# tidy baseline -- maintained by staticGate.sh (see its header)
# format: <count> <normalized key>, each preceded by its
# justification: # FP: <reason> | # THIRDPARTY: <reason> | # UNTRIAGED

# FP: shellAssocNormalize(extension, out) gets the typed text then the output buffer, its parameter order; only the names differ
1 src/apps/kpunch/cpanel/cpTypes.c|readability-suspicious-call-argument|1st argument 'typed' (passed to 'extension') looks like it might be swapped with the 2nd, 'ext' (passed to 'out')
# FP: buildProcs walks the same symbol list twice; the path counts procedures on the first walk and then assumes the second finds none before reading procs[j], but j < procCount only reaches entries the loop already wrote
1 src/apps/kpunch/dvxbasic/compiler/compiler.c|clang-analyzer-core.UndefinedBinaryOperatorResult|The left operand of '>' is a garbage value
# FP: basGenTemp: arrlen(NULL) is 0, so (*pool)[tempUsed] runs only when tempUsed < 0, and tempUsed only counts up from 0 per statement
1 src/apps/kpunch/dvxbasic/compiler/gen.c|clang-analyzer-core.NullDereference|Array access results in a null pointer dereference
# FP: COLOR / WIDTH / PALETTE each take their own named argument count (BAS_COLOR_ARGS, BAS_WIDTH_ARGS, BAS_PALETTE_ARGS) that happen to be 3; merging the cases would tie three statements' arities together
1 src/apps/kpunch/dvxbasic/compiler/opcodes.h|bugprone-branch-clone|switch has 3 consecutive identical branches
# FP: WGT_DYN_ACCESS is libdvx's non-NULL sentinel for a BASIC-implemented property / method accessor ((void *)(uintptr_t)1); it is compared, never dereferenced
3 src/apps/kpunch/dvxbasic/formrt/formCtl.c|performance-no-int-to-ptr|integer to pointer cast pessimizes optimization opportunities
# FP: column / BAS_PRINT_ZONE_WIDTH is the print-zone index; integer division is the rule (the next zone starts at a whole zone)
1 src/apps/kpunch/dvxbasic/formrt/formGfx.c|bugprone-integer-division|result of integer division used in a floating point context; possible loss of precision
# FP: count * scaleX * bpp is one scaled screen row (at most the window width times 4 bytes), far from int32 overflow; size_t is 32-bit on the i386 target anyway
1 src/apps/kpunch/dvxbasic/formrt/formGfx.c|bugprone-misplaced-widening-cast|either cast from 'int32_t' (aka 'int') to 'size_t' (aka 'unsigned long') is ineffective, or there is loss of precision before the conversion
# FP: rawResult is BasNativeWordT (uintptr_t), the native call's pointer-sized return register; a STRING-returning DECLARE LIBRARY function returns a char * in it
2 src/apps/kpunch/dvxbasic/formrt/formrt.c|performance-no-int-to-ptr|integer to pointer cast pessimizes optimization opportunities
# FP: frmMenuPropText: the path assumes text = mi->name is NULL, but the address of an array member is never NULL, so mi is not NULL
1 src/apps/kpunch/dvxbasic/formrt/frmModel.c|clang-analyzer-core.NullDereference|Access to field 'level' results in a dereference of a null pointer (loaded from variable 'mi')
# FP: frmModelReparent refuses a new parent inside ctrl: frmModelIsDescendant(m, parent, ctrl) asks whether parent descends from ancestor ctrl, the intended order
1 src/apps/kpunch/dvxbasic/formrt/frmModel.c|readability-suspicious-call-argument|2nd argument 'parent' (passed to 'ctrl') looks like it might be swapped with the 3rd, 'ctrl' (passed to 'ancestor')
# FP: the project tree keeps a file index (or -1 for group rows) in the widget's void *userData, the only per-item slot the tree widget offers; it is cast back, never dereferenced
3 src/apps/kpunch/dvxbasic/ide/ideProject.c|performance-no-int-to-ptr|integer to pointer cast pessimizes optimization opportunities
# FP: validateNewName(newValue, max, oldName): the new name is the one validated and oldName the one excepted from the in-use check; the order is right
2 src/apps/kpunch/dvxbasic/ide/ideProperties.c|readability-suspicious-call-argument|1st argument 'newValue' (passed to 'name') looks like it might be swapped with the 3rd, 'oldName' (passed to 'exceptName')
# FP: a toolbox button keeps its tool index in void *userData (the widget's only per-item slot); cast back, never dereferenced
1 src/apps/kpunch/dvxbasic/ide/ideToolbox.c|performance-no-int-to-ptr|integer to pointer cast pessimizes optimization opportunities
# FP: pixel math: basGfxHome takes the centre pixel (integer) of the viewport and clipLine pads the view by half the pen width rounded down plus one pixel; both are meant to be whole pixels
3 src/apps/kpunch/dvxbasic/runtime/gfx.c|bugprone-integer-division|result of integer division used in a floating point context; possible loss of precision
# FP: text-viewport cells (at most 80 x 60) and a span x1 - x0 + 1 clipped to the framebuffer width: no int32 overflow possible
2 src/apps/kpunch/dvxbasic/runtime/screen.c|bugprone-misplaced-widening-cast|either cast from 'int' to 'size_t' (aka 'unsigned long') is ineffective, or there is loss of precision before the conversion
# FP: rows * cols of the text page: rows and cols come from the SCREEN / WIDTH mode table (at most 80 x 60), far from int32 overflow; size_t is 32-bit on the i386 target
2 src/apps/kpunch/dvxbasic/runtime/screen.c|bugprone-misplaced-widening-cast|either cast from 'int32_t' (aka 'int') to 'size_t' (aka 'unsigned long') is ineffective, or there is loss of precision before the conversion
# FP: stringFind: last - i + 1 with start <= i <= last, both within a string length (< INT32_MAX), cannot overflow before the size_t cast
1 src/apps/kpunch/dvxbasic/runtime/vm.c|bugprone-misplaced-widening-cast|either cast from 'int' to 'size_t' (aka 'unsigned long') is ineffective, or there is loss of precision before the conversion
# FP: the BASIC SHELL statement runs a command line by definition (QBasic / VB SHELL)
1 src/apps/kpunch/dvxbasic/runtime/vm.c|cert-env33-c|calling 'system' uses a command processor
# FP: BASIC RND: QBasic-compatible pseudo-random numbers, not a security use
1 src/apps/kpunch/dvxbasic/runtime/vm.c|cert-msc30-c,cert-msc50-cpp|rand() has limited randomness
# FP: BASIC RANDOMIZE seeds RND from the given or timer value as QBasic does; predictable sequences are the documented behaviour
1 src/apps/kpunch/dvxbasic/runtime/vm.c|cert-msc32-c,cert-msc51-cpp|random number generator seeded with a disallowed source of seed value will generate a predictable sequence of values
# FP: TypeOf: the path assumes objectClass's &classes[classIdx] is NULL (the address of an element of an allocated table with classIdx < classCount never is) and then that classes[i].name is NULL
1 src/apps/kpunch/dvxbasic/runtime/vm.c|clang-analyzer-core.NonNullParamChecker|Null pointer passed to 1st parameter expecting 'nonnull'
# FP: gcFind: a non-zero hash slot holds idx + 1 of a node gcAdd wrote before entering it, and gcGrow re-enters only indices < count of the realloc-kept nodes; the path forgets realloc keeps the contents
1 src/apps/kpunch/dvxbasic/runtime/vm.c|clang-analyzer-core.UndefinedBinaryOperatorResult|The left operand of '==' is a garbage value
# FP: onMenu switches on the CMD_* ids this app put in its menu; no other id can arrive and none needs handling
1 src/apps/kpunch/dvxhelp/dvxhelp.c|bugprone-switch-missing-default-case|switching on non-enum value without default case may not cover all cases
# FP: TOPIC_TO_USERDATA keeps topic index + 1 in the tree item's userData on purpose (NULL marks a section header)
1 src/apps/kpunch/dvxhelp/dvxhelp.c|performance-no-int-to-ptr|integer to pointer cast pessimizes optimization opportunities
# FP: the hotkey's slot index is passed as dvxRegisterHotkey's user pointer on purpose
1 src/apps/kpunch/progman/progman.c|performance-no-int-to-ptr|integer to pointer cast pessimizes optimization opportunities
# FP: the two PkgDiskDamagedE branches are different failures tested in order (unreadable header first, failed seek only after the set and disk checks); merging them would seek before the checks
1 src/installer/pkgRead.c|bugprone-branch-clone|repeated branch body in conditional chain
# FP: audioLockSpan computes the address hull of the lock items in uintptr_t and hands its start back to platformLockRegion as a pointer, by design
2 src/libs/kpunch/audio/audioMix.c|performance-no-int-to-ptr|integer to pointer cast pessimizes optimization opportunities
# FP: the allocation (newObject / calloc) is the last test of a guard chain, made only after the cheap checks pass; parenthesized and negated on purpose
2 src/libs/kpunch/dvxnet/netProto.c|bugprone-assignment-in-if-condition|an assignment within an 'if' condition is bug-prone
# FP: protoBufferSize returns TCP_SND_BUF or TCP_WND, two separate lwIP options that happen to be equal in this lwipopts.h
1 src/libs/kpunch/dvxnet/netProto.c|bugprone-branch-clone|conditional operator with identical true and false expressions
# FP: lwIP's tcp_pcb starts with the IP_PCB members; reaching them through struct ip_pcb is lwIP's own idiom for the shared socket options
1 src/libs/kpunch/dvxnet/netProto.c|bugprone-casting-through-void|do not cast 'struct tcp_pcb *' to 'struct ip_pcb *' through 'void *'
# FP: lwIP's udp_pcb starts with the IP_PCB members; reaching them through struct ip_pcb is lwIP's own idiom for the shared socket options
1 src/libs/kpunch/dvxnet/netProto.c|bugprone-casting-through-void|do not cast 'struct udp_pcb *' to 'struct ip_pcb *' through 'void *'
# FP: the resolver slot index is dns_gethostbyname's callback argument on purpose
1 src/libs/kpunch/dvxnet/netProto.c|performance-no-int-to-ptr|integer to pointer cast pessimizes optimization opportunities
# FP: both strcpy calls follow a strlen check against the destination size (ENAMETOOLONG / ENOSPC returned otherwise)
2 src/libs/kpunch/dvxnet/netResolve.c|clang-analyzer-security.insecureAPI.strcpy|Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119
# FP: name is cut to sizeof(name) - sizeof(suffix) before the strcat and the suffix is shorter than its buffer, so it always fits
1 src/libs/kpunch/dvxshell/pmModel.c|clang-analyzer-security.insecureAPI.strcpy|Call to function 'strcat' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcat'. CWE-119
# FP: allocSlot and findLoadedPath scan from slot 1; every slot past 0 is a ShellAppT allocSlot itself calloc'd and appended only when non-NULL
2 src/libs/kpunch/dvxshell/shellApp.c|clang-analyzer-core.NullDereference|Access to field 'state' results in a dereference of a null pointer
# FP: the app id is passed as the task argument on purpose
1 src/libs/kpunch/dvxshell/shellApp.c|performance-no-int-to-ptr|integer to pointer cast pessimizes optimization opportunities
# FP: the BASIC hotkey id is passed as dvxRegisterHotkey's user pointer on purpose
1 src/libs/kpunch/dvxshell/shellBas.c|performance-no-int-to-ptr|integer to pointer cast pessimizes optimization opportunities
# FP: platformAltScanToChar returns 0 or an ASCII letter or digit from its table, never a negative char
1 src/libs/kpunch/libdvx/dvxApp.c|bugprone-signed-char-misuse,cert-str34-c|'signed char' to 'int32_t' (aka 'int') conversion; consider casting to 'unsigned char' first.
# FP: executeSysMenuCmd switches on the SysMenu*E ids openSysMenu put in the menu; handleMouseButton leaves the other HIT_* parts (none, border) without action on purpose
2 src/libs/kpunch/libdvx/dvxApp.c|bugprone-switch-missing-default-case|switching on non-enum value without default case may not cover all cases
# FP: the message box button id is kept in the button's userData on purpose
1 src/libs/kpunch/libdvx/dvxDialog.c|performance-no-int-to-ptr|integer to pointer cast pessimizes optimization opportunities
# FP: realpath(resolved, canon): the path to resolve, then the output buffer, which is realpath's parameter order
1 src/libs/kpunch/libdvx/dvxDialog.c|readability-suspicious-call-argument|1st argument 'resolved' (passed to '__name') looks like it might be swapped with the 2nd, 'canon' (passed to '__resolved')
# FP: GNU ld --wrap=abort (HOST_APP_LDFLAGS) requires exactly the name __wrap_abort
1 src/libs/kpunch/libdvx/platform/dvxPlatformHost.c|bugprone-reserved-identifier,cert-dcl37-c,cert-dcl51-cpp|declaration uses identifier '__wrap_abort', which is a reserved identifier
# FP: GNU ld --wrap=exit (HOST_APP_LDFLAGS) requires exactly the name __wrap_exit
1 src/libs/kpunch/libdvx/platform/dvxPlatformHost.c|bugprone-reserved-identifier,cert-dcl37-c,cert-dcl51-cpp|declaration uses identifier '__wrap_exit', which is a reserved identifier
# FP: platformVideoExclusiveCapture's signature is the platform interface; the DOS layer writes out, the host stub has nothing to write
1 src/libs/kpunch/libdvx/platform/dvxPlatformHost.c|readability-non-const-parameter|pointer parameter 'out' can be pointer to const
# FP: platformMkdirRecursive returns -1 when strlen(path) >= sizeof(buf), the test right before the strcpy
1 src/libs/kpunch/libdvx/platform/dvxPlatformUtil.c|clang-analyzer-security.insecureAPI.strcpy|Call to function 'strcpy' is insecure as it does not provide bounding of the memory buffer. Replace unbounded copy functions with analogous functions that support length arguments such as 'strlcpy'. CWE-119
# FP: callStatic runs only for a signature found in the signature table (an unknown one returns false first) and WGT_SIG_DYNAMIC is dispatched before it; every table signature has a case
1 src/libs/kpunch/libdvx/widgetIface.c|bugprone-switch-missing-default-case|switching on non-enum value without default case may not cover all cases
# FP: the dummy return address is written at the aligned stack top, which is computed as an integer on purpose
1 src/libs/kpunch/libtasks/taskswitch.c|performance-no-int-to-ptr|integer to pointer cast pessimizes optimization opportunities
# FP: sVibrato is a signed int8_t table of pitch steps (-2..2); the sign is meant
1 src/libs/kpunch/music/musicSynth.c|bugprone-signed-char-misuse,cert-str34-c|'signed char' to 'int32_t' (aka 'int') conversion; consider casting to 'unsigned char' first.
# FP: outLine builds a length-delimited line (margin, text, CR LF) that outBytes writes with its length; no NUL is wanted
1 src/libs/kpunch/print/printText.c|bugprone-not-null-terminated-result|the result from calling 'memcpy' is not null-terminated
# FP: the frame-type switch drops unknown types from the wire on purpose, and rxState only ever holds RX_STATE_HUNT, ACTIVE or ESCAPE, each with a case
2 src/libs/kpunch/serial/packet/packet.c|bugprone-switch-missing-default-case|switching on non-enum value without default case may not cover all cases
# FP: the COM port number is the packet stream's context pointer on purpose
1 src/libs/kpunch/serial/packet/packet.c|performance-no-int-to-ptr|integer to pointer cast pessimizes optimization opportunities
# FP: destroyLink runs only when depth returns to 0; secLinkHandshake holds depth >= 1 around its secLinkHandshakeStep calls (enterCall / leaveCall always pair, depth starts at 0), so the inner leaveCall never frees
1 src/libs/kpunch/serial/seclink/secLink.c|clang-analyzer-unix.Malloc|Use of memory after it is freed
# FP: the result buffer is allocated as the last test of the guard, only after the argument checks pass; parenthesized and negated on purpose
4 src/libs/kpunch/serial/security/secBas.c|bugprone-assignment-in-if-condition|an assignment within an 'if' condition is bug-prone
# FP: a link record is 'target NUL display' and addRecord gets its length; the target copy includes its NUL, the display text needs none
1 src/tools/dvxhlpc.c|bugprone-not-null-terminated-result|the result from calling 'memcpy' is not null-terminated
# FP: _POSIX_C_SOURCE is the POSIX feature-test macro; the program must define it before any include
1 src/tools/dvxhlpc.c|bugprone-reserved-identifier,cert-dcl37-c,cert-dcl51-cpp|declaration uses identifier '_POSIX_C_SOURCE', which is a reserved identifier
# FP: sTelState only holds the eight TS_* states and each has a case
1 src/tools/proxy/proxy.c|bugprone-switch-missing-default-case|switching on non-enum value without default case may not cover all cases
# FP: parseState only holds PARSE_NORMAL, PARSE_ESC or PARSE_CSI, each with a case
1 src/widgets/kpunch/ansiTerm/widgetAnsiTerm.c|bugprone-switch-missing-default-case|switching on non-enum value without default case may not cover all cases
# FP: the bullet is copied without its NUL and the payload copy right after includes its NUL (pLen + 1)
1 src/widgets/kpunch/helpView/widgetHelpView.c|bugprone-not-null-terminated-result|the result from calling 'memcpy' is not null-terminated
# FP: record types the viewer does not draw (newer or unknown ones in the file) are skipped on purpose
1 src/widgets/kpunch/helpView/widgetHelpView.c|bugprone-switch-missing-default-case|switching on non-enum value without default case may not cover all cases
# FP: the loop stops at sAlignNames' NULL sentinel (index 3), so a is 0..2, the three ListViewAlignE values
1 src/widgets/kpunch/listView/widgetListView.c|clang-analyzer-optin.core.EnumCastOutOfRange|The value '3' provided to the cast expression is not in the valid range of values for the enum
# FP: count > resolvedColCap with count 0 needs a negative capacity; it starts at 0 and only grows to a count
1 src/widgets/kpunch/listView/widgetListView.c|clang-analyzer-optin.portability.UnixAPI|Call to 'realloc' has an allocation size of 0 bytes
# FP: the getLayoutMetrics class-method signature is shared by every box class; the classes that have these metrics write them, this one leaves them unset
1 src/widgets/kpunch/scrollPane/widgetScrollPane.c|readability-non-const-parameter|pointer parameter 'borderW' can be pointer to const
# FP: the getLayoutMetrics class-method signature is shared by every box class; the classes that have these metrics write them, this one leaves them unset
1 src/widgets/kpunch/scrollPane/widgetScrollPane.c|readability-non-const-parameter|pointer parameter 'extraTop' can be pointer to const
# FP: the getLayoutMetrics class-method signature is shared by every box class; the classes that have these metrics write them, this one leaves them unset
1 src/widgets/kpunch/statusBar/widgetStatusBar.c|readability-non-const-parameter|pointer parameter 'borderW' can be pointer to const
# FP: the getLayoutMetrics class-method signature is shared by every box class; the classes that have these metrics write them, this one leaves them unset
1 src/widgets/kpunch/statusBar/widgetStatusBar.c|readability-non-const-parameter|pointer parameter 'extraTop' can be pointer to const
# FP: NULL reaches memcpy only for a negative length: colorize is called with colorLen >= 1 (textHelp paint) and textOut gets a line length or hi - lo of a sorted selection; not the null + zero-count pattern
2 src/widgets/kpunch/textInput/widgetTextInput.c|clang-analyzer-core.NonNullParamChecker|Null pointer passed to 1st parameter expecting 'nonnull'
# FP: the getLayoutMetrics class-method signature is shared by every box class; the classes that have these metrics write them, this one leaves them unset
1 src/widgets/kpunch/toolbar/widgetToolbar.c|readability-non-const-parameter|pointer parameter 'borderW' can be pointer to const
# FP: the getLayoutMetrics class-method signature is shared by every box class; the classes that have these metrics write them, this one leaves them unset
1 src/widgets/kpunch/toolbar/widgetToolbar.c|readability-non-const-parameter|pointer parameter 'extraTop' can be pointer to const
# FP: count > indexCap with count 0 needs a negative capacity; it starts at 0 and only grows to a count
1 src/widgets/kpunch/treeView/widgetTreeView.c|clang-analyzer-optin.portability.UnixAPI|Call to 'realloc' has an allocation size of 0 bytes
# FP: treeItemInSubtree(item, candidate) asks whether the drop target lies in the dragged item's subtree: dropTarget is the item, dragItem the candidate
1 src/widgets/kpunch/treeView/widgetTreeView.c|readability-suspicious-call-argument|1st argument 'dropTarget' (passed to 'item') looks like it might be swapped with the 2nd, 'dragItem' (passed to 'candidate')
# FP: the getLayoutMetrics class-method signature is shared by every box class; the classes that have these metrics write them, this one leaves them unset
1 src/widgets/kpunch/wrapBox/widgetWrapBox.c|readability-non-const-parameter|pointer parameter 'borderW' can be pointer to const
# FP: the getLayoutMetrics class-method signature is shared by every box class; the classes that have these metrics write them, this one leaves them unset
1 src/widgets/kpunch/wrapBox/widgetWrapBox.c|readability-non-const-parameter|pointer parameter 'extraTop' can be pointer to const
# FP: the getLayoutMetrics class-method signature is shared by every box class; the classes that have these metrics write them, this one leaves them unset
1 src/widgets/kpunch/wrapBox/widgetWrapBox.c|readability-non-const-parameter|pointer parameter 'gap' can be pointer to const
