ABR : Buffer overflow, array index of 'hwaddr' may be out of bounds. Array 'hwaddr' of size 6 may use index value(s) 6..15 : lwip/src/core/dhcp.c : 1683 : Critical : Analyze INFINITE_LOOP.LOCAL : Infinite loop : lwip/src/api/tcpip.c : 87 : Error : Analyze NPD.CHECK.CALL.MUST : Pointer 'prev' checked for NULL at line 166 will be passed to function and may be dereferenced there by passing argument 2 to function 'ip_reass_dequeue_datagram' at line 203. : lwip/src/core/ipv4/ip_frag.c : 203 : Critical : Analyze NPD.CHECK.MIGHT : Pointer 'netif' checked for NULL at line 321 may be dereferenced at line 342. : lwip/port/ethernetif/ethernetif.c : 342 : Critical : Analyze NPD.CHECK.MIGHT : Pointer 'p_to' checked for NULL at line 873 may be dereferenced at line 845. : lwip/src/core/pbuf.c : 845 : Critical : Analyze NPD.CHECK.MIGHT : Pointer 'to' checked for NULL at line 818 may be dereferenced at line 820. : lwip/src/api/sockets.c : 820 : Critical : Analyze NPD.CHECK.MIGHT : Pointer 'pcb' checked for NULL at line 222 may be dereferenced at line 233. : lwip/src/api/api_msg.c : 233 : Critical : Analyze NPD.CHECK.MIGHT : Pointer 'eth_ret' checked for NULL at line 588 may be dereferenced at line 595. : lwip/src/netif/etharp.c : 595 : Critical : Analyze NPD.CHECK.MIGHT : Pointer 'ip_ret' checked for NULL at line 588 may be dereferenced at line 596. : lwip/src/netif/etharp.c : 596 : Critical : Analyze NPD.CHECK.MUST : Pointer 'p_to' checked for NULL at line 843 will be dereferenced at line 845. : lwip/src/core/pbuf.c : 845 : Critical : Analyze NPD.CHECK.MUST : Pointer 'q' checked for NULL at line 441 will be dereferenced at line 433. Also there is one similar error on line 454. : lwip/src/core/pbuf.c : 433 : Critical : Analyze NPD.CHECK.MUST : Pointer 'p' checked for NULL at line 413 will be dereferenced at line 414. : lwip/src/core/pbuf.c : 414 : Critical : Analyze NPD.CHECK.MUST : Pointer 'p' checked for NULL at line 959 will be dereferenced at line 961. : lwip/src/core/pbuf.c : 961 : Critical : Analyze NPD.CHECK.MUST : Pointer 'pc->custom_free_function' checked for NULL at line 641 will be dereferenced at line 642. : lwip/src/core/pbuf.c : 642 : Critical : Analyze NPD.CHECK.MUST : Pointer 'dhcp' checked for NULL at line 586 will be dereferenced at line 590. : lwip/src/core/dhcp.c : 590 : Critical : Analyze NPD.CHECK.MUST : Pointer 'netif' checked for NULL at line 585 will be dereferenced at line 587. : lwip/src/core/dhcp.c : 587 : Critical : Analyze NPD.CHECK.MUST : Pointer 'netif' checked for NULL at line 604 will be dereferenced at line 606. : lwip/src/core/dhcp.c : 606 : Critical : Analyze NPD.CHECK.MUST : Pointer 'dhcp->msg_out' checked for NULL at line 1733 will be dereferenced at line 1735. : lwip/src/core/dhcp.c : 1735 : Critical : Analyze NPD.CHECK.MUST : Pointer 'inseg.p' checked for NULL at line 1145 will be dereferenced at line 1147. : lwip/src/core/tcp_in.c : 1147 : Critical : Analyze NPD.CHECK.MUST : Pointer 'ipr->p' checked for NULL at line 444 will be dereferenced at line 446. : lwip/src/core/ipv4/ip_frag.c : 446 : Critical : Analyze NPD.CHECK.MUST : Pointer 'pcr' checked for NULL at line 643 will be dereferenced at line 645. : lwip/src/core/ipv4/ip_frag.c : 645 : Critical : Analyze NPD.CHECK.MUST : Pointer 'prev' checked for NULL at line 313 will be dereferenced at line 314. : lwip/src/core/ipv4/ip_frag.c : 314 : Critical : Analyze NPD.CHECK.MUST : Pointer 'sock' checked for NULL at line 1144 will be dereferenced at line 1146. Also there is one similar error on line 1178. : lwip/src/api/sockets.c : 1146 : Critical : Analyze NPD.CHECK.MUST : Pointer 'newconn' checked for NULL at line 342 will be dereferenced at line 344. : lwip/src/api/sockets.c : 344 : Critical : Analyze NPD.CHECK.MUST : Pointer 'data' checked for NULL at line 1650 will be dereferenced at line 1653. : lwip/src/api/sockets.c : 1653 : Critical : Analyze NPD.CHECK.MUST : Pointer 'data' checked for NULL at line 2060 will be dereferenced at line 2063. : lwip/src/api/sockets.c : 2063 : Critical : Analyze NPD.CHECK.MUST : Pointer 'addrlen' checked for NULL at line 359 will be dereferenced at line 366. : lwip/src/api/sockets.c : 366 : Critical : Analyze NPD.CHECK.MUST : Pointer 'p' checked for NULL at line 617 will be dereferenced at line 626. : lwip/src/api/sockets.c : 626 : Critical : Analyze NPD.CHECK.MUST : Pointer 'buf' checked for NULL at line 617 will be dereferenced at line 624. : lwip/src/api/sockets.c : 624 : Critical : Analyze NPD.CHECK.MUST : Pointer 'conn->pcb.tcp' checked for NULL at line 743 will be dereferenced at line 754. Also there is one similar error on line 756. : lwip/src/api/api_msg.c : 754 : Critical : Analyze NPD.CHECK.MUST : Pointer 'conn->pcb.tcp' checked for NULL at line 1208 will be dereferenced at line 1223. : lwip/src/api/api_msg.c : 1223 : Critical : Analyze NPD.CHECK.MUST : Pointer 'conn' checked for NULL at line 156 will be dereferenced at line 158. : lwip/src/api/api_msg.c : 158 : Critical : Analyze NPD.CHECK.MUST : Pointer 'conn' checked for NULL at line 223 will be dereferenced at line 225. : lwip/src/api/api_msg.c : 225 : Critical : Analyze NPD.CHECK.MUST : Pointer 'conn' checked for NULL at line 282 will be dereferenced at line 284. : lwip/src/api/api_msg.c : 284 : Critical : Analyze NPD.CHECK.MUST : Pointer 'conn' checked for NULL at line 318 will be dereferenced at line 320. : lwip/src/api/api_msg.c : 320 : Critical : Analyze NPD.CHECK.MUST : Pointer 'conn' checked for NULL at line 354 will be dereferenced at line 356. : lwip/src/api/api_msg.c : 356 : Critical : Analyze NPD.CHECK.MUST : Pointer 'conn' checked for NULL at line 740 will be dereferenced at line 741. : lwip/src/api/api_msg.c : 741 : Critical : Analyze NPD.CHECK.MUST : Pointer 'conn' checked for NULL at line 1205 will be dereferenced at line 1206. : lwip/src/api/api_msg.c : 1206 : Critical : Analyze NPD.CHECK.MUST : Pointer 'conn->current_msg' checked for NULL at line 395 will be dereferenced at line 396. : lwip/src/api/api_msg.c : 396 : Critical : Analyze NPD.CHECK.MUST : Pointer 'conn->current_msg' checked for NULL at line 744 will be dereferenced at line 746. : lwip/src/api/api_msg.c : 746 : Critical : Analyze NPD.CHECK.MUST : Pointer 'conn->current_msg' checked for NULL at line 1207 will be dereferenced at line 1210. : lwip/src/api/api_msg.c : 1210 : Critical : Analyze NPD.CHECK.MUST : Pointer 'buf' checked for NULL at line 406 will be dereferenced at line 407. : lwip/src/api/api_lib.c : 407 : Critical : Analyze NPD.CHECK.MUST : Pointer 'init' checked for NULL at line 142 will be dereferenced at line 185. : lwip/src/core/netif.c : 185 : Critical : Analyze NPD.FUNC.MIGHT : Pointer 'buf' returned from call to function 'sys_arch_mbox_fetch' at line 371 may be NULL and may be dereferenced at line 407. : lwip/src/api/api_lib.c : 407 : Critical : Analyze NPD.FUNC.MUST : Pointer 'frame.descriptor' returned from call to function 'ETH_RxPkt_ChainMode' at line 236 may be NULL and will be dereferenced at line 257. : lwip/port/ethernetif/ethernetif.c : 257 : Critical : Analyze NPD.FUNC.MUST : Pointer 'q' returned from call to function 'mem_trim' at line 450 may be NULL and will be dereferenced at line 454. : lwip/src/core/pbuf.c : 454 : Critical : Analyze NPD.FUNC.MUST : Pointer 'sock' returned from call to function 'tryget_socket' at line 1143 may be NULL and will be dereferenced at line 1146. Also there is one similar error on line 1178. : lwip/src/api/sockets.c : 1146 : Critical : Analyze NPD.FUNC.MUST : Pointer 'msg' returned from call to function 'sys_timeouts_mbox_fetch' at line 91 may be NULL and will be dereferenced at line 93. : lwip/src/api/tcpip.c : 93 : Critical : Analyze NPD.GEN.CALL.MIGHT : Null pointer 'prev' that comes from line 124 may be passed to function and can be dereferenced there by passing argument 2 to function 'ip_reass_free_complete_datagram' at line 143. : lwip/src/core/ipv4/ip_frag.c : 143 : Critical : Analyze NPD.GEN.CALL.MIGHT : Null pointer 'prev' that comes from line 234 may be passed to function and can be dereferenced there by passing argument 2 to function 'ip_reass_free_complete_datagram' at line 254. : lwip/src/core/ipv4/ip_frag.c : 254 : Critical : Analyze NPD.GEN.CALL.MIGHT : Null pointer 'ipr_prev' that comes from line 484 may be passed to function and can be dereferenced there by passing argument 2 to function 'ip_reass_dequeue_datagram' at line 596. : lwip/src/core/ipv4/ip_frag.c : 596 : Critical : Analyze RNPD.DEREF : Suspicious dereference of pointer 'ipr->p' before NULL check at line 444 : lwip/src/core/ipv4/ip_frag.c : 426 : Critical : Analyze RNPD.DEREF : Suspicious dereference of pointer 'conn->current_msg' before NULL check at line 1207 : lwip/src/api/api_msg.c : 1203 : Critical : Analyze RNPD.DEREF : Suspicious dereference of pointer 'conn' before NULL check at line 165 : lwip/src/api/api_msg.c : 158 : Critical : Analyze RNPD.DEREF : Suspicious dereference of pointer 'conn' before NULL check at line 227 : lwip/src/api/api_msg.c : 225 : Critical : Analyze RNPD.DEREF : Suspicious dereference of pointer 'conn' before NULL check at line 326 : lwip/src/api/api_msg.c : 320 : Critical : Analyze UNINIT.STACK.ARRAY.MIGHT : 'parts' array elements might be used uninitialized in this function. Also there are 2 similar errors on line(s) 233, 240. : lwip/src/core/ipv4/ip_addr.c : 226 : Critical : Analyze UNINIT.STACK.MIGHT : 'naddr.addr' might be used uninitialized in this function. : lwip/src/api/sockets.c : 364 : Critical : Analyze UNINIT.STACK.MIGHT : 'port' might be used uninitialized in this function. : lwip/src/api/sockets.c : 363 : Critical : Analyze UNINIT.STACK.MIGHT : 'port' might be used uninitialized in this function. : lwip/src/api/sockets.c : 674 : Critical : Analyze UNINIT.STACK.MUST : 'naddr.addr' is used uninitialized in this function. : lwip/src/api/sockets.c : 1418 : Critical : Analyze