[PATCH] maint: avoid warnings from GCC's -fanalyzer

[Pádraig Brady]

* src/env.c (build_argv): Add an assert() to avoid:
  warning: use of NULL 'n' where non-null expected
  [CWE-690] [-Wanalyzer-null-argument]
  note: argument 1 of 'getenv' must be non-null
* src/dd.c (alloc_ibuf): Don't discard the allocated pointer, to avoid:
  [CWE-401] [-Wanalyzer-malloc-leak]
(alloc_obuf): Likewise.
(cleanup): Deallocate the now tracked buffers which
also avoids "possibly lost" warnings from valgrind.
* src/tsort.c (search_item): Add asserts to avoid:
  [CWE-690] [-Wanalyzer-null-dereference]
(record_relation): An assert doesn't suffice here,
so disable the warning for this function.
* src/comm.c: Suppress the following false positive for the whole file:
  [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
* src/chown-core.c: Suppress the following false positive for the file:
  [CWE-415] [-Wanalyzer-double-free]
---
 src/chown-core.c |  5 +++++
 src/comm.c       |  5 +++++
 src/dd.c         | 21 +++++++++++++++------
 src/env.c        |  4 ++--
 src/tsort.c      | 13 +++++++++++--
 5 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/src/chown-core.c b/src/chown-core.c
index f1e37eb26..6c221d287 100644
--- a/src/chown-core.c
+++ b/src/chown-core.c
@@ -16,6 +16,11 @@
 
 /* Extracted from chown.c/chgrp.c and librarified by Jim Meyering.  */
 
+/* GCC 10 gives a false postive warning with -fanalyzer for this.  */
+#if (__GNUC__ == 10 && 0 <= __GNUC_MINOR__) || 10 < __GNUC__
+# pragma GCC diagnostic ignored "-Wanalyzer-double-free"
+#endif
+
 #include <config.h>
 #include <stdio.h>
 #include <sys/types.h>
diff --git a/src/comm.c b/src/comm.c
index 2bf8094bf..826023c34 100644
--- a/src/comm.c
+++ b/src/comm.c
@@ -16,6 +16,11 @@
 
 /* Written by Richard Stallman and David MacKenzie. */
 
+/* GCC 10 gives a false postive warning with -fanalyzer for this.  */
+#if (__GNUC__ == 10 && 0 <= __GNUC_MINOR__) || 10 < __GNUC__
+# pragma GCC diagnostic ignored "-Wanalyzer-use-of-uninitialized-value"
+#endif
+
 #include <config.h>
 
 #include <getopt.h>
diff --git a/src/dd.c b/src/dd.c
index e92fe007c..244bd32ef 100644
--- a/src/dd.c
+++ b/src/dd.c
@@ -244,8 +244,12 @@ static char space_character = ' ';
 
 /* Input buffer. */
 static char *ibuf;
+/* aligned offset into the above.  */
+static char *real_ibuf;
 
 /* Output buffer. */
+static char *real_obuf;
+/* aligned offset into the above.  */
 static char *obuf;
 
 /* Current index into 'obuf'. */
@@ -693,8 +697,8 @@ alloc_ibuf (void)
   if (ibuf)
     return;
 
-  char *real_buf = malloc (input_blocksize + INPUT_BLOCK_SLOP);
-  if (!real_buf)
+  real_ibuf = malloc (input_blocksize + INPUT_BLOCK_SLOP);
+  if (!real_ibuf)
     {
       uintmax_t ibs = input_blocksize;
       char hbuf[LONGEST_HUMAN_READABLE + 1];
@@ -705,9 +709,7 @@ alloc_ibuf (void)
                            human_opts | human_base_1024, 1, 1));
     }
 
-  real_buf += SWAB_ALIGN_OFFSET;       /* allow space for swab */
-
-  ibuf = ptr_align (real_buf, page_size);
+  ibuf = ptr_align (real_ibuf + SWAB_ALIGN_OFFSET, page_size);
 }
 
 /* Ensure output buffer OBUF is allocated/initialized.  */
@@ -721,7 +723,7 @@ alloc_obuf (void)
   if (conversions_mask & C_TWOBUFS)
     {
       /* Page-align the output buffer, too.  */
-      char *real_obuf = malloc (output_blocksize + OUTPUT_BLOCK_SLOP);
+      real_obuf = malloc (output_blocksize + OUTPUT_BLOCK_SLOP);
       if (!real_obuf)
         {
           uintmax_t obs = output_blocksize;
@@ -962,6 +964,13 @@ iclose (int fd)
 static void
 cleanup (void)
 {
+#ifdef lint
+  free (real_ibuf);
+  free (real_obuf);
+  real_ibuf = NULL;
+  real_obuf = NULL;
+#endif
+
   if (iclose (STDIN_FILENO) != 0)
     die (EXIT_FAILURE, errno, _("closing input file %s"), quoteaf 
(input_file));
 
diff --git a/src/env.c b/src/env.c
index cafd511c3..babe5a0d4 100644
--- a/src/env.c
+++ b/src/env.c
@@ -481,10 +481,10 @@ build_argv (const char* str, int extra_argc)
           if (sq)
             break;
 
-          /* Store the ${VARNAME} value. Error checking omitted as
-             the ${VARNAME} was already validated. */
+          /* Store the ${VARNAME} value. */
           {
             char *n = extract_varname (str);
+            assert (n);  /* ${VARNAME} already validated. */
             char *v = getenv (n);
             if (v)
               {
diff --git a/src/tsort.c b/src/tsort.c
index 5d8ec7d18..cff2d3a65 100644
--- a/src/tsort.c
+++ b/src/tsort.c
@@ -143,6 +143,7 @@ search_item (struct item *root, const char *str)
   while (true)
     {
       /* A2. Compare.  */
+      assert (str && p && p->str);
       a = strcmp (str, p->str);
       if (a == 0)
         return p;
@@ -165,7 +166,7 @@ search_item (struct item *root, const char *str)
             p->right = q;
 
           /* A6. Adjust balance factors.  */
-          assert (!STREQ (str, s->str));
+          assert (str && s && s->str && !STREQ (str, s->str));
           if (strcmp (str, s->str) < 0)
             {
               r = p = s->left;
@@ -179,7 +180,7 @@ search_item (struct item *root, const char *str)
 
           while (p != q)
             {
-              assert (!STREQ (str, p->str));
+              assert (str && p && p->str && !STREQ (str, p->str));
               if (strcmp (str, p->str) < 0)
                 {
                   p->balance = -1;
@@ -273,6 +274,12 @@ record_relation (struct item *j, struct item *k)
 {
   struct successor *p;
 
+/* GCC 10 gives a false postive warning with -fanalyzer for this,
+   and an assert did not suppress the warning
+   with the initial GCC 10 release.  */
+#if (__GNUC__ == 10 && 0 <= __GNUC_MINOR__) || 10 < __GNUC__
+# pragma GCC diagnostic push
+# pragma GCC diagnostic ignored "-Wanalyzer-null-dereference"
   if (!STREQ (j->str, k->str))
     {
       k->count++;
@@ -281,6 +288,8 @@ record_relation (struct item *j, struct item *k)
       p->next = j->top;
       j->top = p;
     }
+# pragma GCC diagnostic pop
+#endif
 }
 
 static bool
-- 
2.26.2