_init_done set once by LIB$INITIALIZE before main; not concurrent.,curl_full_audit_0.4.35,high
CON02-C,curl,src/tool_vms.c,141,FP,"Init-once flag set by VMS LIB$INITIALIZE, not used for inter-thread sync.",curl_full_audit_0.4.35,high
WIN04-C,curl,src/tool_vms.c,200,FP,"x_decc_init is a VMS LIB$INITIALIZE PSECT entry; EncodePointer is a Windows API, inapplicable.",curl_full_audit_0.4.35,high
DCL20-C,curl,src/tool_vms.c,200,FP,Function-pointer typedef for LIB$INITIALIZE callback ABI; () form is intentional VMS shim.,curl_full_audit_0.4.35,med
API02-C,curl,lib/curlx/base64.h,27,FP,"insize is the size param; outlen is an out-count for allocated output, not an unsized input.",curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.h,27,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.h,28,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API02-C,curl,lib/curlx/base64.h,29,FP,"insize is the size param; outlen is an out-count, not an unsized buffer.",curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.h,29,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.h,30,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API02-C,curl,lib/curlx/base64.h,31,FP,"src is NUL-terminated string; outlen is an out-count, not an unsized input array.",curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.h,31,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/base64.h,32,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
STR31-C,curl,lib/curlx/inet_pton.c,73,FP,Loop bounded by NUL terminator and validates each octet; not unbounded copy.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/inet_pton.c,73,FP,ch is int from *src++ but only used as digit/'.'; sign-extension irrelevant after ISDIGIT.,curl_full_audit_0.4.35,med
STR34-C,curl,lib/curlx/inet_pton.c,73,FP,"Same site; ch validated via ISDIGIT/'.', no harmful sign extension.",curl_full_audit_0.4.35,med
ARR30-C,curl,lib/curlx/inet_pton.c,132,FP,Loop bounded by NUL; tp writes guarded by tp+INT16SZ > endp checks against tmp[16].,curl_full_audit_0.4.35,high
STR31-C,curl,lib/curlx/inet_pton.c,132,FP,Bounds-checked against endp before each write; not an unbounded copy.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/curlx/inet_pton.c,132,FP,"ch validated via ISXDIGIT/':'/'.', no harmful sign extension.",curl_full_audit_0.4.35,med
STR34-C,curl,lib/curlx/inet_pton.c,132,FP,"Same site; ch consumed by classifiers, sign extension harmless.",curl_full_audit_0.4.35,med
MEM33-C,curl,lib/curlx/inet_pton.c,181,FP,Byte-by-byte shift of fixed unsigned char tmp[16]; no flexible-array struct assignment occurs.,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curlx/inet_pton.c,181,FP,endp/colonp/tp all point into the same tmp[16] array; subtraction well-defined.,curl_full_audit_0.4.35,high
API00-C,curl,lib/curlx/strdup.c,43,FP,Thin _wcsdup helper; caller contract guarantees non-NULL src; categorical API00 helper FP.,curl_full_audit_0.4.35,med
API05-C,curl,lib/curlx/strdup.c,64,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/curlx/strdup.c,66,FP,curlx_malloc is a macro/decl from curl memory headers; declared before use.,curl_full_audit_0.4.35,high
STR31-C,curl,lib/curlx/strdup.c,70,FP,"memdup copies exactly length bytes of arbitrary data, not a NUL-terminated string.",curl_full_audit_0.4.35,high
API05-C,curl,lib/curlx/strdup.c,85,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
DCL31-C,curl,lib/curlx/strdup.c,87,FP,curlx_malloc macro/decl from curl memory headers; declared before use.,curl_full_audit_0.4.35,high
STR31-C,curl,lib/curlx/strdup.c,92,FP,memdup0 copies length bytes then explicitly adds buf[length]=0; terminator handled.,curl_full_audit_0.4.35,high
EXP34-C,curl,lib/curlx/strdup.c,92,FP,memcpy guarded by if(length) and DEBUGASSERT(src); src non-NULL when length>0.,curl_full_audit_0.4.35,high
ARR00-C,curl,lib/curlx/strdup.c,95,FP,"buf is a malloc'd heap pointer returned to caller, not a local array.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/dict.c,79,FP,ch = *ptr only compared to small literals; no widening sign-extension hazard.,curl_full_audit_0.4.35,med
EXP34-C,curl,lib/dict.c,161,FP,path set by Curl_urldecode which returns early on error; path non-NULL on success.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/dict.c,166,FP,"Writing (char)0 to *database++; this is a store, not a sign-extending read.",curl_full_audit_0.4.35,high
STR34-C,curl,lib/dict.c,169,FP,Store of (char)0 to *strategy++; not a widening read.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/dict.c,172,FP,Store of (char)0 to *nthdef; not a widening read.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/dict.c,213,FP,Store of (char)0 to *database++; not a widening read.,curl_full_audit_0.4.35,high
STR34-C,curl,lib/dict.c,216,FP,Store of (char)0 to *nthdef; not a widening read.,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/dict.c,303,FP,Curl_scheme_dict is referenced from the global scheme table in other files; needs external linkage.,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/dict.c,303,FP,Scheme table entry referenced across translation units; cannot be file-local.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/llist.c,34,FP,verifynode returns n as non-const; adding const to param would conflict with return type.,curl_full_audit_0.4.35,high
PRE01-C,curl,lib/llist.c,40,FP,"VERIFYNODE(x) expands to bare x (identity); parenthesizing identity macro is needless, no precedence risk.",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/llist.c,168,FP,"Returns ptr = e->_ptr (caller's stored heap data), not address of a local variable.",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/llist.c,175,FP,Curl_node_uremove is UNITTEST-exported and called by Curl_node_remove; external linkage intended.,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/llist.c,175,FP,UNITTEST symbol referenced by unit tests in other TUs; cannot be static.,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/llist.c,196,FP,"Curl_llist_destroy mutates list via Curl_node_uremove (shrinks list); list is modified, not const.",curl_full_audit_0.4.35,high
API00-C,curl,lib/llist.c,234,FP,"Curl_node_elem guards n with DEBUGASSERT(n); internal API, callers pass valid nodes.",curl_full_audit_0.4.35,high
EXP34-C,curl,lib/llist.c,237,FP,n asserted non-NULL by contract; internal list API never called with NULL node.,curl_full_audit_0.4.35,med
API00-C,curl,lib/llist.c,254,FP,Curl_node_prev (UNITTESTS only) asserts n; internal API contract guarantees non-NULL.,curl_full_audit_0.4.35,high
API05-C,curl,lib/multiif.h,92,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API02-C,curl,lib/multiif.h,91,FP,"pbuflen is the out-size; borrow returns buffer+length, no missing size arg.",curl_full_audit_0.4.35,high
API02-C,curl,lib/multiif.h,98,FP,release takes the previously-borrowed buf back by identity; no size param needed.,curl_full_audit_0.4.35,high
API02-C,curl,lib/multiif.h,115,FP,pbuflen is the out-size for borrowed buffer; no missing size arg.,curl_full_audit_0.4.35,high
API05-C,curl,lib/multiif.h,116,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API02-C,curl,lib/multiif.h,123,FP,release returns borrowed buf by identity; no size param needed.,curl_full_audit_0.4.35,high
API02-C,curl,lib/multiif.h,140,FP,"pbuf is char** out-pointer; borrow returns buffer, size handled internally.",curl_full_audit_0.4.35,high
API05-C,curl,lib/multiif.h,141,FP,Conformant-array-syntax advisory; categorical FP.,curl_full_audit_0.4.35,high
API02-C,curl,lib/multiif.h,147,FP,release returns borrowed buf by identity; no size param needed.,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/cleartext.c,50,FP,authzid NULL-checked at line 58; SASL internal callers pass valid creds,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/cleartext.c,50,FP,"authcid passed by internal SASL code, never user-NULL; advisory only",curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/cleartext.c,50,FP,"passwd internal SASL param, not externally NULL; advisory",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/cleartext.c,58,FP,"line 58 is strlen() call, no char-to-int sign-extension conversion present",curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/cleartext.c,58,FP,strlen on authzid; no signed-char widening; misparse,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/cleartext.c,59,FP,strlen(authcid); no signed-char integer conversion,curl_full_audit_0.4.35,high
STR34-C,curl,lib/vauth/cleartext.c,60,FP,strlen(passwd); no signed-char integer conversion,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/cleartext.c,89,FP,"thin wrapper; value passed to strlen by internal caller, never NULL",curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/cleartext.c,107,FP,"thin wrapper to login_message; internal caller, no external NULL",curl_full_audit_0.4.35,high
DCL40-C,curl,lib/vauth/vauth.h,67,FP,two decls under #ifndef/#else USE_WINDOWS_SSPI; only one compiled,curl_full_audit_0.4.35,high
API02-C,curl,lib/vauth/vauth.h,109,FP,"outptr/outlen are output pointer pairs, not arrays needing size",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/vauth.h,110,FP,conformant-array advisory; curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/vauth.h,111,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/vauth.h,112,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/vauth.h,113,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/vauth.h,115,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API02-C,curl,lib/vauth/vauth.h,341,FP,"outptr/outlen output pointer pair, not sized array",curl_full_audit_0.4.35,high
API05-C,curl,lib/vauth/vauth.h,342,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/vtls/vtls.h,53,FP,"ECH_ENABLED arg is simple pointer lvalue; double eval harmless, no side effects",curl_full_audit_0.4.35,high
PRE01-C,curl,lib/vtls/vtls.h,53,FP,param only used with -> member access; no precedence risk,curl_full_audit_0.4.35,low
PRE12-C,curl,lib/vtls/vtls.h,53,FP,multiple eval of side-effect-free pointer lvalue; benign idiom,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.h,164,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.h,173,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.h,173,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.h,182,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.h,185,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls.h,186,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API02-C,curl,lib/vtls/vtls_scache.h,64,FP,"ppeer_key is char** output, not sized input array",curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.h,146,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.h,147,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.h,153,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.h,154,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.h,156,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.h,203,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.h,204,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/vtls/vtls_scache.h,205,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/hmac.c,55,FP,"sizeof(*ctxt) does not dereference; ctxt only sized, then malloc'd",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/hmac.c,59,FP,"ctxt is heap pointer from curlx_malloc, not stack local",curl_full_audit_0.4.35,high
DCL30-C,curl,lib/hmac.c,94,FP,"returns heap-allocated ctxt pointer, automatic storage misclassification",curl_full_audit_0.4.35,high
MSC07-C,curl,lib/hmac.c,96,FP,"line 96 is the 'fail:' label reachable via goto, not unreachable",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/hmac.c,101,FP,ctxt's pointed-to hash contexts are mutated via hupdate; const wrong,curl_full_audit_0.4.35,high
API05-C,curl,lib/hmac.c,145,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/hmac.c,146,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/hmac.c,147,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip4.c,70,FP,thin resolver wrapper; hostname always non-NULL from internal callers,curl_full_audit_0.4.35,high
API00-C,curl,lib/hostip4.c,97,FP,"hostname internal, passed to gethostbyname; never user-NULL",curl_full_audit_0.4.35,high
DCL00-C,curl,lib/hostip4.c,106,FP,h is reassigned by gethostbyname_r/gethostbyname; not const-able,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/hostip4.c,146,FP,"(char*)buf + sizeof(struct hostent) is correct byte arithmetic, not double-scaled",curl_full_audit_0.4.35,high
ARR39-C,curl,lib/hostip4.c,165,FP,char* pointer plus sizeof is byte offset; not double scaling,curl_full_audit_0.4.35,high
ARR39-C,curl,lib/hostip4.c,232,FP,char* plus sizeof(struct hostent) correct byte offset for buffer layout,curl_full_audit_0.4.35,high
CON34-C,curl,lib/hostip4.c,265,TP,gethostbyname() fallback genuinely uses shared static storage; non-threadsafe path,curl_full_audit_0.4.35,low
MEM30-C,curl,lib/hostip4.c,274,FP,free at 256 and 274 are mutually-exclusive branches; not double-free,curl_full_audit_0.4.35,high
INT33-C,curl,lib/ratelimit.c,55,FP,"step_us init to CURL_US_PER_SEC, only reassigned nonzero; never zero",curl_full_audit_0.4.35,high
INT33-C,curl,lib/ratelimit.c,56,FP,step_us always nonzero (init + DEBUGASSERT); modulo safe,curl_full_audit_0.4.35,high
INT33-C,curl,lib/ratelimit.c,59,FP,elapsed_steps>=1: guard at line50 ensures elapsed_us>=step_us,curl_full_audit_0.4.35,high
INT10-C,curl,lib/ratelimit.c,136,FP,msteps>=1000 positive int64 in this branch; modulo always positive,curl_full_audit_0.4.35,high
INT33-C,curl,lib/ratelimit.c,137,FP,branch entered only when msteps>=1000 so msteps/1000>=1; nonzero,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/ratelimit.c,178,TP,"Curl_rlimit_per_step only reads r->rate_per_step; could be const, not vtable",curl_full_audit_0.4.35,low
DCL13-C,curl,lib/ratelimit.c,183,TP,Curl_rlimit_active only reads r fields; could be const,curl_full_audit_0.4.35,low
DCL13-C,curl,lib/ratelimit.c,188,TP,Curl_rlimit_is_blocked only reads r->blocked; could be const,curl_full_audit_0.4.35,low
ARR01-C,curl,lib/sigpipe.h,38,FP,"sizeof(*ig) is struct size for memset, correct; ig is single-object pointer",curl_full_audit_0.4.35,high
DCL13-C,curl,lib/sigpipe.h,47,TP,sigpipe_ignore only reads data->set.no_signal; could be const Curl_easy*,curl_full_audit_0.4.35,low
SIG00-C,curl,lib/sigpipe.h,56,FP,"setting SIG_IGN for SIGPIPE; sa_mask irrelevant for ignore, no handler",curl_full_audit_0.4.35,high
SIG02-C,curl,lib/sigpipe.h,56,FP,"ignoring SIGPIPE is the canonical correct use, not normal-functionality signaling",curl_full_audit_0.4.35,high
SIG00-C,curl,lib/sigpipe.h,64,FP,applying SIG_IGN action; sa_mask not relevant when ignoring,curl_full_audit_0.4.35,high
SIG02-C,curl,lib/sigpipe.h,64,FP,"SIGPIPE ignore/restore, correct usage",curl_full_audit_0.4.35,high
SIG00-C,curl,lib/sigpipe.h,77,FP,restoring previous SIGPIPE disposition; no handler/masking concern,curl_full_audit_0.4.35,high
SIG02-C,curl,lib/sigpipe.h,77,FP,restore of saved SIGPIPE action; correct,curl_full_audit_0.4.35,high
API02-C,curl,lib/url.h,46,FP,userp is char** output; login+len already provide bounds,curl_full_audit_0.4.35,high
API02-C,curl,lib/url.h,46,FP,"passwdp is char** output param, not a sized input array",curl_full_audit_0.4.35,high
API02-C,curl,lib/url.h,46,FP,optionsp is char** output param; size param already present (len),curl_full_audit_0.4.35,high
API05-C,curl,lib/url.h,46,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/url.h,47,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/url.h,47,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/url.h,48,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/url.h,77,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.h,37,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.h,40,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.h,58,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.h,60,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.h,62,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.h,63,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/http2.h,63,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
DCL00-C,curl,src/terminal.c,44,FP,width reassigned at lines 50/81/84; not const-able,curl_full_audit_0.4.35,high
ENV30-C,curl,src/terminal.c,49,FP,"p points into curl_getenv strdup'd copy; str_number advances ptr, no env mutation",curl_full_audit_0.4.35,high
EXP33-C,curl,src/terminal.c,49,FP,"num read only after str_number succeeds (short-circuit), which initializes it",curl_full_audit_0.4.35,high
ENV30-C,curl,src/terminal.c,51,FP,"colp is malloc'd by curl_getenv; freeing it is correct, not env buffer",curl_full_audit_0.4.35,high
DCL00-C,curl,src/terminal.c,55,FP,cols reassigned at lines 60/64/76/81; not const-able,curl_full_audit_0.4.35,high
DCL39-C,curl,src/terminal.c,59,FP,"ioctl fills ts from kernel (read into struct), no userspace padding leak out",curl_full_audit_0.4.35,high
DCL39-C,curl,src/terminal.c,63,FP,ioctl TIOCGWINSZ reads window size into ts; not a leak across trust boundary,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_stderr.c,34,FP,"stderr is a global FILE*, not stack-allocated; no escape",curl_full_audit_0.4.35,high
EXP20-C,curl,src/tool_stderr.c,44,FP,!strcmp idiom for filename equality; idiomatic curl style,curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_stderr.c,45,FP,"stdout is global FILE*, not stack memory",curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_stderr.c,61,FP,freopen returns stderr stream itself; not a leaked separate fp,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_stderr.c,61,FP,fp aliases stderr after freopen; closing program stream not required,curl_full_audit_0.4.35,high
MEM12-C,curl,src/tool_stderr.c,65,FP,"fp is stderr; nothing leaked, freopen reuses existing stream",curl_full_audit_0.4.35,high
MEM30-C,curl,src/tool_stderr.c,68,FP,"stderr is global FILE*, not stack memory",curl_full_audit_0.4.35,high
ARR02-C,curl,lib/arpa_telnet.h,45,FP,"telnetoptions[] sized by initializer; valid C, advisory only",curl_full_audit_0.4.35,high
PRE01-C,curl,lib/arpa_telnet.h,57,FP,CURL_TELOPT(x) uses x as array index; no precedence risk in practice,curl_full_audit_0.4.35,low
ARR02-C,curl,lib/arpa_telnet.h,87,FP,"telnetcmds[] sized by initializer; valid C, advisory only",curl_full_audit_0.4.35,high
PRE00-C,curl,lib/arpa_telnet.h,103,FP,"CURL_TELCMD_OK bounds-check macro, side-effect-free args; benign double eval",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/arpa_telnet.h,103,FP,x cast and compared twice but no side effects; idiomatic,curl_full_audit_0.4.35,high
PRE02-C,curl,lib/arpa_telnet.h,108,FP,"replacement is array subscript postfix expr; already self-contained, no wrap needed",curl_full_audit_0.4.35,med
DCL31-C,curl,lib/cf-haproxy.c,57,FP,curlx_free declared in curlx header included transitively; sqc macro/header blind,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/cf-haproxy.c,205,FP,cf_haproxy_adjust_pollset is cftype vtable fn; signature fixed by function pointer,curl_full_audit_0.4.35,high
EXP33-C,curl,lib/cf-haproxy.c,212,FP,ctx assigned from curlx_calloc before use; allocator opaque to sqc,curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-haproxy.c,231,FP,"cf_at passed onward, data unused; thin insert wrapper, internal callers",curl_full_audit_0.4.35,high
API00-C,curl,lib/cf-haproxy.c,231,FP,data param unused (void); no deref to validate,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/cf-haproxy.c,231,FP,function ends with explicit 'return result' on all paths,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/curl_gethostname.c,44,FP,all #ifdef branches return (-1/0/err/1); no fallthrough end,curl_full_audit_0.4.35,high
ERR33-C,curl,lib/curl_gethostname.c,60,FP,getenv result checked via if(force_hostname) at line 61,curl_full_audit_0.4.35,high
CON34-C,curl,lib/curl_gethostname.c,60,FP,"DEBUGBUILD-only test hook; value copied immediately, read-only",curl_full_audit_0.4.35,med
EXP05-C,curl,lib/curl_gethostname.c,77,FP,name is 'char* const' not const-data; char*->uchar* not casting away const,curl_full_audit_0.4.35,high
STR30-C,curl,lib/curl_gethostname.c,92,FP,"dot points into caller's writable name buffer, not a string literal",curl_full_audit_0.4.35,high
STR34-C,curl,lib/curl_gethostname.c,92,FP,assigning '\0' to *dot; no char-to-larger-int sign extension,curl_full_audit_0.4.35,high
DCL23-C,curl,lib/curl_rtmp.h,27,FP,Curl_scheme_rtmpt distinct scheme handler names; trailing-char diff is intentional,curl_full_audit_0.4.35,high
DCL23-C,curl,lib/curl_rtmp.h,28,FP,rtmpe distinct RTMP variant handler; intentional naming,curl_full_audit_0.4.35,high
DCL23-C,curl,lib/curl_rtmp.h,29,FP,rtmpte distinct variant; intentional,curl_full_audit_0.4.35,high
DCL23-C,curl,lib/curl_rtmp.h,30,FP,rtmps distinct variant; intentional,curl_full_audit_0.4.35,high
DCL23-C,curl,lib/curl_rtmp.h,31,FP,rtmpts distinct variant; intentional,curl_full_audit_0.4.35,high
API05-C,curl,lib/curl_rtmp.h,33,FP,conformant-array advisory; pointer param convention,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_share.h,37,FP,"GOOD_SHARE_HANDLE validation macro, side-effect-free arg; benign",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_share.h,37,FP,x compared twice but no side effects; idiomatic guard,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_share.h,39,FP,"flag-test macro, side-effect-free arg",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_share.h,39,FP,s evaluated twice but harmless; idiomatic,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/curl_share.h,73,FP,"member-access macro, side-effect-free arg",curl_full_audit_0.4.35,high
PRE12-C,curl,lib/curl_share.h,73,FP,data evaluated twice but no side effects; benign,curl_full_audit_0.4.35,high
ERR02-C,curl,lib/curlx/warnless.h,44,FP,"ssize_t return on type-conversion helper; advisory style, not an error/data mix bug",curl_full_audit_0.4.35,high
ERR02-C,curl,lib/curlx/warnless.h,48,FP,ssize_t param on conversion helper; advisory style only,curl_full_audit_0.4.35,high
API02-C,curl,lib/curlx/warnless.h,64,FP,"size_t* is a scalar out-param, not an array needing capacity",curl_full_audit_0.4.35,high
ERR02-C,curl,lib/curlx/warnless.h,64,FP,ssize_t input to conversion helper; advisory style,curl_full_audit_0.4.35,high
API02-C,curl,lib/curlx/warnless.h,68,FP,"size_t* scalar out-param, not an array",curl_full_audit_0.4.35,high
API02-C,curl,lib/curlx/warnless.h,72,FP,"size_t* scalar out-param, not an array",curl_full_audit_0.4.35,high
DCL15-C,curl,lib/getenv.c,26,FP,curl_getenv is public exported API (curl.h); cannot be static,curl_full_audit_0.4.35,high
MEM30-C,curl,lib/getenv.c,26,FP,realloc size rc is never 0 in loop; on NULL old buf freed once then return,curl_full_audit_0.4.35,high
MSC37-C,curl,lib/getenv.c,26,FP,Every branch returns; infinite for-loop only exits via return statements,curl_full_audit_0.4.35,high
ENV34-C,curl,lib/getenv.c,66,FP,"getenv result immediately strdup'd, not stored long-term",curl_full_audit_0.4.35,high
ERR33-C,curl,lib/getenv.c,66,FP,NULL handled: (env && env[0]) ? strdup : NULL,curl_full_audit_0.4.35,high
CON34-C,curl,lib/getenv.c,66,FP,"getenv result copied immediately; advisory thread note, not a defect here",curl_full_audit_0.4.35,med
DCL13-C,curl,lib/gopher.c,40,FP,gopher_connect signature fixed by Curl_handler vtable typedef; const impossible,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/gopher.c,40,FP,done is bool* output param of fixed vtable callback signature,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/gopher.c,219,FP,Curl_scheme_gopher referenced externally in scheme table; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/gopher.c,219,FP,Externally-referenced scheme descriptor; file scope is required,curl_full_audit_0.4.35,high
DCL15-C,curl,lib/gopher.c,232,FP,Curl_scheme_gophers referenced externally; needs external linkage,curl_full_audit_0.4.35,high
DCL19-C,curl,lib/gopher.c,232,FP,Externally-referenced scheme descriptor; file scope required,curl_full_audit_0.4.35,high
PRE00-C,curl,lib/pingpong.h,73,FP,"do-while assignment macro; pp used only as assignment target, no side-effect callers",curl_full_audit_0.4.35,med
PRE01-C,curl,lib/pingpong.h,73,FP,"s is a complete RHS identifier; parenthesizing changes nothing, no precedence risk",curl_full_audit_0.4.35,med
PRE01-C,curl,lib/pingpong.h,73,FP,e is a complete RHS identifier; no precedence risk,curl_full_audit_0.4.35,med
PRE12-C,curl,lib/pingpong.h,73,FP,"pp assignment-target only; callers pass plain &pp addresses, no double-eval defect",curl_full_audit_0.4.35,med
API02-C,curl,lib/pingpong.h,130,FP,"size_t* is scalar out-param for response size, not an array",curl_full_audit_0.4.35,high
API05-C,curl,lib/pingpong.h,133,FP,Advisory conformant-array style; curl never uses C99 array-param syntax,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/setup-win32.h,92,FP,Defining Windows SDK _WIN32_WINNT_* under #ifndef shim; required platform macro,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/setup-win32.h,95,FP,Windows SDK macro shim guarded by #ifndef; intentional,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/setup-win32.h,98,FP,Windows SDK macro shim; intentional platform compatibility define,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/setup-win32.h,101,FP,Windows SDK macro shim; intentional,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/setup-win32.h,104,FP,Windows SDK macro shim; intentional,curl_full_audit_0.4.35,high
DCL37-C,curl,lib/setup-win32.h,107,FP,Windows SDK macro shim; intentional,curl_full_audit_0.4.35,high
API02-C,curl,lib/strcase.h,35,FP,n size param already present; rule misreads dest as unsized array,curl_full_audit_0.4.35,high
API05-C,curl,lib/strcase.h,35,FP,Advisory conformant-array style; not curl convention,curl_full_audit_0.4.35,high
API05-C,curl,lib/strcase.h,35,FP,Advisory conformant-array style on src param,curl_full_audit_0.4.35,high
API02-C,curl,lib/strcase.h,36,FP,n size param present; advisory misfire,curl_full_audit_0.4.35,high
API05-C,curl,lib/strcase.h,36,FP,Advisory conformant-array style,curl_full_audit_0.4.35,high
API05-C,curl,lib/strcase.h,36,FP,Advisory conformant-array style on src param,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/krb5_gssapi.c,76,FP,Internal auth API; data always valid from caller; siblings unchecked too,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/krb5_gssapi.c,76,FP,krb5 supplied by internal SASL machinery; never NULL,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/krb5_gssapi.c,179,FP,krb5 internal in/out struct always valid from caller,curl_full_audit_0.4.35,high
DCL13-C,curl,lib/vauth/krb5_gssapi.c,182,FP,"krb5->context passed to gss_unwrap; struct logically in/out, curl avoids const here",curl_full_audit_0.4.35,med
DCL00-C,curl,lib/vauth/krb5_gssapi.c,196,FP,max_size IS modified later (lines 246/260-262); cannot be const,curl_full_audit_0.4.35,high
API00-C,curl,lib/vauth/krb5_gssapi.c,305,FP,cleanup called internally with valid krb5; gss_release_* handles members,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_dirhie.c,87,FP,outfile always a valid path from caller; strlen would crash but contract guarantees non-NULL,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_dirhie.c,90,FP,outfile is char* passed to strlen; no char-to-int sign extension occurs,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_dirhie.c,97,FP,outfile is pointer arg to strspn; no signed-char promotion,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_dirhie.c,98,FP,*outfile used as loop truthiness/index; no widening sign-extension defect,curl_full_audit_0.4.35,high
STR34-C,curl,src/tool_dirhie.c,98,FP,outfile pointer arithmetic; not a signed-char conversion,curl_full_audit_0.4.35,high
DCL18-C,curl,src/tool_dirhie.c,123,FP,0000750 is intentional octal file mode for mkdir; correct usage,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_easysrc.c,44,FP,"Advisory; NULL-terminated string array, implicit bounds idiomatic",curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_easysrc.c,60,FP,Advisory; NULL-terminated string array,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_easysrc.c,67,FP,Advisory; NULL-terminated string array,curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_easysrc.c,100,FP,"*plist = list stores heap slist into out-param, not address of local",curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_easysrc.c,179,FP,out fclosed at line 228 when fopened; stdout intentionally not closed,curl_full_audit_0.4.35,high
FIO42-C,curl,src/tool_easysrc.c,179,FP,Duplicate of fopen finding; out is closed when opened,curl_full_audit_0.4.35,high
ARR02-C,curl,src/tool_xattr.c,34,FP,"Advisory; NULL-terminated mapping table, implicit bounds idiomatic",curl_full_audit_0.4.35,high
DCL30-C,curl,src/tool_xattr.c,70,FP,nurl is heap buffer from curl_url_get; returning it is correct (documented free),curl_full_audit_0.4.35,high
CON34-C,curl,src/tool_xattr.c,84,FP,"DEBUGBUILD-only test hook getenv; advisory thread note, not a defect",curl_full_audit_0.4.35,med
ERR02-C,curl,src/tool_xattr.c,95,FP,ssize_t from extattr_set_fd checked rc<0; advisory style only,curl_full_audit_0.4.35,high
API00-C,curl,src/tool_xattr.c,108,FP,curl handle valid from tool_operate; getinfo NULL-checks internally,curl_full_audit_0.4.35,high
INT32-C,curl,src/tool_xattr.c,119,FP,i indexes 3-element mappings[] bounded by NULL terminator; cannot near INT_MAX,curl_full_audit_0.4.35,high
MEM31-C,curl,lib/vtls/vtls_spack.c,277,FN,"Duplicate ALPN/TICKET/QUICTP tag overwrites s->alpn/sdata/quic_tp (each memdup0-allocated); destroy frees only last copy, first leaks on untrusted decode.",curl_full_audit_0.4.35,med
FIO42-C,curl,src/tool_doswin.c,869,FN,socket_r created after tdata=NULL; cleanup sclose guarded by '&& tdata' so connect/shutdown/SetStdHandle failure leaks socket_r. Windows-only.,curl_full_audit_0.4.35,low
MEM31-C,curl,src/var.c,309,FN,"When funcp set, varfunc populates buf; null-byte detection returns PARAM_EXPAND_ERROR before curlx_dyn_free(&buf) at 314. buf leaks. Tool-side, requires expanded value with embedded NUL.",curl_full_audit_0.4.35,low
EXP34-C,curl,src/tool_setopt.c,438,FN,c_escape returns NULL on OOM; TOOLMIME cases pass escaped to easysrc_addf %s without guard (libcurl_generate_slist guards). NULL-to-%s on OOM. CSV upstream_present False corrected to True (present in curl-main).,curl_full_audit_0.4.35,low
INT30-C,curl,lib/vtls/x509asn1.c,982,FN,"Unsigned wrap on span<2 yields garbage 'len', but it only feeds an infof log and an snprintf into an adequately sized local buffer. No memory access; cosmetic only.",curl_full_audit_0.4.35,low