Home
Examples of errors detected by the V547 diagnostic

Examples of errors detected by the V547 diagnostic

V547. Expression is always true/false.

Shareaza

V547 Expression 'pBytes [ 0 ] == 0xEF' is always false. The value range of signed char type: [-128, 127]. Shareaza remote.cpp 350

V547 Expression 'pBytes [ 1 ] == 0xBB' is always false. The value range of signed char type: [-128, 127]. Shareaza remote.cpp 350

V547 Expression 'pBytes [ 2 ] == 0xBF' is always false. The value range of signed char type: [-128, 127]. Shareaza remote.cpp 350


void CRemote::Output(LPCTSTR pszName)
{

  ...
  CHAR* pBytes = new CHAR[ nBytes ];
  hFile.Read( pBytes, nBytes );
  ...
  if ( nBytes > 3 &&
       pBytes[0] == 0xEF &&
       pBytes[1] == 0xBB &&
       pBytes[2] == 0xBF )
  {
    pBytes += 3;
    nBytes -= 3;
    bBOM = true;
  }
  ...
}

Shareaza

V547 Expression is always false. Unsigned type value is never < 0. BugTrap encoding.cpp 425


size_t UTF16BeDecodeChar(BYTE* pBytes, size_t nNumBytes,
                         TCHAR arrChar[2], size_t& nCharSize)
{
  if (UTF16BeToLeChar(pBytes, nNumBytes) < 0)
  {
    nCharSize = MAXSIZE_T;
    return 0;
  }
  return UTF16LeDecodeChar(pBytes, nNumBytes,
                           arrChar, nCharSize);
}

In case of an error, the UTF16BeToLeChar() function returns MAXSIZE_T. This case will be handled incorrectly.

Shareaza

V547 Expression 'nCharPos >= 0' is always true. Unsigned type value is always >= 0. BugTrap xmlreader.h 946


inline void CXmlReader::CXmlInputStream::UnsafePutCharsBack(
  const TCHAR* pChars, size_t nNumChars)
{
  if (nNumChars > 0)
  {
    for (size_t nCharPos = nNumChars - 1;
         nCharPos >= 0;
         --nCharPos)
      UnsafePutCharBack(pChars[nCharPos]);
  }
}

Infinite loop.

VirtualDub

V547 Expression 'c < 0' is always false. Unsigned type value is never < 0. Ami lexer.cpp 225


typedef unsigned short wint_t;

void lexungetc(wint_t c) {
  if (c < 0)
    return;

  g_backstack.push_back(c);
}

VirtualDub

V547 Expression 'c < 0' is always false. Unsigned type value is never < 0. Ami lexer.cpp 279


typedef unsigned short wint_t;

wint_t lexgetescape() {
  wint_t c = lexgetc();
  if (c < 0)
    fatal("Newline found in escape sequence");
  ...
}

Geocoding with SQL-Server

V547 Expression '* s > 127' is always false. The value range of signed char type: [-128, 127]. Shp2Xml shp2xml.cpp 18


char *chkXml(char *buf) {
 for (char *s = buf; *s; s++)
   if (*s == '&') *s = '/';
   ....
   else if (*s > 127) *s = '~';
 return buf;
}

Ultimate TCP/IP

V547 Expression '( len - indx ) >= 0' is always true. Unsigned type value is always >= 0. UTDns utstrlst.cpp 58


void CUT_StrMethods::RemoveCRLF(LPSTR buf)
{
  // v4.2 changed to size_t
  size_t  len, indx = 1;
  if(buf != NULL){
    len = strlen(buf);
    while((len - indx) >= 0 && indx <= 2) {
      if(buf[len - indx] == '\r' ||
         buf[len - indx] == '\n')
         buf[len - indx] = 0;
      ++indx;
    }
  }
}

This is an example of vulnerability. When processing an empty string, the (len - indx) expression will equal 0xFFFFFFFFu. The value 0xFFFFFFFFu is above 0. An array overrun will occur.

Identical errors can be found in some other places:

V547 Expression '( len - indx ) >= 0' is always true. Unsigned type value is always >= 0. UTDns utstrlst.cpp 75

Ultimate TCP/IP

V547 Expression 'loop >= 0' is always true. Unsigned type value is always >= 0. UTDns utstrlst.cpp 430


void CUT_StrMethods::RemoveSpaces(LPSTR szString) {
  ...
  size_t loop, len = strlen(szString);
  // Remove the trailing spaces
  for(loop = (len-1); loop >= 0; loop--) {
    if(szString[loop] != ' ')
      break;
  }
  ...
}

An example of vulnerability. If a string contains only blanks, an array overrun will occur.

Identical errors can be found in some other places:

V547 Expression 'loop >= 0' is always true. Unsigned type value is always >= 0. UTDns utstrlst.cpp 458

Ultimate TCP/IP

V547 Expression 'buf[t] > 127' is always false. The value range of signed char type: [-128, 127]. UTImap4 utmime.cpp 320


int CUT_MimeEncode::Encode7bit(....)
{
  ...
  char buf[1000];
  ...
  for ( t=0; t<bytesRead; t++ ) {
    if (buf[t]==0 || buf[t]>127) {
      retval = UTE_ENCODING_INVALID_CHAR;
      break;
    }
  ...
}

Ultimate Toolbox

V547 Expression 'lpDrawItemStruct -> itemID >= 0' is always true. Unsigned type value is always >= 0. UT oxautolistbox.cpp 56


void COXAutoListBox::DrawItem(....)
{
  ...
  if (lpDrawItemStruct->itemID>=0)
  {
    ...
  }
  ...
}

Most likely this is what should be written here: (lpDrawItemStruct->itemID != (UINT)(-1))

Ultimate Toolbox

V547 Expression 'lpms -> itemID < 0' is always false. Unsigned type value is never < 0. UT oxcoolcombobox.cpp 476


void COXCoolComboBox::MeasureItem(....)
{
  if(lpms->itemID<0)
    lpms->itemHeight=m_nDefaultFontHeight+1;
  else
    lpms->itemHeight=
      m_nDefaultFontHeightSansLeading+1;
}

Ultimate Toolbox

V547 Expression 'chNewChar >= 128' is always false. The value range of signed char type: [-128, 127]. UT oxmaskededit.cpp 81

V547 Expression 'chNewChar <= 255' is always true. The value range of signed char type: [-128, 127]. UT oxmaskededit.cpp 81


BOOL CMaskData::IsValidInput(TCHAR chNewChar)
{
   ...
  if((chNewChar >= 128) && (chNewChar <= 255))
    bIsValidInput=TRUE ;
  ...
}

Ultimate Toolbox

V547 Expression 'm_nCurrentIndex - nOffset < 0' is always false. Unsigned type value is never < 0. UT oxprocess.cpp 594


int m_nCurrentIndex;
...
BOOL COXProcessIterator::Prev(UINT nOffset)
{
  ...
  if(m_nCurrentIndex-nOffset<0)
    return FALSE;
  ...
}

Since the "m_nCurrentIndex-nOffset" expression has the unsigned type, it can never be below 0.

TortoiseSVN

V547 Expression 'c >= 0x80' is always false. The value range of signed char type: [-128, 127]. pathutils.cpp 559


CString CPathUtils::PathUnescape (const char* path)
{
  // try quick path
  size_t i = 0;
  for (; char c = path[i]; ++i)
    if ((c >= 0x80) || (c == '%'))
    {
      // quick path does not work for
      // non-latin or escaped chars
      std::string utf8Path (path);
      CPathUtils::Unescape (&utf8Path[0]);
      return CUnicodeUtils::UTF8ToUTF16 (utf8Path);
    }
  ...
}

TortoiseSVN

V547 Expression '* utf8CheckBuf == 0xC0' is always false. The value range of signed char type: [-128, 127]. tortoiseblame.cpp 310

V547 Expression '* utf8CheckBuf == 0xC1' is always false. The value range of signed char type: [-128, 127]. tortoiseblame.cpp 311

V547 Expression '* utf8CheckBuf >= 0xF5' is always false. The value range of signed char type: [-128, 127]. tortoiseblame.cpp 312


BOOL TortoiseBlame::OpenFile(const TCHAR *fileName)
{
  ...
  // check each line for illegal utf8 sequences.
  // If one is found, we treat
  // the file as ASCII, otherwise we assume
  // an UTF8 file.
  char * utf8CheckBuf = lineptr;
  while ((bUTF8)&&(*utf8CheckBuf))
  {
    if ((*utf8CheckBuf == 0xC0)||
        (*utf8CheckBuf == 0xC1)||
        (*utf8CheckBuf >= 0xF5))
    {
      bUTF8 = false;
      break;
    }

   ...
  }
  ...
}

TortoiseSVN

V547 Expression 'endRevision < 0' is always false. Unsigned type value is never < 0. cachelogquery.cpp 999


typedef index_t revision_t;
...
void CCacheLogQuery::InternalLog (
   revision_t startRevision
 , revision_t endRevision
 , const CDictionaryBasedTempPath& startPath
 , int limit
 , const CLogOptions& options)
{
  ...
  // we cannot receive logs for rev < 0
  if (endRevision < 0)
    endRevision = 0;

  ...
}

Negative values simply cannot appear here. The endRevision variable has the unsigned type and, therefore, endRevision is always >=0. The potential danger is this: if a negative value was cast to the unsigned type somewhere before, we will be handling a very big number. And there's no check for that.

TraceTool

V547 Expression '(m_socketHandle = socket (2, 1, 0)) < 0' is always false. Unsigned type value is never < 0. Vs8_Win_Lib tracetool.cpp 871


static UINT_PTR m_socketHandle ;

void TTrace::LoopMessages(void)
{
  ...
  // Socket creation
  if ( (m_socketHandle = socket(AF_INET,SOCK_STREAM,0)) < 0)
  {
    continue;
  }
  ...
}

FCEUX

V547 Expression 'x < 0' is always false. Unsigned type value is never < 0. fceux gui.cpp 32

V547 Expression 'y < 0' is always false. Unsigned type value is never < 0. fceux gui.cpp 33


void CenterWindow(HWND hwndDlg)
{
  ...
  unsigned x = ((rectP.right-rectP.left) - width) / 2 +
               rectP.left;
  unsigned y = ((rectP.bottom-rectP.top) - height) / 2 +
               rectP.top;
  ...
  // make sure that the dialog box never moves outside
  // of the screen
  if(x < 0) x = 0;
  if(y < 0) y = 0;
  if(x + width  > screenwidth)  x = screenwidth  - width;
  if(y + height > screenheight) y = screenheight - height;
  ...
}

IPP Samples

V547 Expression '* pTrack >= 0' is always true. Unsigned type value is always >= 0. demuxer umc_stream_parser.cpp 179


typedef signed int     Ipp32s;
typedef unsigned int   Ipp32u;

Ipp32s StreamParser::GetTrackByPidOrCreateNew(Ipp32s iPid,
                                              bool *pIsNew)
{
  ...
  else if (!pIsNew || m_uiTracks >= MAX_TRACK)
    return -1;
  ...
}

Status StreamParser::GetNextData(MediaData *pData,
                                 Ipp32u *pTrack)
{
  ...
  *pTrack = GetTrackByPidOrCreateNew(m_pPacket->iPid, NULL);

  if (*pTrack >= 0 && TRACK_LPCM == m_pInfo[*pTrack]->m_Type)
    ippsSwapBytes_16u_I((Ipp16u *)pData->GetDataPointer(),
                        m_pPacket->uiSize / 2);
  ...
}

IPP Samples

V547 Expression 'memSize < 0' is always false. Unsigned type value is never < 0. vc1_enc umc_vc1_enc_planes.h 200


typedef unsigned int    Ipp32u;

UMC::Status Init(..., Ipp32u memSize, ...)
{
  ...
  memSize -= UMC::align_value<Ipp32u>(m_nFrames*sizeof(Frame));
  if(memSize < 0)
      return UMC::UMC_ERR_NOT_ENOUGH_BUFFER;
  ...
}

Identical errors can be found in some other places:

V547 Expression 'memSize < 0' is always false. Unsigned type value is never < 0. vc1_enc umc_vc1_enc_planes.h 211
V547 Expression 'memSize < 0' is always false. Unsigned type value is never < 0. vc1_enc umc_vc1_enc_planes.h 211
V547 Expression 'memSize < 0' is always false. Unsigned type value is never < 0. vc1_enc umc_vc1_enc_mb.cpp 64
And 6 additional diagnostic messages.

IPP Samples

V547 Expression 'm_iCurrMBIndex - x < 0' is always false. Unsigned type value is never < 0. vc1_enc umc_vc1_enc_mb.cpp 188


Ipp32u m_iCurrMBIndex;

VC1EncoderMBInfo *
VC1EncoderMBs::GetPevMBInfo(Ipp32s x, Ipp32s y)
{
   Ipp32s row = (y>0)? m_iPrevRowIndex:m_iCurrRowIndex;
   return ((m_iCurrMBIndex - x <0 || row <0) ?
          0 :
          &m_MBInfo[row][m_iCurrMBIndex - x]);
}

Since the check doesn't work, we may easily get an array overrun.

DOSBox

V547 Expression is always true. Unsigned type value is always >= 0. dosbox libserial.cpp 155


void SERIAL_getErrorString(char* buffer, int length) {
  ...
  if((length - sysmsg_offset -
      strlen((const char*)sysmessagebuffer)) >= 0)
     memcpy(buffer + sysmsg_offset, sysmessagebuffer,
            strlen((const char*)sysmessagebuffer));
  ...
}

This is an example of unsafe code from the viewpoint of buffer overflows. The strlen() function returns size_t. It means that the check for buffer overflow doesn't work.

Miranda IM

V547 Expression 'newItem >= 0' is always true. Unsigned type value is always >= 0. avs options.cpp 265


INT_PTR CALLBACK DlgProcOptionsProtos(....)
{
  ...
  UINT64 newItem = 0;
  ...
  newItem = ListView_InsertItem(hwndList, &item);
  if(newItem >= 0)
    ListView_SetCheckState(....);
  ...
}

Miranda IM

V547 Expression 'nGroupsCount < 0' is always false. Unsigned type value is never < 0. import mirabilis.c 1416


extern DWORD nMessagesCount;

static void MirabilisImport(HWND hdlgProgressWnd)
{
  ...
  nGroupsCount = ImportGroups();
  if (nGroupsCount < 0) {
    AddMessage( LPGEN("Group import was not completed."));
    nGroupsCount = 0;
  }
  ...
}

Miranda IM

V547 Expression 'wParam >= 0' is always true. Unsigned type value is always >= 0. clist_mw cluiframes.c 3140


typedef UINT_PTR WPARAM;

static int id2pos(int id)
{
  int i;
  if (FramesSysNotStarted) return -1;
  for (i=0;i<nFramescount;i++)
  {
    if (Frames[i].id==id) return(i);
  }
  return(-1);
}

INT_PTR CLUIFrameSetFloat(WPARAM wParam,LPARAM lParam)
{
  ...
  wParam=id2pos(wParam);
  if(wParam>=0&&(int)wParam<nFramescount)
    if (Frames[wParam].floating)
  ...
}

Miranda IM

V547 Expression is always true. Unsigned type value is always >= 0. scriver msgoptions.c 458


WINUSERAPI
UINT
WINAPI
GetDlgItemInt(
    __in HWND hDlg,
    __in int nIDDlgItem,
    __out_opt BOOL *lpTranslated,
    __in BOOL bSigned);

#define SRMSGSET_LIMITNAMESLEN_MIN 0

static INT_PTR CALLBACK DlgProcTabsOptions(....)
{
  ...
  limitLength =
    GetDlgItemInt(hwndDlg, IDC_LIMITNAMESLEN, NULL, TRUE) >=
    SRMSGSET_LIMITNAMESLEN_MIN ?
    GetDlgItemInt(hwndDlg, IDC_LIMITNAMESLEN, NULL, TRUE) :
    SRMSGSET_LIMITNAMESLEN_MIN;
  ...
}

Miranda IM

V547 Expression 'nOldLength < 0' is always false. Unsigned type value is never < 0. IRC mstring.h 229


void Append( PCXSTR pszSrc, int nLength )
{
  ...
  UINT nOldLength = GetLength();
  if (nOldLength < 0)
  {
    // protects from underflow
    nOldLength = 0;
  }
  ...
}

Miranda IM

V547 Expression 'ft->std.currentFileSize < 0' is always false. Unsigned type value is never < 0. jabber jabber_file.cpp 92


typedef struct tagPROTOFILETRANSFERSTATUS
{
  ...
  unsigned __int64 currentFileSize;
  ...
} PROTOFILETRANSFERSTATUS;

//There is this place in the program code:
ft->std.currentFileSize = -1;

void __cdecl CJabberProto::FileReceiveThread(filetransfer* ft)
{
  ...
  if (ft->state==FT_DONE ||
      ( ft->state==FT_RECEIVING && ft->std.currentFileSize < 0 ))
  ...
}

Identical errors can be found in some other places:

V547 Expression 'ft->std.currentFileSize < 0' is always false. Unsigned type value is never < 0. jabber jabber_file.cpp 168

StrongDC++

V547 Expression 'totalsize < 0' is always false. Unsigned type value is never < 0. client queuemanager.cpp 2230


uint64_t QueueManager::FileQueue::getTotalQueueSize(){
  uint64_t totalsize = 0;
  ...
  if(totalsize < 0)
    totalsize = 0;
  ...
}

Chromium

V547 Expression 'current_idle_time < 0' is always false. Unsigned type value is never < 0. browser idle_win.cc 23


IdleState CalculateIdleState(unsigned int idle_threshold) {
  ...
  DWORD current_idle_time = 0;
  ...
  // Will go -ve if we have been idle for
  // a long time (2gb seconds).
  if (current_idle_time < 0)
    current_idle_time = INT_MAX;
  ...
}

Chromium

V547 Expression 'count < 0' is always false. Unsigned type value is never < 0. ncdecode_tablegen ncdecode_tablegen.c 197


static void CharAdvance(char** buffer,
                        size_t* buffer_size,
                        size_t count) {
  if (count < 0) {
    NaClFatal("Unable to advance buffer by count!");
  } else {
  ...
}

ICU

V547 Expression '* string != 0 || * string != '_'' is always true. Probably the '&&' operator should be used here. icui18n ucol_sit.cpp 242


U_CDECL_BEGIN static const char* U_CALLCONV
_processVariableTop(....)
{
  ...
  if(i == locElementCapacity &&
     (*string != 0 || *string != '_')) {
    *status = U_BUFFER_OVERFLOW_ERROR;
  }
  ...
}

Network Security Services (NSS)

V547 Expression 'input.len < 0' is always false. Unsigned type value is never < 0. nss pk11merge.c 491


struct SECItemStr {
  ...
  unsigned int len;
};

static SECStatus
pk11_mergeSecretKey(....)
{
  ...
  if (input.len < 0) {
    rv = SECFailure;
    goto done;
  }
  ...
}

QT

V547 Expression '-- size >= 0' is always true. Unsigned type value is always >= 0. QtCLucene arrays.h 154


bool equals( class1* val1, class2* val2 ) const{
{
  ...
  size_t size = val1->size();
  ...
  while ( --size >= 0 ){
    if ( !comp(*itr1,*itr2) )
      return false;
    itr1++;
    itr2++;
  }
  ...
}

An array overrun may surely occur.

QT

V547 Expression 'q->getQueryName () != L"BooleanQuery"' is always true. To compare strings you should use wcscmp() function. QtCLucene multifieldqueryparser.cpp 44


const TCHAR* getQueryName() const;

Query* MultiFieldQueryParser::parse(....)
{
  ...
  if (q && (q->getQueryName() != _T("BooleanQuery")
  ...
}

Identical errors can be found in some other places:

V547 Expression 'q->getQueryName () != L"BooleanQuery"' is always true. To compare strings you should use wcscmp() function. QtCLucene multifieldqueryparser.cpp 63

MySQL

V547 Expression 'str [0] != 'a' || str [0] != 'A'' is always true. Probably the '&&' operator should be used here. clientlib my_time.c 340


enum enum_mysql_timestamp_type
str_to_datetime(....)
{
  ...
  else if (str[0] != 'a' || str[0] != 'A')
    continue; /* Not AM/PM */
  ...
}

Apache HTTP Server

V547 Expression 'len < 0' is always false. Unsigned type value is never < 0. aprutil apr_memcache.c 814


typedef  size_t      apr_size_t;

APU_DECLARE(apr_status_t) apr_memcache_getp(....)
{
  ...
  apr_size_t len = 0;
  ...
  len = atoi(length);
  ...
  if (len < 0) {
    *new_length = 0;
    *baton = NULL;
  }
  else {
    ...
  }
}

Apache HTTP Server

V547 Expression 'csd < 0' is always false. Unsigned type value is never < 0. libhttpd child.c 404


typedef UINT_PTR SOCKET;

static unsigned int __stdcall win9x_accept(void * dummy)
{
  SOCKET csd;
  ...
  do {
      clen = sizeof(sa_client);
      csd = accept(nsd, (struct sockaddr *) &sa_client, &clen);
  } while (csd < 0 &&
           APR_STATUS_IS_EINTR(apr_get_netos_error()));
  ...
}

Intel AMT SDK

V547 Expression '_username == ""' is always false. To compare strings you should use strcmp() function. Discovery discoverysample.cpp 184


static char* _username = "";
static char* _password = "";
static char* _host = "";
static char* _hostMask = "";

if (((_username == "") && (_password != "")) ||
    ((_username != "") && (_password == "")))

This code is dangerous and incorrect. But sometimes it will work - when the whole code is in one module (one *.obj). The compiler will create only one empty string in memory.

Intel AMT SDK

V547 Expression 'bytesRead < 0' is always false. Unsigned type value is never < 0. RemoteConsole remote.c 173


int ReadFileData(char* fileName, UINT8 data[], size_t size)
{
  size_t fileSize , bytesRead;
  ...
  bytesRead = read(fileno(fileHandle), data, (int) size);

  if (bytesRead < 0)
  {
    printf("Error while Reading file %s : %s",
           fileName, strerror(errno));
    bytesRead = 0;
  }
  ...
}

Intel AMT SDK

V547 Expression 'bytesRead < 0' is always false. Unsigned type value is never < 0. ZTCLocalAgent heciwin.cpp 357


int HECIWin::_doIoctl(....)
{
  DWORD bytesRead = 0;
  ...
  if (bytesRead < 0) {
    Deinit();
  }
  ...
}

TrueCrypt

V547 Expression 'fileDataEndPos < 0' is always false. Unsigned type value is never < 0. Setup selfextract.c 551


BOOL SelfExtractInMemory (char *path)
{
  unsigned int fileDataEndPos = 0;
  ...
  if (fileDataEndPos < 0)
  {
    Error ("CANNOT_READ_FROM_PACKAGE");
    return FALSE;
  }
  ...
}

Identical errors can be found in some other places:

V547 Expression 'fileDataStartPos < 0' is always false. Unsigned type value is never < 0. Setup selfextract.c 560

ReactOS

V547 Expression is always false. Probably the '||' operator should be used here. ws2_32_new sockctrl.c 55


INT
WSAAPI
connect(IN SOCKET s,
        IN CONST struct sockaddr *name,
        IN INT namelen)
{
  ...
  /* Check if error code was due to the host not being found */
  if ((Status == SOCKET_ERROR) &&
      (ErrorCode == WSAEHOSTUNREACH) &&
      (ErrorCode == WSAENETUNREACH))
  {
  ...
}

ReactOS

V547 Expression is always true. Probably the '&&' operator should be used here. win32k arc.c 67


typedef enum _ARCTYPE
{
    GdiTypeArc,
    GdiTypeArcTo,
    GdiTypeChord,
    GdiTypePie,
} ARCTYPE, *PARCTYPE;

BOOL IntArc(....)
{
  ...
  if ((Left == Right) ||
      (Top == Bottom) ||
      (((arctype != GdiTypeArc) ||
        (arctype != GdiTypeArcTo)) &&
       ((Right - Left == 1) ||
       (Bottom - Top == 1))
      )
     )
      return TRUE;
  ...
}

Most likely this is what should be written here: (arctype != GdiTypeArc) && (arctype != GdiTypeArcTo)

ReactOS

V547 Expression 'LeftOfBuffer < 0' is always false. Unsigned type value is never < 0. svchost svchost.c 56


BOOL PrepareService(LPCTSTR ServiceName)
{
  DWORD LeftOfBuffer = sizeof(ServiceKeyBuffer) /
                       sizeof(ServiceKeyBuffer[0]);
  ....
  LeftOfBuffer -= _tcslen(SERVICE_KEY);
  ....
  LeftOfBuffer -= _tcslen(ServiceName);
  ....
  LeftOfBuffer -= _tcslen(PARAMETERS_KEY);
  ....
  if (LeftOfBuffer < 0)
  {
    DPRINT1("Buffer overflow for service name: '%s'\n",
            ServiceName);
    return FALSE;
  }
  ....
}

There are a lot of such fragments in ReactOS, but I cannot say for sure how critical they are.

ReactOS

V547 Expression '(Minor != 0x02) || (Minor != 0x13)' is always true. Probably the '&&' operator should be used here. ramdisk ramdisk.c 1955


#define IRP_MN_REMOVE_DEVICE      0x02
#define IRP_MN_QUERY_ID           0x13

NTSTATUS
RamdiskPnp(IN PDEVICE_OBJECT DeviceObject,
           IN PIRP Irp)
{
  ...
  // Only remove-device and query-id are allowed
  if ((Minor != IRP_MN_REMOVE_DEVICE) ||
      (Minor != IRP_MN_QUERY_ID))
  ...
}

This is what should have been written here: ((Minor == IRP_MN_REMOVE_DEVICE) || (Minor == IRP_MN_QUERY_ID))

Identical errors can be found in some other places:

V547 Expression is always true. Probably the '&&' operator should be used here. ntoskrnl section.c 1685
V547 Expression is always true. Probably the '&&' operator should be used here. fastfat create.c 456

ReactOS

V547 Expression is always false. Unsigned type value is never < 0. opengl32 font.c 1099


BOOL APIENTRY IntUseFontOutlinesW(....)
{
  ...
  if (GetGlyphOutline(hDC, glyphIndex, GGO_NATIVE,
       &glyphMetrics, glyphBufSize, glyphBuf, &matrix) < 0)
  {
    HeapFree(GetProcessHeap(), 0, glyphBuf);
    return FALSE; /*WGL_STATUS_FAILURE*/
  }
  ...
}

Identical errors can be found in some other places:

V547 Expression 'glyphSize < 0' is always false. Unsigned type value is never < 0. opengl32 font.c 1084

ReactOS

V547 Expression 'IntEaLength >= 0' is always true. Unsigned type value is always >= 0. ntoskrnl util.c 220


NTSTATUS
IoCheckEaBufferValidity(....)
{
  ULONG NextEaBufferOffset, IntEaLength;
  ...
  if (IntEaLength >= 0)
  {
    EaBufferEnd = (PFILE_FULL_EA_INFORMATION)
      ((ULONG_PTR)EaBufferEnd +
      EaBufferEnd->NextEntryOffset);
    continue;
  }
}

Identical errors can be found in some other places:

V547 Expression 'IntEaLength >= 0' is always true. Unsigned type value is always >= 0. ntoskrnl util.c 198

ReactOS

V547 Expression 'i < 512' is always true. The value range of unsigned char type: [0, 255]. freeldr_common xboxhw.c 344


static VOID
DetectBiosDisks(....)
{
  UCHAR DiskCount, i;
  ...
  for (i = 0; ! Changed && i < 512; i++)
  {
    Changed = ((PUCHAR)DISKREADBUFFER)[i] != 0xcd;
  }
  ...
}

An infinite loop will occur here if the first 255 bytes contain value 0xcd.

Identical errors can be found in some other places:

V547 Expression 'i < 512' is always true. The value range of unsigned char type: [0, 255]. freeldr_common hardware.c 826

ReactOS

V547 Expression 'ads->tcpsocket >= 0' is always true. Unsigned type value is always >= 0. adns setup.c 683


typedef UINT_PTR SOCKET;

#define ADNS_SOCKET SOCKET

struct adns__state {
  ...
  ADNS_SOCKET udpsocket, tcpsocket;
  ...
};

void adns_finish(adns_state ads) {
  ...
  if (ads->tcpsocket >= 0) adns_socket_close(ads->tcpsocket);
  ...
}

Identical errors can be found in some other places:

V547 Expression 'ads->udpsocket < 0' is always false. Unsigned type value is never < 0. adns setup.c 539
V547 Expression 'fd < 0' is always false. Unsigned type value is never < 0. adns event.c 117

Chromium

V547 Expression is always true. Probably the '&&' operator should be used here. webrtc_vplib interpolator.cc 119


WebRtc_Word32
interpolator::SupportedVideoType(VideoType srcVideoType,
                                 VideoType dstVideoType)
{
  ...
  if ((srcVideoType != kI420) ||
      (srcVideoType != kIYUV) ||
      (srcVideoType != kYV12))
  {
      return -1;
  }
  ...
}

Mozilla Firefox

V547 Expression 'c < 0' is always false. Unsigned type value is never < 0. updater.cpp 1179


int
PatchFile::LoadSourceFile(FILE* ofile)
{
  ...
  size_t c = fread(rb, 1, r, ofile);
  if (c < 0) {
    LOG(("LoadSourceFile: error reading destination file: "
         LOG_S "\n", mFile));
    return READ_ERROR;
  }
  ...
}

Identical errors can be found in some other places:

V547 Expression 'c < 0' is always false. Unsigned type value is never < 0. updater.cpp 2373
V547 Expression 'c < 0' is always false. Unsigned type value is never < 0. bspatch.cpp 107

Mozilla Firefox

V547 Expression is always true. Unsigned type value is always >= 0. exception_handler.cc 846


bool ExceptionHandler::WriteMinidumpForChild(....)
{
  ...
  DWORD last_suspend_cnt = -1;
  ...
  // this thread may have died already, so not opening
  // the handle is a non-fatal error
  if (NULL != child_thread_handle) {
    if (0 <=
        (last_suspend_cnt = SuspendThread(child_thread_handle)))
    {
  ...
}

Most likely this is what should be written here: (((DWORD) -1) != (last_suspend_cnt = SuspendThread(child_thread_handle))).

Identical errors can be found in some other places:

V547 Expression '0 <= last_suspend_cnt' is always true. Unsigned type value is always >= 0. exception_handler.cc 869

Mozilla Firefox

V547 Expression 'index < 0' is always false. Unsigned type value is never < 0. nsieprofilemigrator.cpp 622


PRBool
nsIEProfileMigrator::TestForIE7()
{
  ...
  PRUint32 index = ieVersion.FindChar('.', 0);
  if (index < 0)
    return PR_FALSE;
  ...
}

Notepad++

V547 Expression is always false. Probably the '||' operator should be used here. Notepad++ notepad_plus.cpp 4967


DWORD WINAPI Notepad_plus::threadTextPlayer(void *params)
{
  ...
  const char *text2display = ...;
  ...
  if (text2display[i] == ' ' && text2display[i] == '.')
  ...
}

Identical errors can be found in some other places:

V547 Expression is always false. Probably the '||' operator should be used here. Notepad++ notepad_plus.cpp 5032

ADAPTIVE Communication Environment (ACE)

V547 Expression 'ch != '_' || ch != ':'' is always true. Probably the '&&' operator should be used here. ACEXML_Parser parser.cpp 1905


ACEXML_Char*
ACEXML_Parser::parse_reference_name (void)
{
  ACEXML_Char ch = this->get ();
  if (!this->isLetter (ch) && (ch != '_' || ch != ':'))
    return 0;
  ...
}

WinMerge

V547 Expression 'cchText < 0' is always false. Unsigned type value is never < 0. Merge ccrystaleditview.cpp 1135


BOOL CCrystalEditView::
DoDropText (COleDataObject * pDataObject,
            const CPoint & ptClient)
{
  ...
  UINT cbData = (UINT) ::GlobalSize (hData);
  UINT cchText = cbData / sizeof(TCHAR) - 1;
  if (cchText < 0)
    return FALSE;
  ...
}

BCmenu

V547 Expression 'nLoc >= 0' is always true. Unsigned type value is always >= 0. Merge bcmenu.cpp 1232


BCMenu *BCMenu::FindMenuOption(int nId,UINT& nLoc)
{
  ...
  nLoc = -1;
  ...
}

BOOL BCMenu::ModifyODMenuW(wchar_t *lpstrText,
                           UINT nID, int nIconNormal)
{
  UINT nLoc;
  ...
  BCMenu *psubmenu = FindMenuOption(nID,nLoc);
  ...
  if(psubmenu && nLoc>=0) mdata = psubmenu->m_MenuList[nLoc];
  ...
}

Identical errors can be found in some other places:

V547 Expression 'nLoc >= 0' is always true. Unsigned type value is always >= 0. Merge bcmenu.cpp 1263
V547 Expression 'nLoc >= 0' is always true. Unsigned type value is always >= 0. Merge bcmenu.cpp 1285
V547 Expression 'nLoc >= 0' is always true. Unsigned type value is always >= 0. Merge bcmenu.cpp 1309
And 2 additional diagnostic messages.

WinMerge

V547 Expression 'text.length() >= 0' is always true. Unsigned type value is always >= 0. Merge splash.cpp 262


typedef String std::wstring;

void CSplashWnd::OnPaint()
{
  ...
  String text = LoadResString(IDS_SPLASH_DEVELOPERS);

  // avoid dereference of empty strings and
  // the NULL termiated character
  if (text.length() >= 0)
  {
  ...
}

UCSniff

V547 Expression '* hDecoder < 0' is always false. Unsigned type value is never < 0. g726_decoder.c 11


int initialize_g726_decoder(unsigned long *hDecoder)
{
  *hDecoder = EasyG726_init_decoder();
  if(*hDecoder<0)
   return -1;
  return 0;
}

Identical errors can be found in some other places:

V547 Expression 'currentRTPCall->hDecoderFwd >= 0' is always true. Unsigned type value is always >= 0. ec_siprtp.c 1547
V547 Expression 'currentRTPCall->hDecoderRev >= 0' is always true. Unsigned type value is always >= 0. ec_siprtp.c 1550

DeSmuME

V547 Expression 'name[i] >= 0xF0' is always false. The value range of signed char type: [-128, 127]. DeSmuME_VS2005 directory.cpp 118


static int _FAT_directory_lfnLength (const char* name) {
  ...
  for (i = 0; i < nameLength; i++) {
    if (name[i] < 0x20 || name[i] >= ABOVE_UCS_RANGE) {
      return -1;
    }
  }
  ...
}

This is what should have been written here: (unsigned char)(name[i]) >= ABOVE_UCS_RANGE

DeSmuME

V547 Expression 'remain < 0' is always false. Unsigned type value is never < 0. DeSmuME_VS2005 fatfile.cpp 527


static bool _FAT_check_position_for_next_cluster(....,
 size_t remain, ....)
{
  ...
  if ((remain < 0) ||
      (position->sector > partition->sectorsPerCluster)) {
    // invalid arguments - internal error
    r->_errno = EINVAL;
    goto err;
  }
  ...
}

DeSmuME

V547 Expression '(str[0] != ' ') || (str[0] != '\t')' is always true. Probably the '&&' operator should be used here. DeSmuME_VS2005 xstring.cpp 93


int str_ltrim(char *str, int flags) {
  ...
  while (str[0]) {
    if ((str[0] != ' ') || (str[0] != '\t') ||
        (str[0] != '\r') || (str[0] != '\n'))
      break;
  ...
}

DeSmuME

V547 Expression is always true. Probably the '&&' operator should be used here. DeSmuME_VS2005 xstring.cpp 124


int str_rtrim(char *str, int flags) {
 u32 i=0;

 while (strlen(str)) {
  if ((str[strlen(str)-1] != ' ') ||
   (str[strlen(str)-1] != '\t') ||
   (str[strlen(str)-1] != '\r') ||
   (str[strlen(str)-1] != '\n')) break;
  ...
}

DeSmuME

V547 Expression '(char *) cheatsExport->gametitle != ""' is always true. To compare strings you should use strcmp() function. DeSmuME_VS2005 cheatswin.cpp 1382


class CHEATSEXPORT
{
  ...
  u8 *gametitle;
  ...
}

INT_PTR CALLBACK CheatsExportProc(HWND dialog, UINT msg,
                                  WPARAM wparam, LPARAM lparam)
{
  ...
  if ((char*)cheatsExport->gametitle != "")
  ...
}

Identical errors can be found in some other places:

V547 Expression 'tmp_fat_path != ""' is always true. To compare strings you should use strcmp() function. DeSmuME_VS2005 slot1_config.cpp 56

DeSmuME

V547 Expression 'appliedSize == 'b' && appliedSize == 's'' is always false. Probably the '||' operator should be used here. DeSmuME_VS2005 ram_search.cpp 817

V547 Expression 'appliedSize == 'w' && appliedSize == 's'' is always false. Probably the '||' operator should be used here. DeSmuME_VS2005 ram_search.cpp 819


bool Set_RS_Val()
{
  ...
  if((appliedSize == 'b' && appliedSize == 's' &&
      (rs_param < -128 || rs_param > 127)) ||
     (appliedSize == 'b' && appliedSize != 's' &&
      (rs_param < 0 || rs_param > 255)) ||
     (appliedSize == 'w' && appliedSize == 's' &&
      (rs_param < -32768 || rs_param > 32767)) ||
     (appliedSize == 'w' && appliedSize != 's' &&
      (rs_param < 0 || rs_param > 65535)))
    return false;
  ...
}

DeSmuME

V547 Expression 'info.type != 0xFF || info.type != 0xFE' is always true. Probably the '&&' operator should be used here. DeSmuME_VS2005 mc.cpp 1054


void BackupDevice::loadfile()
{
  ...
  if (info.type != 0xFF || info.type != 0xFE)
  ...
}

MAME

V547 Expression is always true. Probably the '&&' operator should be used here. mpu4.c 934


int m_led_extender;
#define CARD_A   1
#define NO_EXTENDER  0

static WRITE8_DEVICE_HANDLER( pia_ic5_porta_w )
{
  ...
  else if ((state->m_led_extender != CARD_A)||
           (state->m_led_extender != NO_EXTENDER))
  ...
}

Trans-Proteomic Pipeline

V547 Expression 'c != '\\' || c != '/'' is always true. Probably the '&&' operator should be used here. Tandem2XML tandemresultsparser.cxx 787


bool TandemResultsParser::writePepXML(....)
{
  ...
  char c = pathSummary.at(pathSummary.length() - 1);
  if (c != '\\' || c != '/')
  ...
}

This is what should have been written here: if (c != '\\' && c != '/')

Trans-Proteomic Pipeline

V547 Expression 'peptideProphetOpts_.find(" PI ", 0) >= 0' is always true. Unsigned type value is always >= 0. pepXMLViewer pipelineanalysis.cxx 1590


class basic_string
{
  ...
  size_type find(const _Elem *_Ptr, size_type _Off = 0) const
  ...
}

void
PipelineAnalysis::prepareFields(void) {
  ...
  if (peptideProphetOpts_.find(" PI ", 0)>=0) {
    fields_.push_back(Field("PpI_zscore"));
  }
  ...
}

This is what should have been written here: (peptideProphetOpts_.find(" PI ", 0) != string::npos).

Identical errors can be found in some other places:

V547 Expression 'peptideProphetOpts_.find(" RT ", 0) >= 0' is always true. Unsigned type value is always >= 0. pepXMLViewer pipelineanalysis.cxx 1593

Trans-Proteomic Pipeline

V547 Expression 'numAssignedPeaks >= 0' is always true. Unsigned type value is always >= 0. tpplib spectrastreplicates.cpp 642


void SpectraSTReplicates::aggregateStats(....)
{
  ...
  unsigned int numAssignedPeaks =
    (*r)->entry->getPeakList()->getNumAssignedPeaks();
  if (numAssignedPeaks >= 0)
  {
    sumFracAssigned +=
      (double)numAssignedPeaks / (double)numPeaks;
    numAnnotated++;
  }
  ...
}

Identical errors can be found in some other places:

V547 Expression 'pl->getNumAssignedPeaks() >= 0' is always true. Unsigned type value is always >= 0. tpplib spectrastreplicates.cpp 724

Trans-Proteomic Pipeline

V547 Expression 'pos < 0' is always false. Unsigned type value is never < 0. dta2mzXML dta2mzxml.cpp 622


int Dta2mzXML::extractScanNum(const string& dtaFileName)
{
  ...
  std::string::size_type pos = dtaFileName.rfind("/");

  if (pos < 0)  {
    pos = dtaFileName.rfind("\\");
  }
  ...
}

This is what should have been written here: (pos == string::npos).

Identical errors can be found in some other places:

V547 Expression 'pos < 0' is always false. Unsigned type value is never < 0. dta2mzXML dta2mzxml.cpp 626
V547 Expression 'pos < 0' is always false. Unsigned type value is never < 0. dta2mzXML dta2mzxml.cpp 653
V547 Expression 'pos < 0' is always false. Unsigned type value is never < 0. dta2mzXML dta2mzxml.cpp 657

Visualization Toolkit (VTK)

V547 Expression is always true. Probably the '&&' operator should be used here. vtkHybrid vtkmniobjectreader.cxx 161


int vtkMNIObjectReader::CanReadFile(const char* fname)
{
  ...
  if (objType == 'P' || objType != 'L' ||
      objType == 'M' || objType != 'F' ||
      objType == 'X' || objType != 'Q' ||
      objType == 'T')
  ...
}

Visualization Toolkit (VTK)

V547 Expression is always true. Probably the '&&' operator should be used here. vtkIO vtknetcdfcfreader.cxx 838


int vtkNetCDFCFReader::RequestDataObject(....)
{
  if (    (preferredDataType != VTK_IMAGE_DATA)
       || (preferredDataType != VTK_RECTILINEAR_GRID) )
  {
    vtkWarningMacro("You have set the OutputType to a data "
                    "type that cannot fully represent the "
                    "topology of the data. Some of the "
                    "topology will be ignored.");
  }
}

Identical errors can be found in some other places:

V547 Expression is always true. Probably the '&&' operator should be used here. vtkIO vtknetcdfcfreader.cxx 847

MongoDB

V547 Expression 'str::after("abcde", 'x') == ""' is always false. To compare strings you should use strcmp() function. test.cpp 43


inline const char * after(const char *s, char x);
inline string after(const string& s, char x);
inline const char * after(const char *s, const char *x);
inline string after(string s, string x);

inline const char * after(const char *s, char x) {
  const char *p = strchr(s, x);
  return (p != 0) ? p+1 : "";
}

int main() {
{
  ...
  assert( str::after("abcde", 'x') == "" );
  ...
}

MongoDB

V547 Expression 'i >= 0' is always true. Unsigned type value is always >= 0. mmap_win.cpp 90


void* MemoryMappedFile::map(....) {
  ....
  size_t len = strlen( filename );
  for ( size_t i=len-1; i>=0; i-- ) {
    if ( filename[i] == '/' ||
         filename[i] == '\\' )
      break;

    if ( filename[i] == ':' )
         filename[i] = '_';
  }
  ....
}

CamStudio

V547 Expression 'bytesRead < 0' is always false. Unsigned type value is never < 0. soundfile.cpp 166


bool CSoundFile::OpenWaveFile()
{
  ....
  DWORD bytesRead = mmioRead(m_hFile, (LPSTR)&m_Format,
                             m_MMCKInfoChild.cksize);
  if (bytesRead < 0)
  {
    AfxMessageBox("Error reading PCM wave format record");
    mmioClose(m_hFile,0);
    m_Mode = FILE_ERROR;
    return FALSE;
  }
  ....
}

CamStudio

V547 Expression '* p == 0xFE' is always false. The value range of char type: [127, -128]. compile.cpp 527


#define MAGIC_CONTINUE_NUMBER_LO 0xFE
#define MAGIC_CONTINUE_NUMBER_HI 0x7F

/* I can't believe this actually worked */
void bufferResolveJumps(Buffer out)
{
  ....
  if (*p == MAGIC_CONTINUE_NUMBER_LO &&
      *(p+1) == MAGIC_CONTINUE_NUMBER_HI)
  {
  ....
}

You're right not to believe. It doesn't work indeed! :-)

Samba

V547 Expression '(to != CH_UTF16LE) || (to != CH_UTF16BE)' is always true. Probably the '&&' operator should be used here. charcnv.c 188


static size_t convert_string_internal(....)
{
  ....
    if (((from == CH_UTF16LE)||(from == CH_UTF16BE)) &&
        ((to != CH_UTF16LE)||(to != CH_UTF16BE))) {
  ....
}

Identical errors can be found in some other places:

V547 Expression '(to != CH_UTF16LE) || (to != CH_UTF16BE)' is always true. Probably the '&&' operator should be used here. charcnv.c 599

Samba

V547 Expression 'result.pid < 0' is always false. Unsigned type value is never < 0. util.c 2376


struct server_id {
  uint32_t pid;
  uint32_t vnn;
  uint64_t unique_id;
}

struct server_id interpret_pid(const char *pid_string)
{
  struct server_id result;
  ....
  /* Assigning to result.pid may have overflowed
     Map negative pid to -1: i.e. error */
  if (result.pid < 0) {
    result.pid = -1;
  }
  ....
}

Samba

V547 Expression is always false. Consider reviewing this expression. pdbtest.c 170


static bool samu_correct(struct samu *s1, struct samu *s2)
{
  ....
  if (d2_buf == NULL && d2_buf != NULL) {
    DEBUG(0, ("Logon hours is not set\n"));
    ret = False;
  }
  ....
}

Tor

V547 Expression is always true. Probably the '&&' operator should be used here. transports.c 556


void
pt_configure_remaining_proxies(void)
{
  ....
  tor_assert(mp->conf_state != PT_PROTO_BROKEN ||
             mp->conf_state != PT_PROTO_FAILED_LAUNCH);
  ....
}

OpenCV

V547 Expression 'd > maxd' is always false. Unsigned type value is never < 0. fuzzymeanshifttracker.cpp 386


void CvFuzzyMeanShiftTracker::SearchWindow::initDepthValues(....)
{
  unsigned int d=0, mind = 0xFFFF, maxd = 0,
           m0 = 0, m1 = 0, mc, dd;
  ....
  for (int j = 0; j < height; j++)
  {
    ....
    if (d > maxd)
      maxd = d;
    ....
  }
}

Variable 'd' does not change in the loop.

ReactOS

V547 Expression 'i < 0x10000' is always true. The value range of unsigned short type: [0, 65535]. xboxhw.c 358


#define DISKREADBUFFER_SIZE HEX(10000)

typedef unsigned short USHORT, *PUSHORT;

static VOID DetectBiosDisks(....)
{
  USHORT i;
  ....
  Changed = FALSE;
  for (i = 0; ! Changed && i < DISKREADBUFFER_SIZE; i++)
  {
    Changed = ((PUCHAR)DISKREADBUFFER)[i] != 0xcd;
  }
  ....
}

ReactOS

V547 Expression 'ads->udpsocket < 0' is always false. Unsigned type value is never < 0. setup.c 539


typedef UINT_PTR SOCKET;
#define ADNS_SOCKET SOCKET

struct adns__state {
  ....
  ADNS_SOCKET udpsocket, tcpsocket;
  ....
};

static int init_finish(adns_state ads) {
  ....
  if (ads->udpsocket<0) { r= errno; goto x_free; }
  ....
}

Identical errors can be found in some other places:

V547 Expression 'fd < 0' is always false. Unsigned type value is never < 0. event.c 117
V547 Expression 'ads->udpsocket >= 0' is always true. Unsigned type value is always >= 0. check.c 105
V547 Expression 'ads->tcpsocket >= 0' is always true. Unsigned type value is always >= 0. check.c 114
And 1 additional diagnostic messages.

ReactOS

V547 Expression '0 <= Id' is always true. Unsigned type value is always >= 0. menu.c 2663


static INT FASTCALL
MenuButtonUp(MTRACKER *Mt, HMENU PtMenu, UINT Flags)
{
  UINT Id;
  ....
  Id = NtUserMenuItemFromPoint(....);
  ....
  if (0 <= Id &&
      MenuGetRosMenuItemInfo(MenuInfo.Self, Id, &ItemInfo) &&
      MenuInfo.FocusedItem == Id)
  ....
}

ReactOS

V547 Expression 'Info->nPage < 0' is always false. Unsigned type value is never < 0. scrollbar.c 428


typedef struct tagSCROLLINFO {
  ....
  UINT nPage;
  ....
} SCROLLINFO,*LPSCROLLINFO;

static DWORD FASTCALL
co_IntSetScrollInfo(....)
{
  LPSCROLLINFO Info;
  ....
  /* Make sure the page size is valid */
  if (Info->nPage < 0)
  {
    pSBData->page = Info->nPage = 0;
  }
  ....
}

ReactOS

V547 Expression 'Entry->Id <= 0xffff' is always true. The value range of unsigned short type: [0, 65535]. res.c 312


typedef unsigned short WORD;
WORD Id;

static LONG
LdrpCompareResourceNames_U(....)
{
  /* Fail if ResourceName2 is an ID */
  if (Entry->Id <= USHRT_MAX) return -1;
  ....
}

ReactOS

V547 Expression 'index < 0' is always false. Unsigned type value is never < 0. extensions.c 936


typedef unsigned int GLuint;

const GLubyte *_mesa_get_enabled_extension(
  struct gl_context *ctx, GLuint index)
{
  const GLboolean *base;
  size_t n;
  const struct extension *i;
  if (index < 0)
    return NULL;
  ....
}

Identical errors can be found in some other places:

V547 Expression 'ch <= 0xFF' is always true. The value range of char type: [-128, 127]. hexedit.c 1279
V547 Expression 'index >= 0' is always true. Unsigned type value is always >= 0. st_glsl_to_tgsi.cpp 4013
V547 Expression 'index >= 0' is always true. Unsigned type value is always >= 0. st_glsl_to_tgsi.cpp 4023
And 4 additional diagnostic messages.

Windows 8 Driver Samples

V547 Expression 'i < 256' is always true. The value range of unsigned char type: [0, 255]. hw_mac.c 1946


VOID HwFillRateElement(....)
{
  UCHAR i, j;
  ....
  for (i = 0; (i < basicRateSet->uRateSetLength) &&
              (i < 256); i++)
  {
    rate[i] = 0x80 | basicRateSet->ucRateSet[i];
  }
  ....
}

Windows 8 Driver Samples

V547 Expression is always false. The value range of unsigned char type: [0, 255]. hw_mac.c 1971


VOID HwFillRateElement(....)
{
  ....
  UCHAR rate[256];
  UCHAR rateNum;
  ....
  if (rateNum == sizeof(rate) / sizeof(UCHAR))
    break;
  ....
}

NetXMS

V547 Expression 'sockfd < 0' is always false. Unsigned type value is never < 0. radius.cpp 682


typedef UINT_PTR SOCKET;

static int DoRadiusAuth(....)
{
  SOCKET sockfd;
  ....
  // Open a socket.
  sockfd = socket(AF_INET, SOCK_DGRAM, 0);
  if (sockfd < 0)
  {
    DbgPrintf(3, _T("RADIUS: Cannot create socket"));
    pairfree(req);
    return 5;
  }
  ....
}

Identical errors can be found in some other places:

V547 Expression 'col->fd >= 0' is always true. Unsigned type value is always >= 0. ipfix.c 845
V547 Expression is always false. Unsigned type value is never < 0. ipfix.c 962
V547 Expression 'sock < 0' is always false. Unsigned type value is never < 0. ipfix.c 1013
And 4 additional diagnostic messages.

NetXMS

V547 Expression 'i >= 0' is always true. Unsigned type value is always >= 0. ipfix.c 488


int ipfix_snprint_string(....)
{
  size_t  i;
  uint8_t *in = (uint8_t*) data;

  for( i=len-1; i>=0; i-- ) {
    if ( in[i] == '\0' ) {
      return snprintf( str, size, "%s", in );
    }
  }
  ....
}

NetXMS

V547 Expression 'value >= 0' is always true. Unsigned type value is always >= 0. catalyst.cpp 71


bool CatalystDriver::isDeviceSupported(
  SNMP_Transport *snmp, const TCHAR *oid)
{
  DWORD value = 0;
  if (SnmpGet(snmp->getSnmpVersion(), snmp,
             _T(".1.3.6.1.4.1.9.5.1.2.14.0"),
             NULL, 0, &value, sizeof(DWORD), 0)
      != SNMP_ERR_SUCCESS)
    return false;
  // Catalyst 3550 can return 0 as number of slots
  return value >= 0;
}

<< Return to list of all diagnostics

Static Code Analyzer for C/C++/C++11

Examples of errors detected by the V547 diagnostic

Shareaza

Shareaza

Shareaza

VirtualDub

VirtualDub

Geocoding with SQL-Server

Ultimate TCP/IP

Ultimate TCP/IP

Ultimate TCP/IP

Ultimate Toolbox

Ultimate Toolbox

Ultimate Toolbox

Ultimate Toolbox

TortoiseSVN

TortoiseSVN

TortoiseSVN

TraceTool

FCEUX

IPP Samples

IPP Samples

IPP Samples

DOSBox

Miranda IM

Miranda IM

Miranda IM

Miranda IM

Miranda IM

Miranda IM

StrongDC++

Chromium

Chromium

ICU

Network Security Services (NSS)

QT

QT

MySQL

Apache HTTP Server

Apache HTTP Server

Intel AMT SDK

Intel AMT SDK

Intel AMT SDK

TrueCrypt

ReactOS

ReactOS

ReactOS

ReactOS

ReactOS

ReactOS

ReactOS

ReactOS

Chromium

Mozilla Firefox

Mozilla Firefox

Mozilla Firefox

Notepad++

ADAPTIVE Communication Environment (ACE)

WinMerge

BCmenu

WinMerge

UCSniff

DeSmuME

DeSmuME

DeSmuME

DeSmuME

DeSmuME

DeSmuME

DeSmuME

MAME

Trans-Proteomic Pipeline

Trans-Proteomic Pipeline

Trans-Proteomic Pipeline

Trans-Proteomic Pipeline

Visualization Toolkit (VTK)

Visualization Toolkit (VTK)

MongoDB

MongoDB

CamStudio

CamStudio