configure: WARNING: unrecognized options: --disable-guile
configure: WARNING:
  You will not be able to create source packages with 'make dist'
  because gtk-doc >= 1.14 is not found.
od: cannot skip past end of combined input
od: cannot skip past end of combined input
configure: WARNING:
***
*** libunbound was not found. Libdane will not be built.
*** 
configure: WARNING: unrecognized options: --disable-guile
configure: WARNING:
***
*** The DNSSEC root key file in /etc/unbound/root.key was not found.
*** This file is needed for the verification of DNSSEC responses.
*** Use the command: unbound-anchor -a "/etc/unbound/root.key"
*** to generate or update it.
*** 
serv.c: In function 'terminate':
serv.c:1140:9: warning: ignoring return value of 'write' declared with attribute 'warn_unused_result' [-Wunused-result]
 1140 |         write(STDERR_FILENO, buf, p - buf);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ocsptool.c: In function 'verify_response':
ocsptool.c:532:32: warning: use of uninitialized value 'chain[1]' [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
  532 |                         signer = chain[1];
      |                         ~~~~~~~^~~~~~~~~~
  'main': events 1-2
    |
    |  642 | int main(int argc, char **argv)
    |      |     ^~~~
    |      |     |
    |      |     (1) entry to 'main'
    |......
    |  646 |         if ((ret = gnutls_global_init()) < 0) {
    |      |            ~
    |      |            |
    |      |            (2) following 'false' branch (when 'ret >= 0')...
    |
  'main': event 3
    |
    |ocsptool-options.h:200:30:
    |  200 | #define optionProcess(a,b,c) process_options(b,c)
    |      |                              ^~~~~~~~~~~~~~~~~~~~
    |      |                              |
    |      |                              (3) ...to here
ocsptool.c:651:9: note: in expansion of macro 'optionProcess'
    |  651 |         optionProcess(&ocsptoolOptions, argc, argv);
    |      |         ^~~~~~~~~~~~~
    |
  'main': event 4
    |
    |  681 |         if (HAVE_OPT(OUTFILE)) {
    |      |            ^
    |      |            |
    |      |            (4) following 'false' branch...
    |
  'main': events 5-6
    |
    |  689 |                 outfile = stdout;
    |      |                         ^
    |      |                         |
    |      |                         (5) ...to here
    |  690 | 
    |  691 |         if (HAVE_OPT(INFILE)) {
    |      |            ~             
    |      |            |
    |      |            (6) following 'false' branch...
    |
  'main': events 7-8
    |
    |  698 |                 infile = stdin;
    |      |                        ^
    |      |                        |
    |      |                        (7) ...to here
    |......
    |  705 |         if (HAVE_OPT(REQUEST_INFO))
    |      |            ~            
    |      |            |
    |      |            (8) following 'false' branch...
    |
  'main': event 9
    |
    |ocsptool-options.h:116:56:
    |  116 | #define HAVE_OPT_RESPONSE_INFO ocsptool_options.present.response_info
    |      |                                ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~
    |      |                                                        |
    |      |                                                        (9) ...to here
ocsptool-options.h:102:24: note: in expansion of macro 'HAVE_OPT_RESPONSE_INFO'
    |  102 | #define HAVE_OPT(name) HAVE_OPT_ ## name
    |      |                        ^~~~~~~~~
ocsptool.c:707:18: note: in expansion of macro 'HAVE_OPT'
    |  707 |         else if (HAVE_OPT(RESPONSE_INFO))
    |      |                  ^~~~~~~~
    |
  'main': event 10
    |
    |  707 |         else if (HAVE_OPT(RESPONSE_INFO))
    |      |                 ^
    |      |                 |
    |      |                 (10) following 'false' branch...
    |
  'main': event 11
    |
    |ocsptool-options.h:117:59:
    |  117 | #define HAVE_OPT_GENERATE_REQUEST ocsptool_options.present.generate_request
    |      |                                   ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~
    |      |                                                           |
    |      |                                                           (11) ...to here
ocsptool-options.h:102:24: note: in expansion of macro 'HAVE_OPT_GENERATE_REQUEST'
    |  102 | #define HAVE_OPT(name) HAVE_OPT_ ## name
    |      |                        ^~~~~~~~~
ocsptool.c:709:18: note: in expansion of macro 'HAVE_OPT'
    |  709 |         else if (HAVE_OPT(GENERATE_REQUEST))
    |      |                  ^~~~~~~~
    |
  'main': event 12
    |
    |  709 |         else if (HAVE_OPT(GENERATE_REQUEST))
    |      |                 ^
    |      |                 |
    |      |                 (12) following 'false' branch...
    |
  'main': event 13
    |
    |ocsptool-options.h:114:58:
    |  114 | #define HAVE_OPT_VERIFY_RESPONSE ocsptool_options.present.verify_response
    |      |                                  ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~
    |      |                                                          |
    |      |                                                          (13) ...to here
ocsptool-options.h:102:24: note: in expansion of macro 'HAVE_OPT_VERIFY_RESPONSE'
    |  102 | #define HAVE_OPT(name) HAVE_OPT_ ## name
    |      |                        ^~~~~~~~~
ocsptool.c:711:18: note: in expansion of macro 'HAVE_OPT'
    |  711 |         else if (HAVE_OPT(VERIFY_RESPONSE))
    |      |                  ^~~~~~~~
    |
  'main': events 14-16
    |
    |  711 |         else if (HAVE_OPT(VERIFY_RESPONSE))
    |      |                 ^
    |      |                 |
    |      |                 (14) following 'true' branch...
    |  712 |                 verify_response(NULL);
    |      |                 ~~~~~~~~~~~~~~~~~~~~~
    |      |                 |
    |      |                 (15) ...to here
    |      |                 (16) calling 'verify_response' from 'main'
    |
    +--> 'verify_response': events 17-23
           |
           |  501 | static void verify_response(gnutls_datum_t *nonce)
           |      |             ^~~~~~~~~~~~~~~
           |      |             |
           |      |             (17) entry to 'verify_response'
           |......
           |  508 |         gnutls_x509_crt_t chain[MAX_CHAIN_SIZE];
           |      |                           ~~~~~
           |      |                           |
           |      |                           (18) region created on stack here
           |......
           |  516 |         if (dat.data == NULL) {
           |      |            ~ 
           |      |            |
           |      |            (19) following 'false' branch...
           |......
           |  520 |         dat.size = size;
           |      |         ~~~~~~~~~~~~~~~
           |      |                  |
           |      |                  (20) ...to here
           |  521 | 
           |  522 |         if (HAVE_OPT(LOAD_CHAIN)) {
           |      |            ~ 
           |      |            |
           |      |            (21) following 'true' branch...
           |  523 |                 chain_size = load_chain(chain);
           |      |                              ~~~~~~~~~~~~~~~~~
           |      |                              |
           |      |                              (22) ...to here
           |      |                              (23) calling 'load_chain' from 'verify_response'
           |
           +--> 'load_chain': events 24-26
                  |
                  |  451 | static unsigned load_chain(gnutls_x509_crt_t chain[MAX_CHAIN_SIZE])
                  |      |                 ^~~~~~~~~~
                  |      |                 |
                  |      |                 (24) entry to 'load_chain'
                  |  452 | {
                  |  453 |         if (HAVE_OPT(LOAD_CHAIN)) {
                  |      |            ~     
                  |      |            |
                  |      |            (25) following 'true' branch...
                  |......
                  |  457 |                 memset(&info, 0, sizeof(info));
                  |      |                 ~
                  |      |                 |
                  |      |                 (26) inlined call to 'memset' from 'load_chain'
                  |
                  +--> 'memset': event 27
                         |
                         |/usr/include/bits/string_fortified.h:59:10:
                         |   59 |   return __builtin___memset_chk (__dest, __ch, __len,
                         |      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         |      |          |
                         |      |          (27) ...to here
                         |   60 |                                  __glibc_objsize0 (__dest));
                         |      |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~
                         |
                  <------+
                  |
                'load_chain': event 28
                  |
                  |ocsptool.c:466:20:
                  |  466 |                 if (list_size > MAX_CHAIN_SIZE) {
                  |      |                    ^
                  |      |                    |
                  |      |                    (28) following 'false' branch...
                  |
                'load_chain': event 29
                  |
                  |cc1:
                  | (29): ...to here
                  |
           <------+
           |
         'verify_response': events 30-35
           |
           |  523 |                 chain_size = load_chain(chain);
           |      |                              ^~~~~~~~~~~~~~~~~
           |      |                              |
           |      |                              (30) returning to 'verify_response' from 'load_chain'
           |  524 |                 if (chain_size < 1) {
           |      |                    ~          
           |      |                    |
           |      |                    (31) following 'false' branch (when 'chain_size != 0')...
           |......
           |  529 |                 if (chain_size == 1)
           |      |                    ~          
           |      |                    |
           |      |                    (32) ...to here
           |      |                    (33) following 'false' branch (when 'chain_size != 1')...
           |......
           |  532 |                         signer = chain[1];
           |      |                         ~~~~~~~~~~~~~~~~~
           |      |                                |
           |      |                                (34) ...to here
           |      |                                (35) use of uninitialized value 'chain[1]' here
           |
utils.c: In function '_fail':
utils.c:96:9: warning: ignoring return value of 'vasprintf' declared with attribute 'warn_unused_result' [-Wunused-result]
   96 |         vasprintf(&str, format, arg_ptr);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ex-serv-x509.c: In function 'main':
ex-serv-x509.c:113:9: warning: 'listen' on possibly invalid file descriptor 'listen_sd' [-Wanalyzer-fd-use-without-check]
  113 |         listen(listen_sd, 1024);
      |         ^~~~~~~~~~~~~~~~~~~~~~~
  'main': event 1
    |
    |   24 | #define CHECK(x) assert((x) >= 0)
    |      |                  ^~~~~~
    |      |                  |
    |      |                  (1) following 'true' branch...
ex-serv-x509.c:60:9: note: in expansion of macro 'CHECK'
    |   60 |         CHECK(gnutls_global_init());
    |      |         ^~~~~
    |
  'main': event 2
    |
    |   62 |         CHECK(gnutls_certificate_allocate_credentials(&x509_cred));
    |      |               ^
    |      |               |
    |      |               (2) ...to here
ex-serv-x509.c:62:9: note: in expansion of macro 'CHECK'
    |   62 |         CHECK(gnutls_certificate_allocate_credentials(&x509_cred));
    |      |         ^~~~~
    |
  'main': event 3
    |
    |   24 | #define CHECK(x) assert((x) >= 0)
    |      |                  ^~~~~~
    |      |                  |
    |      |                  (3) following 'true' branch...
ex-serv-x509.c:62:9: note: in expansion of macro 'CHECK'
    |   62 |         CHECK(gnutls_certificate_allocate_credentials(&x509_cred));
    |      |         ^~~~~
    |
  'main': event 4
    |
    |   64 |         CHECK(gnutls_certificate_set_x509_trust_file(x509_cred, CAFILE,
    |      |               ^
    |      |               |
    |      |               (4) ...to here
ex-serv-x509.c:64:9: note: in expansion of macro 'CHECK'
    |   64 |         CHECK(gnutls_certificate_set_x509_trust_file(x509_cred, CAFILE,
    |      |         ^~~~~
    |
  'main': event 5
    |
    |   24 | #define CHECK(x) assert((x) >= 0)
    |      |                  ^~~~~~
    |      |                  |
    |      |                  (5) following 'true' branch...
ex-serv-x509.c:64:9: note: in expansion of macro 'CHECK'
    |   64 |         CHECK(gnutls_certificate_set_x509_trust_file(x509_cred, CAFILE,
    |      |         ^~~~~
    |
  'main': event 6
    |
    |   67 |         CHECK(gnutls_certificate_set_x509_crl_file(x509_cred, CRLFILE,
    |      |               ^
    |      |               |
    |      |               (6) ...to here
ex-serv-x509.c:67:9: note: in expansion of macro 'CHECK'
    |   67 |         CHECK(gnutls_certificate_set_x509_crl_file(x509_cred, CRLFILE,
    |      |         ^~~~~
    |
  'main': event 7
    |
    |   24 | #define CHECK(x) assert((x) >= 0)
    |      |                  ^~~~~~
    |      |                  |
    |      |                  (7) following 'true' branch...
ex-serv-x509.c:67:9: note: in expansion of macro 'CHECK'
    |   67 |         CHECK(gnutls_certificate_set_x509_crl_file(x509_cred, CRLFILE,
    |      |         ^~~~~
    |
  'main': event 8
    |
    |   76 |         CHECK(gnutls_certificate_set_x509_key_file(x509_cred, CERTFILE, KEYFILE,
    |      |               ^
    |      |               |
    |      |               (8) ...to here
ex-serv-x509.c:76:9: note: in expansion of macro 'CHECK'
    |   76 |         CHECK(gnutls_certificate_set_x509_key_file(x509_cred, CERTFILE, KEYFILE,
    |      |         ^~~~~
    |
  'main': event 9
    |
    |   24 | #define CHECK(x) assert((x) >= 0)
    |      |                  ^~~~~~
    |      |                  |
    |      |                  (9) following 'true' branch...
ex-serv-x509.c:76:9: note: in expansion of macro 'CHECK'
    |   76 |         CHECK(gnutls_certificate_set_x509_key_file(x509_cred, CERTFILE, KEYFILE,
    |      |         ^~~~~
    |
  'main': event 10
    |
    |   79 |         CHECK(gnutls_certificate_set_ocsp_status_request_file(
    |      |               ^
    |      |               |
    |      |               (10) ...to here
ex-serv-x509.c:79:9: note: in expansion of macro 'CHECK'
    |   79 |         CHECK(gnutls_certificate_set_ocsp_status_request_file(
    |      |         ^~~~~
    |
  'main': event 11
    |
    |   24 | #define CHECK(x) assert((x) >= 0)
    |      |                  ^~~~~~
    |      |                  |
    |      |                  (11) following 'true' branch...
ex-serv-x509.c:79:9: note: in expansion of macro 'CHECK'
    |   79 |         CHECK(gnutls_certificate_set_ocsp_status_request_file(
    |      |         ^~~~~
    |
  'main': event 12
    |
    |   82 |         CHECK(gnutls_priority_init(&priority_cache, NULL, NULL));
    |      |               ^
    |      |               |
    |      |               (12) ...to here
ex-serv-x509.c:82:9: note: in expansion of macro 'CHECK'
    |   82 |         CHECK(gnutls_priority_init(&priority_cache, NULL, NULL));
    |      |         ^~~~~
    |
  'main': event 13
    |
    |   24 | #define CHECK(x) assert((x) >= 0)
    |      |                  ^~~~~~
    |      |                  |
    |      |                  (13) following 'true' branch...
ex-serv-x509.c:82:9: note: in expansion of macro 'CHECK'
    |   82 |         CHECK(gnutls_priority_init(&priority_cache, NULL, NULL));
    |      |         ^~~~~
    |
  'main': events 14-16
    |
    |   95 |         gnutls_certificate_set_known_dh_params(x509_cred,
    |      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |         |
    |      |         (14) ...to here
    |   96 |                                                GNUTLS_SEC_PARAM_MEDIUM);
    |      |                                                ~~~~~~~~~~~~~~~~~~~~~~~~
    |......
    |  101 |         listen_sd = socket(AF_INET, SOCK_STREAM, 0);
    |      |                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                     |
    |      |                     (15) when 'socket' fails
    |......
    |  113 |         listen(listen_sd, 1024);
    |      |         ~~~~~~~~~~~~~~~~~~~~~~~
    |      |         |
    |      |         (16) 'listen_sd' could be invalid
    |
tlsproxy/tlsproxy.c: In function 'runlistener':
tlsproxy/tlsproxy.c:228:16: warning: leak of file descriptor 'listenfd' [CWE-775] [-Wanalyzer-fd-leak]
  228 |         while (!rxsigquit) {
      |                ^~~~~~~~~~
  'runlistener': events 1-2
    |
    |  214 | static int runlistener(void)
    |      |            ^~~~~~~~~~~
    |      |            |
    |      |            (1) entry to 'runlistener'
    |......
    |  217 |         if ((listenfd = bindtoaddress(listenaddr)) < 0) {
    |      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                         |
    |      |                         (2) calling 'bindtoaddress' from 'runlistener'
    |
    +--> 'bindtoaddress': events 3-5
           |
           |   57 | static int bindtoaddress(char *addrport)
           |      |            ^~~~~~~~~~~~~
           |      |            |
           |      |            (3) entry to 'bindtoaddress'
           |......
           |   80 |         if (s != 0) {
           |      |            ~
           |      |            |
           |      |            (4) following 'false' branch (when 's == 0')...
           |......
           |   88 |         for (rp = result; rp != NULL; rp = rp->ai_next) {
           |      |              ~~~~~~~~~~~
           |      |                 |
           |      |                 (5) ...to here
           |
         'bindtoaddress': events 6-14
           |
           |   88 |         for (rp = result; rp != NULL; rp = rp->ai_next) {
           |      |                              ^
           |      |                              |
           |      |                              (6) following 'true' branch (when 'rp' is non-NULL)...
           |   89 |                 fd = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
           |      |                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                      |
           |      |                      (7) ...to here
           |      |                      (8) socket created here
           |      |                      (9) when 'socket' succeeds
           |   90 | 
           |   91 |                 if (fd >= 0) {
           |      |                    ~          
           |      |                    |
           |      |                    (10) following 'true' branch (when 'fd >= 0')...
           |   92 |                         int one = 1;
           |      |                             ~~~
           |      |                             |
           |      |                             (11) ...to here
           |   93 |                         if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one,
           |      |                            ~  
           |      |                            |
           |      |                            (12) following 'false' branch...
           |......
           |   98 |                         if (bind(fd, rp->ai_addr, rp->ai_addrlen) == 0)
           |      |                            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                            ||
           |      |                            |(13) ...to here
           |      |                            (14) following 'true' branch...
           |
         'bindtoaddress': event 15
           |
           |cc1:
           | (15): ...to here
           |
         'bindtoaddress': events 16-20
           |
           |  104 |         if (!rp) {
           |      |            ^
           |      |            |
           |      |            (16) following 'false' branch (when 'rp' is non-NULL)...
           |......
           |  110 |         freeaddrinfo(result); /* No longer needed */
           |      |         ~~~~~~~~~~~~~~~~~~~~
           |      |         |
           |      |         (17) ...to here
           |  111 | 
           |  112 |         if (listen(fd, 5) < 0) {
           |      |            ~~~~~~~~~~~~~~
           |      |            ||
           |      |            |(18) stream socket marked as passive here via 'listen'
           |      |            |(19) when 'listen' succeeds
           |      |            (20) following 'false' branch...
           |
         'bindtoaddress': event 21
           |
           |cc1:
           | (21): ...to here
           |
    <------+
    |
  'runlistener': events 22-23
    |
    |  217 |         if ((listenfd = bindtoaddress(listenaddr)) < 0) {
    |      |            ~            ^~~~~~~~~~~~~~~~~~~~~~~~~
    |      |            |            |
    |      |            |            (22) returning to 'runlistener' from 'bindtoaddress'
    |      |            (23) following 'false' branch (when 'listenfd >= 0')...
    |
  'runlistener': event 24
    |
    |cc1:
    | (24): ...to here
    |
  'runlistener': event 25
    |
    |  228 |         while (!rxsigquit) {
    |      |                ^~~~~~~~~~
    |      |                |
    |      |                (25) following 'false' branch...
    |
  'runlistener': event 26
    |
    |cc1:
    | (26): ...to here
    |
  'runlistener': event 27
    |
    |  228 |         while (!rxsigquit) {
    |      |                ^~~~~~~~~~
    |      |                |
    |      |                (27) 'listenfd' leaks here
    |
crq_key_id.c: In function 'doit':
crq_key_id.c:180:20: warning: check of 'pkey_key_id' for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
  180 |                 if (pkey_key_id) {
      |                    ^
  'doit': events 1-41
    |
    |   57 |         if (ret < 0)
    |      |            ^
    |      |            |
    |      |            (1) following 'false' branch (when 'ret >= 0')...
    |......
    |   60 |         gnutls_global_set_log_function(tls_log_func);
    |      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |         |
    |      |         (2) ...to here
    |......
    |   64 |         for (algorithm = GNUTLS_PK_RSA; algorithm <= GNUTLS_PK_DSA;
    |      |                                         ~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                                                   |
    |      |                                                   (3) following 'true' branch (when 'algorithm != 3')...
    |......
    |   70 |                 ret = gnutls_x509_crq_init(&crq);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (4) ...to here
    |   71 |                 if (ret < 0)
    |      |                    ~
    |      |                    |
    |      |                    (5) following 'false' branch (when 'ret >= 0')...
    |......
    |   75 |                 ret = gnutls_x509_privkey_init(&pkey);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (6) ...to here
    |   76 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (7) following 'false' branch (when 'ret >= 0')...
    |......
    |   81 |                 ret = gnutls_privkey_init(&abs_pkey);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (8) ...to here
    |   82 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (9) following 'false' branch (when 'ret >= 0')...
    |......
    |   87 |                 ret = gnutls_x509_privkey_generate(pkey, algorithm, 2048, 0);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (10) ...to here
    |   88 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (11) following 'false' branch (when 'ret >= 0')...
    |......
    |   92 |                 } else if (debug) {
    |      |                            ~~~~~
    |      |                            |
    |      |                            (12) ...to here
    |......
    |  100 |                 if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER) {
    |      |                    ~
    |      |                    |
    |      |                    (13) following 'false' branch (when 'ret == -51')...
    |......
    |  105 |                 pkey_key_id = malloc(sizeof(unsigned char) * pkey_key_id_len);
    |      |                               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                               |
    |      |                               (14) ...to here
    |      |                               (15) allocated here
    |......
    |  108 |                 if (ret != GNUTLS_E_SUCCESS) {
    |      |                    ~
    |      |                    |
    |      |                    (16) following 'false' branch (when 'ret == 0')...
    |......
    |  113 |                 ret = gnutls_x509_crq_set_version(crq, 1);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (17) ...to here
    |  114 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (18) following 'false' branch (when 'ret >= 0')...
    |......
    |  119 |                 ret = gnutls_x509_crq_set_key(crq, pkey);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (19) ...to here
    |  120 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (20) following 'false' branch (when 'ret >= 0')...
    |......
    |  125 |                 ret = gnutls_x509_crq_set_dn_by_oid(
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (21) ...to here
    |  126 |                         crq, GNUTLS_OID_X520_COMMON_NAME, 0, "CN-Test", 7);
    |      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |  127 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (22) following 'false' branch (when 'ret >= 0')...
    |......
    |  132 |                 ret = gnutls_privkey_import_x509(abs_pkey, pkey, 0);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (23) ...to here
    |  133 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (24) following 'false' branch (when 'ret >= 0')...
    |......
    |  138 |                 ret = gnutls_x509_crq_privkey_sign(crq, abs_pkey,
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (25) ...to here
    |  139 |                                                    GNUTLS_DIG_SHA256, 0);
    |      |                                                    ~~~~~~~~~~~~~~~~~~~~~
    |  140 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (26) following 'false' branch (when 'ret >= 0')...
    |......
    |  145 |                 ret = gnutls_x509_crq_verify(crq, 0);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (27) ...to here
    |  146 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (28) following 'false' branch (when 'ret >= 0')...
    |......
    |  151 |                 crq_key_id_len = 0;
    |      |                 ~~~~~~~~~~~~~~~~~~
    |      |                                |
    |      |                                (29) ...to here
    |......
    |  154 |                 if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER) {
    |      |                    ~
    |      |                    |
    |      |                    (30) following 'false' branch (when 'ret == -51')...
    |......
    |  159 |                 crq_key_id = malloc(sizeof(unsigned char) * crq_key_id_len);
    |      |                              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                              |
    |      |                              (31) ...to here
    |......
    |  162 |                 if (ret != GNUTLS_E_SUCCESS) {
    |      |                    ~
    |      |                    |
    |      |                    (32) following 'false' branch (when 'ret == 0')...
    |......
    |  167 |                 if (crq_key_id_len == pkey_key_id_len) {
    |      |                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                    |               |
    |      |                    |               (33) ...to here
    |      |                    (34) following 'true' branch...
    |  168 |                         ret = memcmp(crq_key_id, pkey_key_id, crq_key_id_len);
    |      |                               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                               |
    |      |                               (35) ...to here
    |      |                               (36) pointer 'pkey_key_id' is dereferenced here
    |  169 |                         if (ret == 0) {
    |      |                            ~
    |      |                            |
    |      |                            (37) following 'true' branch (when 'ret == 0')...
    |  170 |                                 if (debug)
    |      |                                    ~~~~~~
    |      |                                    ||
    |      |                                    |(38) ...to here
    |      |                                    (39) following 'false' branch...
    |......
    |  180 |                 if (pkey_key_id) {
    |      |                    ~
    |      |                    |
    |      |                    (40) ...to here
    |      |                    (41) pointer 'pkey_key_id' is checked for NULL here but it was already dereferenced at (36)
    |
crq_key_id.c:185:20: warning: check of 'crq_key_id' for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
  185 |                 if (crq_key_id) {
      |                    ^
  'doit': events 1-43
    |
    |   57 |         if (ret < 0)
    |      |            ^
    |      |            |
    |      |            (1) following 'false' branch (when 'ret >= 0')...
    |......
    |   60 |         gnutls_global_set_log_function(tls_log_func);
    |      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |         |
    |      |         (2) ...to here
    |......
    |   64 |         for (algorithm = GNUTLS_PK_RSA; algorithm <= GNUTLS_PK_DSA;
    |      |                                         ~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                                                   |
    |      |                                                   (3) following 'true' branch (when 'algorithm != 3')...
    |......
    |   70 |                 ret = gnutls_x509_crq_init(&crq);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (4) ...to here
    |   71 |                 if (ret < 0)
    |      |                    ~
    |      |                    |
    |      |                    (5) following 'false' branch (when 'ret >= 0')...
    |......
    |   75 |                 ret = gnutls_x509_privkey_init(&pkey);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (6) ...to here
    |   76 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (7) following 'false' branch (when 'ret >= 0')...
    |......
    |   81 |                 ret = gnutls_privkey_init(&abs_pkey);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (8) ...to here
    |   82 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (9) following 'false' branch (when 'ret >= 0')...
    |......
    |   87 |                 ret = gnutls_x509_privkey_generate(pkey, algorithm, 2048, 0);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (10) ...to here
    |   88 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (11) following 'false' branch (when 'ret >= 0')...
    |......
    |   92 |                 } else if (debug) {
    |      |                            ~~~~~
    |      |                            |
    |      |                            (12) ...to here
    |......
    |  100 |                 if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER) {
    |      |                    ~
    |      |                    |
    |      |                    (13) following 'false' branch (when 'ret == -51')...
    |......
    |  105 |                 pkey_key_id = malloc(sizeof(unsigned char) * pkey_key_id_len);
    |      |                               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                               |
    |      |                               (14) ...to here
    |......
    |  108 |                 if (ret != GNUTLS_E_SUCCESS) {
    |      |                    ~
    |      |                    |
    |      |                    (15) following 'false' branch (when 'ret == 0')...
    |......
    |  113 |                 ret = gnutls_x509_crq_set_version(crq, 1);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (16) ...to here
    |  114 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (17) following 'false' branch (when 'ret >= 0')...
    |......
    |  119 |                 ret = gnutls_x509_crq_set_key(crq, pkey);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (18) ...to here
    |  120 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (19) following 'false' branch (when 'ret >= 0')...
    |......
    |  125 |                 ret = gnutls_x509_crq_set_dn_by_oid(
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (20) ...to here
    |  126 |                         crq, GNUTLS_OID_X520_COMMON_NAME, 0, "CN-Test", 7);
    |      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |  127 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (21) following 'false' branch (when 'ret >= 0')...
    |......
    |  132 |                 ret = gnutls_privkey_import_x509(abs_pkey, pkey, 0);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (22) ...to here
    |  133 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (23) following 'false' branch (when 'ret >= 0')...
    |......
    |  138 |                 ret = gnutls_x509_crq_privkey_sign(crq, abs_pkey,
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (24) ...to here
    |  139 |                                                    GNUTLS_DIG_SHA256, 0);
    |      |                                                    ~~~~~~~~~~~~~~~~~~~~~
    |  140 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (25) following 'false' branch (when 'ret >= 0')...
    |......
    |  145 |                 ret = gnutls_x509_crq_verify(crq, 0);
    |      |                       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                       |
    |      |                       (26) ...to here
    |  146 |                 if (ret < 0) {
    |      |                    ~
    |      |                    |
    |      |                    (27) following 'false' branch (when 'ret >= 0')...
    |......
    |  151 |                 crq_key_id_len = 0;
    |      |                 ~~~~~~~~~~~~~~~~~~
    |      |                                |
    |      |                                (28) ...to here
    |......
    |  154 |                 if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER) {
    |      |                    ~
    |      |                    |
    |      |                    (29) following 'false' branch (when 'ret == -51')...
    |......
    |  159 |                 crq_key_id = malloc(sizeof(unsigned char) * crq_key_id_len);
    |      |                              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                              |
    |      |                              (30) ...to here
    |      |                              (31) allocated here
    |......
    |  162 |                 if (ret != GNUTLS_E_SUCCESS) {
    |      |                    ~
    |      |                    |
    |      |                    (32) following 'false' branch (when 'ret == 0')...
    |......
    |  167 |                 if (crq_key_id_len == pkey_key_id_len) {
    |      |                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                    |               |
    |      |                    |               (33) ...to here
    |      |                    (34) following 'true' branch...
    |  168 |                         ret = memcmp(crq_key_id, pkey_key_id, crq_key_id_len);
    |      |                               ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                               |
    |      |                               (35) ...to here
    |      |                               (36) pointer 'crq_key_id' is dereferenced here
    |  169 |                         if (ret == 0) {
    |      |                            ~
    |      |                            |
    |      |                            (37) following 'true' branch (when 'ret == 0')...
    |  170 |                                 if (debug)
    |      |                                    ~~~~~~
    |      |                                    ||
    |      |                                    |(38) ...to here
    |      |                                    (39) following 'false' branch...
    |......
    |  180 |                 if (pkey_key_id) {
    |      |                    ~
    |      |                    |
    |      |                    (40) ...to here
    |      |                    (41) following 'false' branch (when 'pkey_key_id' is NULL)...
    |......
    |  185 |                 if (crq_key_id) {
    |      |                    ~
    |      |                    |
    |      |                    (42) ...to here
    |      |                    (43) pointer 'crq_key_id' is checked for NULL here but it was already dereferenced at (36)
    |
keylog-env.c: In function 'doit':
keylog-env.c:170:9: warning: ignoring return value of 'truncate' declared with attribute 'warn_unused_result' [-Wunused-result]
  170 |         truncate(filename, 0);
      |         ^~~~~~~~~~~~~~~~~~~~~
pkcs11/pkcs11-get-issuer.c: In function 'doit':
pkcs11/pkcs11-get-issuer.c:133:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  133 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-get-issuer.c:37:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/pkcs11-chainverify.c: In function 'doit':
pkcs11/pkcs11-chainverify.c:111:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  111 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-chainverify.c:35:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/pkcs11-is-known.c: In function 'doit':
pkcs11/pkcs11-is-known.c:383:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  383 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-is-known.c:37:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/pkcs11-combo.c: In function 'doit':
pkcs11/pkcs11-combo.c:250:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  250 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-combo.c:41:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/pkcs11-privkey.c: In function 'doit':
pkcs11/pkcs11-privkey.c:156:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  156 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-privkey.c:36:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-pubkey-import-rsa.c:34:
pkcs11/pkcs11-pubkey-import.c: In function 'try':
pkcs11/pkcs11-pubkey-import.c:99:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
   99 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-pubkey-import.c:37:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-pubkey-import-ecdsa.c:35:
pkcs11/pkcs11-pubkey-import.c: In function 'try':
pkcs11/pkcs11-pubkey-import.c:99:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
   99 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-pubkey-import-ecdsa.c:30:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/pkcs11-ec-privkey-test.c: In function 'doit':
pkcs11/pkcs11-ec-privkey-test.c:108:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  108 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-ec-privkey-test.c:37:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/pkcs11-import-with-pin.c: In function 'doit':
pkcs11/pkcs11-import-with-pin.c:108:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  108 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-import-with-pin.c:37:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/pkcs11-obj-import.c: In function 'doit':
pkcs11/pkcs11-obj-import.c:99:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
   99 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-obj-import.c:40:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/pkcs11-rsa-pss-privkey-test.c: In function 'doit':
pkcs11/pkcs11-rsa-pss-privkey-test.c:124:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  124 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-rsa-pss-privkey-test.c:37:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/tls-neg-pkcs11-key.c: In function 'doit':
pkcs11/tls-neg-pkcs11-key.c:454:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  454 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/tls-neg-pkcs11-key.c:45:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/gnutls_pcert_list_import_x509_file.c: In function 'doit':
pkcs11/gnutls_pcert_list_import_x509_file.c:179:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  179 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/gnutls_pcert_list_import_x509_file.c:37:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/gnutls_x509_crt_list_import_url.c: In function 'doit':
pkcs11/gnutls_x509_crt_list_import_url.c:159:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  159 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/gnutls_x509_crt_list_import_url.c:37:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/pkcs11-eddsa-privkey-test.c: In function 'doit':
pkcs11/pkcs11-eddsa-privkey-test.c:264:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  264 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-eddsa-privkey-test.c:37:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/pkcs11-privkey-generate.c: In function 'doit':
pkcs11/pkcs11-privkey-generate.c:159:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  159 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/pkcs11-privkey-generate.c:50:
pkcs11/softhsm.h: In function 'set_softhsm_conf':
pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/tls-neg-pkcs11-no-key.c: In function 'doit':
pkcs11/tls-neg-pkcs11-no-key.c:345:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  345 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/tls-neg-pkcs11-no-key.c:52:
./pkcs11/softhsm.h: In function 'set_softhsm_conf':
./pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
tls13/post-handshake-with-cert-pkcs11.c: In function 'doit':
tls13/post-handshake-with-cert-pkcs11.c:460:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  460 |         system(buf);
      |         ^~~~~~~~~~~
In file included from tls13/post-handshake-with-cert-pkcs11.c:52:
./pkcs11/softhsm.h: In function 'set_softhsm_conf':
./pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/distrust-after.c: In function 'doit':
pkcs11/distrust-after.c:242:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  242 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/distrust-after.c:251:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  251 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/distrust-after.c:265:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  265 |         system(buf);
      |         ^~~~~~~~~~~
pkcs11/distrust-after.c:274:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  274 |         system(buf);
      |         ^~~~~~~~~~~
In file included from pkcs11/distrust-after.c:45:
./pkcs11/softhsm.h: In function 'set_softhsm_conf':
./pkcs11/softhsm.h:115:9: warning: ignoring return value of 'system' declared with attribute 'warn_unused_result' [-Wunused-result]
  115 |         system(buf);
      |         ^~~~~~~~~~~
protocol-set-allowlist.c: In function 'doit':
protocol-set-allowlist.c:228:17: warning: ignoring return value of 'fgets' declared with attribute 'warn_unused_result' [-Wunused-result]
  228 |                 fgets(cmd_buf, MAX_CMD_LEN, stdin);
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
libtool: warning: relinking 'libgnutlsxx.la'
libtool: warning: remember to run 'libtool --finish /usr/lib'
libtool: warning: '../lib/libgnutls.la' has not been installed in '/usr/lib'
libtool: warning: '../lib/libgnutls.la' has not been installed in '/usr/lib'
libtool: warning: '../lib/libgnutls.la' has not been installed in '/usr/lib'
libtool: warning: '/var/pisi/gnutls-3.8.10-24/work/gnutls-3.8.10/lib/libgnutls.la' has not been installed in '/usr/lib'
libtool: warning: '../lib/libgnutls.la' has not been installed in '/usr/lib'
libtool: warning: '../lib/libgnutls.la' has not been installed in '/usr/lib'
libtool: warning: '../lib/libgnutls.la' has not been installed in '/usr/lib'
libtool: warning: '../lib/libgnutls.la' has not been installed in '/usr/lib'
libtool: warning: '/var/pisi/gnutls-3.8.10-24/work/gnutls-3.8.10/lib/libgnutls.la' has not been installed in '/usr/lib'
configure: WARNING: unrecognized options: --disable-guile, --enable-local-libopts
configure: WARNING:
  You will not be able to create source packages with 'make dist'
  because gtk-doc >= 1.14 is not found.
od: cannot skip past end of combined input
od: cannot skip past end of combined input
configure: WARNING:
***
*** libunbound was not found. Libdane will not be built.
*** 
configure: WARNING: unrecognized options: --disable-guile, --enable-local-libopts
configure: WARNING:
***
*** The DNSSEC root key file in /etc/unbound/root.key was not found.
*** This file is needed for the verification of DNSSEC responses.
*** Use the command: unbound-anchor -a "/etc/unbound/root.key"
*** to generate or update it.
*** 
In file included from rsa_psk.c:28:
rsa_psk.c: In function '_gnutls_proc_rsa_psk_client_kx':
./../gnutls_int.h:261:25: warning: comparison of integer expressions of different signedness: 'ssize_t' {aka 'int'} and 'unsigned int' [-Wsign-compare]
  261 |                 if (len < x) {           \
      |                         ^
./../gnutls_int.h:258:38: note: in expansion of macro 'DECR_LENGTH_COM'
  258 | #define DECR_LENGTH_RET(len, x, RET) DECR_LENGTH_COM(len, x, return RET)
      |                                      ^~~~~~~~~~~~~~~
./../gnutls_int.h:249:9: note: in expansion of macro 'DECR_LENGTH_RET'
  249 |         DECR_LENGTH_RET(len, x, GNUTLS_E_UNEXPECTED_PACKET_LENGTH)
      |         ^~~~~~~~~~~~~~~
rsa_psk.c:281:9: note: in expansion of macro 'DECR_LEN'
  281 |         DECR_LEN(data_size, username.size);
      |         ^~~~~~~~
In file included from cert.c:28:
cert.c: In function 'find_x509_client_cert':
./../gnutls_int.h:261:25: warning: comparison of integer expressions of different signedness: 'ssize_t' {aka 'int'} and 'unsigned int' [-Wsign-compare]
  261 |                 if (len < x) {           \
      |                         ^
./../gnutls_int.h:258:38: note: in expansion of macro 'DECR_LENGTH_COM'
  258 | #define DECR_LENGTH_RET(len, x, RET) DECR_LENGTH_COM(len, x, return RET)
      |                                      ^~~~~~~~~~~~~~~
cert.c:231:17: note: in expansion of macro 'DECR_LENGTH_RET'
  231 |                 DECR_LENGTH_RET(data_size, size, 0);
      |                 ^~~~~~~~~~~~~~~
cert.c: In function 'get_issuers_num':
./../gnutls_int.h:261:25: warning: comparison of integer expressions of different signedness: 'ssize_t' {aka 'int'} and 'unsigned int' [-Wsign-compare]
  261 |                 if (len < x) {           \
      |                         ^
./../gnutls_int.h:258:38: note: in expansion of macro 'DECR_LENGTH_COM'
  258 | #define DECR_LENGTH_RET(len, x, RET) DECR_LENGTH_COM(len, x, return RET)
      |                                      ^~~~~~~~~~~~~~~
cert.c:372:17: note: in expansion of macro 'DECR_LENGTH_RET'
  372 |                 DECR_LENGTH_RET(data_size, size,
      |                 ^~~~~~~~~~~~~~~
In file included from psk.c:23:
psk.c: In function '_gnutls_proc_psk_client_kx':
./../gnutls_int.h:261:25: warning: comparison of integer expressions of different signedness: 'ssize_t' {aka 'int'} and 'unsigned int' [-Wsign-compare]
  261 |                 if (len < x) {           \
      |                         ^
./../gnutls_int.h:258:38: note: in expansion of macro 'DECR_LENGTH_COM'
  258 | #define DECR_LENGTH_RET(len, x, RET) DECR_LENGTH_COM(len, x, return RET)
      |                                      ^~~~~~~~~~~~~~~
./../gnutls_int.h:249:9: note: in expansion of macro 'DECR_LENGTH_RET'
  249 |         DECR_LENGTH_RET(len, x, GNUTLS_E_UNEXPECTED_PACKET_LENGTH)
      |         ^~~~~~~~~~~~~~~
psk.c:205:9: note: in expansion of macro 'DECR_LEN'
  205 |         DECR_LEN(data_size, username.size);
      |         ^~~~~~~~
psk.c: In function '_gnutls_proc_psk_server_kx':
./../gnutls_int.h:261:25: warning: comparison of integer expressions of different signedness: 'ssize_t' {aka 'int'} and 'unsigned int' [-Wsign-compare]
  261 |                 if (len < x) {           \
      |                         ^
./../gnutls_int.h:258:38: note: in expansion of macro 'DECR_LENGTH_COM'
  258 | #define DECR_LENGTH_RET(len, x, RET) DECR_LENGTH_COM(len, x, return RET)
      |                                      ^~~~~~~~~~~~~~~
./../gnutls_int.h:249:9: note: in expansion of macro 'DECR_LENGTH_RET'
  249 |         DECR_LENGTH_RET(len, x, GNUTLS_E_UNEXPECTED_PACKET_LENGTH)
      |         ^~~~~~~~~~~~~~~
psk.c:305:9: note: in expansion of macro 'DECR_LEN'
  305 |         DECR_LEN(data_size, hint.size);
      |         ^~~~~~~~
In file included from dhe_psk.c:28:
dhe_psk.c: In function 'proc_dhe_psk_client_kx':
./../gnutls_int.h:261:25: warning: comparison of integer expressions of different signedness: 'ssize_t' {aka 'int'} and 'unsigned int' [-Wsign-compare]
  261 |                 if (len < x) {           \
      |                         ^
./../gnutls_int.h:258:38: note: in expansion of macro 'DECR_LENGTH_COM'
  258 | #define DECR_LENGTH_RET(len, x, RET) DECR_LENGTH_COM(len, x, return RET)
      |                                      ^~~~~~~~~~~~~~~
./../gnutls_int.h:249:9: note: in expansion of macro 'DECR_LENGTH_RET'
  249 |         DECR_LENGTH_RET(len, x, GNUTLS_E_UNEXPECTED_PACKET_LENGTH)
      |         ^~~~~~~~~~~~~~~
dhe_psk.c:286:9: note: in expansion of macro 'DECR_LEN'
  286 |         DECR_LEN(data_size, username.size);
      |         ^~~~~~~~
dhe_psk.c: In function 'proc_ecdhe_psk_client_kx':
./../gnutls_int.h:261:25: warning: comparison of integer expressions of different signedness: 'ssize_t' {aka 'int'} and 'unsigned int' [-Wsign-compare]
  261 |                 if (len < x) {           \
      |                         ^
./../gnutls_int.h:258:38: note: in expansion of macro 'DECR_LENGTH_COM'
  258 | #define DECR_LENGTH_RET(len, x, RET) DECR_LENGTH_COM(len, x, return RET)
      |                                      ^~~~~~~~~~~~~~~
./../gnutls_int.h:249:9: note: in expansion of macro 'DECR_LENGTH_RET'
  249 |         DECR_LENGTH_RET(len, x, GNUTLS_E_UNEXPECTED_PACKET_LENGTH)
      |         ^~~~~~~~~~~~~~~
dhe_psk.c:350:9: note: in expansion of macro 'DECR_LEN'
  350 |         DECR_LEN(data_size, username.size);
      |         ^~~~~~~~
dhe_psk.c: In function 'proc_dhe_psk_server_kx':
./../gnutls_int.h:261:25: warning: comparison of integer expressions of different signedness: 'ssize_t' {aka 'int'} and 'unsigned int' [-Wsign-compare]
  261 |                 if (len < x) {           \
      |                         ^
./../gnutls_int.h:258:38: note: in expansion of macro 'DECR_LENGTH_COM'
  258 | #define DECR_LENGTH_RET(len, x, RET) DECR_LENGTH_COM(len, x, return RET)
      |                                      ^~~~~~~~~~~~~~~
./../gnutls_int.h:249:9: note: in expansion of macro 'DECR_LENGTH_RET'
  249 |         DECR_LENGTH_RET(len, x, GNUTLS_E_UNEXPECTED_PACKET_LENGTH)
      |         ^~~~~~~~~~~~~~~
dhe_psk.c:409:9: note: in expansion of macro 'DECR_LEN'
  409 |         DECR_LEN(data_size, hint.size);
      |         ^~~~~~~~
dhe_psk.c: In function 'proc_ecdhe_psk_server_kx':
./../gnutls_int.h:261:25: warning: comparison of integer expressions of different signedness: 'ssize_t' {aka 'int'} and 'unsigned int' [-Wsign-compare]
  261 |                 if (len < x) {           \
      |                         ^
./../gnutls_int.h:258:38: note: in expansion of macro 'DECR_LENGTH_COM'
  258 | #define DECR_LENGTH_RET(len, x, RET) DECR_LENGTH_COM(len, x, return RET)
      |                                      ^~~~~~~~~~~~~~~
./../gnutls_int.h:249:9: note: in expansion of macro 'DECR_LENGTH_RET'
  249 |         DECR_LENGTH_RET(len, x, GNUTLS_E_UNEXPECTED_PACKET_LENGTH)
      |         ^~~~~~~~~~~~~~~
dhe_psk.c:454:9: note: in expansion of macro 'DECR_LEN'
  454 |         DECR_LEN(data_size, hint.size);
      |         ^~~~~~~~
In file included from ecdhe.c:29:
ecdhe.c: In function '_gnutls_proc_ecdh_common_client_kx':
./../gnutls_int.h:261:25: warning: comparison of integer expressions of different signedness: 'ssize_t' {aka 'int'} and 'unsigned int' [-Wsign-compare]
  261 |                 if (len < x) {           \
      |                         ^
./../gnutls_int.h:258:38: note: in expansion of macro 'DECR_LENGTH_COM'
  258 | #define DECR_LENGTH_RET(len, x, RET) DECR_LENGTH_COM(len, x, return RET)
      |                                      ^~~~~~~~~~~~~~~
./../gnutls_int.h:249:9: note: in expansion of macro 'DECR_LENGTH_RET'
  249 |         DECR_LENGTH_RET(len, x, GNUTLS_E_UNEXPECTED_PACKET_LENGTH)
      |         ^~~~~~~~~~~~~~~
ecdhe.c:158:9: note: in expansion of macro 'DECR_LEN'
  158 |         DECR_LEN(data_size, point_size);
      |         ^~~~~~~~
ecdhe.c: In function '_gnutls_proc_ecdh_common_server_kx':
./../gnutls_int.h:261:25: warning: comparison of integer expressions of different signedness: 'ssize_t' {aka 'int'} and 'unsigned int' [-Wsign-compare]
  261 |                 if (len < x) {           \
      |                         ^
./../gnutls_int.h:258:38: note: in expansion of macro 'DECR_LENGTH_COM'
  258 | #define DECR_LENGTH_RET(len, x, RET) DECR_LENGTH_COM(len, x, return RET)
      |                                      ^~~~~~~~~~~~~~~
./../gnutls_int.h:249:9: note: in expansion of macro 'DECR_LENGTH_RET'
  249 |         DECR_LENGTH_RET(len, x, GNUTLS_E_UNEXPECTED_PACKET_LENGTH)
      |         ^~~~~~~~~~~~~~~
ecdhe.c:368:9: note: in expansion of macro 'DECR_LEN'
  368 |         DECR_LEN(data_size, point_size);
      |         ^~~~~~~~
int/dsa-compute-k.c: In function 'is_zero_limb':
int/dsa-compute-k.c:42:31: warning: right shift count >= width of type [-Wshift-count-overflow]
   42 |         return ((x >> 1) - 1) >> (GMP_LIMB_BITS - 1);
      |                               ^~
compress.c:44: warning: macro "BROTLIDEC_LIBRARY_SONAME" is not used [-Wunused-macros]
   44 | #define BROTLIDEC_LIBRARY_SONAME "none"
      | 
compress.c:48: warning: macro "ZSTD_LIBRARY_SONAME" is not used [-Wunused-macros]
   48 | #define ZSTD_LIBRARY_SONAME "none"
      | 
compress.c:40: warning: macro "BROTLIENC_LIBRARY_SONAME" is not used [-Wunused-macros]
   40 | #define BROTLIENC_LIBRARY_SONAME "none"
      | 
priority.c: In function 'gnutls_priority_init2':
priority.c:3228:45: warning: comparison of integer expressions of different signedness: 'ptrdiff_t' {aka 'int'} and 'unsigned int' [-Wsign-compare]
 3228 |                         if (err_pos && diff > hlen) {
      |                                             ^
serv.c: In function 'terminate':
serv.c:1140:9: warning: ignoring return value of 'write' declared with attribute 'warn_unused_result' [-Wunused-result]
 1140 |         write(STDERR_FILENO, buf, p - buf);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ocsptool.c: In function 'verify_response':
ocsptool.c:532:32: warning: use of uninitialized value 'chain[1]' [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
  532 |                         signer = chain[1];
      |                         ~~~~~~~^~~~~~~~~~
  'main': events 1-2
    |
    |  642 | int main(int argc, char **argv)
    |      |     ^~~~
    |      |     |
    |      |     (1) entry to 'main'
    |......
    |  646 |         if ((ret = gnutls_global_init()) < 0) {
    |      |            ~
    |      |            |
    |      |            (2) following 'false' branch (when 'ret >= 0')...
    |
  'main': event 3
    |
    |ocsptool-options.h:200:30:
    |  200 | #define optionProcess(a,b,c) process_options(b,c)
    |      |                              ^~~~~~~~~~~~~~~~~~~~
    |      |                              |
    |      |                              (3) ...to here
ocsptool.c:651:9: note: in expansion of macro 'optionProcess'
    |  651 |         optionProcess(&ocsptoolOptions, argc, argv);
    |      |         ^~~~~~~~~~~~~
    |
  'main': event 4
    |
    |  681 |         if (HAVE_OPT(OUTFILE)) {
    |      |            ^
    |      |            |
    |      |            (4) following 'false' branch...
    |
  'main': events 5-6
    |
    |  689 |                 outfile = stdout;
    |      |                         ^
    |      |                         |
    |      |                         (5) ...to here
    |  690 | 
    |  691 |         if (HAVE_OPT(INFILE)) {
    |      |            ~             
    |      |            |
    |      |            (6) following 'true' branch...
    |
  'main': event 7
    |
    |  692 |                 infile = fopen(OPT_ARG(INFILE), "rb");
    |      |                          ^
    |      |                          |
    |      |                          (7) ...to here
    |
  'main': event 8
    |
    |  693 |                 if (infile == NULL) {
    |      |                    ^
    |      |                    |
    |      |                    (8) following 'false' branch...
    |
  'main': event 9
    |
    |ocsptool-options.h:180:51:
    |  180 | #define ENABLED_OPT_INDER ocsptool_options.enabled.inder
    |      |                           ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~
    |      |                                                   |
    |      |                                                   (9) ...to here
ocsptool-options.h:104:27: note: in expansion of macro 'ENABLED_OPT_INDER'
    |  104 | #define ENABLED_OPT(name) ENABLED_OPT_ ## name
    |      |                           ^~~~~~~~~~~~
ocsptool.c:700:13: note: in expansion of macro 'ENABLED_OPT'
    |  700 |         if (ENABLED_OPT(INDER))
    |      |             ^~~~~~~~~~~
    |
  'main': event 10
    |
    |  705 |         if (HAVE_OPT(REQUEST_INFO))
    |      |            ^
    |      |            |
    |      |            (10) following 'false' branch...
    |
  'main': event 11
    |
    |ocsptool-options.h:116:56:
    |  116 | #define HAVE_OPT_RESPONSE_INFO ocsptool_options.present.response_info
    |      |                                ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~
    |      |                                                        |
    |      |                                                        (11) ...to here
ocsptool-options.h:102:24: note: in expansion of macro 'HAVE_OPT_RESPONSE_INFO'
    |  102 | #define HAVE_OPT(name) HAVE_OPT_ ## name
    |      |                        ^~~~~~~~~
ocsptool.c:707:18: note: in expansion of macro 'HAVE_OPT'
    |  707 |         else if (HAVE_OPT(RESPONSE_INFO))
    |      |                  ^~~~~~~~
    |
  'main': event 12
    |
    |  707 |         else if (HAVE_OPT(RESPONSE_INFO))
    |      |                 ^
    |      |                 |
    |      |                 (12) following 'false' branch...
    |
  'main': event 13
    |
    |ocsptool-options.h:117:59:
    |  117 | #define HAVE_OPT_GENERATE_REQUEST ocsptool_options.present.generate_request
    |      |                                   ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~
    |      |                                                           |
    |      |                                                           (13) ...to here
ocsptool-options.h:102:24: note: in expansion of macro 'HAVE_OPT_GENERATE_REQUEST'
    |  102 | #define HAVE_OPT(name) HAVE_OPT_ ## name
    |      |                        ^~~~~~~~~
ocsptool.c:709:18: note: in expansion of macro 'HAVE_OPT'
    |  709 |         else if (HAVE_OPT(GENERATE_REQUEST))
    |      |                  ^~~~~~~~
    |
  'main': event 14
    |
    |  709 |         else if (HAVE_OPT(GENERATE_REQUEST))
    |      |                 ^
    |      |                 |
    |      |                 (14) following 'false' branch...
    |
  'main': event 15
    |
    |ocsptool-options.h:114:58:
    |  114 | #define HAVE_OPT_VERIFY_RESPONSE ocsptool_options.present.verify_response
    |      |                                  ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~
    |      |                                                          |
    |      |                                                          (15) ...to here
ocsptool-options.h:102:24: note: in expansion of macro 'HAVE_OPT_VERIFY_RESPONSE'
    |  102 | #define HAVE_OPT(name) HAVE_OPT_ ## name
    |      |                        ^~~~~~~~~
ocsptool.c:711:18: note: in expansion of macro 'HAVE_OPT'
    |  711 |         else if (HAVE_OPT(VERIFY_RESPONSE))
    |      |                  ^~~~~~~~
    |
  'main': events 16-18
    |
    |  711 |         else if (HAVE_OPT(VERIFY_RESPONSE))
    |      |                 ^
    |      |                 |
    |      |                 (16) following 'true' branch...
    |  712 |                 verify_response(NULL);
    |      |                 ~~~~~~~~~~~~~~~~~~~~~
    |      |                 |
    |      |                 (17) ...to here
    |      |                 (18) calling 'verify_response' from 'main'
    |
    +--> 'verify_response': events 19-25
           |
           |  501 | static void verify_response(gnutls_datum_t *nonce)
           |      |             ^~~~~~~~~~~~~~~
           |      |             |
           |      |             (19) entry to 'verify_response'
           |......
           |  508 |         gnutls_x509_crt_t chain[MAX_CHAIN_SIZE];
           |      |                           ~~~~~
           |      |                           |
           |      |                           (20) region created on stack here
           |......
           |  516 |         if (dat.data == NULL) {
           |      |            ~ 
           |      |            |
           |      |            (21) following 'false' branch...
           |......
           |  520 |         dat.size = size;
           |      |         ~~~~~~~~~~~~~~~
           |      |                  |
           |      |                  (22) ...to here
           |  521 | 
           |  522 |         if (HAVE_OPT(LOAD_CHAIN)) {
           |      |            ~ 
           |      |            |
           |      |            (23) following 'true' branch...
           |  523 |                 chain_size = load_chain(chain);
           |      |                              ~~~~~~~~~~~~~~~~~
           |      |                              |
           |      |                              (24) ...to here
           |      |                              (25) calling 'load_chain' from 'verify_response'
           |
           +--> 'load_chain': events 26-28
                  |
                  |  451 | static unsigned load_chain(gnutls_x509_crt_t chain[MAX_CHAIN_SIZE])
                  |      |                 ^~~~~~~~~~
                  |      |                 |
                  |      |                 (26) entry to 'load_chain'
                  |  452 | {
                  |  453 |         if (HAVE_OPT(LOAD_CHAIN)) {
                  |      |            ~     
                  |      |            |
                  |      |            (27) following 'true' branch...
                  |......
                  |  457 |                 memset(&info, 0, sizeof(info));
                  |      |                 ~
                  |      |                 |
                  |      |                 (28) inlined call to 'memset' from 'load_chain'
                  |
                  +--> 'memset': event 29
                         |
                         |/usr/include/bits/string_fortified.h:59:10:
                         |   59 |   return __builtin___memset_chk (__dest, __ch, __len,
                         |      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
                         |      |          |
                         |      |          (29) ...to here
                         |   60 |                                  __glibc_objsize0 (__dest));
                         |      |                                  ~~~~~~~~~~~~~~~~~~~~~~~~~~
                         |
                  <------+
                  |
                'load_chain': event 30
                  |
                  |ocsptool.c:466:20:
                  |  466 |                 if (list_size > MAX_CHAIN_SIZE) {
                  |      |                    ^
                  |      |                    |
                  |      |                    (30) following 'false' branch...
                  |
                'load_chain': event 31
                  |
                  |cc1:
                  | (31): ...to here
                  |
                'load_chain': event 32
                  |
                  |  471 |                 for (i = 0; i < list_size; i++)
                  |      |                             ~~^~~~~~~~~~~
                  |      |                               |
                  |      |                               (32) following 'false' branch...
                  |
                'load_chain': event 33
                  |
                  |./../lib/includes/gnutls/gnutls.h:2302:24:
                  | 2302 | #define gnutls_free(a) gnutls_free((void *)(a)), a = NULL
                  |      |                        ^~~~~~~~~~~~~~~~~~~~~~~~
                  |      |                        |
                  |      |                        (33) ...to here
ocsptool.c:473:17: note: in expansion of macro 'gnutls_free'
                  |  473 |                 gnutls_free(list);
                  |      |                 ^~~~~~~~~~~
                  |
           <------+
           |
         'verify_response': events 34-39
           |
           |  523 |                 chain_size = load_chain(chain);
           |      |                              ^~~~~~~~~~~~~~~~~
           |      |                              |
           |      |                              (34) returning to 'verify_response' from 'load_chain'
           |  524 |                 if (chain_size < 1) {
           |      |                    ~          
           |      |                    |
           |      |                    (35) following 'false' branch (when 'chain_size != 0')...
           |......
           |  529 |                 if (chain_size == 1)
           |      |                    ~          
           |      |                    |
           |      |                    (36) ...to here
           |      |                    (37) following 'false' branch (when 'chain_size != 1')...
           |......
           |  532 |                         signer = chain[1];
           |      |                         ~~~~~~~~~~~~~~~~~
           |      |                                |
           |      |                                (38) ...to here
           |      |                                (39) use of uninitialized value 'chain[1]' here
           |
utils.c: In function '_fail':
utils.c:96:9: warning: ignoring return value of 'vasprintf' declared with attribute 'warn_unused_result' [-Wunused-result]
   96 |         vasprintf(&str, format, arg_ptr);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ex-serv-x509.c: In function 'main':
ex-serv-x509.c:113:9: warning: 'listen' on possibly invalid file descriptor 'listen_sd' [-Wanalyzer-fd-use-without-check]
  113 |         listen(listen_sd, 1024);
      |         ^~~~~~~~~~~~~~~~~~~~~~~
  'main': event 1
    |
    |   24 | #define CHECK(x) assert((x) >= 0)
    |      |                  ^~~~~~
    |      |                  |
    |      |                  (1) following 'true' branch...
ex-serv-x509.c:60:9: note: in expansion of macro 'CHECK'
    |   60 |         CHECK(gnutls_global_init());
    |      |         ^~~~~
    |
  'main': event 2
    |
    |   62 |         CHECK(gnutls_certificate_allocate_credentials(&x509_cred));
    |      |               ^
    |      |               |
    |      |               (2) ...to here
ex-serv-x509.c:62:9: note: in expansion of macro 'CHECK'
    |   62 |         CHECK(gnutls_certificate_allocate_credentials(&x509_cred));
    |      |         ^~~~~
    |
  'main': event 3
    |
    |   24 | #define CHECK(x) assert((x) >= 0)
    |      |                  ^~~~~~
    |      |                  |
    |      |                  (3) following 'true' branch...
ex-serv-x509.c:62:9: note: in expansion of macro 'CHECK'
    |   62 |         CHECK(gnutls_certificate_allocate_credentials(&x509_cred));
    |      |         ^~~~~
    |
  'main': event 4
    |
    |   64 |         CHECK(gnutls_certificate_set_x509_trust_file(x509_cred, CAFILE,
    |      |               ^
    |      |               |
    |      |               (4) ...to here
ex-serv-x509.c:64:9: note: in expansion of macro 'CHECK'
    |   64 |         CHECK(gnutls_certificate_set_x509_trust_file(x509_cred, CAFILE,
    |      |         ^~~~~
    |
  'main': event 5
    |
    |   24 | #define CHECK(x) assert((x) >= 0)
    |      |                  ^~~~~~
    |      |                  |
    |      |                  (5) following 'true' branch...
ex-serv-x509.c:64:9: note: in expansion of macro 'CHECK'
    |   64 |         CHECK(gnutls_certificate_set_x509_trust_file(x509_cred, CAFILE,
    |      |         ^~~~~
    |
  'main': event 6
    |
    |   67 |         CHECK(gnutls_certificate_set_x509_crl_file(x509_cred, CRLFILE,
    |      |               ^
    |      |               |
    |      |               (6) ...to here
ex-serv-x509.c:67:9: note: in expansion of macro 'CHECK'
    |   67 |         CHECK(gnutls_certificate_set_x509_crl_file(x509_cred, CRLFILE,
    |      |         ^~~~~
    |
  'main': event 7
    |
    |   24 | #define CHECK(x) assert((x) >= 0)
    |      |                  ^~~~~~
    |      |                  |
    |      |                  (7) following 'true' branch...
ex-serv-x509.c:67:9: note: in expansion of macro 'CHECK'
    |   67 |         CHECK(gnutls_certificate_set_x509_crl_file(x509_cred, CRLFILE,
    |      |         ^~~~~
    |
  'main': event 8
    |
    |   76 |         CHECK(gnutls_certificate_set_x509_key_file(x509_cred, CERTFILE, KEYFILE,
    |      |               ^
    |      |               |
    |      |               (8) ...to here
ex-serv-x509.c:76:9: note: in expansion of macro 'CHECK'
    |   76 |         CHECK(gnutls_certificate_set_x509_key_file(x509_cred, CERTFILE, KEYFILE,
    |      |         ^~~~~
    |
  'main': event 9
    |
    |   24 | #define CHECK(x) assert((x) >= 0)
    |      |                  ^~~~~~
    |      |                  |
    |      |                  (9) following 'true' branch...
ex-serv-x509.c:76:9: note: in expansion of macro 'CHECK'
    |   76 |         CHECK(gnutls_certificate_set_x509_key_file(x509_cred, CERTFILE, KEYFILE,
    |      |         ^~~~~
    |
  'main': event 10
    |
    |   79 |         CHECK(gnutls_certificate_set_ocsp_status_request_file(
    |      |               ^
    |      |               |
    |      |               (10) ...to here
ex-serv-x509.c:79:9: note: in expansion of macro 'CHECK'
    |   79 |         CHECK(gnutls_certificate_set_ocsp_status_request_file(
    |      |         ^~~~~
    |
  'main': event 11
    |
    |   24 | #define CHECK(x) assert((x) >= 0)
    |      |                  ^~~~~~
    |      |                  |
    |      |                  (11) following 'true' branch...
ex-serv-x509.c:79:9: note: in expansion of macro 'CHECK'
    |   79 |         CHECK(gnutls_certificate_set_ocsp_status_request_file(
    |      |         ^~~~~
    |
  'main': event 12
    |
    |   82 |         CHECK(gnutls_priority_init(&priority_cache, NULL, NULL));
    |      |               ^
    |      |               |
    |      |               (12) ...to here
ex-serv-x509.c:82:9: note: in expansion of macro 'CHECK'
    |   82 |         CHECK(gnutls_priority_init(&priority_cache, NULL, NULL));
    |      |         ^~~~~
    |
  'main': event 13
    |
    |   24 | #define CHECK(x) assert((x) >= 0)
    |      |                  ^~~~~~
    |      |                  |
    |      |                  (13) following 'true' branch...
ex-serv-x509.c:82:9: note: in expansion of macro 'CHECK'
    |   82 |         CHECK(gnutls_priority_init(&priority_cache, NULL, NULL));
    |      |         ^~~~~
    |
  'main': events 14-16
    |
    |   95 |         gnutls_certificate_set_known_dh_params(x509_cred,
    |      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |         |
    |      |         (14) ...to here
    |   96 |                                                GNUTLS_SEC_PARAM_MEDIUM);
    |      |                                                ~~~~~~~~~~~~~~~~~~~~~~~~
    |......
    |  101 |         listen_sd = socket(AF_INET, SOCK_STREAM, 0);
    |      |                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                     |
    |      |                     (15) when 'socket' fails
    |......
    |  113 |         listen(listen_sd, 1024);
    |      |         ~~~~~~~~~~~~~~~~~~~~~~~
    |      |         |
    |      |         (16) 'listen_sd' could be invalid
    |
tlsproxy/tlsproxy.c: In function 'runlistener':
tlsproxy/tlsproxy.c:228:16: warning: leak of file descriptor 'listenfd' [CWE-775] [-Wanalyzer-fd-leak]
  228 |         while (!rxsigquit) {
      |                ^~~~~~~~~~
  'runlistener': events 1-2
    |
    |  214 | static int runlistener(void)
    |      |            ^~~~~~~~~~~
    |      |            |
    |      |            (1) entry to 'runlistener'
    |......
    |  217 |         if ((listenfd = bindtoaddress(listenaddr)) < 0) {
    |      |                         ~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |                         |
    |      |                         (2) calling 'bindtoaddress' from 'runlistener'
    |
    +--> 'bindtoaddress': events 3-5
           |
           |   57 | static int bindtoaddress(char *addrport)
           |      |            ^~~~~~~~~~~~~
           |      |            |
           |      |            (3) entry to 'bindtoaddress'
           |......
           |   80 |         if (s != 0) {
           |      |            ~
           |      |            |
           |      |            (4) following 'false' branch (when 's == 0')...
           |......
           |   88 |         for (rp = result; rp != NULL; rp = rp->ai_next) {
           |      |              ~~~~~~~~~~~
           |      |                 |
           |      |                 (5) ...to here
           |
         'bindtoaddress': events 6-14
           |
           |   88 |         for (rp = result; rp != NULL; rp = rp->ai_next) {
           |      |                              ^
           |      |                              |
           |      |                              (6) following 'true' branch (when 'rp' is non-NULL)...
           |   89 |                 fd = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol);
           |      |                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                      |
           |      |                      (7) ...to here
           |      |                      (8) socket created here
           |      |                      (9) when 'socket' succeeds
           |   90 | 
           |   91 |                 if (fd >= 0) {
           |      |                    ~          
           |      |                    |
           |      |                    (10) following 'true' branch (when 'fd >= 0')...
           |   92 |                         int one = 1;
           |      |                             ~~~
           |      |                             |
           |      |                             (11) ...to here
           |   93 |                         if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one,
           |      |                            ~  
           |      |                            |
           |      |                            (12) following 'false' branch...
           |......
           |   98 |                         if (bind(fd, rp->ai_addr, rp->ai_addrlen) == 0)
           |      |                            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
           |      |                            ||
           |      |                            |(13) ...to here
           |      |                            (14) following 'true' branch...
           |
         'bindtoaddress': event 15
           |
           |cc1:
           | (15): ...to here
           |
         'bindtoaddress': events 16-20
           |
           |  104 |         if (!rp) {
           |      |            ^
           |      |            |
           |      |            (16) following 'false' branch (when 'rp' is non-NULL)...
           |......
           |  110 |         freeaddrinfo(result); /* No longer needed */
           |      |         ~~~~~~~~~~~~~~~~~~~~
           |      |         |
           |      |         (17) ...to here
           |  111 | 
           |  112 |         if (listen(fd, 5) < 0) {
           |      |            ~~~~~~~~~~~~~~
           |      |            ||
           |      |            |(18) stream socket marked as passive here via 'listen'
           |      |            |(19) when 'listen' succeeds
           |      |            (20) following 'false' branch...
           |
         'bindtoaddress': event 21
           |
           |cc1:
           | (21): ...to here
           |
    <------+
    |
  'runlistener': events 22-23
    |
    |  217 |         if ((listenfd = bindtoaddress(listenaddr)) < 0) {
    |      |            ~            ^~~~~~~~~~~~~~~~~~~~~~~~~
    |      |            |            |
    |      |            |            (22) returning to 'runlistener' from 'bindtoaddress'
    |      |            (23) following 'false' branch (when 'listenfd >= 0')...
    |
  'runlistener': event 24
    |
    |cc1:
    | (24): ...to here
    |
  'runlistener': event 25
    |
    |  228 |         while (!rxsigquit) {
    |      |                ^~~~~~~~~~
    |      |                |
    |      |                (25) following 'false' branch...
    |
  'runlistener': event 26
    |
    |cc1:
    | (26): ...to here
    |
  'runlistener': event 27
    |
    |  228 |         while (!rxsigquit) {
    |      |                ^~~~~~~~~~
    |      |                |
    |      |                (27) 'listenfd' leaks here
    |
libtool: warning: relinking 'libgnutlsxx.la'
libtool: warning: remember to run 'libtool --finish /usr/lib32'
libtool: warning: '../lib/libgnutls.la' has not been installed in '/usr/lib32'
libtool: warning: '../lib/libgnutls.la' has not been installed in '/usr/lib32'
libtool: warning: '../lib/libgnutls.la' has not been installed in '/usr/lib32'
libtool: warning: '/var/pisi/gnutls-3.8.10-24/work-emul32/gnutls-3.8.10/lib/libgnutls.la' has not been installed in '/usr/lib32'
libtool: warning: '../lib/libgnutls.la' has not been installed in '/usr/lib32'
libtool: warning: '../lib/libgnutls.la' has not been installed in '/usr/lib32'
libtool: warning: '../lib/libgnutls.la' has not been installed in '/usr/lib32'
libtool: warning: '../lib/libgnutls.la' has not been installed in '/usr/lib32'
libtool: warning: '/var/pisi/gnutls-3.8.10-24/work-emul32/gnutls-3.8.10/lib/libgnutls.la' has not been installed in '/usr/lib32'