BRANCH: master
COMMIT: 979f59850c72624137d25f80be4188c3ba6b5fa0
ISSUE COUNT: 16 [11 unconfirmed, 5 pending fix]
EXCLUDED: nothing
SUPERCEDES: #9573
ANALYZER BUILD: checker-279 (2016-11-14 15:34:09)

This report includes upstream repositories (leveldb, secp256k1). We may not want to fix them, but we should at least know about them, in case they cause issues. I can provide detailed reports for any of these, on request (see example of such a report for the `rpc/mining.cpp` error below).

DISCLAIMER: These results have not been thoroughly confirmed, and may be improbable or flat out invalid, but it's worth having a list of these somewhere.

# BITCOIN CORE [4 issues]

## LOGIC ERRORS [1 present, 1 confirmed]:
* [src/rpc/mining.cpp:652:39](https://github.com/bitcoin/bitcoin/blob/master/src/rpc/mining.cpp#L652): Called C++ object pointer is null ([see report](https://bc-2.jp/paths/report-1056de.html)) (RESOLVED BY #12963)
```C++
    result.pushKV("mintime", (int64_t)pindexPrev->GetMedianTimePast()+1);
                                      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```

## DEAD STORE [2 present, 2 confirmed]:
* [src/test/util_tests.cpp:952:13](https://github.com/bitcoin/bitcoin/blob/master/src/test/util_tests.cpp#L952): Value stored to 'rv' is never read (RESOLVED BY #12963)
```C++
            rv = write(fd, &ch, 1);
            ^    ~~~~~~~~~~~~~~~~~
```
* [src/wallet/test/coinselector_tests.cpp:550:9](https://github.com/bitcoin/bitcoin/blob/master/src/wallet/test/coinselector_tests.cpp#L550): Value stored to 'target' is never read (RESOLVED BY #12963)
```C++
        target = 0;
        ^        ~
```

## MEMORY ERROR [1 present, 0 confirmed]:
* [src/httpserver.cpp:606:15](https://github.com/bitcoin/bitcoin/blob/master/src/httpserver.cpp#L606): Potential leak of memory pointed to by 'ev'
```C++
    replySent = true;
    ~~~~~~~~~~^~~~~~
```

# LEVELDB [4 issues]

## LOGIC ERRORS [1 present, 1 confirmed]:
* [src/leveldb/port/port_posix.cc:60:15](https://github.com/bitcoin/bitcoin/blob/master/src/leveldb/port/port_posix.cc#L60): The left operand of '&' is a garbage value (RESOLVED BY https://github.com/bitcoin-core/leveldb/pull/16)
```C++
  return (ecx & (1 << 20)) != 0;
          ~~~ ^
```

## DEAD STORE [3 present, 0 confirmed]:
* [src/leveldb/db/log_reader.cc:42:5](https://github.com/bitcoin/bitcoin/blob/master/src/leveldb/db/log_reader.cc#L42): Value stored to 'offset_in_block' is never read
```C++
    offset_in_block = 0;
    ^                 ~
```
* [src/leveldb/db/log_reader.cc:103:13](https://github.com/bitcoin/bitcoin/blob/master/src/leveldb/db/log_reader.cc#L103): Value stored to 'in_fragmented_record' is never read
```C++
            in_fragmented_record = false;
            ^                      ~~~~~
```
* [src/leveldb/db/log_reader.cc:121:13](https://github.com/bitcoin/bitcoin/blob/master/src/leveldb/db/log_reader.cc#L121): Value stored to 'in_fragmented_record' is never read
```C++
            in_fragmented_record = false;
            ^                      ~~~~~
```

# SECP256K1 [8 issues]

## LOGIC ERRORS [7 present, 0 confirmed]:
* [src/field_5x52_impl.h:406:13](https://github.com/bitcoin/bitcoin/blob/master/src/secp256k1/src/field_5x52_impl.h#L406): Assigned value is garbage or undefined
```C
    r->n[0] += a->n[0];
            ^  ~~~~~~~
```
* [src/field_5x52_impl.h:390:13](https://github.com/bitcoin/bitcoin/blob/master/src/secp256k1/src/field_5x52_impl.h#L390): The left expression of the compound assignment is an uninitialized value. The computed value will also be garbage
```C
    r->n[0] *= a;
    ~~~~~~~ ^
```
* [src/field_5x52_impl.h:406:13](https://github.com/bitcoin/bitcoin/blob/master/src/secp256k1/src/field_5x52_impl.h#L406): The left expression of the compound assignment is an uninitialized value. The computed value will also be garbage
```C
    r->n[0] += a->n[0];
    ~~~~~~~ ^
```
* [src/util.h:24:5](https://github.com/bitcoin/bitcoin/blob/master/src/secp256k1/src/util.h#L24): Access to field 'fn' results in a dereference of a null pointer (loaded from variable 'cb')
```C
    cb->fn(text, (void*)cb->data);
    ^~~~~~
```
* [src/scalar_4x64_impl.h:60:20](https://github.com/bitcoin/bitcoin/blob/master/src/secp256k1/src/scalar_4x64_impl.h#L60): The left operand of '<' is a garbage value
```C
    no |= (a->d[3] < SECP256K1_N_3); /* No need for a > check. */
           ~~~~~~~ ^
```
* [src/ecmult_impl.h:217:12](https://github.com/bitcoin/bitcoin/blob/master/src/secp256k1/src/ecmult_impl.h#L217): Access to field 'pre_g' results in a dereference of a null pointer (loaded from variable 'ctx')
```C
    return ctx->pre_g != NULL;
           ^~~~~~~~~~
```
* [src/ecmult_gen_impl.h:95:12](https://github.com/bitcoin/bitcoin/blob/master/src/secp256k1/src/ecmult_gen_impl.h#L95): Access to field 'prec' results in a dereference of a null pointer (loaded from variable 'ctx')
```C
    return ctx->prec != NULL;
           ^~~~~~~~~
```

## DEAD STORE [1 present, 1 confirmed]
* [src/ecmult_gen_impl.h:153:5](https://github.com/bitcoin/bitcoin/blob/master/src/secp256k1/src/ecmult_gen_impl.h#L153): Value stored to 'bits' is never read (RESOLVED BY https://github.com/bitcoin-core/secp256k1/pull/485)
```C
    bits = 0;
    ^      ~
```

result.pushKV("transactions", transactions);
    result.pushKV("coinbaseaux", aux);
    result.pushKV("coinbasevalue", (int64_t)pblock->vtx[0]->vout[0].nValue);
    result.pushKV("longpollid", chainActive.Tip()->GetBlockHash().GetHex() + i64tostr(nTransactionsUpdatedLast));
    result.pushKV("target", hashTarget.GetHex());
    result.pushKV("mintime", (int64_t)pindexPrev->GetMedianTimePast()+1);
    result.pushKV("mutable", aMutable);
    result.pushKV("noncerange", "00000000ffffffff");
    int64_t nSigOpLimit = MAX_BLOCK_SIGOPS_COST;
    int64_t nSizeLimit = MAX_BLOCK_SERIALIZED_SIZE;
    if (fPreSegWit) {
        assert(nSigOpLimit % WITNESS_SCALE_FACTOR == 0);
        nSigOpLimit /= WITNESS_SCALE_FACTOR;
        assert(nSizeLimit % WITNESS_SCALE_FACTOR == 0);
        nSizeLimit /= WITNESS_SCALE_FACTOR;
    }
    result.pushKV("sigoplimit", nSigOpLimit);
    result.pushKV("sizelimit", nSizeLimit);
    if (!fPreSegWit) {
        result.pushKV("weightlimit", (int64_t)MAX_BLOCK_WEIGHT);
    }
    result.pushKV("curtime", pblock->GetBlockTime());
    result.pushKV("bits", strprintf("%08x", pblock->nBits));
    result.pushKV("height", (int64_t)(pindexPrev->nHeight+1));
    if (!pblocktemplate->vchCoinbaseCommitment.empty() && fSupportsSegwit) {
        result.pushKV("default_witness_commitment", HexStr(pblocktemplate->vchCoinbaseCommitment.begin(), pblocktemplate->vchCoinbaseCommitment.end()));
    }
    return result;
}
class submitblock_StateCatcher : public CValidationInterface