Примеры ошибок, обнаруженных с помощью диагностики V547

V547. Expression is always true/false.

Shareaza

V547 Expression 'pBytes [ 0 ] == 0xEF' is always false. The value range of signed char type: [-128, 127]. Shareaza remote.cpp 350

void CRemote::Output(LPCTSTR pszName)
{

  ....
  CHAR* pBytes = new CHAR[ nBytes ];
  hFile.Read( pBytes, nBytes );
  ....
  if ( nBytes > 3 &&
       pBytes[0] == 0xEF &&
       pBytes[1] == 0xBB &&
       pBytes[2] == 0xBF )
  {
    pBytes += 3;
    nBytes -= 3;
    bBOM = true;
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'pBytes [ 1 ] == 0xBB' is always false. The value range of signed char type: [-128, 127]. Shareaza remote.cpp 350
• V547 Expression 'pBytes [ 2 ] == 0xBF' is always false. The value range of signed char type: [-128, 127]. Shareaza remote.cpp 350

Shareaza

V547 Expression is always false. Unsigned type value is never < 0. BugTrap encoding.cpp 425

size_t UTF16BeDecodeChar(BYTE* pBytes, size_t nNumBytes,
                         TCHAR arrChar[2], size_t& nCharSize)
{
  if (UTF16BeToLeChar(pBytes, nNumBytes) < 0)
  {
    nCharSize = MAXSIZE_T;
    return 0;
  }
  return UTF16LeDecodeChar(pBytes, nNumBytes,
                           arrChar, nCharSize);
}

In case of an error, the UTF16BeToLeChar() function returns MAXSIZE_T. This case will be handled incorrectly.

Shareaza

V547 Expression 'nCharPos >= 0' is always true. Unsigned type value is always >= 0. BugTrap xmlreader.h 946

inline void CXmlReader::CXmlInputStream::UnsafePutCharsBack(
  const TCHAR* pChars, size_t nNumChars)
{
  if (nNumChars > 0)
  {
    for (size_t nCharPos = nNumChars - 1;
         nCharPos >= 0;
         --nCharPos)
      UnsafePutCharBack(pChars[nCharPos]);
  }
}

Infinite loop.

VirtualDub

V547 Expression 'c < 0' is always false. Unsigned type value is never < 0. Ami lexer.cpp 225

typedef unsigned short wint_t;

void lexungetc(wint_t c) {
  if (c < 0)
    return;

  g_backstack.push_back(c);
}

VirtualDub

V547 Expression 'c < 0' is always false. Unsigned type value is never < 0. Ami lexer.cpp 279

typedef unsigned short wint_t;

wint_t lexgetescape() {
  wint_t c = lexgetc();
  if (c < 0)
    fatal("Newline found in escape sequence");
  ....
}

Geocoding with SQL-Server

V547 Expression '* s > 127' is always false. The value range of signed char type: [-128, 127]. Shp2Xml shp2xml.cpp 18

char *chkXml(char *buf) {
 for (char *s = buf; *s; s++)
   if (*s == '&') *s = '/';
   ....
   else if (*s > 127) *s = '~';
 return buf;
}

Ultimate TCP/IP

V547 Expression '( len - indx ) >= 0' is always true. Unsigned type value is always >= 0. UTDns utstrlst.cpp 58

void CUT_StrMethods::RemoveCRLF(LPSTR buf)
{
  // v4.2 changed to size_t
  size_t  len, indx = 1;
  if(buf != NULL){
    len = strlen(buf);
    while((len - indx) >= 0 && indx <= 2) {
      if(buf[len - indx] == '\r' ||
         buf[len - indx] == '\n')
         buf[len - indx] = 0;
      ++indx;
    }
  }
}

This is an example of potential vulnerability. When processing an empty string, the (len - indx) expression will equal 0xFFFFFFFFu. The value 0xFFFFFFFFu is above 0. An array overrun will occur.

Similar errors can be found in some other places:

• V547 Expression '( len - indx ) >= 0' is always true. Unsigned type value is always >= 0. UTDns utstrlst.cpp 75

Ultimate TCP/IP

V547 Expression 'loop >= 0' is always true. Unsigned type value is always >= 0. UTDns utstrlst.cpp 430

void CUT_StrMethods::RemoveSpaces(LPSTR szString) {
  ....
  size_t loop, len = strlen(szString);
  // Remove the trailing spaces
  for(loop = (len-1); loop >= 0; loop--) {
    if(szString[loop] != ' ')
      break;
  }
  ....
}

An example of potential vulnerability. If a string contains only blanks, an array overrun will occur.

Similar errors can be found in some other places:

• V547 Expression 'loop >= 0' is always true. Unsigned type value is always >= 0. UTDns utstrlst.cpp 458

Ultimate TCP/IP

V547 Expression 'buf[t] > 127' is always false. The value range of signed char type: [-128, 127]. UTImap4 utmime.cpp 320

int CUT_MimeEncode::Encode7bit(....)
{
  ....
  char buf[1000];
  ....
  for ( t=0; t<bytesRead; t++ ) {
    if (buf[t]==0 || buf[t]>127) {
      retval = UTE_ENCODING_INVALID_CHAR;
      break;
    }
  ....
}

Ultimate Toolbox

V547 Expression 'lpDrawItemStruct -> itemID >= 0' is always true. Unsigned type value is always >= 0. UT oxautolistbox.cpp 56

void COXAutoListBox::DrawItem(....)
{
  ....
  if (lpDrawItemStruct->itemID>=0)
  {
    ....
  }
  ....
}

Most likely this is what should be written here: (lpDrawItemStruct->itemID != (UINT)(-1))

Ultimate Toolbox

V547 Expression 'lpms -> itemID < 0' is always false. Unsigned type value is never < 0. UT oxcoolcombobox.cpp 476

void COXCoolComboBox::MeasureItem(....)
{
  if(lpms->itemID<0)
    lpms->itemHeight=m_nDefaultFontHeight+1;
  else
    lpms->itemHeight=
      m_nDefaultFontHeightSansLeading+1;
}

Ultimate Toolbox

V547 Expression 'chNewChar >= 128' is always false. The value range of signed char type: [-128, 127]. UT oxmaskededit.cpp 81

BOOL CMaskData::IsValidInput(TCHAR chNewChar)
{
   ....
  if((chNewChar >= 128) && (chNewChar <= 255))
    bIsValidInput=TRUE ;
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'chNewChar <= 255' is always true. The value range of signed char type: [-128, 127]. UT oxmaskededit.cpp 81

Ultimate Toolbox

V547 Expression 'm_nCurrentIndex - nOffset < 0' is always false. Unsigned type value is never < 0. UT oxprocess.cpp 594

int m_nCurrentIndex;
....
BOOL COXProcessIterator::Prev(UINT nOffset)
{
  ....
  if(m_nCurrentIndex-nOffset<0)
    return FALSE;
  ....
}

Since the "m_nCurrentIndex-nOffset" expression has the unsigned type, it can never be below 0.

TortoiseSVN

V547 Expression 'c >= 0x80' is always false. The value range of signed char type: [-128, 127]. pathutils.cpp 559

CString CPathUtils::PathUnescape (const char* path)
{
  // try quick path
  size_t i = 0;
  for (; char c = path[i]; ++i)
    if ((c >= 0x80) || (c == '%'))
    {
      // quick path does not work for
      // non-latin or escaped chars
      std::string utf8Path (path);
      CPathUtils::Unescape (&utf8Path[0]);
      return CUnicodeUtils::UTF8ToUTF16 (utf8Path);
    }
  ....
}

TortoiseSVN

V547 Expression '* utf8CheckBuf == 0xC0' is always false. The value range of signed char type: [-128, 127]. tortoiseblame.cpp 310

BOOL TortoiseBlame::OpenFile(const TCHAR *fileName)
{
  ....
  // check each line for illegal utf8 sequences.
  // If one is found, we treat
  // the file as ASCII, otherwise we assume
  // an UTF8 file.
  char * utf8CheckBuf = lineptr;
  while ((bUTF8)&&(*utf8CheckBuf))
  {
    if ((*utf8CheckBuf == 0xC0)||
        (*utf8CheckBuf == 0xC1)||
        (*utf8CheckBuf >= 0xF5))
    {
      bUTF8 = false;
      break;
    }

   ....
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression '* utf8CheckBuf == 0xC1' is always false. The value range of signed char type: [-128, 127]. tortoiseblame.cpp 311
• V547 Expression '* utf8CheckBuf >= 0xF5' is always false. The value range of signed char type: [-128, 127]. tortoiseblame.cpp 312

TortoiseSVN

V547 Expression 'endRevision < 0' is always false. Unsigned type value is never < 0. cachelogquery.cpp 999

typedef index_t revision_t;
....
void CCacheLogQuery::InternalLog (
   revision_t startRevision
 , revision_t endRevision
 , const CDictionaryBasedTempPath& startPath
 , int limit
 , const CLogOptions& options)
{
  ....
  // we cannot receive logs for rev < 0
  if (endRevision < 0)
    endRevision = 0;

  ....
}

Negative values simply cannot appear here. The endRevision variable has the unsigned type and, therefore, endRevision is always >=0. The potential danger is this: if a negative value was cast to the unsigned type somewhere before, we will be handling a very big number. And there's no check for that.

TraceTool

V547 Expression '(m_socketHandle = socket (2, 1, 0)) < 0' is always false. Unsigned type value is never < 0. Vs8_Win_Lib tracetool.cpp 871

static UINT_PTR m_socketHandle ;

void TTrace::LoopMessages(void)
{
  ....
  // Socket creation
  if ( (m_socketHandle = socket(AF_INET,SOCK_STREAM,0)) < 0)
  {
    continue;
  }
  ....
}

FCEUX

V547 Expression 'x < 0' is always false. Unsigned type value is never < 0. fceux gui.cpp 32

void CenterWindow(HWND hwndDlg)
{
  ....
  unsigned x = ((rectP.right-rectP.left) - width) / 2 +
               rectP.left;
  unsigned y = ((rectP.bottom-rectP.top) - height) / 2 +
               rectP.top;
  ....
  // make sure that the dialog box never moves outside
  // of the screen
  if(x < 0) x = 0;
  if(y < 0) y = 0;
  if(x + width  > screenwidth)  x = screenwidth  - width;
  if(y + height > screenheight) y = screenheight - height;
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'y < 0' is always false. Unsigned type value is never < 0. fceux gui.cpp 33

IPP Samples

V547 Expression '* pTrack >= 0' is always true. Unsigned type value is always >= 0. demuxer umc_stream_parser.cpp 179

typedef signed int     Ipp32s;
typedef unsigned int   Ipp32u;

Ipp32s StreamParser::GetTrackByPidOrCreateNew(Ipp32s iPid,
                                              bool *pIsNew)
{
  ....
  else if (!pIsNew || m_uiTracks >= MAX_TRACK)
    return -1;
  ....
}

Status StreamParser::GetNextData(MediaData *pData,
                                 Ipp32u *pTrack)
{
  ....
  *pTrack = GetTrackByPidOrCreateNew(m_pPacket->iPid, NULL);

  if (*pTrack >= 0 && TRACK_LPCM == m_pInfo[*pTrack]->m_Type)
    ippsSwapBytes_16u_I((Ipp16u *)pData->GetDataPointer(),
                        m_pPacket->uiSize / 2);
  ....
}

IPP Samples

V547 Expression 'memSize < 0' is always false. Unsigned type value is never < 0. vc1_enc umc_vc1_enc_planes.h 200

typedef unsigned int    Ipp32u;

UMC::Status Init(..., Ipp32u memSize, ...)
{
  ....
  memSize -= UMC::align_value<Ipp32u>(m_nFrames*sizeof(Frame));
  if(memSize < 0)
      return UMC::UMC_ERR_NOT_ENOUGH_BUFFER;
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'memSize < 0' is always false. Unsigned type value is never < 0. vc1_enc umc_vc1_enc_planes.h 211
• V547 Expression 'memSize < 0' is always false. Unsigned type value is never < 0. vc1_enc umc_vc1_enc_mb.cpp 64
• V547 Expression 'memSize < 0' is always false. Unsigned type value is never < 0. vc1_enc umc_vc1_enc_mb.cpp 73
• And 5 additional diagnostic messages.

IPP Samples

V547 Expression 'm_iCurrMBIndex - x < 0' is always false. Unsigned type value is never < 0. vc1_enc umc_vc1_enc_mb.cpp 188

Ipp32u m_iCurrMBIndex;

VC1EncoderMBInfo *
VC1EncoderMBs::GetPevMBInfo(Ipp32s x, Ipp32s y)
{
   Ipp32s row = (y>0)? m_iPrevRowIndex:m_iCurrRowIndex;
   return ((m_iCurrMBIndex - x <0 || row <0) ?
          0 :
          &m_MBInfo[row][m_iCurrMBIndex - x]);
}

Since the check doesn't work, we may easily get an array overrun.

DOSBox

V547 Expression is always true. Unsigned type value is always >= 0. dosbox libserial.cpp 155

void SERIAL_getErrorString(char* buffer, int length) {
  ....
  if((length - sysmsg_offset -
      strlen((const char*)sysmessagebuffer)) >= 0)
     memcpy(buffer + sysmsg_offset, sysmessagebuffer,
            strlen((const char*)sysmessagebuffer));
  ....
}

This is an example of unsafe code from the viewpoint of buffer overflows. The strlen() function returns size_t. It means that the check for buffer overflow doesn't work.

Miranda IM

V547 Expression 'newItem >= 0' is always true. Unsigned type value is always >= 0. avs options.cpp 265

INT_PTR CALLBACK DlgProcOptionsProtos(....)
{
  ....
  UINT64 newItem = 0;
  ....
  newItem = ListView_InsertItem(hwndList, &item);
  if(newItem >= 0)
    ListView_SetCheckState(....);
  ....
}

Miranda IM

V547 Expression 'nGroupsCount < 0' is always false. Unsigned type value is never < 0. import mirabilis.c 1416

extern DWORD nMessagesCount;

static void MirabilisImport(HWND hdlgProgressWnd)
{
  ....
  nGroupsCount = ImportGroups();
  if (nGroupsCount < 0) {
    AddMessage( LPGEN("Group import was not completed."));
    nGroupsCount = 0;
  }
  ....
}

Miranda IM

V547 Expression 'wParam >= 0' is always true. Unsigned type value is always >= 0. clist_mw cluiframes.c 3140

typedef UINT_PTR WPARAM;

static int id2pos(int id)
{
  int i;
  if (FramesSysNotStarted) return -1;
  for (i=0;i<nFramescount;i++)
  {
    if (Frames[i].id==id) return(i);
  }
  return(-1);
}

INT_PTR CLUIFrameSetFloat(WPARAM wParam,LPARAM lParam)
{
  ....
  wParam=id2pos(wParam);
  if(wParam>=0&&(int)wParam<nFramescount)
    if (Frames[wParam].floating)
  ....
}

Miranda IM

V547 Expression is always true. Unsigned type value is always >= 0. scriver msgoptions.c 458

WINUSERAPI
UINT
WINAPI
GetDlgItemInt(
    __in HWND hDlg,
    __in int nIDDlgItem,
    __out_opt BOOL *lpTranslated,
    __in BOOL bSigned);

#define SRMSGSET_LIMITNAMESLEN_MIN 0

static INT_PTR CALLBACK DlgProcTabsOptions(....)
{
  ....
  limitLength =
    GetDlgItemInt(hwndDlg, IDC_LIMITNAMESLEN, NULL, TRUE) >=
    SRMSGSET_LIMITNAMESLEN_MIN ?
    GetDlgItemInt(hwndDlg, IDC_LIMITNAMESLEN, NULL, TRUE) :
    SRMSGSET_LIMITNAMESLEN_MIN;
  ....
}

Miranda IM

V547 Expression 'nOldLength < 0' is always false. Unsigned type value is never < 0. IRC mstring.h 229

void Append( PCXSTR pszSrc, int nLength )
{
  ....
  UINT nOldLength = GetLength();
  if (nOldLength < 0)
  {
    // protects from underflow
    nOldLength = 0;
  }
  ....
}

Miranda IM

V547 Expression 'ft->std.currentFileSize < 0' is always false. Unsigned type value is never < 0. jabber jabber_file.cpp 92

typedef struct tagPROTOFILETRANSFERSTATUS
{
  ....
  unsigned __int64 currentFileSize;
  ....
} PROTOFILETRANSFERSTATUS;

//There is this place in the program code:
ft->std.currentFileSize = -1;


void __cdecl CJabberProto::FileReceiveThread(filetransfer* ft)
{
  ....
  if (ft->state==FT_DONE ||
      ( ft->state==FT_RECEIVING && ft->std.currentFileSize < 0 ))
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'ft->std.currentFileSize < 0' is always false. Unsigned type value is never < 0. jabber jabber_file.cpp 168

StrongDC++

V547 Expression 'totalsize < 0' is always false. Unsigned type value is never < 0. client queuemanager.cpp 2230

uint64_t QueueManager::FileQueue::getTotalQueueSize(){
  uint64_t totalsize = 0;
  ....
  if(totalsize < 0)
    totalsize = 0;
  ....
}

Chromium

V547 Expression 'current_idle_time < 0' is always false. Unsigned type value is never < 0. browser idle_win.cc 23

IdleState CalculateIdleState(unsigned int idle_threshold) {
  ....
  DWORD current_idle_time = 0;
  ....
  // Will go -ve if we have been idle for
  // a long time (2gb seconds).
  if (current_idle_time < 0)
    current_idle_time = INT_MAX;
  ....
}

Chromium

V547 Expression 'count < 0' is always false. Unsigned type value is never < 0. ncdecode_tablegen ncdecode_tablegen.c 197

static void CharAdvance(char** buffer,
                        size_t* buffer_size,
                        size_t count) {
  if (count < 0) {
    NaClFatal("Unable to advance buffer by count!");
  } else {
  ....
}

ICU

V547 Expression '* string != 0 || * string != '_'' is always true. Probably the '&&' operator should be used here. icui18n ucol_sit.cpp 242

U_CDECL_BEGIN static const char* U_CALLCONV
_processVariableTop(....)
{
  ....
  if(i == locElementCapacity &&
     (*string != 0 || *string != '_')) {
    *status = U_BUFFER_OVERFLOW_ERROR;
  }
  ....
}

Network Security Services (NSS)

V547 Expression 'input.len < 0' is always false. Unsigned type value is never < 0. nss pk11merge.c 491

struct SECItemStr {
  ....
  unsigned int len;
};

static SECStatus
pk11_mergeSecretKey(....)
{
  ....
  if (input.len < 0) {
    rv = SECFailure;
    goto done;
  }
  ....
}

Qt

V547 Expression '-- size >= 0' is always true. Unsigned type value is always >= 0. QtCLucene arrays.h 154

bool equals( class1* val1, class2* val2 ) const{
{
  ....
  size_t size = val1->size();
  ....
  while ( --size >= 0 ){
    if ( !comp(*itr1,*itr2) )
      return false;
    itr1++;
    itr2++;
  }
  ....
}

An array overrun may surely occur.

Qt

V547 Expression 'q->getQueryName () != L"BooleanQuery"' is always true. To compare strings you should use wcscmp() function. QtCLucene multifieldqueryparser.cpp 44

const TCHAR* getQueryName() const;

Query* MultiFieldQueryParser::parse(....)
{
  ....
  if (q && (q->getQueryName() != _T("BooleanQuery")
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'q->getQueryName () != L"BooleanQuery"' is always true. To compare strings you should use wcscmp() function. QtCLucene multifieldqueryparser.cpp 63

MySQL

V547 Expression 'str [0] != 'a' || str [0] != 'A'' is always true. Probably the '&&' operator should be used here. clientlib my_time.c 340

enum enum_mysql_timestamp_type
str_to_datetime(....)
{
  ....
  else if (str[0] != 'a' || str[0] != 'A')
    continue; /* Not AM/PM */
  ....
}

Apache HTTP Server

V547 Expression 'len < 0' is always false. Unsigned type value is never < 0. aprutil apr_memcache.c 814

typedef  size_t      apr_size_t;

APU_DECLARE(apr_status_t) apr_memcache_getp(....)
{
  ....
  apr_size_t len = 0;
  ....
  len = atoi(length);
  ....
  if (len < 0) {
    *new_length = 0;
    *baton = NULL;
  }
  else {
    ....
  }
}

Apache HTTP Server

V547 Expression 'csd < 0' is always false. Unsigned type value is never < 0. libhttpd child.c 404

typedef UINT_PTR SOCKET;

static unsigned int __stdcall win9x_accept(void * dummy)
{
  SOCKET csd;
  ....
  do {
      clen = sizeof(sa_client);
      csd = accept(nsd, (struct sockaddr *) &sa_client, &clen);
  } while (csd < 0 &&
           APR_STATUS_IS_EINTR(apr_get_netos_error()));
  ....
}

Intel AMT SDK

V547 Expression '_username == ""' is always false. To compare strings you should use strcmp() function. Discovery discoverysample.cpp 184

static char* _username = "";
static char* _password = "";
static char* _host = "";
static char* _hostMask = "";

if (((_username == "") && (_password != "")) ||
    ((_username != "") && (_password == "")))

This code is dangerous and incorrect. But sometimes it will work - when the whole code is in one module (one *.obj). The compiler will create only one empty string in memory.

Intel AMT SDK

V547 Expression 'bytesRead < 0' is always false. Unsigned type value is never < 0. RemoteConsole remote.c 173

int ReadFileData(char* fileName, UINT8 data[], size_t size)
{
  size_t fileSize , bytesRead;
  ....
  bytesRead = read(fileno(fileHandle), data, (int) size);

  if (bytesRead < 0)
  {
    printf("Error while Reading file %s : %s",
           fileName, strerror(errno));
    bytesRead = 0;
  }
  ....
}

Intel AMT SDK

V547 Expression 'bytesRead < 0' is always false. Unsigned type value is never < 0. ZTCLocalAgent heciwin.cpp 357

int HECIWin::_doIoctl(....)
{
  DWORD bytesRead = 0;
  ....
  if (bytesRead < 0) {
    Deinit();
  }
  ....
}

TrueCrypt

V547 Expression 'fileDataEndPos < 0' is always false. Unsigned type value is never < 0. Setup selfextract.c 551

BOOL SelfExtractInMemory (char *path)
{
  unsigned int fileDataEndPos = 0;
  ....
  if (fileDataEndPos < 0)
  {
    Error ("CANNOT_READ_FROM_PACKAGE");
    return FALSE;
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'fileDataStartPos < 0' is always false. Unsigned type value is never < 0. Setup selfextract.c 560

ReactOS

V547 Expression is always false. Probably the '||' operator should be used here. ws2_32_new sockctrl.c 55

INT
WSAAPI
connect(IN SOCKET s,
        IN CONST struct sockaddr *name,
        IN INT namelen)
{
  ....
  /* Check if error code was due to the host not being found */
  if ((Status == SOCKET_ERROR) &&
      (ErrorCode == WSAEHOSTUNREACH) &&
      (ErrorCode == WSAENETUNREACH))
  {
  ....
}

ReactOS

V547 Expression is always true. Probably the '&&' operator should be used here. win32k arc.c 67

typedef enum _ARCTYPE
{
    GdiTypeArc,
    GdiTypeArcTo,
    GdiTypeChord,
    GdiTypePie,
} ARCTYPE, *PARCTYPE;

BOOL IntArc(....)
{
  ....
  if ((Left == Right) ||
      (Top == Bottom) ||
      (((arctype != GdiTypeArc) ||
        (arctype != GdiTypeArcTo)) &&
       ((Right - Left == 1) ||
       (Bottom - Top == 1))
      )
     )
      return TRUE;
  ....
}

Most likely this is what should be written here: (arctype != GdiTypeArc) && (arctype != GdiTypeArcTo)

ReactOS

V547 Expression 'LeftOfBuffer < 0' is always false. Unsigned type value is never < 0. svchost svchost.c 56

BOOL PrepareService(LPCTSTR ServiceName)
{
  DWORD LeftOfBuffer = sizeof(ServiceKeyBuffer) /
                       sizeof(ServiceKeyBuffer[0]);
  ....
  LeftOfBuffer -= _tcslen(SERVICE_KEY);
  ....
  LeftOfBuffer -= _tcslen(ServiceName);
  ....
  LeftOfBuffer -= _tcslen(PARAMETERS_KEY);
  ....
  if (LeftOfBuffer < 0)
  {
    DPRINT1("Buffer overflow for service name: '%s'\n",
            ServiceName);
    return FALSE;
  }
  ....
}

There are a lot of such fragments in ReactOS, but I cannot say for sure how critical they are.

ReactOS

V547 Expression '(Minor != 0x02) || (Minor != 0x13)' is always true. Probably the '&&' operator should be used here. ramdisk ramdisk.c 1955

#define IRP_MN_REMOVE_DEVICE      0x02
#define IRP_MN_QUERY_ID           0x13

NTSTATUS
RamdiskPnp(IN PDEVICE_OBJECT DeviceObject,
           IN PIRP Irp)
{
  ....
  // Only remove-device and query-id are allowed
  if ((Minor != IRP_MN_REMOVE_DEVICE) ||
      (Minor != IRP_MN_QUERY_ID))
  ....
}

This is what should have been written here: ((Minor == IRP_MN_REMOVE_DEVICE) || (Minor == IRP_MN_QUERY_ID))

Similar errors can be found in some other places:

• V547 Expression is always true. Probably the '&&' operator should be used here. ntoskrnl section.c 1685
• V547 Expression is always true. Probably the '&&' operator should be used here. fastfat create.c 456

ReactOS

V547 Expression is always false. Unsigned type value is never < 0. opengl32 font.c 1099

BOOL APIENTRY IntUseFontOutlinesW(....)
{
  ....
  if (GetGlyphOutline(hDC, glyphIndex, GGO_NATIVE,
       &glyphMetrics, glyphBufSize, glyphBuf, &matrix) < 0)
  {
    HeapFree(GetProcessHeap(), 0, glyphBuf);
    return FALSE; /*WGL_STATUS_FAILURE*/
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'glyphSize < 0' is always false. Unsigned type value is never < 0. opengl32 font.c 1084

ReactOS

V547 Expression 'IntEaLength >= 0' is always true. Unsigned type value is always >= 0. ntoskrnl util.c 220

NTSTATUS
IoCheckEaBufferValidity(....)
{
  ULONG NextEaBufferOffset, IntEaLength;
  ....
  if (IntEaLength >= 0)
  {
    EaBufferEnd = (PFILE_FULL_EA_INFORMATION)
      ((ULONG_PTR)EaBufferEnd +
      EaBufferEnd->NextEntryOffset);
    continue;
  }
}

Similar errors can be found in some other places:

• V547 Expression 'IntEaLength >= 0' is always true. Unsigned type value is always >= 0. ntoskrnl util.c 198

ReactOS

V547 Expression 'i < 512' is always true. The value range of unsigned char type: [0, 255]. freeldr_common xboxhw.c 344

static VOID
DetectBiosDisks(....)
{
  UCHAR DiskCount, i;
  ....
  for (i = 0; ! Changed && i < 512; i++)
  {
    Changed = ((PUCHAR)DISKREADBUFFER)[i] != 0xcd;
  }
  ....
}

An infinite loop will occur here if the first 255 bytes contain value 0xcd.

Similar errors can be found in some other places:

• V547 Expression 'i < 512' is always true. The value range of unsigned char type: [0, 255]. freeldr_common hardware.c 826

ReactOS

V547 Expression 'ads->tcpsocket >= 0' is always true. Unsigned type value is always >= 0. adns setup.c 683

typedef UINT_PTR SOCKET;

#define ADNS_SOCKET SOCKET

struct adns__state {
  ....
  ADNS_SOCKET udpsocket, tcpsocket;
  ....
};

void adns_finish(adns_state ads) {
  ....
  if (ads->tcpsocket >= 0) adns_socket_close(ads->tcpsocket);
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'ads->udpsocket < 0' is always false. Unsigned type value is never < 0. adns setup.c 539
• V547 Expression 'fd < 0' is always false. Unsigned type value is never < 0. adns event.c 117

Chromium

V547 Expression is always true. Probably the '&&' operator should be used here. webrtc_vplib interpolator.cc 119

WebRtc_Word32
interpolator::SupportedVideoType(VideoType srcVideoType,
                                 VideoType dstVideoType)
{
  ....
  if ((srcVideoType != kI420) ||
      (srcVideoType != kIYUV) ||
      (srcVideoType != kYV12))
  {
      return -1;
  }
  ....
}

Mozilla Firefox

V547 Expression 'c < 0' is always false. Unsigned type value is never < 0. updater.cpp 1179

int
PatchFile::LoadSourceFile(FILE* ofile)
{
  ....
  size_t c = fread(rb, 1, r, ofile);
  if (c < 0) {
    LOG(("LoadSourceFile: error reading destination file: "
         LOG_S "\n", mFile));
    return READ_ERROR;
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'c < 0' is always false. Unsigned type value is never < 0. updater.cpp 2373
• V547 Expression 'c < 0' is always false. Unsigned type value is never < 0. bspatch.cpp 107

Mozilla Firefox

V547 Expression is always true. Unsigned type value is always >= 0. exception_handler.cc 846

bool ExceptionHandler::WriteMinidumpForChild(....)
{
  ....
  DWORD last_suspend_cnt = -1;
  ....
  // this thread may have died already, so not opening
  // the handle is a non-fatal error
  if (NULL != child_thread_handle) {
    if (0 <=
        (last_suspend_cnt = SuspendThread(child_thread_handle)))
    {
  ....
}

Most likely this is what should be written here: (((DWORD) -1) != (last_suspend_cnt = SuspendThread(child_thread_handle))).

Similar errors can be found in some other places:

• V547 Expression '0 <= last_suspend_cnt' is always true. Unsigned type value is always >= 0. exception_handler.cc 869

Mozilla Firefox

V547 Expression 'index < 0' is always false. Unsigned type value is never < 0. nsieprofilemigrator.cpp 622

PRBool
nsIEProfileMigrator::TestForIE7()
{
  ....
  PRUint32 index = ieVersion.FindChar('.', 0);
  if (index < 0)
    return PR_FALSE;
  ....
}

Notepad++

V547 Expression is always false. Probably the '||' operator should be used here. Notepad++ notepad_plus.cpp 4967

DWORD WINAPI Notepad_plus::threadTextPlayer(void *params)
{
  ....
  const char *text2display = ...;
  ....
  if (text2display[i] == ' ' && text2display[i] == '.')
  ....
}

Similar errors can be found in some other places:

• V547 Expression is always false. Probably the '||' operator should be used here. Notepad++ notepad_plus.cpp 5032

ADAPTIVE Communication Environment (ACE)

V547 Expression 'ch != '_' || ch != ':'' is always true. Probably the '&&' operator should be used here. ACEXML_Parser parser.cpp 1905

ACEXML_Char*
ACEXML_Parser::parse_reference_name (void)
{
  ACEXML_Char ch = this->get ();
  if (!this->isLetter (ch) && (ch != '_' || ch != ':'))
    return 0;
  ....
}

WinMerge

V547 Expression 'cchText < 0' is always false. Unsigned type value is never < 0. Merge ccrystaleditview.cpp 1135

BOOL CCrystalEditView::
DoDropText (COleDataObject * pDataObject,
            const CPoint & ptClient)
{
  ....
  UINT cbData = (UINT) ::GlobalSize (hData);
  UINT cchText = cbData / sizeof(TCHAR) - 1;
  if (cchText < 0)
    return FALSE;
  ....
}

BCmenu

V547 Expression 'nLoc >= 0' is always true. Unsigned type value is always >= 0. Merge bcmenu.cpp 1232

BCMenu *BCMenu::FindMenuOption(int nId,UINT& nLoc)
{
  ....
  nLoc = -1;
  ....
}

BOOL BCMenu::ModifyODMenuW(wchar_t *lpstrText,
                           UINT nID, int nIconNormal)
{
  UINT nLoc;
  ....
  BCMenu *psubmenu = FindMenuOption(nID,nLoc);
  ....
  if(psubmenu && nLoc>=0) mdata = psubmenu->m_MenuList[nLoc];
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'nLoc >= 0' is always true. Unsigned type value is always >= 0. Merge bcmenu.cpp 1263
• V547 Expression 'nLoc >= 0' is always true. Unsigned type value is always >= 0. Merge bcmenu.cpp 1285
• V547 Expression 'nLoc >= 0' is always true. Unsigned type value is always >= 0. Merge bcmenu.cpp 1309
• And 2 additional diagnostic messages.

WinMerge

V547 Expression 'text.length() >= 0' is always true. Unsigned type value is always >= 0. Merge splash.cpp 262

typedef String std::wstring;

void CSplashWnd::OnPaint()
{
  ....
  String text = LoadResString(IDS_SPLASH_DEVELOPERS);

  // avoid dereference of empty strings and
  // the NULL termiated character
  if (text.length() >= 0)
  {
  ....
}

UCSniff

V547 Expression '* hDecoder < 0' is always false. Unsigned type value is never < 0. g726_decoder.c 11

int initialize_g726_decoder(unsigned long *hDecoder)
{
  *hDecoder = EasyG726_init_decoder();
  if(*hDecoder<0)
   return -1;
  return 0;
}

Similar errors can be found in some other places:

• V547 Expression 'currentRTPCall->hDecoderFwd >= 0' is always true. Unsigned type value is always >= 0. ec_siprtp.c 1547
• V547 Expression 'currentRTPCall->hDecoderRev >= 0' is always true. Unsigned type value is always >= 0. ec_siprtp.c 1550

DeSmuME

V547 Expression 'name[i] >= 0xF0' is always false. The value range of signed char type: [-128, 127]. DeSmuME_VS2005 directory.cpp 118

static int _FAT_directory_lfnLength (const char* name) {
  ....
  for (i = 0; i < nameLength; i++) {
    if (name[i] < 0x20 || name[i] >= ABOVE_UCS_RANGE) {
      return -1;
    }
  }
  ....
}

This is what should have been written here: (unsigned char)(name[i]) >= ABOVE_UCS_RANGE

DeSmuME

V547 Expression 'remain < 0' is always false. Unsigned type value is never < 0. DeSmuME_VS2005 fatfile.cpp 527

static bool _FAT_check_position_for_next_cluster(....,
 size_t remain, ....)
{
  ....
  if ((remain < 0) ||
      (position->sector > partition->sectorsPerCluster)) {
    // invalid arguments - internal error
    r->_errno = EINVAL;
    goto err;
  }
  ....
}

DeSmuME

V547 Expression '(str[0] != ' ') || (str[0] != '\t')' is always true. Probably the '&&' operator should be used here. DeSmuME_VS2005 xstring.cpp 93

int str_ltrim(char *str, int flags) {
  ....
  while (str[0]) {
    if ((str[0] != ' ') || (str[0] != '\t') ||
        (str[0] != '\r') || (str[0] != '\n'))
      break;
  ....
}

DeSmuME

V547 Expression is always true. Probably the '&&' operator should be used here. DeSmuME_VS2005 xstring.cpp 124

int str_rtrim(char *str, int flags) {
 u32 i=0;

 while (strlen(str)) {
  if ((str[strlen(str)-1] != ' ') ||
   (str[strlen(str)-1] != '\t') ||
   (str[strlen(str)-1] != '\r') ||
   (str[strlen(str)-1] != '\n')) break;
  ....
}

DeSmuME

V547 Expression '(char *) cheatsExport->gametitle != ""' is always true. To compare strings you should use strcmp() function. DeSmuME_VS2005 cheatswin.cpp 1382

class CHEATSEXPORT
{
  ....
  u8 *gametitle;
  ....
}

INT_PTR CALLBACK CheatsExportProc(HWND dialog, UINT msg,
                                  WPARAM wparam, LPARAM lparam)
{
  ....
  if ((char*)cheatsExport->gametitle != "")
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'tmp_fat_path != ""' is always true. To compare strings you should use strcmp() function. DeSmuME_VS2005 slot1_config.cpp 56

DeSmuME

V547 Expression 'appliedSize == 'b' && appliedSize == 's'' is always false. Probably the '||' operator should be used here. DeSmuME_VS2005 ram_search.cpp 817

bool Set_RS_Val()
{
  ....
  if((appliedSize == 'b' && appliedSize == 's' &&
      (rs_param < -128 || rs_param > 127)) ||
     (appliedSize == 'b' && appliedSize != 's' &&
      (rs_param < 0 || rs_param > 255)) ||
     (appliedSize == 'w' && appliedSize == 's' &&
      (rs_param < -32768 || rs_param > 32767)) ||
     (appliedSize == 'w' && appliedSize != 's' &&
      (rs_param < 0 || rs_param > 65535)))
    return false;
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'appliedSize == 'w' && appliedSize == 's'' is always false. Probably the '||' operator should be used here. DeSmuME_VS2005 ram_search.cpp 819

DeSmuME

V547 Expression 'info.type != 0xFF || info.type != 0xFE' is always true. Probably the '&&' operator should be used here. DeSmuME_VS2005 mc.cpp 1054

void BackupDevice::loadfile()
{
  ....
  if (info.type != 0xFF || info.type != 0xFE)
  ....
}

MAME

V547 Expression is always true. Probably the '&&' operator should be used here. mpu4.c 934

int m_led_extender;
#define CARD_A   1
#define NO_EXTENDER  0

static WRITE8_DEVICE_HANDLER( pia_ic5_porta_w )
{
  ....
  else if ((state->m_led_extender != CARD_A)||
           (state->m_led_extender != NO_EXTENDER))
  ....
}

Trans-Proteomic Pipeline

V547 Expression 'c != '\\' || c != '/'' is always true. Probably the '&&' operator should be used here. Tandem2XML tandemresultsparser.cxx 787

bool TandemResultsParser::writePepXML(....)
{
  ....
  char c = pathSummary.at(pathSummary.length() - 1);
  if (c != '\\' || c != '/')
  ....
}

This is what should have been written here: if (c != '\\' && c != '/')

Trans-Proteomic Pipeline

V547 Expression 'peptideProphetOpts_.find(" PI ", 0) >= 0' is always true. Unsigned type value is always >= 0. pepXMLViewer pipelineanalysis.cxx 1590

class basic_string
{
  ....
  size_type find(const _Elem *_Ptr, size_type _Off = 0) const
  ....
}

void
PipelineAnalysis::prepareFields(void) {
  ....
  if (peptideProphetOpts_.find(" PI ", 0)>=0) {
    fields_.push_back(Field("PpI_zscore"));
  }
  ....
}

This is what should have been written here: (peptideProphetOpts_.find(" PI ", 0) != string::npos).

Similar errors can be found in some other places:

• V547 Expression 'peptideProphetOpts_.find(" RT ", 0) >= 0' is always true. Unsigned type value is always >= 0. pepXMLViewer pipelineanalysis.cxx 1593

Trans-Proteomic Pipeline

V547 Expression 'numAssignedPeaks >= 0' is always true. Unsigned type value is always >= 0. tpplib spectrastreplicates.cpp 642

void SpectraSTReplicates::aggregateStats(....)
{
  ....
  unsigned int numAssignedPeaks =
    (*r)->entry->getPeakList()->getNumAssignedPeaks();
  if (numAssignedPeaks >= 0)
  {
    sumFracAssigned +=
      (double)numAssignedPeaks / (double)numPeaks;
    numAnnotated++;
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'pl->getNumAssignedPeaks() >= 0' is always true. Unsigned type value is always >= 0. tpplib spectrastreplicates.cpp 724

Trans-Proteomic Pipeline

V547 Expression 'pos < 0' is always false. Unsigned type value is never < 0. dta2mzXML dta2mzxml.cpp 622

int Dta2mzXML::extractScanNum(const string& dtaFileName)
{
  ....
  std::string::size_type pos = dtaFileName.rfind("/");

  if (pos < 0)  {
    pos = dtaFileName.rfind("\\");
  }
  ....
}

This is what should have been written here: (pos == string::npos).

Similar errors can be found in some other places:

• V547 Expression 'pos < 0' is always false. Unsigned type value is never < 0. dta2mzXML dta2mzxml.cpp 626
• V547 Expression 'pos < 0' is always false. Unsigned type value is never < 0. dta2mzXML dta2mzxml.cpp 653
• V547 Expression 'pos < 0' is always false. Unsigned type value is never < 0. dta2mzXML dta2mzxml.cpp 657

Visualization Toolkit (VTK)

V547 Expression is always true. Probably the '&&' operator should be used here. vtkHybrid vtkmniobjectreader.cxx 161

int vtkMNIObjectReader::CanReadFile(const char* fname)
{
  ....
  if (objType == 'P' || objType != 'L' ||
      objType == 'M' || objType != 'F' ||
      objType == 'X' || objType != 'Q' ||
      objType == 'T')
  ....
}

Visualization Toolkit (VTK)

V547 Expression is always true. Probably the '&&' operator should be used here. vtkIO vtknetcdfcfreader.cxx 838

int vtkNetCDFCFReader::RequestDataObject(....)
{
  if (    (preferredDataType != VTK_IMAGE_DATA)
       || (preferredDataType != VTK_RECTILINEAR_GRID) )
  {
    vtkWarningMacro("You have set the OutputType to a data "
                    "type that cannot fully represent the "
                    "topology of the data. Some of the "
                    "topology will be ignored.");
  }
}

Similar errors can be found in some other places:

• V547 Expression is always true. Probably the '&&' operator should be used here. vtkIO vtknetcdfcfreader.cxx 847

MongoDB

V547 Expression 'str::after("abcde", 'x') == ""' is always false. To compare strings you should use strcmp() function. test.cpp 43

inline const char * after(const char *s, char x);
inline string after(const string& s, char x);
inline const char * after(const char *s, const char *x);
inline string after(string s, string x);

inline const char * after(const char *s, char x) {
  const char *p = strchr(s, x);
  return (p != 0) ? p+1 : "";
}

int main() {
{
  ....
  assert( str::after("abcde", 'x') == "" );
  ....
}

MongoDB

V547 Expression 'i >= 0' is always true. Unsigned type value is always >= 0. mmap_win.cpp 90

void* MemoryMappedFile::map(....) {
  ....
  size_t len = strlen( filename );
  for ( size_t i=len-1; i>=0; i-- ) {
    if ( filename[i] == '/' ||
         filename[i] == '\\' )
      break;

    if ( filename[i] == ':' )
         filename[i] = '_';
  }
  ....
}

CamStudio

V547 Expression 'bytesRead < 0' is always false. Unsigned type value is never < 0. soundfile.cpp 166

bool CSoundFile::OpenWaveFile()
{
  ....
  DWORD bytesRead = mmioRead(m_hFile, (LPSTR)&m_Format,
                             m_MMCKInfoChild.cksize);
  if (bytesRead < 0)
  {
    AfxMessageBox("Error reading PCM wave format record");
    mmioClose(m_hFile,0);
    m_Mode = FILE_ERROR;
    return FALSE;
  }
  ....
}

CamStudio

V547 Expression '* p == 0xFE' is always false. The value range of char type: [127, -128]. compile.cpp 527

#define MAGIC_CONTINUE_NUMBER_LO 0xFE
#define MAGIC_CONTINUE_NUMBER_HI 0x7F

/* I can't believe this actually worked */
void bufferResolveJumps(Buffer out)
{
  ....
  if (*p == MAGIC_CONTINUE_NUMBER_LO &&
      *(p+1) == MAGIC_CONTINUE_NUMBER_HI)
  {
  ....
}

You're right not to believe. It doesn't work indeed! :-)

Samba

V547 Expression '(to != CH_UTF16LE) || (to != CH_UTF16BE)' is always true. Probably the '&&' operator should be used here. charcnv.c 188

static size_t convert_string_internal(....)
{
  ....
    if (((from == CH_UTF16LE)||(from == CH_UTF16BE)) &&
        ((to != CH_UTF16LE)||(to != CH_UTF16BE))) {
  ....
}

Similar errors can be found in some other places:

• V547 Expression '(to != CH_UTF16LE) || (to != CH_UTF16BE)' is always true. Probably the '&&' operator should be used here. charcnv.c 599

Samba

V547 Expression 'result.pid < 0' is always false. Unsigned type value is never < 0. util.c 2376

struct server_id {
  uint32_t pid;
  uint32_t vnn;
  uint64_t unique_id;
}

struct server_id interpret_pid(const char *pid_string)
{
  struct server_id result;
  ....
  /* Assigning to result.pid may have overflowed
     Map negative pid to -1: i.e. error */
  if (result.pid < 0) {
    result.pid = -1;
  }
  ....
}

Samba

V547 Expression is always false. Consider reviewing this expression. pdbtest.c 170

static bool samu_correct(struct samu *s1, struct samu *s2)
{
  ....
  if (d2_buf == NULL && d2_buf != NULL) {
    DEBUG(0, ("Logon hours is not set\n"));
    ret = False;
  }
  ....
}

Tor

V547 Expression is always true. Probably the '&&' operator should be used here. transports.c 556

void
pt_configure_remaining_proxies(void)
{
  ....
  tor_assert(mp->conf_state != PT_PROTO_BROKEN ||
             mp->conf_state != PT_PROTO_FAILED_LAUNCH);
  ....
}

OpenCV

V547 Expression 'd > maxd' is always false. Unsigned type value is never < 0. fuzzymeanshifttracker.cpp 386

void CvFuzzyMeanShiftTracker::SearchWindow::initDepthValues(....)
{
  unsigned int d=0, mind = 0xFFFF, maxd = 0,
           m0 = 0, m1 = 0, mc, dd;
  ....
  for (int j = 0; j < height; j++)
  {
    ....
    if (d > maxd)
      maxd = d;
    ....
  }
}

Variable 'd' does not change in the loop.

ReactOS

V547 Expression 'i < 0x10000' is always true. The value range of unsigned short type: [0, 65535]. xboxhw.c 358

#define DISKREADBUFFER_SIZE HEX(10000)

typedef unsigned short USHORT, *PUSHORT;

static VOID DetectBiosDisks(....)
{
  USHORT i;
  ....
  Changed = FALSE;
  for (i = 0; ! Changed && i < DISKREADBUFFER_SIZE; i++)
  {
    Changed = ((PUCHAR)DISKREADBUFFER)[i] != 0xcd;
  }
  ....
}

ReactOS

V547 Expression 'ads->udpsocket < 0' is always false. Unsigned type value is never < 0. setup.c 539

typedef UINT_PTR SOCKET;
#define ADNS_SOCKET SOCKET

struct adns__state {
  ....
  ADNS_SOCKET udpsocket, tcpsocket;
  ....
};

static int init_finish(adns_state ads) {
  ....
  if (ads->udpsocket<0) { r= errno; goto x_free; }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'fd < 0' is always false. Unsigned type value is never < 0. event.c 117
• V547 Expression 'ads->udpsocket >= 0' is always true. Unsigned type value is always >= 0. check.c 105
• V547 Expression 'ads->tcpsocket >= 0' is always true. Unsigned type value is always >= 0. check.c 114
• And 1 additional diagnostic messages.

ReactOS

V547 Expression '0 <= Id' is always true. Unsigned type value is always >= 0. menu.c 2663

static INT FASTCALL
MenuButtonUp(MTRACKER *Mt, HMENU PtMenu, UINT Flags)
{
  UINT Id;
  ....
  Id = NtUserMenuItemFromPoint(....);
  ....
  if (0 <= Id &&
      MenuGetRosMenuItemInfo(MenuInfo.Self, Id, &ItemInfo) &&
      MenuInfo.FocusedItem == Id)
  ....
}

ReactOS

V547 Expression 'Info->nPage < 0' is always false. Unsigned type value is never < 0. scrollbar.c 428

typedef struct tagSCROLLINFO {
  ....
  UINT nPage;
  ....
} SCROLLINFO,*LPSCROLLINFO;

static DWORD FASTCALL
co_IntSetScrollInfo(....)
{
  LPSCROLLINFO Info;
  ....
  /* Make sure the page size is valid */
  if (Info->nPage < 0)
  {
    pSBData->page = Info->nPage = 0;
  }
  ....
}

ReactOS

V547 Expression 'Entry->Id <= 0xffff' is always true. The value range of unsigned short type: [0, 65535]. res.c 312

typedef unsigned short WORD;
WORD Id;

static LONG
LdrpCompareResourceNames_U(....)
{
  /* Fail if ResourceName2 is an ID */
  if (Entry->Id <= USHRT_MAX) return -1;
  ....
}

ReactOS

V547 Expression 'index < 0' is always false. Unsigned type value is never < 0. extensions.c 936

typedef unsigned int GLuint;

const GLubyte *_mesa_get_enabled_extension(
  struct gl_context *ctx, GLuint index)
{
  const GLboolean *base;
  size_t n;
  const struct extension *i;
  if (index < 0)
    return NULL;
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'ch <= 0xFF' is always true. The value range of char type: [-128, 127]. hexedit.c 1279
• V547 Expression 'index >= 0' is always true. Unsigned type value is always >= 0. st_glsl_to_tgsi.cpp 4013
• V547 Expression 'index >= 0' is always true. Unsigned type value is always >= 0. st_glsl_to_tgsi.cpp 4023
• And 4 additional diagnostic messages.

Windows 8 Driver Samples

V547 Expression 'i < 256' is always true. The value range of unsigned char type: [0, 255]. hw_mac.c 1946

VOID HwFillRateElement(....)
{
  UCHAR i, j;
  ....
  for (i = 0; (i < basicRateSet->uRateSetLength) &&
              (i < 256); i++)
  {
    rate[i] = 0x80 | basicRateSet->ucRateSet[i];
  }
  ....
}

Windows 8 Driver Samples

V547 Expression is always false. The value range of unsigned char type: [0, 255]. hw_mac.c 1971

VOID HwFillRateElement(....)
{
  ....
  UCHAR rate[256];
  UCHAR rateNum;
  ....
  if (rateNum == sizeof(rate) / sizeof(UCHAR))
    break;
  ....
}

NetXMS

V547 Expression 'sockfd < 0' is always false. Unsigned type value is never < 0. radius.cpp 682

typedef UINT_PTR SOCKET;

static int DoRadiusAuth(....)
{
  SOCKET sockfd;
  ....
  // Open a socket.
  sockfd = socket(AF_INET, SOCK_DGRAM, 0);
  if (sockfd < 0)
  {
    DbgPrintf(3, _T("RADIUS: Cannot create socket"));
    pairfree(req);
    return 5;
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'col->fd >= 0' is always true. Unsigned type value is always >= 0. ipfix.c 845
• V547 Expression is always false. Unsigned type value is never < 0. ipfix.c 962
• V547 Expression 'sock < 0' is always false. Unsigned type value is never < 0. ipfix.c 1013
• And 4 additional diagnostic messages.

NetXMS

V547 Expression 'i >= 0' is always true. Unsigned type value is always >= 0. ipfix.c 488

int ipfix_snprint_string(....)
{
  size_t  i;
  uint8_t *in = (uint8_t*) data;

  for( i=len-1; i>=0; i-- ) {
    if ( in[i] == '\0' ) {
      return snprintf( str, size, "%s", in );
    }
  }
  ....
}

NetXMS

V547 Expression 'value >= 0' is always true. Unsigned type value is always >= 0. catalyst.cpp 71

bool CatalystDriver::isDeviceSupported(
  SNMP_Transport *snmp, const TCHAR *oid)
{
  DWORD value = 0;
  if (SnmpGet(snmp->getSnmpVersion(), snmp,
             _T(".1.3.6.1.4.1.9.5.1.2.14.0"),
             NULL, 0, &value, sizeof(DWORD), 0)
      != SNMP_ERR_SUCCESS)
    return false;
  // Catalyst 3550 can return 0 as number of slots
  return value >= 0;
}

WinMerge

V547 Expression 'i >= 0' is always true. Unsigned type value is always >= 0. mergedoclinediffs.cpp 282

void CMergeDoc::Computelinediff(....)
{
  ....
  vector<wdiff*>::size_type i;
  ....
  for (i=worddiffs.size() - 1; i>=0; --i)
  {
    const wdiff * diff = worddiffs[i];
    if (end1 == -1 && diff->end[0] != -1)
      end1 = diff->end[0];
    if (end2 == -1 && diff->end[1] != -1)
      end2 = diff->end[1];
    if (end1 != -1 && end2 != -1)
      break; // found both
  }
  ....
}

QuickThread

V547 Expression 'NUMA_NodeNumber >= 0' is always true. Unsigned type value is always >= 0. quickthreadnuma.cpp 101

int numa_preferred(void)
{
  unsigned char NUMA_NodeNumber = numa_available();
  if(NUMA_NodeNumber >= 0)
    return NUMA_NodeNumber;
  return 0;
}

TortoiseSVN

V547 Expression 'ticks < 0' is always false. Unsigned type value is never < 0. winplink.c 635

int main(int argc, char **argv)
{
  ....
  DWORD ticks;
  ....
  if (run_timers(now, &next)) {
    ticks = next - GETTICKCOUNT();
    if (ticks < 0) ticks = 0;
  } else {
    ticks = INFINITE;
  }
  ....
}

Chromium

V547 Expression 'socket_ < 0' is always false. Unsigned type value is never < 0. tcp_server_socket_win.cc 48

typedef UINT_PTR SOCKET;

SOCKET socket_;

int TCPServerSocketWin::Listen(....) {
  ....
  socket_ = socket(address.GetSockAddrFamily(),
                   SOCK_STREAM, IPPROTO_TCP);
  if (socket_ < 0) {
    PLOG(ERROR) << "socket() returned an error";
    return MapSystemError(WSAGetLastError());
  }
  ....
}

Multi Theft Auto

V547 Expression 'm_TidyupTimer.Get() < 0' is always false. Unsigned type value is never < 0. crenderitem.effectcloner.cpp 182

unsigned long long Get ( void );

void CEffectClonerImpl::MaybeTidyUp ( void )
{
  ....
  if ( m_TidyupTimer.Get () < 0 )
    return;
  ....
}

Multi Theft Auto

V547 Expression 'ucNumber >= 1000' is always false. The value range of unsigned char type: [0, 255]. cluafunctiondefinitions.cpp 4450

int CLuaFunctionDefinitions::GetVehicleUpgradeSlotName (....)
{
  unsigned char ucNumber;
  ....
  else if ( ucNumber >= 1000 && ucNumber <= 1193 )
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'ucNumber <= 1193' is always true. The value range of unsigned char type: [0, 255]. cluafunctiondefinitions.cpp 4450
• V547 Expression 'ucNameLength > 1024' is always false. The value range of unsigned char type: [0, 255]. cpackethandler.cpp 2766

Multi Theft Auto

V547 Expression 'uiResourceLength < 0' is always false. Unsigned type value is never < 0. csettings.cpp 408

inline const char* CSettings::GetName (....,
  unsigned int uiResourceLength )
{
  // Only calculate the resource length if it's
  // not already specified
  if ( uiResourceLength < 0 ) {
    ....
  } else {
    ....
  }
}

Similar errors can be found in some other places:

• V547 Expression 'pVehicle->GetVehicleSirenCount() >= 0' is always true. Unsigned type value is always >= 0. cmultiplayersa_1.3.cpp 376
• V547 Expression 'sirenData.data.m_ucSirenCount >= 0' is always true. Unsigned type value is always >= 0. cvehiclerpcs.cpp 604

Multi Theft Auto

V547 Expression 'wc < 0x10000' is always true. The value range of wchar_t type: [0, 65535]. utf8.h 121

int
utf8_wctomb (unsigned char *dest, wchar_t wc, int dest_size)
{
  if (!dest)
    return 0;
  int count;
  if (wc < 0x80)
    count = 1;
  else if (wc < 0x800)
    count = 2;
  else if (wc < 0x10000)
    count = 3;
  else if (wc < 0x200000)
    count = 4;
  else if (wc < 0x4000000)
    count = 5;
  else if (wc <= 0x7fffffff)
    count = 6;
  else
    return RET_ILSEQ;
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'wc < 0x200000' is always true. The value range of wchar_t type: [0, 65535]. utf8.h 123
• V547 Expression 'wc < 0x4000000' is always true. The value range of wchar_t type: [0, 65535]. utf8.h 125
• V547 Expression 'wc <= 0x7fffffff' is always true. The value range of wchar_t type: [0, 65535]. utf8.h 127

Boost (C++ libraries)

V547 Expression 'new_socket.get() >= 0' is always true. Unsigned type value is always >= 0. win_iocp_socket_service.hpp 436

typedef SOCKET socket_type;

class socket_holder
{
  ....
  socket_type socket_;
  ....
  socket_type get() const { return socket_; }
  ....
};

template <typename Socket>
boost::system::error_code accept(....)
{
  ....
  // On success, assign new connection to peer socket object.
  if (new_socketnew_socket.get() >= 0)
  {
    if (peer_endpoint)
      peer_endpoint->resize(addr_len);
    if (!peer.assign(impl.protocol_, new_socket.get(), ec))
      new_socket.release();
  }
  return ec;
}

Trans-Proteomic Pipeline

V547 Expression 'b + tau >= 0' is always true. Unsigned type value is always >= 0. spectrastpeaklist.cpp 2058

double SpectraSTPeakList::calcXCorr() {
  ....
  for (int tau = -75; tau <= 75; tau++) {

    float dot = 0.0;
    for (unsigned int b = 0; b < numBins; b++) {
      if (b + tau >= 0 && b + tau < (int)numBins) {
        dot += (*m_bins)[b] * theoBins[b + tau] / 10000.0;
      }
    }
    ....
  ....
}

TinyCAD

V547 Expression 'parentPos >= 0' is always true. Unsigned type value is always >= 0. bomgenerator.cpp 77

void CBOMGenerator::GenerateBomForDesign(
  int level, size_t parentPos, ....)
{
  ....
  if (parentPos >= 0) cmrParent = cmrDefaultParent;
  ....
}

SeqAn

V547 Expression 'pos < 0' is always false. Unsigned type value is never < 0. tokenize.h 1548

template <typename TStream, typename TPass, typename TBuffer>
inline int
readLineStripTrailingBlanks(TBuffer & buffer,
  RecordReader<TStream, TPass> & reader)
{
  ....
  typename Size<TBuffer>::Type pos = length(buffer) - 1;

  if (pos < 0)
    return 0;
  ....
}

CrashRpt library

V547 Expression 'pos < 0' is always false. Unsigned type value is never < 0. main.cpp 314

typedef std::basic_string<TCHAR> tstring;

int process_report(....)
{
  ....
  tstring sInDirName;
  ....
  size_t pos = sInDirName.rfind('\\');
  if(pos<0) // There is no back slash in path
  {
    sInDirName = _T("");
    sInFileName = szInput;
  }
  else
  {
    sInFileName = sInDirName.substr(pos+1);
    sInDirName = sInDirName.substr(0, pos);
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'pos < 0' is always false. Unsigned type value is never < 0. main.cpp 352
• V547 Expression 'pos >= 0' is always true. Unsigned type value is always >= 0. main.cpp 837
• V547 Expression 'pos >= 0' is always true. Unsigned type value is always >= 0. minidumpreader.cpp 775

WebPagetest

V547 Expression is always false. Probably the '||' operator should be used here. json_reader.cpp 566

bool
Reader::readArray( Token &tokenStart )
{
  ....
  bool badTokenType = ( token.type_ == tokenArraySeparator &&
                        token.type_ == tokenArrayEnd );
  if ( !ok  ||  badTokenType )
  {
    ....
}

This is what should have been written here: token.type_ != tokenArraySeparator && token.type_ != tokenArrayEnd

Snes9x

V547 Expression is always false. Probably the '||' operator should be used here. ram_search.cpp 921

bool Set_RS_Val()
{
  ....
  int appliedSize;
  ....
  if((appliedSize == TEXT('b') && appliedSize == TEXT('s') &&
      (rs_param < -128 || rs_param > 127)) ||
     (appliedSize == TEXT('b') && appliedSize != TEXT('s') &&
      (rs_param < 0 || rs_param > 255)) ||
     (appliedSize == TEXT('w') && appliedSize == TEXT('s') &&
      (rs_param < -32768 || rs_param > 32767)) ||
     (appliedSize == TEXT('w') && appliedSize != TEXT('s') &&
      (rs_param < 0 || rs_param > 65535)))
     return false;
  ....
}

Similar errors can be found in some other places:

• V547 Expression is always false. Probably the '||' operator should be used here. ram_search.cpp 923

VirtualDub

V547 Expression 'res < 0' is always false. Unsigned type value is never < 0. Riza w32videocodecpack.cpp 828

void VDVideoCompressorVCM::GetState(vdfastvector<uint8>& data) {
  DWORD res;
  ....
  res = ICGetState(hic, data.data(), size);
  ....
  if (res < 0)
    throw MyICError("Video compression", res);
}

Similar errors can be found in some other places:

• V547 Expression 'retval < 0' is always false. Unsigned type value is never < 0. Riza w32videocodec.cpp 284

Prime95

V547 Expression '* p == '//'' is always false. The value range of char type: [-128, 127]. prime95 prime95.cpp 156

BOOL CPrime95App::InitInstance()
{
  char *p;
  ....
  for (p = m_lpCmdLine; *p == '//' || *p == '-'; ) {
  ....
}

Prime95

V547 Expression '(s = socket(hp->h_addrtype, 1, 0)) < 0' is always false. Unsigned type value is never < 0. prime95 primenet.c 354

typedef UINT_PTR SOCKET;

SOCKET socket(__in int af, __in int type,
              __in int protocol);

int pnHttpServer (char *pbuf, unsigned cbuf, char* postargs)
{
  ....
  if ((s = socket (hp->h_addrtype, SOCK_STREAM, 0)) < 0) {
  ....
}

Geant4 software

V547 Expression is always true. Probably the '&&' operator should be used here. G4had_im_r_matrix g4collisionmesonbaryonelastic.cc 53

G4bool G4CollisionMesonBaryonElastic::
 IsInCharge(const G4KineticTrack& trk1,
            const G4KineticTrack& trk2) const
 {
   G4bool result = false;
   G4ParticleDefinition * p1 = trk1.GetDefinition();
   G4ParticleDefinition * p2 = trk2.GetDefinition();
   if(   (GetNumberOfPartons(p1) != 2 ||
          GetNumberOfPartons(p2) != 3)
       ||(GetNumberOfPartons(p1) != 3 ||
          GetNumberOfPartons(p2) != 2) )
   {
     result = false;
   }
  ....
}

libusbx

V547 Expression '0 > * busnum' is always false. Unsigned type value is never < 0. linux_usbfs.c 620

int linux_get_device_address (....,
  uint8_t *busnum, uint8_t *devaddr,
  ....)
{
  ....
  *busnum = __read_sysfs_attr(ctx, sys_name, "busnum");
  if (0 > *busnum)
    return *busnum;

  *devaddr = __read_sysfs_attr(ctx, sys_name, "devnum");
  if (0 > *devaddr)
    return *devaddr;
  ....
}

Similar errors can be found in some other places:

• V547 Expression '0 > * devaddr' is always false. Unsigned type value is never < 0. linux_usbfs.c 624

PostgreSQL Database Management System

V547 Expression 'sock_fd < 0' is always false. Unsigned type value is never < 0. postgres auth.c 1668

typedef UINT_PTR SOCKET;
typedef SOCKET pgsocket;

static int
ident_inet(hbaPort *port)
{
  ....
  pgsocket  sock_fd;
  ....
  sock_fd = socket(ident_serv->ai_family,
                   ident_serv->ai_socktype,
                   ident_serv->ai_protocol);
  if (sock_fd < 0)
  {
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'sock_fd >= 0' is always true. Unsigned type value is always >= 0. postgres auth.c 1748
• V547 Expression 'sock < 0' is always false. Unsigned type value is never < 0. postgres auth.c 2567
• V547 Expression is always false. Unsigned type value is never < 0. postgres pqcomm.c 395
• And 2 additional diagnostic messages.

Source Engine SDK

V547 Expression 'm_nActiveParticles >= 0' is always true. Unsigned type value is always >= 0. Client (HL2) particlemgr.cpp 967

unsigned short m_nActiveParticles;

void CParticleEffectBinding::RemoveParticle(
  Particle *pParticle )
{
  ....
  Assert( m_nActiveParticles >= 0 );
  ....
}

Source Engine SDK

V547 Expression 'firstedge >= 0' is always true. Unsigned type value is always >= 0. Vbsp writebsp.cpp 1428

static void AddNodeToBounds(....)
{
  ....
  unsigned int firstedge = dfaces[face].firstedge;
  Assert( firstedge >= 0 );
  ....
}

Source Engine SDK

V547 Expression 'pEdge->v[0] >= 0' is always true. Unsigned type value is always >= 0. Vbsp writebsp.cpp 1435

struct dedge_t
{
  DECLARE_BYTESWAP_DATADESC();
  unsigned short  v[2];
};

static void AddNodeToBounds(....)
{
  ....
  Assert( pEdge->v[0] >= 0 );
  Assert( pEdge->v[1] >= 0 );
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'pEdge->v[1] >= 0' is always true. Unsigned type value is always >= 0. Vbsp writebsp.cpp 1436

Source Engine SDK

V547 Expression 'numbounce < 0' is always false. Unsigned type value is never < 0. Vrad_dll vrad.cpp 2412

unsigned  numbounce = 100;

int ParseCommandLine( int argc, char **argv, bool *onlydetail )
{
  ....
  numbounce = atoi (argv[i]);
  if ( numbounce < 0 )
  {
    Warning(
      "Error: expected non-negative value after '-bounce'\n");
    return 1;
  }
  ....
}

Firebird

V547 Expression '-- i >= 0' is always true. Unsigned type value is always >= 0. isql.cpp 3421

static processing_state add_row(TEXT* tabname)
{
  ....
  unsigned i = n_cols;
  while (--i >= 0)
  {
    if (colnumber[i] == ~0u)
  {
       bldr->remove(fbStatus, i);
       if (ISQL_errmsg(fbStatus))
         return (SKIP);
    }
  }
  msg.assignRefNoIncr(bldr->getMetadata(fbStatus));
  ....
}

Firebird

V547 Expression 'scale < 0' is always false. Unsigned type value is never < 0. isql.cpp 3716

static processing_state add_row(TEXT* tabname)
{
  ....
  unsigned varLength, scale;
  ....
  scale = msg->getScale(fbStatus, i);
  ....
  if (scale < 0)
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'scale < 0' is always false. Unsigned type value is never < 0. isql.cpp 4437

Firebird

V547 Expression '* * argv != 'n' || * * argv != 'N'' is always true. Probably the '&&' operator should be used here. gpre.cpp 1829

static bool get_switches(....)
  ....
  if (**argv != 'n' || **argv != 'N')
  {
    fprintf(stderr,
      "-sqlda :  Deprecated Feature: you must use XSQLDA\n ");
    print_switches();
    return false;
  }
  ....
}

CryEngine 3 SDK

V547 Expression is always true. Probably the '&&' operator should be used here. searchmodule.cpp 469

SearchSpotStatus GetStatus() const { return m_status; }

SearchSpot* SearchGroup::FindBestSearchSpot(....)
{
  ....
  if(searchSpot.GetStatus() != Unreachable ||
     searchSpot.GetStatus() != BeingSearchedRightAboutNow)
  ....
}

CryEngine 3 SDK

V547 Expression 'inTimelineId >= 0' is always true. Unsigned type value is always >= 0. circularstatsstorage.cpp 31

const CCircularBufferTimeline *
CCircularBufferStatsContainer::GetTimeline(
  size_t inTimelineId) const
{
  ....
  if (inTimelineId >= 0 && (int)inTimelineId < m_numTimelines)
  {
    tl = &m_timelines[inTimelineId];
  }
  else
  {
    CryWarning(VALIDATOR_MODULE_GAME,VALIDATOR_ERROR,
               "Statistics event %" PRISIZE_T
               " is larger than the max registered of %"
               PRISIZE_T ", event ignored",
               inTimelineId,m_numTimelines);
  }
  ....
}

ICU

V547 Expression 'standardDate.wDay < 0' is always false. Unsigned type value is never < 0. wintzimpl.cpp 66

int32_t getRuleWeekInMonth(void) const;

typedef struct _SYSTEMTIME {
  ....
  WORD wDay;
  ....
} SYSTEMTIME, *PSYSTEMTIME;

static UBool getSystemTimeInformation(....)
{
  ....
  standardDate.wDay = std->getRule()->getRuleWeekInMonth();
  if (standardDate.wDay < 0) {
    standardDate.wDay = 5;
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'daylightDate.wDay < 0' is always false. Unsigned type value is never < 0. wintzimpl.cpp 87

Scilab

V547 Expression 'iParentType == 9 && iParentType == 21' is always false. Probably the '||' operator should be used here. sci_uimenu.c 99

#define __GO_FIGURE__ 9
#define __GO_UIMENU__ 21

int sci_uimenu(char *fname, unsigned long fname_len)
{
  ....
  if (iParentType == __GO_FIGURE__ &&
      iParentType == __GO_UIMENU__)
  {
    Scierror(999, _("%s: Wrong type for input argument #%d: ")
             _("A '%s' or '%s' handle expected.\n"),
             fname, 1, "Figure", "Uimenu");
    return FALSE;
  }
  ....
}

This is what should have been written here: iParentType != __GO_FIGURE__ && iParentType != __GO_UIMENU__

Word for Windows 1.1a

V547 Expression '-- cch >= 0' is always true. Unsigned type value is always >= 0. mergeelx.c 1188

void GetNameElk(elk, stOut)
ELK elk;
unsigned char *stOut;
{
  unsigned char *stElk = &rgchElkNames[mpelkichName[elk]];
  unsigned cch = stElk[0] + 1;

  while (--cch >= 0)
    *stOut++ = *stElk++;
}

Qt

V547 Expression is always true. Probably the '&&' operator should be used here. qsgatlastexture.cpp 271

void Atlas::uploadBgra(Texture *texture)
{
  const QRect &r = texture->atlasSubRect();
  QImage image = texture->image();

  if (image.format() != QImage::Format_ARGB32_Premultiplied ||
      image.format() != QImage::Format_RGB32) {
  ....
}

CLucene

V547 Expression '-- size >= 0' is always true. Unsigned type value is always >= 0. arrays.h 154

class Arrays
{
  ....
   bool equals( class1* val1, class2* val2 ) const{
     static _comparator comp;
     if ( val1 == val2 )
       return true;
     size_t size = val1->size();
     if ( size != val2->size() )
       return false;
     _itr1 itr1 = val1->begin();
     _itr2 itr2 = val2->begin();
     while ( --size >= 0 ){
       if ( !comp(*itr1,*itr2) )
         return false;
       itr1++;
       itr2++;
     }
   return true;
  }
  ....
}

CLucene

V547 Expression 'q->getQueryName() != L"BooleanQuery"' is always true. To compare strings you should use wcscmp() function. multifieldqueryparser.cpp 44

const TCHAR* getQueryName() const;

Query* MultiFieldQueryParser::parse(....)
{
  ....
  Query* q = QueryParser::parse(query, fields[i], analyzer);
  if (q && (q->getQueryName() != _T("BooleanQuery")
      || ((BooleanQuery*)q)->getClauseCount() > 0)) {
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'q->getQueryName() != L"BooleanQuery"' is always true. To compare strings you should use wcscmp() function. multifieldqueryparser.cpp 63

TortoiseGit

V547 Expression is always false. Probably the '||' operator should be used here. clonedlg.cpp 413

void CCloneDlg::OnBnClickedCheckSvn()
{
  ....
  CString str;
  m_URLCombo.GetWindowText(str);

  while(str.GetLength()>=1 &&
        str[str.GetLength()-1] == _T('\\') &&
        str[str.GetLength()-1] == _T('/'))
  {
    str=str.Left(str.GetLength()-1);
  }
  ....
}

TortoiseGit

V547 Expression is always true. Probably the '&&' operator should be used here. smart_protocol.c 264

enum git_ack_status {
  GIT_ACK_NONE,
  GIT_ACK_CONTINUE,
  GIT_ACK_COMMON,
  GIT_ACK_READY
};

static int wait_while_ack(gitno_buffer *buf)
{
  ....
  if (pkt->type == GIT_PKT_ACK &&
      (pkt->status != GIT_ACK_CONTINUE ||
       pkt->status != GIT_ACK_COMMON)) {
  ....
}

Tesseract

V547 Expression 'c == 'x' && c == 'X'' is always false. Probably the '||' operator should be used here. libtesseract303 scanutils.cpp 135

uintmax_t streamtoumax(FILE* s, int base) {
  int d, c = 0;
  ....
  c = fgetc(s);
  if (c == 'x' && c == 'X') c = fgetc(s);
  ....
}

WebRTC

V547 Expression 'new_fd < 0' is always false. Unsigned type value is never < 0. ccsip_platform_tcp.c 438

typedef UINT_PTR SOCKET;
typedef SOCKET cpr_socket_t;

cpr_socket_t
sip_tcp_create_connection (sipSPIMessage_t *spi_msg)
{
  cpr_socket_t new_fd;
  ....
  new_fd = cprSocket(af_listen, SOCK_STREAM, 0);
  if (new_fd < 0) {
    CCSIP_DEBUG_ERROR(SIP_F_PREFIX"Socket creation failed %d.",
                      fname, cpr_errno);
    return INVALID_SOCKET;
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'sock < 0' is always false. Unsigned type value is never < 0. ccsip_platform_tls.c 118

Mozilla Firefox

V547 Expression 'aChannelCount < 0' is always false. Unsigned type value is never < 0. adts.cpp 44

bool
Adts::ConvertEsdsToAdts(uint16_t aChannelCount, ....)
{
  ....
  if (newSize >= (1 << 13) || aChannelCount < 0 ||
      aChannelCount > 15 || aFrequencyIndex < 0 ||
      aProfile < 1 || aProfile > 4)
    return false;
  ....
}

Mozilla Firefox

V547 Expression is always false. Probably the '||' operator should be used here. nswindowsregkey.cpp 292

NS_IMETHODIMP
nsWindowsRegKey::ReadStringValue(....)
{
  ....
  DWORD type;
  ....
  if (type != REG_SZ && type == REG_EXPAND_SZ &&
      type == REG_MULTI_SZ)
    return NS_ERROR_FAILURE;
  ....
}

Mozilla Firefox

V547 Expression '-- guess >= minEntry' is always true. Unsigned type value is always >= 0. ion.cpp 1112

const SafepointIndex *
IonScript::getSafepointIndex(uint32_t disp) const
{
  ....
  size_t minEntry = 0;
  ....
  size_t guess = ....;
  ....
  while (--guess >= minEntry) {
    guessDisp = table[guess].displacement();
    JS_ASSERT(guessDisp >= disp);
    if (guessDisp == disp)
      return &table[guess];
  }
  ....
}

Newton Game Dynamics

V547 Expression 'm_mantissa[0] >= 0' is always true. Unsigned type value is always >= 0. dggoogol.cpp 55

typedef unsigned long long dgUnsigned64;

dgUnsigned64 m_mantissa[DG_GOOGOL_SIZE];

dgGoogol::dgGoogol(dgFloat64 value)
  :m_sign(0)
  ,m_exponent(0)
{
  ....
  m_mantissa[0] = (dgInt64 (dgFloat64 (
                    dgUnsigned64(1)<<62) * mantissa));

  // it looks like GCC have problems with this
  dgAssert (m_mantissa[0] >= 0);
  ....
}

Cocos2d-x

V547 Expression '0 == commonInfo->eventName' is always false. Pointer 'commonInfo->eventName' != NULL. ccluaengine.cpp 436

struct CommonScriptData
{
  // Now this struct is only used in LuaBinding.
  int handler;
  char eventName[64];
  ....
};

int LuaEngine::handleCommonEvent(void* data)
{
  ....
  CommonScriptData* commonInfo = static_cast<....*>(data);
  if (NULL == commonInfo->eventName ||                   // <=
      0 == commonInfo->handler)
    return 0;
  ....
}

Similar errors can be found in some other places:

• V547 Expression '0 != commonInfo->eventSourceClassName' is always true. Pointer 'commonInfo->eventSourceClassName' != NULL. ccluaengine.cpp 442

Asterisk

V547 Expression is always false. Unsigned type value is never < 0. enum.c 309

static int ebl_callback(....)
{
  unsigned int i;
  ....
  if ((i = dn_expand((unsigned char *)fullanswer,
     (unsigned char *)answer + len,
     (unsigned char *)answer, c->apex, sizeof(c->apex) - 1)) < 0)
  {
    ast_log(LOG_WARNING, "Failed to expand hostname\n");
    return 0;
  }
}

PHP:Hypertext Preprocessor

V547 Expression 'tmp_len >= 0' is always true. Unsigned type value is always >= 0. ftp_fopen_wrapper.c 639

static size_t php_ftp_dirstream_read(....)
{
  size_t tmp_len;
  ....
  /* Trim off trailing whitespace characters */
  tmp_len--;
  while (tmp_len >= 0 &&                  // <=
    (ent->d_name[tmp_len] == '\n' ||
     ent->d_name[tmp_len] == '\r' ||
     ent->d_name[tmp_len] == '\t' ||
     ent->d_name[tmp_len] == ' ')) {
       ent->d_name[tmp_len--] = '\0';
  }
  ....
}

Oracle VM Virtual Box

V547 Expression is always true. Probably the '&&' operator should be used here. vboxfboverlay.cpp 2259

VBoxVHWAImage::reset(VHWACommandList * pCmdList)
{
  ....
  if (pCmd->SurfInfo.PixelFormat.c.rgbBitCount != 32
   || pCmd->SurfInfo.PixelFormat.c.rgbBitCount != 24)
  {
    AssertFailed();
    pCmd->u.out.ErrInfo = -1;
    return VINF_SUCCESS;
  }
  ....
}

K Desktop Environment

V547 Expression is always true. Probably the '&&' operator should be used here. incidenceformatter.cpp 2684

static QString formatICalInvitationHelper(....)
{
  ....
  a = findDelegatedFromMyAttendee( inc );
  if ( a ) {
    if ( a->status() != Attendee::Accepted ||
         a->status() != Attendee::Tentative ) {
      html += responseButtons( inc, rsvpReq, rsvpRec, helper );
      break;
    }
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression is always true. Probably the '&&' operator should be used here. incidenceformatter.cpp 3293

Miranda NG

V547 Expression 'dis->itemData >= 0' is always true. Unsigned type value is always >= 0. TabSRMM hotkeyhandler.cpp 213

ULONG_PTR itemData;

LONG_PTR CALLBACK HotkeyHandlerDlgProc(....)
{
  ....
  if (dis->itemData >= 0) {
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'wParam >= 0' is always true. Unsigned type value is always >= 0. Jabber jabber_agent.cpp 58
• V547 Expression 'ft->std.currentFileSize < 0' is always false. Unsigned type value is never < 0. Jabber jabber_file.cpp 76
• V547 Expression 'lpdis->itemID < 0' is always false. Unsigned type value is never < 0. Jabber jabber_groupchat.cpp 522
• And 24 additional diagnostic messages.

Miranda NG

V547 Expression 'cp != "\005"' is always true. To compare strings you should use strcmp() function. Yahoo libyahoo2.cpp 4486

static void yahoo_process_search_connection(....)
{
  ....
  if (cp != "\005")
  ....
}

Miranda NG

V547 Expression 'i >= 0' is always true. Unsigned type value is always >= 0. Tipper str_utils.cpp 220

TCHAR *myfgets(TCHAR *Buf, int MaxCount, FILE *File)
{
  _fgetts(Buf, MaxCount, File);
  for (size_t i = _tcslen(Buf) - 1; i >= 0; i--)
  {
    if (Buf[i] == '\n' || Buf[i] == ' ')
      Buf[i] = 0;
    else
      break;
  }

  CharLower(Buf);
  return Buf;
}

LibreOffice

V547 Expression is always true. Probably the '&&' operator should be used here. sbxmod.cxx 1777

enum SbxDataType {
  SbxEMPTY    =  0,
  SbxNULL     =  1,
  ....
};

void SbModule::GetCodeCompleteDataFromParse(
  CodeCompleteDataCache& aCache)
{
  ....
  if( (pSymDef->GetType() != SbxEMPTY) ||
      (pSymDef->GetType() != SbxNULL) )
    aCache.InsertGlobalVar( pSymDef->GetName(),
      pParser->aGblStrings.Find(pSymDef->GetTypeId()) );
  ....
}

Similar errors can be found in some other places:

• V547 Expression is always true. Probably the '&&' operator should be used here. sbxmod.cxx 1785

LibreOffice

V547 Expression is always false. Probably the '||' operator should be used here. svdobj.cxx 2352

enum SfxStyleFamily {
  ....
  SFX_STYLE_FAMILY_PARA = 2,
  ....
  SFX_STYLE_FAMILY_PAGE = 8,
  ....
};

void SdrObject::NbcSetStyleSheet(SfxStyleSheet* pNewStyleSheet,
                                 bool bDontRemoveHardAttr)
{
  // only allow graphic and presentation styles for shapes
  if( pNewStyleSheet &&
     (pNewStyleSheet->GetFamily() == SFX_STYLE_FAMILY_PARA) &&
     (pNewStyleSheet->GetFamily() == SFX_STYLE_FAMILY_PAGE) )
        return;

    GetProperties().SetStyleSheet(pNewStyleSheet,
                                  bDontRemoveHardAttr);
}

LibreOffice

V547 Expression is always false. Probably the '||' operator should be used here. xmlstylesexporthelper.cxx 223

OUString ScMyValidationsContainer::GetCondition(
  ScXMLExport& rExport, const ScMyValidation& aValidation)
{
  ....
  if (.... ||
      (aValidation.aOperator ==
                          sheet::ConditionOperator_BETWEEN &&
       aValidation.aOperator ==
                          sheet::ConditionOperator_NOT_BETWEEN &&
       !aValidation.sFormula2.isEmpty())))
  ....
}

.NET CoreCLR

V547 Expression 'maxCpuId >= 0' is always true. Unsigned type value is always >= 0. cee_wks codeman.cpp 1219

void EEJitManager::SetCpuInfo()
{
  ....
  unsigned char buffer[16];
  DWORD maxCpuId = getcpuid(0, buffer);
  if (maxCpuId >= 0)
  {
  ....
}

Haiku Operation System

V547 Expression '* r && * r == ' ' && * r == '\t'' is always false. Probably the '||' operator should be used here. selection.c 546

static int
selection_rel(....)
{
  char *r, *rname;
  ....
  while (*r && *r == ' ' && *r == '\t')
    r++;
  ....
}

Haiku Operation System

V547 Expression is always true. Probably the '&&' operator should be used here. StatusView.cpp 1397

void
TDragRegion::Draw(BRect)
{
  ....
  if (fDragLocation != kDontDrawDragRegion ||
      fDragLocation != kNoDragRegion)
    DrawDragRegion();
}

Haiku Operation System

V547 Expression 'reservedBase < 0' is always false. Unsigned type value is never < 0. agp_gart.cpp 1172

/* address types */
typedef  unsigned long int  __haiku_addr_t;   // <=
typedef __haiku_addr_t    addr_t;             // <=

static status_t
bind_aperture(...., addr_t reservedBase, ....)
{
  ....
  if (status < B_OK) {
    if (reservedBase < 0)
      aperture->DeleteMemory(memory);

    return status;
  }
  ....
}

Haiku Operation System

V547 Expression 'nogscale >= 0' is always true. Unsigned type value is always >= 0. tvp3026.c 212

status_t mil2_dac_init (void)
{
  uint32   rfhcnt, nogscale, memconfig;
  ....
  for (nogscale = 1; nogscale >= 0; nogscale--) {           // <=
    int max = -1 + 33.2 * mclk / (nogscale? 1: 4);
    for (rfhcnt = 15; rfhcnt > 0; rfhcnt--) {
      int value = (rfhcnt & 0x0e) * 256 + (rfhcnt & 0x01) * 64;
      LOG(2,("mil2_dac_init factor %d, rfhcnt %2d: %d ?<= %d\n",
        nogscale, rfhcnt, value, max));
      if (value <= max) goto rfhcnt_found;
    }
  }
  ....
}

Godot Engine

V547 Expression 'p_bytes < 0' is always false. Unsigned type value is never < 0. memory_pool_static_malloc.cpp 159

void* MemoryPoolStaticMalloc::_realloc(void *p_memory,
                                       size_t p_bytes) {
  ....
  if (p_bytes<=0)
  {
    this->free(p_memory);
    ERR_FAIL_COND_V( p_bytes < 0 , NULL );
    return NULL;
  }
  ....
}

Godot Engine

V547 Expression 's < 0' is always false. Unsigned type value is never < 0. particles_2d.cpp 230

_FORCE_INLINE_ static float _rand_from_seed(uint32_t *seed)
{
  ....
  uint32_t s = (*seed);
  ....
  if (s < 0)
    s += 2147483647;
  ....
}

Unreal Engine 4

V547 Expression is always false. Unsigned type value is never < 0. windowsapplication.cpp 1938

void FWindowsApplication::QueryConnectedMice()
{
  ....
  if (GetRawInputDeviceInfoA(Device.hDevice, ....) < 0)
    continue;

  Name.Reset(new char[NameLen+1]);
  if (GetRawInputDeviceInfoA(Device.hDevice, ....) < 0)
    continue;
  ....
}

UINT WINAPI GetRawInputDeviceInfo(...);

MAME

V547 Expression 'nBit < 0' is always false. Unsigned type value is never < 0. bitmask.c 60

BOOL TestBit(LPBITS lpBits, UINT nBit)
{
  UINT  offset;
  UCHAR  mask;

  if (nBit < 0 || !lpBits || !lpBits->m_lpBits)
    return FALSE;
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'nBit < 0' is always false. Unsigned type value is never < 0. bitmask.c 80
• V547 Expression 'nBit < 0' is always false. Unsigned type value is never < 0. bitmask.c 100

Apple II emulator

V547 Expression 'uTStates < 0' is always false. Unsigned type value is never < 0. z80.cpp 5507

static const double uZ80ClockMultiplier = CLK_Z80 / CLK_6502;
inline static ULONG ConvertZ80TStatesTo6502Cycles(UINT uTStates)
{
  return (uTStates < 0) ?
    0 : (ULONG) ((double)uTStates / uZ80ClockMultiplier);
}

Gamer_Z eXtreme Party

V547 Expression is always true. Probably the '&&' operator should be used here. minigamederby.cxx 346

bool OnPlayerKeyStateChange(
  int playerid, int newkeys, int oldkeys) override
{
  if (newkeys == 1 || newkeys == 9 ||
      newkeys == 33 && oldkeys != 1 ||
      oldkeys != 9 || oldkeys != 33)       // <=
  {
    AddVehicleComponent(Player[playerid].CurrentVehicle, 1010);
  }
  return true;
}

Similar errors can be found in some other places:

• V547 Expression is always true. Probably the '&&' operator should be used here. minigameracingsystem.cxx 528

Gamer_Z eXtreme Party

V547 Expression 'index >= 0' is always true. Unsigned type value is always >= 0. stunting.cxx 372

ZCMDF(tpx, PERMISSION_NONE,
      RESTRICTION_NOT_IN_A_GAME | RESTRICTION_NOT_AFTER_FIGHT,
      cmd_alias({}), "D")
{
  if (parser.Good())
  {
    size_t index = (_StuntPark.Objects.size() - 1) -
                   parser.Get<unsigned long>();
    if (index >= 0)
    {
      ....
    }
  }
  return true;
}

FreeSWITCH

V547 Expression is always false. Unsigned type value is never < 0. esl.c 690

typedef SOCKET ws_socket_t;

static ws_socket_t prepare_socket(ips_t *ips)
{
  ws_socket_t sock = ws_sock_invalid;

  ....
  if ((sock = socket(family, SOCK_STREAM, IPPROTO_TCP)) < 0) {
    die("Socket Error!\n");
  }
  ....
}

FreeSWITCH

V547 Expression 'fftstate->Perm == ((void *) 0)' is always false. Pointer 'fftstate->Perm' != NULL. fft.c 339

typedef struct {
  unsigned int SpaceAlloced;
  unsigned int MaxPermAlloced;
  double Tmp0[MAXFFTSIZE];
  double Tmp1[MAXFFTSIZE];
  double Tmp2[MAXFFTSIZE];
  double Tmp3[MAXFFTSIZE];
  int Perm[MAXFFTSIZE];
  int factor [NFACTOR];

} FFTstr;

static int   FFTRADIX (...., FFTstr *fftstate)
{
  ....
  if (fftstate->Tmp0 == NULL || fftstate->Tmp1 == NULL ||
      fftstate->Tmp2 == NULL || fftstate->Tmp3 == NULL ||
      fftstate->Perm == NULL) {
    return -1;
  }
  ....
}

Mozilla Thunderbird

V547 Expression is always false. Probably the '||' operator should be used here. nsmsgdbview.cpp 3014

class NS_NO_VTABLE nsMsgViewCommandType
{
  enum
  {
    ....
    junk = 27,
    unjunk = 28,
    ....
  };
};

nsresult nsMsgDBView::
ApplyCommandToIndices(nsMsgViewCommandTypeValue command, ....)
{
  ....
  if ((command == nsMsgViewCommandType::junk) &&
      (command == nsMsgViewCommandType::unjunk))
  ....
}

GINV

V547 Expression '* i ++ < 0' is always false. Unsigned type value is never < 0. imonomaux.cpp 460

class IMonomAuxInterface {
public:
  typedef unsigned         Word;
  typedef Word*            MonomIterator;
  typedef const Word*      MonomConstIterator;
  ....
}

bool IMonomAuxInterface::assertValid(
  IMonomAuxInterface::MonomConstIterator i) const
{
  MonomConstIterator end1 = i + mEndVar;
  do {
    if (*i++ < 0)
      return false;
  } while(i < end1);
  return true;
}

Unreal Engine 4

V547 Expression 'CurrentFileSize >= 0' is always true. Unsigned type value is always >= 0. buildpatchcompactifier.cpp 135

bool FBuildDataCompactifier::Compactify(....) const
{
  ....
  uint64 CurrentFileSize;
  ....
  CurrentFileSize = IFileManager::Get().FileSize(*File);
  if (CurrentFileSize >= 0)
  {
    ....
  }
  else
  {
    GLog->Logf(TEXT("Warning. ......"), *File);
  }
  ....
}

Dolphin Smalltalk 7

V547 Expression 'i >= 0' is always true. Unsigned type value is always >= 0. compact.cpp 35

// Answer the index of the last occuppied OT entry
unsigned __stdcall ObjectMemory::lastOTEntry()
{
  HARDASSERT(m_pOT);

  unsigned i = m_nOTSize-1;
  const OTE* pOT = m_pOT;
  while (pOT[i].isFree())
  {
    ASSERT(i >= 0);
    i--;
  }

  return i;
}

Similar errors can be found in some other places:

• V547 Expression is always true. Unsigned type value is always >= 0. loadimage.cpp 343

Dolphin Smalltalk 7

V547 Expression 'ch > 127' is always false. The value range of char type: [-128, 127]. decode.cpp 55

ostream& operator<<(ostream& stream, ....)
{
  ....
  char ch = string->m_characters[i];
  //if (ch = '\0') break;
  if (ch < 32 || ch > 127)
  {
    static char hexChars[16+1] = "0123456789ABCDEF";
    ....
  }
  ....
}

ChakraCore

V547 Expression 'srcIndex - src->left >= 0' is always true. Unsigned type value is always >= 0. sparsearraysegment.inl 355

class SparseArraySegmentBase
{
public:
    static const uint32 MaxLength;
    ....
    uint32 size;
    ....
}

template<typename T>
SparseArraySegment<T>* SparseArraySegment<T>::CopySegment(....,
  uint32 srcIndex, ....)
{
  ....
  AssertMsg(srcIndex - src->left >= 0,                    // <=
    "src->left > srcIndex resulting in \
     negative indexing of src->elements");
  js_memcpy_s(dst->elements + dstIndex - dst->left,
              sizeof(T) * inputLen,
              src->elements + srcIndex - src->left,
              sizeof(T) * inputLen);
  return dst;
}

ChakraCore

V547 Expression is always true. Probably the '&&' operator should be used here. bytecodegenerator.cpp 805

void ByteCodeGenerator::AssignRegister(Symbol *sym)
{
  AssertMsg(sym->GetDecl() == nullptr ||
            sym->GetDecl()->nop != knopConstDecl ||      // <=
            sym->GetDecl()->nop != knopLetDecl, "....");

  if (sym->GetLocation() == Js::Constants::NoRegister)
  {
    sym->SetLocation(NextVarRegister());
  }
}

ChakraCore

V547 Expression 'callSiteId >= 0' is always true. Unsigned type value is always >= 0. inline.cpp 1181

typedef uint16 ProfileId;

Func * Inline::BuildInlinee(Js::FunctionBody* funcBody, ....)
{
  ....
  Js::ProfileId callSiteId = static_cast<Js::ProfileId>(....);
  Assert(callSiteId >= 0);
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'callSiteId >= 0' is always true. Unsigned type value is always >= 0. inline.cpp 2627
• V547 Expression 'callSiteId >= 0' is always true. Unsigned type value is always >= 0. inline.cpp 3657

Computational Network Toolkit

V547 Expression 'val[0] == 0xEF' is always false. The value range of char type: [-128, 127]. file.cpp 462

bool File::IsUnicodeBOM(bool skip)
{
  ....
  else if (m_options & fileOptionsText)
  {
    char val[3];
    file.ReadString(val, 3);
    found = (val[0] == 0xEF && val[1] == 0xBB && val[2] == 0xBF);
  }
  // restore pointer if no BOM or we aren't skipping it
  if (!found || !skip)
  {
    SetPosition(pos);
  }
  ....
}

MPC-HC

V547 Expression '(SpeakerActivityMask & 0xC000) == 0x0C00' is always false. file_dts.cpp 196

std::string
DTS_HD_SpeakerActivityMask(int16u SpeakerActivityMask)
{
  ....
  if ((SpeakerActivityMask&0xC000)==0x0C00)
  ....
}

Note that 0xC000 and 0x0C00 are used. Apparently these values should have been the same.

Similar errors can be found in some other places:

• V547 Expression '(SpeakerActivityMask & 0xC000) == 0x0C00' is always false. file_dts.cpp 264

FreeBSD Kernel

V547 Expression is always true. Probably the '&&' operator should be used here. qla_hw.c 799

static int
qla_tx_tso(qla_host_t *ha, struct mbuf *mp, ....)
{
  ....
  if ((*tcp_opt != 0x01) || (*(tcp_opt + 1) != 0x01) ||
    (*(tcp_opt + 2) != 0x08) || (*(tcp_opt + 2) != 10)) { // <=
    return -1;
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'value < 0' is always false. Unsigned type value is never < 0. ar9300_xmit.c 450

FreeBSD Kernel

V547 Expression 'cdb[0] != 0x28 || cdb[0] != 0x2A' is always true. Probably the '&&' operator should be used here. mfi_tbolt.c 1110

int
mfi_tbolt_send_frame(struct mfi_softc *sc, struct mfi_command*cm)
{
  ....
  if (cdb[0] != 0x28 || cdb[0] != 0x2A) {
    if ((req_desc = mfi_tbolt_build_mpt_cmd(sc, cm)) == NULL) {
      device_printf(sc->mfi_dev, "Mapping from MFI "
          "to MPT Failed \n");
      return 1;
    }
  }
  else
    device_printf(sc->mfi_dev, "DJA NA XXX SYSPDIO\n");
  ....
}

FreeBSD Kernel

V547 Expression is always true. Probably the '&&' operator should be used here. igmp.c 1939

static void
igmp_v3_suppress_group_record(struct in_multi *inm)
{
  ....
  if (inm->inm_state != IGMP_G_QUERY_PENDING_MEMBER ||
      inm->inm_state != IGMP_SG_QUERY_PENDING_MEMBER)
    return;
  ....
}

FreeBSD Kernel

V547 Expression 'j >= 0' is always true. Unsigned type value is always >= 0. safe.c 1596

static void
safe_mcopy(struct mbuf *srcm, struct mbuf *dstm, u_int offset)
{
  u_int j, dlen, slen;                   // <=
  caddr_t dptr, sptr;

  /*
   * Advance src and dst to offset.
   */
  j = offset;
  while (j >= 0) {                       // <=
    if (srcm->m_len > j)
      break;
    j -= srcm->m_len;                    // <=
    srcm = srcm->m_next;
    if (srcm == NULL)
      return;
  }
  sptr = mtod(srcm, caddr_t) + j;
  slen = srcm->m_len - j;

  j = offset;
  while (j >= 0) {                       // <=
    if (dstm->m_len > j)
      break;
    j -= dstm->m_len;                    // <=
    dstm = dstm->m_next;
    if (dstm == NULL)
      return;
  }
  dptr = mtod(dstm, caddr_t) + j;
  dlen = dstm->m_len - j;
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'j >= 0' is always true. Unsigned type value is always >= 0. safe.c 1608

Oracle VM Virtual Box

V547 Expression is always false. Unsigned type value is never < 0. dt_subr.c 715

#define vsnprintf RTStrPrintfV

int
dt_printf(dtrace_hdl_t *dtp, FILE *fp, const char *format, ...)
{
  ....
  if (vsnprintf(
        &dtp->dt_buffered_buf[dtp->dt_buffered_offs],
        avail,
        format,
        ap) < 0) {                                   // <=
      rval = dt_set_errno(dtp, errno);
      va_end(ap);
      return (rval);
    }
  ....
}

size_t RTStrPrintfV(char *, size_t, const char *, va_list args); int vsnprintf (char *, size_t, const char *, va_list arg );

Oracle VM Virtual Box

V547 Expression 'sd >= 0' is always true. Unsigned type value is always >= 0. vboxservicevminfo.cpp 1086

static int vgsvcVMInfoWriteNetwork(void)
{
  ....
  SOCKET sd = WSASocket(AF_INET, SOCK_DGRAM, 0, 0, 0, 0);
  ....
  if (pAdpInfo)
        RTMemFree(pAdpInfo);
  if (sd >= 0)
      closesocket(sd);
  ....
}

Serious Engine 1 v.1.10

V547 Expression is always false. Probably the '||' operator should be used here. entity.cpp 3537

enum RenderType {
  ....
  RT_BRUSH       = 4,
  RT_FIELDBRUSH  = 8,
  ....
};

void
CEntity::DumpSync_t(CTStream &strm, INDEX iExtensiveSyncCheck)
{
  ....
  if( en_pciCollisionInfo == NULL) {
    strm.FPrintF_t("Collision info NULL\n");
  } else if (en_RenderType==RT_BRUSH &&
             en_RenderType==RT_FIELDBRUSH) {
    strm.FPrintF_t("Collision info: Brush entity\n");
  } else {
  ....
  }
  ....
}

Serious Engine 1 v.1.10

V547 Expression is always true. Probably the '&&' operator should be used here. propertycombobar.cpp 1853

CEntity *CPropertyComboBar::GetSelectedEntityPtr(void)
{
 // obtain selected property ID ptr
 CPropertyID *ppidProperty = GetSelectedProperty();
 // if there is valid property selected
 if( (ppidProperty == NULL) ||
 (ppidProperty->pid_eptType != CEntityProperty::EPT_ENTITYPTR) ||
 (ppidProperty->pid_eptType != CEntityProperty::EPT_PARENT) )
 {
   return NULL;
 }
 ....
}

Serious Engine 1 v.1.10

V547 Expression 'ulUsedShadowMemory >= 0' is always true. Unsigned type value is always >= 0. gfxlibrary.cpp 1693

void CGfxLibrary::ReduceShadows(void)
{
  ULONG ulUsedShadowMemory = ....;
  ....
  ulUsedShadowMemory -= sm.Uncache();
  ASSERT( ulUsedShadowMemory>=0);
  ....
}

Serious Engine 1 v.1.10

V547 Expression 'achrLine != ""' is always true. To compare strings you should use strcmp() function. worldeditor.cpp 2254

void CWorldEditorApp::OnConvertWorlds()
{
  ....
  char achrLine[256];
  CTFileStream fsFileList;

  // count lines in list file
  try {
    fsFileList.Open_t( fnFileList);
    while( !fsFileList.AtEOF()) {
      fsFileList.GetLine_t( achrLine, 256);
      // increase counter only for lines that are not blank
      if( achrLine != "") ctLines++; // <=
    }
    fsFileList.Close();
  }
  ....
}

if(strcmp(achrLine, "") != 0) ctLines++;

Similar errors can be found in some other places:

• V547 Expression is always true. To compare strings you should use strcmp() function. propertycombobar.cpp 965
• V547 Expression 'achrLine == ""' is always false. To compare strings you should use strcmp() function. worldeditor.cpp 2293

OpenToonz

V547 Expression '(int) startOutPoints.size() % 2 != 2' is always true. rasterselection.cpp 852

TStroke getIntersectedStroke(TStroke &stroke, TRectD bbox)
{
  ....
  for (t = 0; t < (int)outPoints.size(); t++)
    addPointToVector(...., (int)startOutPoints.size() % 2 != 2);
  ....
}

PHP:Hypertext Preprocessor

V547 Expression is always false. Unsigned type value is never < 0. spl_directory.c 2886

#define MIN(a, b)   (((a)<(b))?(a):(b))
#define MAX(a, b)  (((a)>(b))?(a):(b))

SPL_METHOD(SplFileObject, fwrite)
{
  ....
  size_t str_len;
  zend_long length = 0;
  ....
  str_len = MAX(0, MIN((size_t)length, str_len));
  ....
}

Firebird

V547 Expression 'bdb->bdb_page.getPageNum() >= 0' is always true. Unsigned type value is always >= 0. cch.cpp 4827

static bool write_page(thread_db* tdbb, BufferDesc* bdb, ....)
{
  ....
  if (bdb->bdb_page.getPageNum() >= 0)
  ....
}

7-Zip

V547 Expression 'newSize < 0' is always false. Unsigned type value is never < 0. update.cpp 254

STDMETHODIMP COutMultiVolStream::SetSize(UInt64 newSize)
{
  if (newSize < 0)
    return E_INVALIDARG;
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'rec.SiAttr.SecurityId >= 0' is always true. Unsigned type value is always >= 0. ntfshandler.cpp 2142
• V547 Expression 's.Len() >= 0' is always true. Unsigned type value is always >= 0. xarhandler.cpp 258

Open X-Ray Engine

V547 Expression is always true. Probably the '&&' operator should be used here. configs_dumper.cpp 262

void configs_dumper::dumper_thread(void* my_ptr)
{
  ....
  DWORD wait_result = WaitForSingleObject(
             this_ptr->m_make_start_event, INFINITE);
  while ( wait_result != WAIT_ABANDONED) ||
         (wait_result != WAIT_FAILED))
  ....
}

Open X-Ray Engine

V547 Expression 'squad->get_index(this) == u32(- 1)' is always false. The value range of unsigned char type: [0, 255]. ai_rat.cpp 480

void CAI_Rat::UpdateCL()
{
  ....
  if (!Useful()) {
    inherited::UpdateCL        ();
    Exec_Look                  (Device.fTimeDelta);

    CMonsterSquad *squad = monster_squad().get_squad(this);

    if (squad && ((squad->GetLeader() != this &&
                  !squad->GetLeader()->g_Alive()) ||
                 squad->get_index(this) == u32(-1)))
      squad->SetLeader(this);

    ....
  }
  ....
}

Open X-Ray Engine

V547 Expression 'm_tActionCondition.m_tLifeTime >= 0' is always true. Unsigned type value is always >= 0. script_entity_action_inline.h 115

namespace ALife
{
  typedef u64 _TIME_ID;
}
ALife::_TIME_ID CScriptActionCondition::m_tLifeTime;

IC bool CScriptEntityAction::CheckIfTimeOver()
{
  return((m_tActionCondition.m_tLifeTime >= 0) &&
         ((m_tActionCondition.m_tStartTime +
           m_tActionCondition.m_tLifeTime)
                        < Device.dwTimeGlobal));
}

Similar errors can be found in some other places:

• V547 Expression 'm_tActionCondition.m_tLifeTime < 0' is always false. Unsigned type value is never < 0. script_entity_action_inline.h 143

CPython

V547 Expression 's->sock_fd < 0' is always false. Unsigned type value is never < 0. socketmodule.c 655

#ifdef MS_WINDOWS
typedef SOCKET SOCKET_T;
#else
typedef int SOCKET_T;
#endif
typedef struct {
  PyObject_HEAD
  SOCKET_T sock_fd; /* Socket file descriptor */
  ....
} PySocketSockObject;

static int
internal_select(PySocketSockObject *s,
                int writing,
                _PyTime_t interval,
                int connect)
{
  ....
  if (s->sock_fd < 0)
    return 0;
  ....
}

CryEngine V

V547 Expression 'pszScript[iSrcBufPos] != '=='' is always true. The value range of char type: [-128, 127]. luadbg.cpp 716

bool CLUADbg::LoadFile(const char* pszFile, bool bForceReload)
{
  FILE* hFile = NULL;
  char* pszScript = NULL, * pszFormattedScript = NULL;
  ....
  while (pszScript[iSrcBufPos] != ' ' &&
    ....
    pszScript[iSrcBufPos] != '=' &&
    pszScript[iSrcBufPos] != '==' &&
    pszScript[iSrcBufPos] != '*' &&
    pszScript[iSrcBufPos] != '+' &&
    pszScript[iSrcBufPos] != '/' &&
    pszScript[iSrcBufPos] != '~' &&
    pszScript[iSrcBufPos] != '"')
  {}
  ....
}

CryEngine V

V547 Expression 'm_socket < 0' is always false. Unsigned type value is never < 0. servicenetwork.cpp 585

typedef SOCKET CRYSOCKET;
// Internal socket data
CRYSOCKET m_socket;

bool CServiceNetworkConnection::TryReconnect()
{
  ....
  // Create new socket if needed
  if (m_socket == 0)
  {
    m_socket = CrySock::socketinet();
    if (m_socket < 0)
    {
      ....
      return false;
    }
  }
  ....
}

ICQ

V547 Expression '"audio_playback_mute"' is always true. core im_container.cpp 329

void core::im_container::on_voip_call_message(....)
{
  ....
  } else if (type == "update") {
  ....
  } else if (type == "voip_set_window_offsets") {
  ....
  } else if (type == "voip_reset") {
  ....
  else if ("audio_playback_mute")
  {
    const std::string mode = _params.get_value_as_string("mute");
    im->on_voip_set_mute(mode == "on");
  }
  else {
    assert(false);
  }
}

CodeLite

V547 Expression 'type.Lower() == "Array"' is always false. NodeJSOuptutParser.h 61

struct NodeJSHandle {
  wxString type;
  ....
  bool IsString() const {return type.Lower() == "string";}
  bool IsArray() const {return type.Lower() == "Array"; }
};

LLVM/Clang

V547 Expression is always true. Probably the '&&' operator should be used here. LoopInterchange.cpp 208

static bool containsNoDependence(CharMatrix &DepMatrix,
                                 unsigned Row,
                                 unsigned Column) {
  for (unsigned i = 0; i < Column; ++i) {
    if (DepMatrix[Row][i] != '=' || DepMatrix[Row][i] != 'S' ||
        DepMatrix[Row][i] != 'I')
      return false;
  }
  return true;
}

Partio

V547 Expression '"R"' is always true. PDA.cpp 90

ParticlesDataMutable* readPDA(....)
{
  ....
  if(word == "V"){
      attrs.push_back(simple->addAttribute(....);
  }else if("R"){                                  // <=
      attrs.push_back(simple->addAttribute(....);
  }else if("I"){                                  // <=
      attrs.push_back(simple->addAttribute(....);
  }
  ....
}

OpenSubdiv

V547 Expression 'buffer[0] == '\r' && buffer[0] == '\n ' ' is always false. Probably the '||' operator should be used here. hdr_reader.cpp 84

unsigned char *loadHdr(....)
{
  ....
  if (! fgets(buffer, MAXLINE, fp)) goto error;
  if (buffer[0] == '\n') break;
  if (buffer[0] == '\r' && buffer[0] == '\n') break;
  ....
}

Linux Kernel

V547 Expression '(ptr[3] & 0x1E) != 0x03' is always true. sd.c 4115

int ext_sd_send_cmd_get_rsp(struct rtsx_chip *chip,
    u8 cmd_idx, u32 arg, u8 rsp_type,
    u8 *rsp, int rsp_len, bool special_check)
{
  int retval;
  int timeout = 100;
  u16 reg_addr;
  u8 *ptr;

  ....

  if (cmd_idx == SELECT_CARD) {
    if (rsp_type == SD_RSP_TYPE_R2) {
      if ((ptr[3] & 0x1E) != 0x04) {
        rtsx_trace(chip);
        return STATUS_FAIL;
      }

    } else if (rsp_type == SD_RSP_TYPE_R0) {
      if ((ptr[3] & 0x1E) != 0x03) {           // <=
        rtsx_trace(chip);
        return STATUS_FAIL;
      }
    }
  }

  ....
}

Linux Kernel

V547 Expression 'block' is always true. svclock.c 873

void
nlmsvc_grant_reply(struct nlm_cookie *cookie, __be32 status)
{
  struct nlm_block  *block;

  dprintk("grant_reply: looking for cookie %x, s=%d \n",
    *(unsigned int *)(cookie->data), status);
  if (!(block = nlmsvc_find_block(cookie)))
    return;

  if (block) {
    if (status == nlm_lck_denied_grace_period) {
      /* Try again in a couple of seconds */
      nlmsvc_insert_block(block, 10 * HZ);
    } else {
      /* Lock is now held by client, or has been rejected.
       * In both cases, the block should be removed. */
      nlmsvc_unlink_block(block);
    }
  }
  nlmsvc_release_block(block);
}

Linux Kernel

V547 Expression 'sym' is always true. menu.c 498

bool menu_is_visible(struct menu *menu)
{
  struct menu *child;
  struct symbol *sym;

  ....

  if (!sym || sym_get_tristate_value(menu->sym) == no) // <=
    return false;

  for (child = menu->list; child; child = child->next) {
    if (menu_is_visible(child)) {
      if (sym)                                         // <=
        sym->flags |= SYMBOL_DEF_USER;
      return true;
    }
  }

  return false;
}

CMaNGOS

V547 Expression is always false. Probably the '||' operator should be used here. SpellEffects.cpp 2872

void Spell::EffectEnchantItemTmp(SpellEffectIndex eff_idx)
{
  ....
  // TODO: Strange stuff in following code
  // shaman family enchantments
  if (....)
      duration = 300;
  else if (m_spellInfo->SpellIconID == 241 &&
           m_spellInfo->Id != 7434)
      duration = 3600;
  else if (m_spellInfo->Id == 28891 &&               // <=
           m_spellInfo->Id == 28898)
      duration = 3600;
  ....
}

Similar errors can be found in some other places:

• V547 Expression is always true. Probably the '&&' operator should be used here. genrevision.cpp 261
• V547 Expression is always true. Probably the '&&' operator should be used here. vmapexport.cpp 361
• V547 Expression is always true. Probably the '&&' operator should be used here. MapTree.cpp 125
• And 1 additional diagnostic messages.

FreeBSD Kernel

V547 Expression 'cfgflags >= 0 || cfgflags <= 3' is always true. hwpmc_piv.c 812

static int
p4_config_pmc(int cpu, int ri, struct pmc *pm)
{
  ....
  int cfgflags, cpuflag;
  ....
  KASSERT(cfgflags >= 0 || cfgflags <= 3,
      ("[p4,%d] illegal cfgflags cfg=%d on cpu=%d ri=%d",
    __LINE__, cfgflags, cpu, ri));
  ....
  KASSERT(cfgflags >= 0 || cfgflags <= 3,
      ("[p4,%d] illegal runcount cfg=%d on cpu=%d ri=%d",
    __LINE__, cfgflags, cpu, ri));
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'cfgflags >= 0 || cfgflags <= 3' is always true. hwpmc_piv.c 838
• V547 Expression 'cdb[0] != 0x28 || cdb[0] != 0x2A' is always true. Probably the '&&' operator should be used here. mfi_tbolt.c 1110

RPCS3

V547 Expression 'sock < 0' is always false. Unsigned type value is never < 0. sys_net.cpp 695

#ifdef _WIN32
  using socket_t = SOCKET;
#else
  using socket_t = int;
#endif

s32 socket(s32 family, s32 type, s32 protocol)
{
  ....
  socket_t sock = ::socket(family, type, protocol);

  if (sock < 0)
  {
    libnet.error("socket()....", get_errno() = get_last_error());
    return -1;
  }
  ....
}

FreeBSD Kernel

V547 Expression is always false. Unsigned type value is never < 0. ng_nat.c 374

unsigned int
LibAliasSetMode(struct libalias *, unsigned int _flags,
                unsigned int _mask);

static int
ng_nat_rcvmsg(node_p node, item_p item, hook_p lasthook)
{
  ....
  if (LibAliasSetMode(priv->lib,
      ng_nat_translate_flags(mode->flags),
      ng_nat_translate_flags(mode->mask)) < 0) {
    error = ENOMEM;
    break;
  }
  ....
}

FreeBSD Kernel

V547 Expression is always false. scif_sas_controller.c 531

....
U16  max_ncq_depth;
....
SCI_STATUS scif_user_parameters_set(
   SCI_CONTROLLER_HANDLE_T   controller,
   SCIF_USER_PARAMETERS_T  * scif_parms
)
{
  ....
   if (scif_parms->sas.max_ncq_depth < 1 &&
       scif_parms->sas.max_ncq_depth > 32)
     return SCI_FAILURE_INVALID_PARAMETER_VALUE;
  ....
}

CryEngine V

V547 Expression 'outArrIndices[i] < 0' is always false. Unsigned type value is never < 0. CGFLoader.cpp 881

static bool CompactBoneVertices(....,
  DynArray<uint16>& outArrIndices, ....)           // <= uint16
{
  ....
  outArrIndices.resize(3 * inFaceCount, -1);

  int outVertexCount = 0;
  for (int i = 0; i < verts.size(); ++i)
  {
    ....
    outArrIndices[....] = outVertexCount - 1;
  }

  // Making sure that the code above has no bugs   // <= LOL
  for (int i = 0; i < outArrIndices.size(); ++i)
  {
    if (outArrIndices[i] < 0)                      // <= LOL
    {
      return false;
    }
  }

  return true;
}

TensorFlow

V547 Expression 'to_unref' is always false. master_session.cc 1114

Status MasterSession::StartStep(const BuildGraphOptions& opts,
                                int64* count,
                                ReffedClientGraph** rcg,
                                bool is_partial) {
  ....
  ReffedClientGraph* to_unref = nullptr;
  ....
  if (to_unref) to_unref->Unref();
  ....
}

Valgrind

V547 Expression 'ce->off >= 0' is always true. Unsigned type value is always >= 0. image.c 147

typedef  ULong  DiOffT;

typedef
   struct {
      Bool   fromC;
      DiOffT off;
      SizeT  size;
      SizeT  used;
      UChar  data[];
   }
   CEnt;

static Bool is_sane_CEnt ( .... )
{
  ....
  CEnt* ce = img->ces[i];
  ....
  if (!(ce->size == CACHE_ENTRY_SIZE)) goto fail;
  if (!(ce->off >= 0)) goto fail;
  if (!(ce->off + ce->used <= img->real_size)) goto fail;
  ....
}

Valgrind

V547 Expression '((void *) 0)' is always false. server.c 110

#define NULL ((void *) 0)

void reset_valgrind_sink(const char *info)
{
   if (VG_(log_output_sink).fd != initial_valgrind_sink.fd
       && initial_valgrind_sink_saved) {
      VG_(log_output_sink).fd = initial_valgrind_sink.fd;
      VG_(umsg) ("Reset valgrind output to log (%s)\n",
                 (info = NULL ? "" : info));                // <=
   }
}

Most likely this is what should be written here: (info == NULL ? "" : info)

ALSA

V547 Expression is always false. pcm_extplug.c 769

int snd_pcm_extplug_set_slave_param_list(
  snd_pcm_extplug_t *extplug, int type, unsigned int num_list,
  const unsigned int *list)
{
  extplug_priv_t *ext = extplug->pcm->private_data;
  if (type < 0 && type >= SND_PCM_EXTPLUG_HW_PARAMS) {     // <=
    SNDERR("EXTPLUG: invalid parameter type %d", type);
    return -EINVAL;
  }
  return snd_ext_parm_set_list(&ext->sparams[type],
                               num_list, list);
}

Most likely this is what should be written here: (type < 0 || type >= SND_PCM_EXTPLUG_HW_PARAMS)

Similar errors can be found in some other places:

• V547 Expression is always false. pcm_extplug.c 791
• V547 Expression is always false. pcm_extplug.c 817
• V547 Expression is always false. pcm_extplug.c 839
• And 2 additional diagnostic messages.

Aspell

V547 Expression 'pathPosEnd >= 0' is always true. Unsigned type value is always >= 0. new_fmode.cpp 566

class String : public OStream
{
  ....
  static const size_t npos = INT_MAX;

  size_t find(char c, size_t pos = 0) const {
    char * res = (char *)memchr(begin_ + pos, c, size() - pos);
    if (res == 0) return npos;
    else return res - begin_;
  }
  ....
};

PosibErr<FilterModeList *> FilterModeList::get_new(
  const String & key, const Config *)
{
  ....
  String possMode;
  ....
  unsigned pathPos = 0;
  unsigned pathPosEnd = 0;
  ....
  while (    ( (pathPosEnd =
                  possMode.find('/',pathPos)) < possMode.size() )
          && ( pathPosEnd >= 0 ) ) {
    pathPos = pathPosEnd + 1;
  }
  ....
}

SCIM

V547 Expression 'epos >= 0' is always true. Unsigned type value is always >= 0. scim_anthy_style_file.cpp 103

StyleLineType StyleLine::get_type (void)
{
  ....
  unsigned int spos, epos;
  ....
  for (epos = m_line.length () - 1;
       epos >= 0 && isspace (m_line[epos]);
       epos--);
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'epos >= 0' is always true. Unsigned type value is always >= 0. scim_anthy_style_file.cpp 137

Tizen

V547 Expression is always true. Probably the '&&' operator should be used here. bluetooth-hid.c 229

typedef enum {
  BT_HID_MOUSE_BUTTON_NONE = 0x00,
  BT_HID_MOUSE_BUTTON_LEFT = 0x01,
  BT_HID_MOUSE_BUTTON_RIGHT = 0x02,
  BT_HID_MOUSE_BUTTON_MIDDLE = 0x04
} bt_hid_mouse_button_e;

int bt_hid_device_send_mouse_event(const char *remote_address,
  const bt_hid_mouse_data_s *mouse_data)
{
  ....
  if (mouse_data->buttons != BT_HID_MOUSE_BUTTON_LEFT ||
      mouse_data->buttons != BT_HID_MOUSE_BUTTON_RIGHT ||
      mouse_data->buttons != BT_HID_MOUSE_BUTTON_MIDDLE) {
    return BT_ERROR_INVALID_PARAMETER;
  }
  ....
}

Tizen

V547 Expression 'm_candiPageFirst < 0' is always false. Unsigned type value is never < 0. imi_view_classic.cpp 201

unsigned m_candiPageFirst;

bool
CIMIClassicView::onKeyEvent(const CKeyEvent& key)
{
  ....
  if (m_candiPageFirst > 0) {
    m_candiPageFirst -= m_candiWindowSize;
    if (m_candiPageFirst < 0) m_candiPageFirst = 0;
    changeMasks |= CANDIDATE_MASK;
  }
  ....
}

Tizen

V547 Expression 'itemData' is always true. QuickAccess.cpp 571

void
QuickAccess::_grid_mostVisited_del(void *data, Evas_Object *)
{
  BROWSER_LOGD("[%s:%d]", __PRETTY_FUNCTION__, __LINE__);
  if (data) {
    auto itemData = static_cast<HistoryItemData*>(data);
    if (itemData)
      delete itemData;
  }
}

Similar errors can be found in some other places:

• V547 Expression '!urlPair' is always false. GenlistManager.cpp 143
• V547 Expression 'item_name' is always true. SettingsUI.cpp 222
• V547 Expression 'item_name' is always true. SettingsUI.cpp 226
• And 1 additional diagnostic messages.

Tizen

V547 Expression 'strlen(s_formatted) < 128' is always true. clock.c 503

#define CLOCK_STR_LEN 128

void indicator_get_time_by_region(char* output,void *data)
{
  ....
  char s_formatted[CLOCK_STR_LEN] = { 0, };
  ....
  if (strlen(s_formatted) < CLOCK_STR_LEN) {            // <=
    strncpy(output, s_formatted, strlen(s_formatted));
  }
  else {
    strncpy(output, s_formatted, CLOCK_STR_LEN - 1);
  }

  return;
}

Tizen

V547 Expression 'doc != NULL' is always true. setting-common-data-slp-setting.c 1450

static void _parseLangListXML(char *docname)
{
  SETTING_TRACE_BEGIN;
  xmlDocPtr doc;
  xmlNodePtr cur;

  doc = xmlParseFile(docname);

  if (doc == NULL) {
    fprintf(stderr, "Document not parsed successfully. \n");
    return;
  }
  ....
  if (doc != NULL) {
    xmlFreeDoc(doc);
  }
  return;
}

EFL Core Libraries

V547 Expression '(status < 500) && (status > 599)' is always false. ecore_con_url.c 351

static void
_ecore_con_url_dialer_error(void *data, const Efl_Event *event)
{
   Ecore_Con_Url *url_con = data;
   Eina_Error *perr = event->info;
   int status;

   status =
     efl_net_dialer_http_response_status_get(url_con->dialer);

   if ((status < 500) && (status > 599))
   {
      DBG("HTTP error %d reset to 1", status);
      status = 1; /* not a real HTTP error */
   }

   WRN("HTTP dialer error url='%s': %s",
       efl_net_dialer_address_dial_get(url_con->dialer),
       eina_error_msg_get(*perr));

   _ecore_con_event_url_complete_add(url_con, status);
}

Similar errors can be found in some other places:

• V547 Expression '(status < 500) && (status > 599)' is always false. ecore_con_url.c 658
• V547 Expression '(status < 500) && (status > 599)' is always false. ecore_con_url.c 1340

EFL Core Libraries

V547 Expression 'match' is always true. eina_rectangle.c 798

EAPI void
eina_rectangle_pool_release(Eina_Rectangle *rect)
{
  Eina_Rectangle *match;
  Eina_Rectangle_Alloc *new;
  ....
  match =(Eina_Rectangle *) (new + 1);
  if (match)
    era->pool->empty = _eina_rectangle_skyline_list_update(
                          era->pool->empty, match);
  ....
}

EFL Core Libraries

V547 Expression 's' is always true. evas_object_smart.c 160

EAPI const void *
evas_object_smart_interface_get(const Evas_Object *eo_obj,
                                const char *name)
{
  Evas_Smart *s;
  ....
  s = evas_object_smart_smart_get(eo_obj);
  if (!s) return NULL;

  if (s)
  ....
}

Similar errors can be found in some other places:

• V547 Expression 's' is always true. evas_object_smart.c 192
• V547 Expression '!c->fmt' is always true. evas_object_textblock.c 6359
• V547 Expression '!cur->node' is always true. evas_object_textblock.c 9943
• And 30 additional diagnostic messages.

ClickHouse

V547 Expression 'val > 0xffffu' is always false. The value range of unsigned short type: [0, 65535]. FunctionsCoding.h 339

static void ipv6_scan(const char *  src, unsigned char * dst)
{
  ....
  uint16_t val{};
  unsigned char * colonp = nullptr;

  while (const auto ch = *src++)
  {
    const auto num = unhex(ch);

    if (num != -1)
    {
      val <<= 4;
      val |= num;
      if (val > 0xffffu)         // <=
        return clear_dst();
  ....
}

ClickHouse

V547 Expression 'offset > 0' is always true. FunctionsCoding.h 649

static void formatIP(UInt32 ip, char *& out)
{
  ....
  for (size_t offset = 8; offset <= 24; offset += 8)
  {
    if (offset > 0)
      *(out++) = '.';
  ....
}

MuseScore

V547 Expression 'middleMeasure != 0' is always false. ove.cpp 7852

bool
getMiddleUnit(...., Measure* middleMeasure, int& middleUnit) {
  ....
}

void OveOrganizer::organizeWedge(....) {
  ....
  Measure* middleMeasure = NULL;
  int middleUnit = 0;

  getMiddleUnit(
    ove_, part, track,
    measure, ove_->getMeasure(bar2Index),
    wedge->start()->getOffset(), wedge->stop()->getOffset(),
    middleMeasure, middleUnit);

  if( middleMeasure != 0 ) {                            // <=
    WedgeEndPoint* midStopPoint = new WedgeEndPoint();
    measureData->addMusicData(midStopPoint);

    midStopPoint->setTick(wedge->getTick());
    midStopPoint->start()->setOffset(middleUnit);
    midStopPoint->setWedgeStart(false);
    midStopPoint->setWedgeType(WedgeType::Cres_Line);
    midStopPoint->setHeight(wedge->getHeight());

    WedgeEndPoint* midStartPoint = new WedgeEndPoint();
    measureData->addMusicData(midStartPoint);

    midStartPoint->setTick(wedge->getTick());
    midStartPoint->start()->setOffset(middleUnit);
    midStartPoint->setWedgeStart(true);
    midStartPoint->setWedgeType(WedgeType::Decresc_Line);
    midStartPoint->setHeight(wedge->getHeight());
    }
  }
  ....
}

Typo: middleMeasure and middleUnit.

MuseScore

V547 Expression 'error == 2' is always false. mididriver.cpp 126

#define ENOENT 2

bool AlsaMidiDriver::init()
{
  int error = snd_seq_open(&alsaSeq, "hw", ....);
  if (error < 0) {
    if (error == ENOENT)
      qDebug("open ALSA sequencer failed: %s",
        snd_strerror(error));
    return false;
  }
  ....
}

Rosegarden

V547 Expression '!beamedSomething' is always true. SegmentNotationHelper.cpp 1405

void SegmentNotationHelper::makeBeamedGroupAux(....)
{
  int groupId = segment().getNextId();
  bool beamedSomething = false;

  for (iterator i = from; i != to; ++i) {
  ....
  if ((*i)->isa(Note::EventType) &&
    (*i)->getNotationDuration() >= Note(....).getDuration()) {
    if (!beamedSomething) continue;         // <=
    iterator j = i;
    bool somethingLeft = false;
    while (++j != to) {
      if ((*j)->getType() == Note::EventType &&
        (*j)->getNotationAbsoluteTime() > (*i)->get....() &&
        (*j)->getNotationDuration() < Note(....).getDuration()) {
        somethingLeft = true;
        break;
      }
    }
    if (!somethingLeft) continue;
  }
  ....
}

Rosegarden

V547 Expression 'i > 5' is always false. SegmentParameterBox.cpp 323

void SegmentParameterBox::initBox()
{
  ....
  for (int i = 0; i < 6; i++) {
    timeT time = 0;
    if (i > 0 && i < 6) {
        time = Note(Note::Hemidemisemiquaver).get.... << (i - 1);
    } else if (i > 5) {
        time = Note(Note::Crotchet).getDuration() * (i - 4);
    }
  ....
}

Rosegarden

V547 Expression 'adjustedOctave < 8' is always false. NotePixmapFactory.cpp 1920

QGraphicsPixmapItem* NotePixmapFactory::makeClef(....)
{
  ....
  int oct = clef.getOctaveOffset();
  if (oct == 0) return plain.makeItem();

  int adjustedOctave = (8 * (oct < 0 ? -oct : oct));
  if (adjustedOctave > 8)
      adjustedOctave--;
  else if (adjustedOctave < 8)
      adjustedOctave++;
  ....
}

Rosegarden

V547 Expression '""' is always true. LilyPondOptionsDialog.cpp 64

LilyPondOptionsDialog::LilyPondOptionsDialog(....)
{
  setModal(true);
  setWindowTitle((windowCaption = "" ?
    tr("LilyPond Export/Preview") : windowCaption));
  ....
}

Similar errors can be found in some other places:

• V547 Expression '""' is always true. MusicXMLOptionsDialog.cpp 60

Ardour

V547 Expression 'strlen(buf) < 256' is always true. vst_info_file.cc 262

static char *
read_string (FILE *fp)
{
  char buf[MAX_STRING_LEN];

  if (!fgets (buf, MAX_STRING_LEN, fp)) {
    return 0;
  }

  if (strlen (buf) < MAX_STRING_LEN) {
    if (strlen (buf)) {
      buf[strlen (buf)-1] = 0;
    }
    return strdup (buf);
  } else {
    return 0;
  }
}

Sphinx (search engine)

V547 Expression is always false. sphinx.cpp 22416

enum ESphBinRead
{
  BIN_READ_OK,        ///< bin read ok
  BIN_READ_EOF,       ///< bin end
  BIN_READ_ERROR,     ///< bin read error
  BIN_PRECACHE_OK,    ///< precache ok
  BIN_PRECACHE_ERROR  ///< precache failed
};

ESphBinRead CSphBin::ReadBytes ( void * pDest, int iBytes )
{
  ....
    return BIN_READ_EOF;
  ....
    return BIN_READ_ERROR;
  ....
  return BIN_READ_OK;
}

static void DictReadEntry (....)
{
  ....
  if ( pBin->ReadBytes ( pKeyword, iKeywordLen )<0 )    // <=
  {
    assert ( pBin->IsError() );
    return;
  }
  ....
}

V8 JavaScript Engine

V547 CWE-570 Expression 'truncated' is always false. objects.cc 2867

void String::StringShortPrint(StringStream* accumulator,
                              bool show_details) {
  int len = length();
  if (len > kMaxShortPrintLength) {
    accumulator->Add("<Very long string[%u]>", len);
    return;
  }

  if (!LooksValid()) {
    accumulator->Add("<Invalid String>");
    return;
  }

  StringCharacterStream stream(this);

  bool truncated = false;
  if (len > kMaxShortPrintLength) {
    len = kMaxShortPrintLength;
    truncated = true;
  }
  bool one_byte = true;
  for (int i = 0; i < len; i++) {
    uint16_t c = stream.GetNext();

    if (c < 32 || c >= 127) {
      one_byte = false;
    }
  }
  stream.Reset(this);
  if (one_byte) {
    if (show_details)
      accumulator->Add("<String[%u]: ", length());
    for (int i = 0; i < len; i++) {
      accumulator->Put(static_cast<char>(stream.GetNext()));
    }
    if (show_details) accumulator->Put('>');
  } else {
    // Backslash indicates that the string contains control
    // characters and that backslashes are therefore escaped.
    if (show_details)
      accumulator->Add("<String[%u]\\: ", length());
    for (int i = 0; i < len; i++) {
      uint16_t c = stream.GetNext();
      if (c == '\n') {
        accumulator->Add("\\n");
      } else if (c == '\r') {
        accumulator->Add("\\r");
      } else if (c == '\\') {
        accumulator->Add("\\\\");
      } else if (c < 32 || c > 126) {
        accumulator->Add("\\x%02x", c);
      } else {
        accumulator->Put(static_cast<char>(c));
      }
    }
    if (truncated) {                      // <=
      accumulator->Put('.');
      accumulator->Put('.');
      accumulator->Put('.');
    }
    if (show_details) accumulator->Put('>');
  }
  return;
}

V8 JavaScript Engine

V547 CWE-570 Expression 'inf == - 1' is always false. string-stream.cc 149

void StringStream::Add(....) {
  ....
    case 'f': case 'g': case 'G': case 'e': case 'E': {
      double value = current.data_.u_double_;
      int inf = std::isinf(value);
      if (inf == -1) {
        Add("-inf");
      } else if (inf == 1) {
        Add("inf");
      } else if (std::isnan(value)) {
        Add("nan");
      } else {
        EmbeddedVector<char, 28> formatted;
        SNPrintF(formatted, temp.start(), value);
        Add(formatted.start());
      }
      break;
    }  ....
}

Description of the std::isinf function: http://en.cppreference.com/w/cpp/numeric/math/isinf As you can see, the function std::isinf returns the bool type. Thus, the function is clearly used incorrectly.

Protocol Buffers

V547 CWE-571 Expression is always true. time.cc 83

static const int kDaysInMonth[13] = {
  0, 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31
};

bool ValidateDateTime(const DateTime& time) {
  if (time.year < 1 || time.year > 9999 ||
      time.month < 1 || time.month > 12 ||
      time.day < 1 || time.day > 31 ||
      time.hour < 0 || time.hour > 23 ||
      time.minute < 0 || time.minute > 59 ||
      time.second < 0 || time.second > 59) {
    return false;
  }
  if (time.month == 2 && IsLeapYear(time.year)) {
    return time.month <= kDaysInMonth[time.month] + 1;
  } else {
    return time.month <= kDaysInMonth[time.month];
  }
}

Details: https://www.viva64.com/en/b/0550/

Similar errors can be found in some other places:

• V547 CWE-571 Expression 'time.month <= kDaysInMonth[time.month]' is always true. time.cc 85

RE2

V547 CWE-570 Expression 'c1 == c' is always false. rune.cc 247

typedef signed int Rune;

enum
{
  UTFmax    = 4,
  Runesync  = 0x80,
  Runeself  = 0x80,
  Runeerror = 0xFFFD,
  Runemax   = 0x10FFFF,
};

char*
utfrune(const char *s, Rune c)
{
  long c1;
  Rune r;
  int n;

  if(c < Runesync)    /* not part of utf sequence */
    return strchr((char*)s, c);

  for(;;) {
    c1 = *(unsigned char*)s;
    if(c1 < Runeself) {  /* one byte rune */
      if(c1 == 0)
        return 0;
      if(c1 == c)                // <=
        return (char*)s;
      s++;
      continue;
    }
    n = chartorune(&r, s);
    if(r == c)
      return (char*)s;
    s += n;
  }
  return 0;
}

If the variable c < 0x80, the function ends its work. This means that the value of a variable (c)>= 0x80. A comparison, interesting for us is performed only in case if c1 < 0x80. If c >= 80 and c1 < 0x80, the c==c1 a condition will always be false.

Skia Graphics Engine

V547 CWE-571 Expression 'allDone' is always true. skopcontour.cpp 43

SkOpSpan* SkOpContour::undoneSpan() {
  SkOpSegment* testSegment = &fHead;
  bool allDone = true;
  do {
    if (testSegment->done()) {
      continue;
    }
    allDone = false;
    return testSegment->undoneSpan();
  } while ((testSegment = testSegment->next()));
  if (allDone) {
    fDone = true;
  }
  return nullptr;
}

Very suspicious code, but it is difficult for me to understand what is the actual error here.

EA WebKit

V547 CWE-570 Expression '!first' is always false. webmediaconstraints.cpp 302

WebString StringConstraint::ToString() const {
  ....
  bool first = true;
  for (const auto& iter : exact_) {
    if (!first)
      builder.Append(", ");
    builder.Append('"');
    builder.Append(iter);
    builder.Append('"');
  }
  ....
}

As the first variable is always true, the commas between items will not be added.

XNU kernel

V547 CWE-571 Expression is always true. mtrr.c 692

void
pat_init(void)
{
  boolean_t  istate;
  uint64_t  pat;

  if (!(cpuid_features() & CPUID_FEATURE_PAT))
    return;

  istate = ml_set_interrupts_enabled(FALSE);

  pat = rdmsr64(MSR_IA32_CR_PAT);
  DBG("CPU%d PAT: was 0x%016llx\n", get_cpu_number(), pat);

  /* Change PA6 attribute field to WC if required */
  if ((pat & ~(0x0FULL << 48)) != (0x01ULL << 48)) {
    mtrr_update_action(CACHE_CONTROL_PAT);
  }
  ml_set_interrupts_enabled(istate);
}

The expression pat & [0xFFF0FFFFFFFFFFFF] can not result in the value 0x0001000000000000. So, the condition is always true. And the function mtrr_update_action is always called.

RT-Thread

V547 CWE-571 Expression 'i == 0' is always true. at91_mci.c 196

static void at91_mci_init_dma_read(struct at91_mci *mci)
{
  rt_uint8_t i;
  ....
  for (i = 0; i < 1; i++)
  {
    /* Check to see if this needs filling */
    if (i == 0)
    {
      if (at91_mci_read(AT91_PDC_RCR) != 0)
      {
        mci_dbg("Transfer active in current\n");
        continue;
      }
    }
    else {
      if (at91_mci_read(AT91_PDC_RNCR) != 0)
      {
        mci_dbg("Transfer active in next\n");
        continue;
      }
    }

    length = data->blksize * data->blks;
    mci_dbg("dma address = %08X, length = %d\n",
            data->buf, length);

    if (i == 0)
    {
      at91_mci_write(AT91_PDC_RPR, (rt_uint32_t)(data->buf));
      at91_mci_write(AT91_PDC_RCR, .....);
    }
    else
    {
      at91_mci_write(AT91_PDC_RNPR, (rt_uint32_t)(data->buf));
      at91_mci_write(AT91_PDC_RNCR, .....);
    }
  }
  ....
}

Similar errors can be found in some other places:

• V547 CWE-571 Expression 'i == 0' is always true. at91_mci.c 215

RT-Thread

V547 CWE-570 Expression 'idx < 0' is always false. fsl_flexcomm.c 133

uint32_t FLEXCOMM_GetInstance(void *base)
{
  int i;

  for (i = 0; i < FSL_FEATURE_SOC_FLEXCOMM_COUNT; i++)
  {
    if ((uint32_t)base == s_flexcommBaseAddrs[i])
    {
      return i;
    }
  }

  assert(false);
  return 0;
}

status_t FLEXCOMM_Init(void *base, FLEXCOMM_PERIPH_T periph)
{
  int idx = FLEXCOMM_GetInstance(base);

  if (idx < 0)
  {
    return kStatus_InvalidArgument;
  }
  ....
}

Similar errors can be found in some other places:

• V547 CWE-570 Expression 'instance < 0' is always false. fsl_spi.c 82
• V547 CWE-570 Expression 'instance < 0' is always false. fsl_spi.c 297
• V547 CWE-570 Expression 'instance < 0' is always false. fsl_spi.c 335

RT-Thread

V547 CWE-571 Expression is always true. Probably the '&&' operator should be used here. bxcan.c 1171

#define RT_CAN_MODE_NORMAL              0
#define RT_CAN_MODE_LISEN               1
#define RT_CAN_MODE_LOOPBACK            2
#define RT_CAN_MODE_LOOPBACKANLISEN     3

static rt_err_t control(struct rt_can_device *can,
                        int cmd, void *arg)
{
  ....
  case RT_CAN_CMD_SET_MODE:
    argval = (rt_uint32_t) arg;
    if (argval != RT_CAN_MODE_NORMAL ||
        argval != RT_CAN_MODE_LISEN ||
        argval != RT_CAN_MODE_LOOPBACK ||
        argval != RT_CAN_MODE_LOOPBACKANLISEN)
    {
      return RT_ERROR;
    }
    if (argval != can->config.mode)
    {
      can->config.mode = argval;
      return bxcan_set_mode(pbxcan->reg, argval);
    }
    break;
  ....
}

Krita

V547 Expression 'j == 0' is always false. KoColorSpace.cpp 218

QPolygonF KoColorSpace::estimatedTRCXYY() const
{
  ....
  for (int j = 5; j>0; j--) {
    channelValuesF.fill(0.0);
    channelValuesF[i] = ((max / 4)*(5 - j));

    if (colorModelId().id() != "XYZA") {
      fromNormalisedChannelsValue(data, channelValuesF);
      convertPixelsTo(....);
      xyzColorSpace->normalisedChannelsValue(....);
    }

    if (j == 0) {
      colorantY = channelValuesF[1];
      if (d->colorants.size()<2) {
        d->colorants.resize(3 * colorChannelCount());
        d->colorants[i] = ....
          d->colorants[i + 1] = ....
          d->colorants[i + 2] = ....
      }
    }
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'x < 0' is always false. kis_selection_filters.cpp 334
• V547 Expression 'y < 0' is always false. kis_selection_filters.cpp 342

Krita

V547 Expression 'n == 128' is always false. compression.cpp 110

quint32 decode_packbits(const char *src,
                        char* dst,
                        quint16 packed_len,
                        quint32 unpacked_len)
{
    qint32    n;
    ....
    while (unpack_left > 0 && pack_left > 0)
    {
        n = *src;
        src++;
        pack_left--;

        if (n == 128)
            continue;
        else if (n > 128)
            n -= 256;
        ....
    }
    ....
}

Similar errors can be found in some other places:

• V547 Expression 'n > 128' is always false. compression.cpp 112

Krita

V547 Expression is always false. SvgTextEditor.cpp 472

void SvgTextEditor::setTextWeightDemi()
{
    if (m_textEditorWidget.richTextEdit->textCursor()
          .charFormat().fontWeight() > QFont::Normal
        && m_textEditorWidget.richTextEdit->textCursor()
           .charFormat().fontWeight() < QFont::Normal) { // <=
        setTextBold(QFont::Normal);
    } else {
        setTextBold(QFont::DemiBold);
    }
}

Krita

V547 Expression is always true. Probably the '&&' operator should be used here. KoResourceItemChooser.cpp 408

void KoResourceItemChooser::updatePreview(KoResource *resource)
{
    ....
    if (image.format() != QImage::Format_RGB32 || // <=
    image.format() != QImage::Format_ARGB32 ||    // <=
    image.format() != QImage::Format_ARGB32_Premultiplied) {

        image = image.convertToFormat(....);
    }
    ....
}

Similar errors can be found in some other places:

• V547 Expression is always true. Probably the '&&' operator should be used here. KoSvgTextShapeMarkupConverter.cpp 1000

System Shock

V547 Expression 'len <= 0' is always true. COMPOSE.C 235

long ComposeFlat8Diff(....)
{
  ....
  len = 0;
  //  len = ....;
  //  ....
  if (len <= 0)
  {
    ....
  }
  ....
}

Azure Service Fabric

V547 CWE-570 Expression 'nwrite < 0' is always false. Unsigned type value is never < 0. File.cpp 1941

static void* ScpWorkerThreadStart(void* param)
{
  ....
  do
  {
    size_t nwrite = fwrite(ptr, 1, remaining, destfile);
    if (nwrite < 0)
    {
      pRequest->error_.Overwrite(ErrorCode::FromErrno(errno));
      break;
    }
    else
    {
      remaining -= nwrite;
      ptr += nwrite;
      pRequest->szCopied_ += nwrite;
    }
  } while (remaining != 0);
  ....
}

Azure Service Fabric

V547 CWE-571 Expression 'len >= 0' is always true. Unsigned type value is always >= 0. Types.cpp 121

size_t BIO_ctrl_pending(BIO *b);

template <typename TBuf>
TBuf BioMemToTBuf(BIO* bio)
{
  char* data = NULL;
  auto len = BIO_ctrl_pending(bio);
  Invariant(len >= 0);
  ....
}

0 A.D.

V547 CWE-570 Expression 'nbNeighb >= 2' is always false. WaterManager.cpp 581

void WaterManager::CreateWaveMeshes()
{
  ....
  int nbNeighb = 0;
  ....
  bool found = false;
  nbNeighb = 0;
  for (int p = 0; p < 8; ++p)
  {
    if (CoastalPointsSet.count(xx+around[p][0] +
                               (yy + around[p][1])*SideSize))
    {
      if (nbNeighb >= 2)
      {
        CoastalPointsSet.erase(xx + yy*SideSize);
        continue;
      }
      ++nbNeighb;
      // We've found a new point around us.
      // Move there
      xx = xx + around[p][0];
      yy = yy + around[p][1];
      indexx = xx + yy*SideSize;
      if (i == 0)
        Chain.push_back(CoastalPoint(indexx,CVector2D(xx*2,yy*2)));
      else
        Chain.push_front(CoastalPoint(indexx,CVector2D(xx*2,yy*2)));
      CoastalPointsSet.erase(xx + yy*SideSize);
      found = true;
      break;
    }
  }
  if (!found)
    endedChain = true;
  ....
}

Perl 5

V547 Expression 'RETVAL == 0' is always true. Typemap.c 710

XS_EUPXS(XS_XS__Typemap_T_SYSRET_pass);
XS_EUPXS(XS_XS__Typemap_T_SYSRET_pass)
{
  dVAR; dXSARGS;
  if (items != 0)
    croak_xs_usage(cv,  "");
  {
    SysRet  RETVAL;
#line 370 "Typemap.xs"
    RETVAL = 0;
#line 706 "Typemap.c"
    {
      SV * RETVALSV;
      RETVALSV = sv_newmortal();
      if (RETVAL != -1) {          // <=
        if (RETVAL == 0)           // <=
          sv_setpvn(RETVALSV, "0 but true", 10);
        else
          sv_setiv(RETVALSV, (IV)RETVAL);
      }
      ST(0) = RETVALSV;
    }
  }
  XSRETURN(1);
}

Qt

V547 CWE-570 Expression 'buffer[i] < '\040' && buffer[i] > '\176'' is always false. qedidparser.cpp 169

QString QEdidParser::parseEdidString(const quint8 *data)
{
    QByteArray buffer(reinterpret_cast<const char *>(data), 13);

    // Erase carriage return and line feed
    buffer = buffer.replace('\r', '\0').replace('\n', '\0');

    // Replace non-printable characters with dash
    for (int i = 0; i < buffer.count(); ++i) {
        if (buffer[i] < '\040' && buffer[i] > '\176')
            buffer[i] = '-';
    }

    return QString::fromLatin1(buffer.trimmed());
}

Qt

V547 CWE-570 Expression 'message' is always false. qwindowscontext.cpp 802

DWORD
__stdcall
FormatMessageW(
  DWORD dwFlags,
  LPCVOID lpSource,
  DWORD dwMessageId,
  DWORD dwLanguageId,
  LPWSTR lpBuffer,
  DWORD nSize,
  va_list *Arguments
);

// Re-engineered from the inline function _com_error::ErrorMessage().
// We cannot use it directly since it uses swprintf_s(), which is not
// present in the MSVCRT.DLL found on Windows XP (QTBUG-35617).
static inline QString errorMessageFromComError(const _com_error &comError)
{
  TCHAR *message = nullptr;
  FormatMessage(
    FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
    NULL, DWORD(comError.Error()), MAKELANGID(LANG_NEUTRAL,SUBLANG_DEFAULT),
    message, 0, NULL);
  if (message) {
    const QString result = QString::fromWCharArray(message).trimmed();
    LocalFree(static_cast<HLOCAL>(message));
    return result;
  }
  if (const WORD wCode = comError.WCode())
    return QString::asprintf("IDispatch error #%u", uint(wCode));
  return QString::asprintf("Unknown error 0x0%x", uint(comError.Error()));
}

Opus

V547 CWE-571 Expression 'st->mode == 1001' is always true. opus_encoder.c 1734

#define MODE_HYBRID             1001

opus_int32 opus_encode_native(....)
{
  ....
  if (st->mode == MODE_HYBRID)
  {
    int len;

    len = (ec_tell(&enc)+7)>>3;
    if (redundancy)
      len += st->mode == MODE_HYBRID ? 3 : 1;
  ....
}

Perl Compatible Regular Expressions

V547 CWE-570 Expression 'mclength != 1' is always false. pcre2_compile.c 7355

static int
compile_branch(....)
{
  uint32_t mclength;
  ....
  if (mclength == 1 || req_caseopt == 0)
  {
    firstcu = mcbuffer[0];
    firstcuflags = req_caseopt;
    if (mclength != 1)
      {
      reqcu = code[-1];
      reqcuflags = cb->req_varyopt;
      }
    }
  ....
}

Libwebsockets

V547 CWE-571 Expression 'sock.sockfd >= 0' is always true. Unsigned type value is always >= 0. libwebsockets.c 2651

typedef UINT_PTR        SOCKET;

typedef SOCKET lws_sockfd_type;

typedef union {
  lws_sockfd_type sockfd;
  lws_filefd_type filefd;
} lws_sock_file_fd_type;

LWS_EXTERN struct lws *
lws_create_adopt_udp(....)
{
  lws_sock_file_fd_type sock;
  ....
  for (rp = r; rp; rp = rp->ai_next) {
    sock.sockfd = socket(rp->ai_family, rp->ai_socktype,
             rp->ai_protocol);
    if (sock.sockfd >= 0)         // <=
      break;
  }
  ....
}

Godot Engine

V547 CWE-570 Expression 'i >= 3' is always false. csg_shape.cpp 939

CSGBrush *CSGBox::_build_brush() {
  ....
  for (int i = 0; i < 6; i++) {
    ....
    if (i < 3)
      face_points[j][(i + k) % 3] = v[k] * (i >= 3 ? -1 : 1);
    else
      face_points[3 - j][(i + k) % 3] = v[k] * (i >= 3 ? -1 : 1);
    ....
  }
  ....
}

Similar errors can be found in some other places:

• V547 CWE-571 Expression 'i >= 3' is always true. csg_shape.cpp 941

Godot Engine

V547 CWE-571 Expression 'idx >= 0 || idx < 4' is always true. variant_op.cpp 2152

void Variant::set(....) {
  ....
  int idx = p_index;
  if (idx < 0)
    idx += 4;
  if (idx >= 0 || idx < 4) {
    Color *v = reinterpret_cast<Color *>(_data._mem);
    (*v)[idx] = p_value;
    valid = true;
  }
  ....
}

Similar errors can be found in some other places:

• V547 CWE-571 Expression 'idx >= 0 || idx < 4' is always true. variant_op.cpp 2527

Stellarium

V547 Expression 'updatePos' is always true. StelGuiItems.cpp 831

void BottomStelBar::updateText(bool updatePos)
{
  ....
  updatePos = true;
  ....
  if (location->text() != newLocation || updatePos)
  {
    updatePos = true;
    ....
  }
  ....
  if (fov->text() != str)
  {
    updatePos = true;
    ....
  }
  ....
  if (fps->text() != str)

  {
    updatePos = true;
    ....
  }

  if (updatePos)
  {
    ....
  }
}

LibrePCB

V547 CWE-571 Expression 'content' is always true. html.c 162

static int
rndr_emphasis(hoedown_buffer *ob, const hoedown_buffer *content,
              const hoedown_renderer_data *data)
{
  if (!content || !content->size) return 0;
  HOEDOWN_BUFPUTSL(ob, "<em>");
  if (content) hoedown_buffer_put(ob, content->data, content->size);
  HOEDOWN_BUFPUTSL(ob, "</em>");
  return 1;
}

LibrePCB

V547 CWE-571 Expression 'e->OutIdx >= 0' is always true. clipper.cpp 2983

void Clipper::DoMaxima(TEdge *e)
{
  ....
  else if( e->OutIdx >= 0 && eMaxPair->OutIdx >= 0 )
  {
    if (e->OutIdx >= 0) AddLocalMaxPoly(e, eMaxPair, e->Top);
    DeleteFromAEL(e);
    DeleteFromAEL(eMaxPair);
  }
  ....
}

LibrePCB

V547 CWE-571 Expression 'layer' is always true. footprintpreviewgraphicsitem.cpp 177

void FootprintPreviewGraphicsItem::paint(....) noexcept {
  ....
  for (const Circle& circle : mFootprint.getCircles()) {
    layer = mLayerProvider.getLayer(*circle.getLayerName());
    if (!layer) continue;
    if (layer){
      pen = QPen(....);
      painter->setPen(pen);
    } else
      painter->setPen(Qt::NoPen);
    ....
  }
  ....
}

Windows Calculator

V547 Expression 'm_resolvedName == L"en-US"' is always false. To compare strings you should use wcscmp() function. Calculator LocalizationSettings.h 180

wchar_t m_resolvedName[LOCALE_NAME_MAX_LENGTH];

Platform::String^ GetEnglishValueFromLocalizedDigits(....) const
{
  if (m_resolvedName == L"en-US")
  {
    return ref new Platform::String(localizedString.c_str());
  }
  ....
}

FreeRDP

V547 Expression '!pipe->In' is always false. MessagePipe.c 63

wMessagePipe* MessagePipe_New()
{
  ....
  pipe->In = MessageQueue_New(NULL);
  if (!pipe->In)
    goto error_in;

  pipe->Out = MessageQueue_New(NULL);
  if (!pipe->In)
    goto error_out;
  ....
}

FreeRDP

V547 Expression 'strcat(target, source) != NULL' is always true. triostr.c 425

TRIO_PUBLIC_STRING int
trio_append
TRIO_ARGS2((target, source),
     char *target,
     TRIO_CONST char *source)
{
  assert(target);
  assert(source);

  return (strcat(target, source) != NULL);
}

FreeRDP

V547 Expression 'cache' is always true. glyph.c 730

typedef struct rdp_glyph_cache rdpGlyphCache;

struct rdp_glyph_cache
{
  ....
  GLYPH_CACHE glyphCache[10];
  ....
};

void glyph_cache_free(rdpGlyphCache* glyphCache)
{
  ....
  GLYPH_CACHE* cache = glyphCache->glyphCache;

  if (cache)
  {
    ....
  }
  ....
}

FreeRDP

V547 Expression 'rdp->state >= CONNECTION_STATE_ACTIVE' is always true. connection.c 1489

int rdp_server_transition_to_state(rdpRdp* rdp, int state)
{
  ....
  switch (state)
  {
    ....
    case CONNECTION_STATE_ACTIVE:
      rdp->state = CONNECTION_STATE_ACTIVE;
      ....
      if (rdp->state >= CONNECTION_STATE_ACTIVE)
      {
        IFCALLRET(client->Activate, client->activated, client);

        if (!client->activated)
          return -1;
      }
    ....
  }
  ....
}

FreeRDP

V547 Expression 'status == 0x00090314' is always false. ntlm.c 299

BOOL ntlm_authenticate(rdpNtlm* ntlm, BOOL* pbContinueNeeded)
{
  ....
  if (status != SEC_E_OK)
  {
    ....
    return FALSE;
  }

  if (status == SEC_I_COMPLETE_NEEDED)            // <=
    status = SEC_E_OK;
  else if (status == SEC_I_COMPLETE_AND_CONTINUE) // <=
    status = SEC_I_CONTINUE_NEEDED;
  ....
}

rdesktop

V547 Expression 'write_time' is always false. disk.c 805

RD_NTSTATUS
disk_set_information(....)
{
  time_t write_time, change_time, access_time, mod_time;
  ....
  if (write_time || change_time)
    mod_time = MIN(write_time, change_time);
  else
    mod_time = write_time ? write_time : change_time; // <=
  ....
}

rdesktop

V547 Expression is always true. Probably the '&&' operator should be used here. disk.c 1419

static RD_NTSTATUS
disk_device_control(RD_NTHANDLE handle, uint32 request, STREAM in,
      STREAM out)
{
  ....
  if (((request >> 16) != 20) || ((request >> 16) != 9))
    return RD_STATUS_INVALID_PARAMETER;
  ....
}

LLVM/Clang

V547 [CWE-571] Expression 'nextByte != 0x90' is always true. X86DisassemblerDecoder.cpp 379

static int readPrefixes(struct InternalInstruction* insn) {
  ....
  uint8_t byte = 0;
  uint8_t nextByte;
  ....
  if (byte == 0xf3 && (nextByte == 0x88 || nextByte == 0x89 ||
                       nextByte == 0xc6 || nextByte == 0xc7)) {
    insn->xAcquireRelease = true;
    if (nextByte != 0x90) // PAUSE instruction support
      break;
  }
  ....
}

Haiku Operation System

V547 Expression 'error == ((int) 0)' is always true. Directory.cpp 688

int32
BDirectory::CountEntries()
{
  status_t error = Rewind();
  if (error != B_OK)
    return error;
  int32 count = 0;
  BPrivate::Storage::LongDirEntry entry;
  while (error == B_OK) {
    if (GetNextDirents(&entry, sizeof(entry), 1) != 1)
      break;
    if (strcmp(entry.d_name, ".") != 0 && strcmp(entry.d_name, "..") != 0)
      count++;
  }
  Rewind();
  return (error == B_OK ? count : error);
}

Haiku Operation System

V547 Expression 'remaining < 0' is always false. Unsigned type value is never < 0. DwarfFile.cpp 1947

status_t
DwarfFile::_UnwindCallFrame(....)
{
  ....
  uint64 remaining = lengthOffset + length - dataReader.Offset();
  if (remaining < 0)
    return B_BAD_DATA;
  ....
}

Haiku Operation System

V547 Expression 'sleep((unsigned) secs) < 0' is always false. Unsigned type value is never < 0. misc.cpp 56

status_t
snooze(bigtime_t amount)
{
  if (amount <= 0)
    return B_OK;

  int64 secs = amount / 1000000LL;
  int64 usecs = amount % 1000000LL;
  if (secs > 0) {
    if (sleep((unsigned)secs) < 0)     // <=
      return errno;
  }

  if (usecs > 0) {
    if (usleep((useconds_t)usecs) < 0)
      return errno;
  }

  return B_OK;
}

extern unsigned int sleep (unsigned int __seconds); extern int usleep (__useconds_t __useconds);

PPSSPP

V547 Expression 'leftvol >= 0' is always true. sceAudio.cpp 120

static u32 sceAudioOutputPannedBlocking
             (u32 chan, int leftvol, int rightvol, u32 samplePtr) {
  int result = 0;
  // For some reason, this is the only one that checks for negative.
  if (leftvol > 0xFFFF || rightvol > 0xFFFF || leftvol < 0 || rightvol < 0) {
    ....
  } else {
    if (leftvol >= 0) {
      chans[chan].leftVolume = leftvol;
    }
    if (rightvol >= 0) {
      chans[chan].rightVolume = rightvol;
    }
    chans[chan].sampleAddress = samplePtr;
    result = __AudioEnqueue(chans[chan], chan, true);
  }
}

PPSSPP

V547 Expression 'size == 8' is always false. syn-att.c 195

extern void ud_translate_att(
  int size = 0;
  .... // Variable "size" doesn't change
  if (size == 8) {
    ud_asmprintf(u, "b");
  } else if (size == 16) {
    ud_asmprintf(u, "w");
  } else if (size == 64) {
    ud_asmprintf(u, "q");
  }
  ....
}

Doom 1

V547 [CWE-571] Expression 'delta < - 64' is always true. d_net.c 130

int ExpandTics (int low)
{
  int delta;
  delta = low - (maketic&0xff);

  if (delta >= -64 && delta <= 64)
    return (maketic&~0xff) + low;
  if (delta > 64)
    return (maketic&~0xff) - 256 + low;
  if (delta < -64)
    return (maketic&~0xff) + 256 + low;

  I_Error ("ExpandTics: strange value %i at maketic %i",low,maketic);
  return 0;
}

Celestia

V547 Expression '!inputFilename.empty()' is always true. makexindex.cpp 128

int main(int argc, char* argv[])
{
  if (!parseCommandLine(argc, argv) || inputFilename.empty())
  {
    Usage();
    return 1;
  }

  istream* inputFile = &cin;
  if (!inputFilename.empty())
  {
    inputFile = new ifstream(inputFilename, ios::in);
    if (!inputFile->good())
    {
      cerr << "Error opening input file " << inputFilename << '\n';
      return 1;
    }
  }
  ....
}

TON

V547 Expression 'path' is always true. fift-main.cpp 136

int main(int argc, char* const argv[]) {
  ....
  if (!no_env) {
    const char* path = std::getenv("FIFTPATH");
    if (path) {
      parse_include_path_set(path ? path : "/usr/lib/fift",
                             source_include_path);
    }
  }
  ....
}

Kodi

V547 Expression 'lastsector' is always false. udf25.cpp:636

int udf25::UDFGetAVDP( struct avdp_t *avdp)
{
  ....
  uint32_t lastsector;
  ....
  lastsector = 0;
  ....
  for(;;) {
    ....
    if( lastsector ) {
      lbnum = lastsector;
      terminate = 1;
    } else {
      //! @todo Find last sector of the disc (this is optional).
      if( lastsector )
        lbnum = lastsector - 256;
      else
        return 0;
    }
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'lastsector' is always false. udf25.cpp:644

Kodi

V547 Expression 'values.size() != 2' is always false. GUIControlSettings.cpp:1174

bool CGUIControlRangeSetting::OnClick()
{
  ....
  std::vector<CVariant> values;
  SettingConstPtr listDefintion = settingList->GetDefinition();
  switch (listDefintion->GetType())
  {
    case SettingType::Integer:
      values.push_back(m_pSlider->
             GetIntValue(CGUISliderControl::RangeSelectorLower));
      values.push_back(m_pSlider->
             GetIntValue(CGUISliderControl::RangeSelectorUpper));
      break;
    case SettingType::Number:
      values.push_back(m_pSlider->
         GetFloatValue(CGUISliderControl::RangeSelectorLower));
      values.push_back(m_pSlider->
         GetFloatValue(CGUISliderControl::RangeSelectorUpper));
      break;
    default:
      return false;
  }
  if (values.size() != 2)
    return false;
  SetValid(CSettingUtils::SetList(settingList, values));
  return IsValid();
}

Kodi

V547 Expression 'prio == 0x7fffffff' is always true. DBusReserve.cpp:57

bool CDBusReserve::AcquireDevice(const std::string& device)
{
  ....
  int prio = INT_MAX;
  ....
  res =
    dbus_bus_request_name(
      m_conn,
      service.c_str(),
      DBUS_NAME_FLAG_DO_NOT_QUEUE |
      (prio == INT_MAX ? 0 : DBUS_NAME_FLAG_ALLOW_REPLACEMENT), // <=
      error);
  ....
}

ROOT

V547 Expression '!file_name_value.empty()' is always false. SelectionRules.cxx 1423

bool SelectionRules::AreAllSelectionRulesUsed() const {
  for(auto&& rule : fClassSelectionRules){
    ....
    std::string file_name_value;
    if (!rule.GetAttributeValue("file_name", file_name_value))
     file_name_value.clear();

    if (!file_name_value.empty()) {                  // <=
      // don't complain about defined_in rules
      continue;
    }

    const char* attrName = nullptr;
    const char* attrVal = nullptr;
    if (!file_name_value.empty()) {                  // <=
      attrName = "file name";
      attrVal = file_name_value.c_str();
    } else {
      attrName = "class";
      if (!name.empty()) attrVal = name.c_str();
    }
    ROOT::TMetaUtils::Warning(0,"Unused %s rule: %s\n", attrName, attrVal);
  }
  ....
}

Heawei Ark Compiler

V547 Expression 'idx >= 0' is always true. Unsigned type value is always >= 0. lexer.h 129

char GetCharAtWithLowerCheck(uint32 idx) const {
  return idx >= 0 ? line[idx] : 0;
}

SDCC

V547 [CWE-570] Expression 'segnib >= 0xE000' is always false. inst_r2k.cc 42

u32_t  rabbit_mmu::logical_addr_to_phys( u16_t logical_addr ) {
  u32_t  phys_addr = logical_addr;
  unsigned     segnib = logical_addr >> 12;

  if (segnib >= 0xE000)
  {
    phys_addr += ((u32_t)xpc) << 12;
  }
  ....
}

Zephyr

V547 [CWE-570] Expression 'len < 0' is always false. Unsigned type value is never < 0. keys.c 312

static int keys_set(const char *name, size_t len_rd, settings_read_cb read_cb,
        void *cb_arg)
{
  ....
  size_t len;
  ....
  len = read_cb(cb_arg, val, sizeof(val));
  if (len < 0) {
    BT_ERR("Failed to read value (err %zu)", len);
    return -EINVAL;
  }
  ....
}

Zephyr

V547 [CWE-570] Expression '(end - * p) < 1' is always false. x509_crt.c 635

static int x509_get_subject_alt_name( unsigned char **p,
                                      const unsigned char *end,
                                      mbedtls_x509_sequence *subject_alt_name )
{
  ....
  while( *p < end )
  {
    if( ( end - *p ) < 1 )
      return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
              MBEDTLS_ERR_ASN1_OUT_OF_DATA );
    ....
  }
  ....
}

Zephyr

V547 [CWE-571] Expression 'disp' is always true. lv_disp.c 148

uint32_t lv_disp_get_inactive_time(const lv_disp_t * disp)
{
  if(!disp) disp = lv_disp_get_default();
  if(!disp) {
    LV_LOG_WARN("lv_disp_get_inactive_time: no display registered");
    return 0;
  }

  if(disp) return lv_tick_elaps(disp->last_activity_time);

  lv_disp_t * d;
  uint32_t t = UINT32_MAX;
  d          = lv_disp_get_next(NULL);
  while(d) {
    t = LV_MATH_MIN(t, lv_tick_elaps(d->last_activity_time));
    d = lv_disp_get_next(d);
  }

  return t;
}

Newton Game Dynamics

V547 Expression 'axisCount' is always false. MultiBodyCar.cpp 650

void UpdateDriverInput(dVehicle* const vehicle, dFloat timestep)
{
  ....
  int axisCount = scene->GetJoystickAxis(axis);
  axisCount = 0;
  if (axisCount)
  {
    ....
  }
  ....
}

ORCT2

V547 [CWE-570] Expression 'name == nullptr' is always false. libopenrct2 ServerList.cpp 102

std::optional<ServerListEntry> ServerListEntry::FromJson(....)
{
  auto name = json_object_get(server, "name");
  ....
  if (name == nullptr || version == nullptr)
  {
    ....
  }
  else
  {
    ....
    entry.name = (name == nullptr ? "" : json_string_value(name));
    ....
  }
  ....
}

Minetest

V547 Expression 'nearest_emergefull_d == - 1' is always true. clientiface.cpp 363

void RemoteClient::GetNextBlocks (....)
{
  ....
  s32 nearest_emergefull_d = -1;
  ....
  s16 d;
  for (d = d_start; d <= d_max; d++) {
    ....
      if (block == NULL || surely_not_found_on_disk || block_is_invalid) {
        if (emerge->enqueueBlockEmerge(peer_id, p, generate)) {
          if (nearest_emerged_d == -1)
            nearest_emerged_d = d;
        } else {
          if (nearest_emergefull_d == -1) // <=
            nearest_emergefull_d = d;
          goto queue_full_break;
        }
  ....
  }
  ....
queue_full_break:
  if (nearest_emerged_d != -1) { // <=
    new_nearest_unsent_d = nearest_emerged_d;
  } else ....
}

The value nearest_emergefull_d is never changing in the loop.

PMDK

V547 [CWE-570] Expression 'rel_wait < 0' is always false. Unsigned type value is never < 0. os_thread_windows.c 359

static DWORD
get_rel_wait(const struct timespec *abstime)
{
  struct __timeb64 t;
  _ftime64_s(&t);
  time_t now_ms = t.time * 1000 + t.millitm;
  time_t ms = (time_t)(abstime->tv_sec * 1000 +
    abstime->tv_nsec / 1000000);

  DWORD rel_wait = (DWORD)(ms - now_ms);

  return rel_wait < 0 ? 0 : rel_wait;
}

PMDK

V547 [CWE-571] Expression 'blocks[i]' is always true. heap.c 1054

static struct memory_block
heap_coalesce(struct palloc_heap *heap,
  const struct memory_block *blocks[], int n)
{
  struct memory_block ret = MEMORY_BLOCK_NONE;

  const struct memory_block *b = NULL;
  ret.size_idx = 0;
  for (int i = 0; i < n; ++i) {
    if (blocks[i] == NULL)
      continue;
    b = b ? b : blocks[i];
    ret.size_idx += blocks[i] ? blocks[i]->size_idx : 0;
  }
  ....
}

Qemu

V547 Expression 'ret < 0' is always false. qcow2-cluster.c 1557

static int handle_dependencies(....)
{
  ....
  if (end <= old_start || start >= old_end) {
    ....
  } else {

    if (bytes == 0 && *m) {
      ....
      return 0;
    }

    if (bytes == 0) {
      ....
      return -EAGAIN;
    }
  ....
  }
  return 0;
}

int qcow2_alloc_cluster_offset(BlockDriverState *bs, ....)
{
  ....
  ret = handle_dependencies(bs, start, &cur_bytes, m);
  if (ret == -EAGAIN) {
    ....
  } else if (ret < 0) {
    ....
  }
}

clipp

V547 Expression 's[0] == '-'' is always false. clipp.h 303

inline bool
fwd_to_unsigned_int(const char*& s)
{
  if(!s) return false;
  for(; std::isspace(*s); ++s);
  if(!s[0] || s[0] == '-') return false;
  if(s[0] == '-') return false;
  return true;
}

Dlib

V547 Expression 'event_thread_started == false' is always true. gui_core_kernel_1.cpp 162

class event_handler_thread : public threaded_object
{
  ....
  bool event_thread_started;
  ....
};

void start_event_thread ()
{
  ....
  if (event_thread_started == false)
  {
    auto_mutex M(window_table.get_mutex());
    if (event_thread_started == false)
    {
      event_thread_started = true;
      // start up the event handler thread
      start();
  ....
}

Dlib

V547 Expression 'samples.size() > 0' is always true. svm.h 360

template <
    typename detection_type,
    typename label_type
    >
bool is_track_association_problem (
  const std::vector<std::vector<
    labeled_detection<detection_type,label_type> > >& samples
)
{
  if (samples.size() == 0)
    return false;

  unsigned long num_nonzero_elements = 0;
  for (unsigned long i = 0; i < samples.size(); ++i)
  {
    if (samples.size() > 0)
      ++num_nonzero_elements;
  }
  if (num_nonzero_elements < 2)
    return false;
  ....
}

Espressif IoT Development Framework

V547 Expression is always false. linenoise.c 256

static int getColumns(void) {
  ....
  /* Restore position. */
  if (cols > start) {
    char seq[32];
    snprintf(seq,32,"\x1b[%dD",cols-start);
    if (fwrite(seq, 1, strlen(seq), stdout) == -1) {
      /* Can't recover... */
    }
    flushWrite();
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression is always false. linenoise.c 481
• V547 Expression is always false. linenoise.c 569

Espressif IoT Development Framework

V547 Expression is always false. linenoise.c 596

int linenoiseEditInsert(struct linenoiseState *l, char c) {
  ....
  if (fwrite(&c,1,1,stdout) == -1) return -1;
  ....
}

Similar errors can be found in some other places:

• V547 Expression is always false. linenoise.c 742

Espressif IoT Development Framework

V547 Expression is always false. linenoise.c 828

static int linenoiseEdit(char *buf, size_t buflen, const char *prompt)
  ....
  while(1) {
    ....
    if (fread(seq+2, 1, 1, stdin) == -1) break;
    ....
  }
  ....
}

Espressif IoT Development Framework

V547 Expression 'ret != 0' is always false. sdio_slave.c 394

esp_err_t sdio_slave_start(void)
{
  ....
  critical_exit_recv();
  ret = ESP_OK;
  if (ret != ESP_OK) return ret;

  sdio_slave_hal_set_ioready(context.hal, true);
  return ESP_OK;
}

Espressif IoT Development Framework

V547 Expression is always true. essl_sdio.c 209

esp_err_t essl_sdio_init(void *arg, uint32_t wait_ms)
{
  ....
  // Set block sizes for functions 1 to given value (default value = 512).
  if (ctx->block_size > 0 || ctx->block_size <= 2048) {
    bs = ctx->block_size;
  } else {
    bs = 512;
  }
  ....
}

Most likely this is what should be written here: ctx->block_size > 0 && ctx->block_size <= 2048

Espressif IoT Development Framework

V547 Expression 'depth <= 0' is always false. panic_handler.c 169

static void print_backtrace(const void *f, int core)
{
  XtExcFrame *frame = (XtExcFrame *) f;
  int depth = 100;
  //Initialize stk_frame with first frame of stack
  esp_backtrace_frame_t stk_frame =
    {.pc = frame->pc, .sp = frame->a1, .next_pc = frame->a0};
  panic_print_str("\r\nBacktrace:");
  print_backtrace_entry(esp_cpu_process_stack_pc(stk_frame.pc), stk_frame.sp);

  //Check if first frame is valid
  bool corrupted =
    !(esp_stack_ptr_is_sane(stk_frame.sp) &&
      (esp_ptr_executable((void *)esp_cpu_process_stack_pc(stk_frame.pc)) ||
       /* Ignore the first corrupted PC in case of InstrFetchProhibited */
       frame->exccause == EXCCAUSE_INSTR_PROHIBITED));

  //Account for stack frame that's already printed
  uint32_t i = ((depth <= 0) ? INT32_MAX : depth) - 1;
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'xAlreadyYielded == ((BaseType_t) 0)' is always true. event_groups.c 260
• V547 Expression 'xAlreadyYielded == ((BaseType_t) 0)' is always true. tasks.c 1475
• V547 Expression 'xAlreadyYielded == ((BaseType_t) 0)' is always true. tasks.c 1520

Espressif IoT Development Framework

V547 Expression is always false. tasks.c 896

#ifndef portPRIVILEGE_BIT
  #define portPRIVILEGE_BIT ( ( UBaseType_t ) 0x00 )
#endif

static void prvInitialiseNewTask(...., UBaseType_t uxPriority, ....)
{
  StackType_t *pxTopOfStack;
  UBaseType_t x;

  #if (portNUM_PROCESSORS < 2)
  xCoreID = 0;
  #endif

  #if( portUSING_MPU_WRAPPERS == 1 )
    /* Should the task be created in privileged mode? */
    BaseType_t xRunPrivileged;
    if( ( uxPriority & portPRIVILEGE_BIT ) != 0U )
    {
      xRunPrivileged = pdTRUE;
    }
    else
    {
      xRunPrivileged = pdFALSE;
    }
  ....
}

Espressif IoT Development Framework

V547 Expression 'err != 0' is always false. sdio_slave_hal.c 96

static esp_err_t sdio_ringbuf_send(....)
{
  uint8_t* get_ptr = ....;
  esp_err_t err = ESP_OK;
  if (copy_callback) {
    (*copy_callback)(get_ptr, arg);
  }
  if (err != ESP_OK) return err;

  buf->write_ptr = get_ptr;
  return ESP_OK;
}

Espressif IoT Development Framework

V547 Expression 'bit_len == 32' is always false. spi_flash_ll.h 371

static inline void spi_flash_ll_set_usr_address(spi_dev_t *dev, uint32_t addr,
                                                int bit_len)
{
  // The blank region should be all ones
  if (bit_len >= 32) {
    dev->addr = addr;
    dev->slv_wr_status = UINT32_MAX;
  } else {
    uint32_t padding_ones = (bit_len == 32? 0 : UINT32_MAX >> bit_len);
    dev->addr = (addr << (32 - bit_len)) | padding_ones;
  }
}

Espressif IoT Development Framework

V547 Expression 'b' is always true. wpabuf.c 235

struct wpabuf * wpabuf_concat(struct wpabuf *a, struct wpabuf *b)
{
  struct wpabuf *n = NULL;
  size_t len = 0;

  if (b == NULL)
    return a;

  if (a)
    len += wpabuf_len(a);
  if (b)
    len += wpabuf_len(b);

  n = wpabuf_alloc(len);
  if (n) {
    if (a)
      wpabuf_put_buf(n, a);
    if (b)
      wpabuf_put_buf(n, b);
  }

  wpabuf_free(a);
  wpabuf_free(b);

  return n;
}

Similar errors can be found in some other places:

• V547 Expression 'b' is always true. wpabuf.c 242

GTK

V547 [CWE-571] Expression 'max_size > 0' is always true. gtkrecentmanager.c 480

static void
gtk_recent_manager_real_changed (GtkRecentManager *manager)
{
  ....
  int age;
  int max_size = MAX_LIST_SIZE;
  ....
  .... // Variable max_size is not used here.
  ....
  if (age == 0 || max_size == 0 || !enabled)
  {
    g_bookmark_file_free (priv->recent_items);
    priv->recent_items = g_bookmark_file_new ();
    priv->size = 0;
  }
  else
  {
    if (age > 0)
      gtk_recent_manager_clamp_to_age (manager, age);
    if (max_size > 0)
      gtk_recent_manager_clamp_to_size (manager, max_size);
  }
  ....
}

GTK

V547 [CWE-571] Expression 'desktop_startup_id' is always true. gdk.c 176

static void
stash_desktop_startup_notification_id (void)
{
  const char *desktop_startup_id;

  desktop_startup_id = g_getenv ("DESKTOP_STARTUP_ID");
  if (desktop_startup_id && *desktop_startup_id != '\0')
    {
      if (!g_utf8_validate (desktop_startup_id, -1, NULL))
        g_warning ("DESKTOP_STARTUP_ID contains invalid UTF-8");
      else
        startup_notification_id =
          g_strdup (desktop_startup_id ? desktop_startup_id : "");
    }
  g_unsetenv ("DESKTOP_STARTUP_ID");
}

Open Asset Import Library

V547 [CWE-571] Expression 'extraBytes > 0' is always true. FBXUtil.cpp 224

std::string EncodeBase64(const char* data, size_t length)
{
    // calculate extra bytes needed to get a multiple of 3
    size_t extraBytes = 3 - length % 3;

    // number of base64 bytes
    size_t encodedBytes = 4 * (length + extraBytes) / 3;

    std::string encoded_string(encodedBytes, '=');

    // read blocks of 3 bytes
    for (size_t ib3 = 0; ib3 < length / 3; ib3++)
    {
        const size_t iByte = ib3 * 3;
        const size_t iEncodedByte = ib3 * 4;
        const char* currData = &data[iByte];

        EncodeByteBlock(currData, encoded_string, iEncodedByte);
    }

    // if size of data is not a multiple of 3,
    // also encode the final bytes (and add zeros where needed)
    if (extraBytes > 0)
    {
        char finalBytes[4] = { 0,0,0,0 };
        memcpy(&finalBytes[0], &data[length - length % 3], length % 3);

        const size_t iEncodedByte = encodedBytes - 4;
        EncodeByteBlock(&finalBytes[0], encoded_string, iEncodedByte);

        // add '=' at the end
        for (size_t i = 0; i < 4 * extraBytes / 3; i++)
            encoded_string[encodedBytes - i - 1] = '=';
    }
    return encoded_string;
}

Qt

V547 [CWE-571] Expression '(general_purpose_bits & Utf8Names) != 0' is always true. qzip.cpp 716

enum GeneralPurposeFlag {
  ....
  Utf8Names = 0x0800,
  ....
};

static inline void writeUShort(uchar *data, ushort i)
{
  data[0] = i & 0xff;
  data[1] = (i>>8) & 0xff;
}

void QZipWriterPrivate::addEntry(EntryType type, const QString &fileName, ....)
{
  ....
  ushort general_purpose_bits = Utf8Names; // always use utf-8
  writeUShort(header.h.general_purpose_bits, general_purpose_bits);

  const bool inUtf8 = (general_purpose_bits & Utf8Names) != 0;
  header.file_name = inUtf8 ? fileName.toUtf8() : fileName.toLocal8Bit();
}

Qt

V547 [CWE-571] Expression 'vi < 0' is always true. qtreeview.cpp 2219

QModelIndex QTreeView::moveCursor(....)
{
  ....
  int vi = -1;
  if (vi < 0)
    vi = qMax(0, d->viewIndex(current));
  ....
}

Qt

V547 [CWE-570] Expression 'type == - 1' is always false. qv4datacollector.cpp 282

int QV4DataCollector::encodeScopeType(
  QV4::Heap::ExecutionContext::ContextType scopeType)
{
    switch (scopeType) {
    case QV4::Heap::ExecutionContext::Type_GlobalContext:
        break;
    case QV4::Heap::ExecutionContext::Type_WithContext:
        return 2;
    case QV4::Heap::ExecutionContext::Type_CallContext:
        return 1;
    case QV4::Heap::ExecutionContext::Type_QmlContext:
        return 3;
    case QV4::Heap::ExecutionContext::Type_BlockContext:
        return 4;
    }
    return 0;
}

QJsonObject QV4DataCollector::buildFrame(....)
{
  ....
  for (int i = 0, ei = scopeTypes.count(); i != ei; ++i) {
    int type = encodeScopeType(scopeTypes[i]);
    if (type == -1)
      continue;

    QJsonObject scope;
    scope[QLatin1String("index")] = i;
    scope[QLatin1String("type")] = type;
    scopes.push_back(scope);
  }
  ....
}

Qt

V547 [CWE-570] Expression 'l != len' is always false. qv4typedarray.cpp 306

typedef unsigned int uint;

ReturnedValue TypedArrayCtor::virtualCallAsConstructor(....)
{
  ....
  qint64 l = argc ? argv[0].toIndex() : 0;
  if (scope.engine->hasException)
    return Encode::undefined();
  // ### lift UINT_MAX restriction
  if (l < 0 || l > UINT_MAX)
    return scope.engine->throwRangeError(QLatin1String("Index out of range."));
  uint len = (uint)l;
  if (l != len)
    scope.engine->throwRangeError(
      QStringLiteral("Non integer length for typed array."));
  ....
}

Qt

V547 [CWE-570] Expression 'count == 9' is always false. qfont.cpp 2142

bool QFont::fromString(const QString &descrip)
{
  ....
  const int count = l.count();
  if (!count || (count > 2 && count < 9) || count == 9 || count > 17 ||
      l.first().isEmpty()) {
    qWarning("QFont::fromString: Invalid description '%s'",
             descrip.isEmpty() ? "(empty)" : descrip.toLatin1().data());
    return false;
  }

  setFamily(l[0].toString());
  if (count > 1 && l[1].toDouble() > 0.0)
    setPointSizeF(l[1].toDouble());
  if (count == 9) {                            // <=
    setStyleHint((StyleHint) l[2].toInt());
    setWeight(QFont::Weight(l[3].toInt()));
    setItalic(l[4].toInt());
    setUnderline(l[5].toInt());
    setStrikeOut(l[6].toInt());
    setFixedPitch(l[7].toInt());
  } else if (count >= 10) { .... }
}

Qt

V547 [CWE-571] Expression 'lang' is always true. qfontconfigdatabase.cpp 462

// this could become a list of all languages used for each writing
// system, instead of using the single most common language.
static const char languageForWritingSystem[][6] = {
    "",     // Any
    "en",  // Latin
    "el",  // Greek
    "ru",  // Cyrillic

    ...... // No null pointers. Empty string literals are used.

    "", // Symbol
    "sga", // Ogham
    "non", // Runic
    "man" // N'Ko
};
static_assert(sizeof languageForWritingSystem /
        sizeof *languageForWritingSystem == QFontDatabase::WritingSystemsCount);

static void populateFromPattern(....)
{
  ....
  for (int j = 1; j < QFontDatabase::WritingSystemsCount; ++j) {
    const FcChar8 *lang = (const FcChar8*) languageForWritingSystem[j];
    if (lang) {
      FcLangResult langRes = FcLangSetHasLang(langset, lang);
      if (langRes != FcLangDifferentLang) {
  ....
}

Qt

V547 [CWE-571] Expression 'socket != - 1' is always true. qnativesocketengine_unix.cpp 315

bool QNativeSocketEnginePrivate::createNewSocket(....)
{
  ....
  int socket = qt_safe_socket(domain, type, protocol, O_NONBLOCK);
  ....
  if (socket < 0) {
    ....
    return false;
  }

  socketDescriptor = socket;

  if (socket != -1) {
    this->socketProtocol = socketProtocol;
    this->socketType = socketType;
  }
  return true;
}

Qt

V547 [CWE-571] Expression 'current' is always true. qopenglframebufferobject.cpp 1185

bool QOpenGLFramebufferObject::release()
{
  if (!isValid())
    return false;

  QOpenGLContext *current = QOpenGLContext::currentContext();
  if (!current)
    return false;

  Q_D(QOpenGLFramebufferObject);
#ifdef QT_DEBUG
  ....
#endif

  if (current) {
    d->funcs.glBindFramebuffer(GL_FRAMEBUFFER,
                               current->defaultFramebufferObject());

    QOpenGLContextPrivate *contextPrv = QOpenGLContextPrivate::get(current);
    contextPrv->qgl_current_fbo_invalid = true;
    contextPrv->qgl_current_fbo = nullptr;
  }

  return true;
}

Qt

V547 [CWE-571] Expression 'window != m_window' is always true. qquick3dscenemanager.cpp 60

void QQuick3DSceneManager::setWindow(QQuickWindow *window)
{
  if (window == m_window)
    return;

  if (window != m_window) {
    if (m_window)
      disconnect(....);
    m_window = window;
    connect(....);
    emit windowChanged();
  }
}

Qt

V547 [CWE-570] Expression '!count' is always false. qsqltablemodel.cpp 1110

bool QSqlTableModel::removeRows(int row, int count, const QModelIndex &parent)
{
  Q_D(QSqlTableModel);
  if (parent.isValid() || row < 0 || count <= 0)
    return false;
  else if (row + count > rowCount())
    return false;
  else if (!count)
    return true;
  ....
}

Qt

V547 [CWE-571] Expression 'widgetItem' is always true. qdockarealayout.cpp 1167

bool QDockAreaLayoutInfo::insertGap(....)
{
  ....
  QDockAreaLayoutItem new_item
    = widgetItem == nullptr
      ? QDockAreaLayoutItem(subinfo)
      : widgetItem ? QDockAreaLayoutItem(widgetItem)
                   : QDockAreaLayoutItem(placeHolderItem);
  ....
}

Qt

V547 [CWE-571] Expression 'identifierWithEscapeChars' is always true. qqmljslexer.cpp 817

int Lexer::scanToken()
{
  ....
  bool identifierWithEscapeChars = false;
  ....
  if (!identifierWithEscapeChars) {
    identifierWithEscapeChars = true;
    ....
  }
  ....
  if (identifierWithEscapeChars) {
    ....
  }
  ....
}

Qt

V547 [CWE-571] Expression 'softwareRenderer' is always true. qsgsoftwarethreadedrenderloop.cpp 510

void QSGSoftwareRenderThread::syncAndRender()
{
  ....
  bool canRender = wd->renderer != nullptr;

  if (canRender) {
     auto softwareRenderer = static_cast<QSGSoftwareRenderer*>(wd->renderer);
     if (softwareRenderer)
       softwareRenderer->setBackingStore(backingStore);
  ....
}

Most likely this is what should be written here: dynamic_cast<QSGSoftwareRenderer*>(wd->renderer);

Qt

V547 [CWE-570] Expression 'm_verbose' is always false. qmlprofilerapplication.cpp 495

void QmlProfilerApplication::tryToConnect()
{
  Q_ASSERT(!m_connection->isConnected());
  ++ m_connectionAttempts;

  if (!m_verbose && !(m_connectionAttempts % 5)) {// print every 5 seconds
    if (m_verbose) {
      if (m_socketFile.isEmpty())
        logError(
          QString::fromLatin1("Could not connect to %1:%2 for %3 seconds ...")
          .arg(m_hostName).arg(m_port).arg(m_connectionAttempts));
      else
        logError(
          QString::fromLatin1("No connection received on %1 for %2 seconds ...")
          .arg(m_socketFile).arg(m_connectionAttempts));
    }
  }
  ....
}

Qt

V547 [CWE-571] Expression 'month' is always true. qdatetime.cpp 4907

static const char qt_shortMonthNames[][4] = {
    "Jan", "Feb", "Mar", "Apr", "May", "Jun",
    "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
};

static int fromShortMonthName(QStringView monthName)
{
  for (unsigned int i = 0;
       i < sizeof(qt_shortMonthNames) / sizeof(qt_shortMonthNames[0]); ++i)
  {
    if (monthName == QLatin1String(qt_shortMonthNames[i], 3))
      return i + 1;
  }
  return -1;
}

QDateTime QDateTime::fromString(QStringView string, Qt::DateFormat format)
{
  ....
  month = fromShortMonthName(parts.at(1));
  if (month)
    day = parts.at(2).toInt(&ok);

  // If failed, try day then month
  if (!ok || !month || !day) {
    month = fromShortMonthName(parts.at(2));
    if (month) {
      QStringView dayPart = parts.at(1);
      if (dayPart.endsWith(u'.'))
        day = dayPart.chopped(1).toInt(&ok);
    }
  }
  ....
}

Similar errors can be found in some other places:

• V547 [CWE-571] Expression 'month' is always true. qdatetime.cpp 4913

Free Heroes of Might and Magic II

V547 Expression 'palette.empty()' is always true. image_tool.cpp 32

const std::vector<uint8_t> PALPAlette()
{
  std::vector<uint8_t> palette;
  if (palette.empty())
  {
    palette.resize( 256 * 3 );
    for ( size_t i = 0; i < palette.size(); ++i )
    {
      palette[i] = kb_pal[i] << 2;
    }
  }
  return palette;
}

Snort

V547 Expression 'rval != - 6' is always true. output_base.c 219

static int register_module(....)
{
  ....
  int rval;
    if ((rval = register_plugin(current_dm)) != OUTPUT_SUCCESS)
    {
      if (rval != OUTPUT_ERROR_EXISTS)
        fprintf(stderr, "%s: Failed to register OUTPUT plugin.\n",
  current_dm->name);
      return OUTPUT_ERROR;
    }
  ....
}

static int register_plugin(const Output_Module_t *dm)
{
  if (....)
  {
    ....
    return OUTPUT_ERROR;
  }
  ....
  return OUTPUT_SUCCESS;
}

#define OUTPUT_SUCCESS 0
#define OUTPUT_ERROR -1
#define OUTPUT_ERROR_EXISTS -6

Snort

V547 Expression 'ret == - 2' is always false. base.c 344

static void load_static_modules(void)
{
  ....
  ret = output_load_module(dirpath);
  if (ret == OUTPUT_SUCCESS)
  {
    DEBUG_WRAP(DebugMessage(DEBUG_INIT, "Found module %s\n", de->d_name););
  }
  else if (ret == OUTPUT_ERROR_NOMEM)
  {
    closedir(dirp);
    return OUTPUT_ERROR_NOMEM;
  }
  ....
}

Snort

V547 Expression 'found_offset' is always true. sf_snort_plugin_pcre.c 202

static int pcre_test(...., int *found_offset)
{
  ....
  *found_offset = -1;
  ....

  if (found_offset)
  {
    *found_offset = ovector[1];
    ....
  }
  return matched;
}

Snort

V547 Expression 'sipMsg->status_code > 0' is always true. sip_dialog.c 806

int SIP_updateDialog(SIPMsg *sipMsg, SIP_DialogList *dList, SFSnortPacket *p)
{
  int ret;
  ....
  if (sipMsg->status_code == 0)
    ret = SIP_processRequest(....);
  else if (sipMsg->status_code > 0)
    ret = SIP_processResponse(....);
  else
    ret = SIP_FAILURE;
  ....
}

xlang

V547 [CWE-570] Expression 'padding == 0' is always false. database.h 505.

static uint32_t stream_offset(std::string_view const& name) noexcept
{
    uint32_t padding = 4 - name.size() % 4;

    if (padding == 0)
    {
        padding = 4;
    }

    return static_cast<uint32_t>(8 + name.size() + padding);
}

Darwin-XNU

V547 Expression 'bp->nb_dirtyoff >= bp->nb_dirtyend' is always false. nfs_bio.c 3858

int
nfs_vinvalbuf_internal(....)
{
  struct nfsbuf *bp;
  ....
  off_t end = ....;

  /* check for any dirty data before the EOF */
  if ((bp->nb_dirtyend > 0) && (bp->nb_dirtyoff < end))
  {
    /* clip dirty range to EOF */
    if (bp->nb_dirtyend > end)
    {
      bp->nb_dirtyend = end;

      if (bp->nb_dirtyoff >= bp->nb_dirtyend)             // <=
      {
        bp->nb_dirtyoff = bp->nb_dirtyend = 0;
      }
    }

    if ((bp->nb_dirtyend > 0) && (bp->nb_dirtyoff < end)) // <=
    {
      ....
    }
  }
  ....
}

Darwin-XNU

V547 Expression 'ar->k_ar.ar_arg_mac_string == NULL' is always true. audit_mac.c 246

void
audit_arg_mac_string(struct kaudit_record *ar, ....)
{
  if (ar->k_ar.ar_arg_mac_string == NULL)
  {
    ar->k_ar.ar_arg_mac_string = kheap_alloc(....);
  }
  ....
  if (ar->k_ar.ar_arg_mac_string == NULL)
  {
    if (ar->k_ar.ar_arg_mac_string == NULL)
    {
      return;
    }
  }
  ....
}

Darwin-XNU

V547 Expression '(value & (1ULL << 62)) == 1' is always false. vm_shared_region.c 2820

static kern_return_t
vm_shared_region_slide_page_v3(vm_offset_t vaddr, ....)
{
  ....
  uint8_t *page_content = (uint8_t *)vaddr;
  uint16_t page_entry;
  ....
  uint8_t* rebaseLocation = page_content;
  uint64_t delta = page_entry;
  do {
    rebaseLocation += delta;
    uint64_t value;
    memcpy(&value, rebaseLocation, sizeof(value));
    ....
    bool isBind = (value & (1ULL << 62)) == 1;   // <=
    if (isBind) {
      return KERN_FAILURE;
    }
    ....
  } while (delta != 0);
  ....
}

Storm Engine

V547 Expression 'nStringCode >= 0xffffff' is always false. dstring_codec.h 84

#define DHASH_SINGLESYM 255
....
uint32_t Convert(const char *pString, ....)
{
  uint32_t nStringCode;
  ....
  nStringCode = ((((unsigned char)pString[0]) << 8) & 0xffffff00) |
                  (DHASH_SINGLESYM)
  ....
  if (nStringCode >= 0xffffff)
  {
    __debugbreak();
  }
  return nStringCode;
}

LLVM/Clang

V547 [CWE-570] Expression 'pathname_.c_str() == nullptr' is always false. gtest-filepath.cc 349

std::string pathname_;
....
void FilePath::Normalize() {
  if (pathname_.c_str() == nullptr) {
    pathname_ = "";
    return;
  }
....
}

DuckStation

V547 Expression 'i < pathLength' is always true. file_system.cpp 454

void CanonicalizePath(const char *Path, ....)
{
  ....
  u32 pathLength = static_cast<u32>(std::strlen(Path));
  ....
  for (i = 0; i < pathLength;)
  {
    ....
    char nextCh = (i < pathLength) ? Path[i + 1] : '\0';
    ....
  }
  ....
}

DuckStation

V547 Expression 'm_value.wSecond <= other.m_value.wSecond' is always true. timestamp.cpp 311

bool Timestamp::operator<=(const Timestamp& other) const
{
  ....
  if (m_value.wYear > other.m_value.wYear)
    return false;
  else if (m_value.wYear < other.m_value.wYear)
    return true;
  if (m_value.wMonth > other.m_value.wMonth)
    return false;
  else if (m_value.wMonth < other.m_value.wMonth)
    return true;
  if (m_value.wDay > other.m_value.wDay)
    return false;
  else if (m_value.wDay < other.m_value.wDay)
    return true;
  if (m_value.wHour > other.m_value.wHour)
    return false;
  else if (m_value.wHour < other.m_value.wHour)
    return true;
  if (m_value.wMinute > other.m_value.wMinute)
    return false;
  else if (m_value.wMinute < other.m_value.wMinute)
    return true;
  if (m_value.wSecond > other.m_value.wSecond)
    return false;
  else if (m_value.wSecond <= other.m_value.wSecond)
    return true;
  if (m_value.wMilliseconds > other.m_value.wMilliseconds)
    return false;
  else if (m_value.wMilliseconds < other.m_value.wMilliseconds)
    return true;

  return false;
}

RPCS3

V547 Expression 'rawcode == CELL_KEYC_KPAD_NUMLOCK' is always false. cellKb.cpp 126

enum Keys
{
  // ....
  CELL_KEYC_KPAD_NUMLOCK          = 0x53,
  // ....
};

u16 cellKbCnvRawCode(u32 arrange, u32 mkey, u32 led, u16 rawcode)
{
  // ....

  // CELL_KB_RAWDAT
  if (rawcode <= 0x03
      || rawcode == 0x29
      || rawcode == 0x35
      || (rawcode >= 0x39 && rawcode <= 0x53)    // <=
      || rawcode == 0x65
      || rawcode == 0x88
      || rawcode == 0x8A
      || rawcode == 0x8B)
  {
    return rawcode | 0x8000;
  }

  const bool is_alt = mkey & (CELL_KB_MKEY_L_ALT | CELL_KB_MKEY_R_ALT);
  const bool is_shift = mkey & (CELL_KB_MKEY_L_SHIFT | CELL_KB_MKEY_R_SHIFT);
  const bool is_caps_lock = led & (CELL_KB_LED_CAPS_LOCK);
  const bool is_num_lock = led & (CELL_KB_LED_NUM_LOCK);

  // CELL_KB_NUMPAD

  if (is_num_lock)
  {
    if (rawcode == CELL_KEYC_KPAD_NUMLOCK)  return 0x00 | 0x4000; // <=
    if (rawcode == CELL_KEYC_KPAD_SLASH)    return 0x2F | 0x4000;
    if (rawcode == CELL_KEYC_KPAD_ASTERISK) return 0x2A | 0x4000;
    if (rawcode == CELL_KEYC_KPAD_MINUS)    return 0x2D | 0x4000;
    if (rawcode == CELL_KEYC_KPAD_PLUS)     return 0x2B | 0x4000;
    if (rawcode == CELL_KEYC_KPAD_ENTER)    return 0x0A | 0x4000;
    if (rawcode == CELL_KEYC_KPAD_0)        return 0x30 | 0x4000;
    if (rawcode >= CELL_KEYC_KPAD_1 && rawcode <= CELL_KEYC_KPAD_9)
      return (rawcode - 0x28) | 0x4000;
  }
}

RPCS3

V547 Expression 'current_version < threshold_version' is always false. Unsigned type value is never < 0. device.cpp 91

void physical_device::create(VkInstance context,
                             VkPhysicalDevice pdev,
                             bool allow_extensions)
{
  else if (get_driver_vendor() == driver_vendor::NVIDIA)
  {
#ifdef _WIN32
    // SPIRV bugs were fixed in 452.28 for windows
    const u32 threshold_version = (452u >> 22) | (28 >> 14);
#else
    // SPIRV bugs were fixed in 450.56 for linux/BSD
    const u32 threshold_version = (450u >> 22) | (56 >> 14);
#endif
    // Clear patch and revision fields
    const auto current_version = props.driverVersion & ~0x3fffu;
    if (current_version < threshold_version)
    {
      rsx_log.error(....);
    }
  }
}

CARLA

V547 Expression 'm_trail == 0' is always false. unpack.hpp 699

std::size_t m_trail;
....
inline int context::execute(const char* data, std::size_t len,
 std::size_t& off)
{
  ....
  case MSGPACK_CS_EXT_8: {
                uint8_t tmp;
                load<uint8_t>(tmp, n);
                m_trail = tmp + 1;
                if(m_trail == 0) {
                    unpack_ext(m_user, n, m_trail, obj);
                    int ret = push_proc(obj, off);
                    if (ret != 0) return ret;
                }
                else {
                    m_cs = MSGPACK_ACS_EXT_VALUE;
                    fixed_trail_again = true;
                }
            } break;
  ....
}

CARLA

V547 Expression '(uint8) WheelLocation >= 0' is always true. Unsigned type value is always >= 0. CARLAWheeledVehicle.cpp 510

float ACarlaWheeledVehicle::GetWheelSteerAngle(
  EVehicleWheelLocation WheelLocation) {

  check((uint8)WheelLocation >= 0)
  check((uint8)WheelLocation < 4)
  ....
}

CARLA

V547 Expression 'rounds > 1' is always true. CarlaExporter.cpp 137

void FCarlaExporterModule::PluginButtonClicked()
{
  ....
  int rounds;
  rounds = 5;
  ....
  for (int round = 0; round < rounds; ++round)
  {
    for (UObject* SelectedObject : BP_Actors)
    {
      ....
      // check to export in this round or not
      if (rounds > 1)                                          // <=
      {
        if (areaType == AreaType::BLOCK && round != 0)
          continue;
        else if (areaType == AreaType::ROAD && round != 1)
          continue;
        else if (areaType == AreaType::GRASS && round != 2)
          continue;
        else if (areaType == AreaType::SIDEWALK && round != 3)
          continue;
        else if (areaType == AreaType::CROSSWALK && round != 4)
          continue;
      }
      ....
    }
  }
}

TheXTech

V547 Expression 'NPC[A].Type == 54 && NPC[A].Type == 15' is always false. Probably the '||' operator should be used here. thextech npc_update.cpp 1277

else if(
     NPC[A].Type == 21 || NPC[A].Type == 22 || NPC[A].Type == 25
  || NPC[A].Type == 26 || NPC[A].Type == 31 || NPC[A].Type == 32
  || NPC[A].Type == 238 || NPC[A].Type == 239 || NPC[A].Type == 35
  || NPC[A].Type == 191 || NPC[A].Type == 193
  || (NPC[A].Type == 40 && NPC[A].Projectile == true) || NPC[A].Type == 49
  || NPC[A].Type == 58 || NPC[A].Type == 67 || NPC[A].Type == 68
  || NPC[A].Type == 69 || NPC[A].Type == 70
  || (NPCIsVeggie[NPC[A].Type] && NPC[A].Projectile == false)
  || (NPC[A].Type == 29 && NPC[A].Projectile == true)

  ||    (NPC[A].Projectile == true
     && (NPC[A].Type == 54 && NPC[A].Type == 15))            // <=

  || .... )
{ .... }

TheXTech

V547 Expression 'A == 48' is always false. thextech effect.cpp 1652

else if(A == 16) // Dead Giant Bullet Bill
{
  numEffects++;
  Effect[numEffects].Shadow = Shadow;
  ....
  Effect[numEffects].Location.SpeedY = Location.SpeedY;
  Effect[numEffects].Location.SpeedX = Location.SpeedX;
  if(A == 48)                                          // <=
    Effect[numEffects].Location.SpeedY = -8;
  Effect[numEffects].Life = 120;
  Effect[numEffects].Type = A;
}

TheXTech

V547 Expression 'tempPlayer == 0' is always true. thextech blocks.cpp 576

// don't spawn players from blocks anymore
tempPlayer = 0;
if(tempPlayer == 0) // Spawn the npc
{
  numNPCs++; // create a new NPC
  NPC[numNPCs].Active = true;
  NPC[numNPCs].TimeLeft = 1000;
....

Chromium

V547 Expression 'entry_size > 0' is always true. objects-printer.cc 1195

void FeedbackVector::FeedbackVectorPrint(std::ostream& os)
{
  ....
  FeedbackMetadataIterator iter(metadata());
  while (iter.HasNext()) {
    ....
    int entry_size = iter.entry_size();
    if (entry_size > 0) os << " {";         // <=
    for (int i = 0; i < entry_size; i++)
    {
      ....
    }
    if (entry_size > 0) os << "\n  }";      // <=
  }
  os << "\n";
}

int FeedbackMetadataIterator::entry_size() const
{
  return FeedbackMetadata::GetSlotSize(kind());
}

int FeedbackMetadata::GetSlotSize(FeedbackSlotKind kind) {
  switch (kind) {
    case FeedbackSlotKind::kForIn:
    ....
      return 1;

    case FeedbackSlotKind::kCall:
    ....
      return 2;

    case FeedbackSlotKind::kInvalid:
    ....
      UNREACHABLE();
  }
  return 1;
}

Blend2D

V547 Expression 'h == 0' is always false. jpegcodec.cpp 252

BLResult blJpegDecoderImplProcessMarker(....) noexcept {
  uint32_t h = blMemReadU16uBE(p + 1);
  // ....
  if (h == 0)
    return blTraceError(BL_ERROR_JPEG_UNSUPPORTED_FEATURE);
  // ....
  impl->delayedHeight = (h == 0); // <=
  // ....
}

static void blPngDeinterlaceBits(....) noexcept {
  // ....
  uint32_t x = w;
  // ....
  switch (n) {
    case 2: {
      // ....
      if (x <= 4) break;
      if (x >= 5) b = uint32_t(*d5++);
      // ....
    }
  // ....
  }
  // ....
}

MuditaOS

V547 Expression 'activeInput' is always true. ServiceAudio.cpp 250

std::optional<AudioMux::Input *> AudioMux::GetActiveInput();

....

auto Audio::handleSetVolume(....) -> std::unique_ptr<AudioResponseMessage>
{
  ....
  if (const auto activeInput = audioMux.GetActiveInput(); activeInput)
  {
    if (activeInput)
    {
      retCode = activeInput.value()->audio->SetOutputVolume(clampedValue);
    }
  }
  ....
}

MuditaOS

V547 Expression 'snoozeCount == 0' is always true. NotificationProvider.cpp 117

void NotificationProvider::handleSnooze(unsigned snoozeCount)
{
  if (snoozeCount > 0)
  {
    notifications[NotificationType::AlarmSnooze] =
       std::make_shared<notifications::AlarmSnoozeNotification>(snoozeCount);
  }
  else if (snoozeCount == 0)
  {
    notifications.erase(NotificationType::AlarmSnooze);
  }

  send();
}

MuditaOS

V547 Expression 'currentState == ButtonState::Off' is always true. ButtonOnOff.cpp 33

enum class ButtonState : bool
{
  Off,
  On
};
....
void ButtonOnOff::switchState(const ButtonState newButtonState)
{
  currentState = newButtonState;
  if (currentState == ButtonState::On)
  {
    ....
  }
  else if (currentState == ButtonState::Off)
  {
    ....
  }
}

Similar errors can be found in some other places:

• V547 Expression 'status != 0x00' is always false. AVRCP.cpp 68
• V547 Expression 'stream_endpoint->close_stream == 1' is always false. avdtp.c 1223
• V547 Expression 'stream_endpoint->abort_stream == 1' is always false. avdtp.c 1256
• And 1 additional diagnostic messages.

Ogre3D

V547 Expression 'x == 0' is always true/false. OgreTerrain.cpp 3750

Terrain::NeighbourIndex Terrain::getNeighbourIndex(long x, long y)
{
  if (x < 0)
  {
    if (y < 0)
      return NEIGHBOUR_SOUTHWEST;
    else if (y > 0)
      return NEIGHBOUR_NORTHWEST;
    else
      return NEIGHBOUR_WEST;
  }
  else if (x > 0)
  {
    if (y < 0)
      return NEIGHBOUR_SOUTHEAST;
    else if (y > 0)
      return NEIGHBOUR_NORTHEAST;
    else
      return NEIGHBOUR_EAST;
  }

  if (y < 0)
  {
    if (x == 0)               // <=
      return NEIGHBOUR_SOUTH;
  }
  else if (y > 0)
  {
    if (x == 0)               // <=
      return NEIGHBOUR_NORTH;
  }

  return NEIGHBOUR_NORTH;
}

Here the x variable is checked for 0 after false checks: x > 0 and x < 0. This check is pointless. Why checking the x variable for 0 if we can access this part of the code only if x == 0 — simple math!

Ogre3D

V547 Expression 'i != end' is always true. OgreScriptTranslator.cpp 787

bool ScriptTranslator::getMatrix4(
  AbstractNodeList::const_iterator i,
  AbstractNodeList::const_iterator end,
  Matrix4 *m)
{
  int n = 0;
  while (i != end && n < 16)
  {
    if (i != end)
    {
      Real r = 0;
      if (getReal(*i, &r))
        (*m)[n / 4][n % 4] = r;
      else
        return false;
    }
    else
    {
      return false;
    }
    ++i;
    ++n;
  }
  return true;
}

Very strange code. I notice at least two problems here: 1. The i != end condition is checked twice. If the condition in while is true, then the condition in if will always be true. The check is unnecessary. 2. The else branch is unreachable. At the same time, it returns false.

GPCS4

V547 [CWE-570] Expression 'nOldFlag & VMPF_NOACCESS' is always false. PlatMemory.cpp 22

enum VM_PROTECT_FLAG
{
  VMPF_NOACCESS  = 0x00000000,
  ....
};

inline uint32_t GetProtectFlag(....)
{
  uint32_t nNewFlag = 0;
  do
  {
    if (nOldFlag & VMPF_NOACCESS)
    {
      nNewFlag = PAGE_NOACCESS;
      break;
    }
    ....
  } while (false);
  return nNewFlag;
}

GPCS4

V547 [CWE-571] Expression 'retAddress' is always true. Memory.cpp 373

void* MemoryAllocator::allocateInternal(....)
{
  ....
  while (searchAddr < SCE_KERNEL_APP_MAP_AREA_END_ADDR)
    {
      ....
      void* retAddress = VMAllocate(reinterpret_cast<void*>(regionAddress), len,
                                    plat::VMAT_RESERVE_COMMIT, uprot);
      if (!retAddress)
      {
        searchAddr = reinterpret_cast<size_t>(mi.pRegionStart) + mi.nRegionSize;
        continue;
      }
      ....
      if (retAddress)
      {
        // unlikely
        plat::VMFree(retAddress);
      }
    ....
    }
  ....
}

GPCS4

V547 [CWE-571] Expression 'pipeConfig == kPipeConfigP16' is always true. GnmDepthRenderTarget.h 170

uint8_t getZReadTileSwizzleMask(void) const
    {
      ....
      if (pipeConfig != kPipeConfigP16 ||
        zfmt == kZFormatInvalid ||
        !GpuAddress::isMacroTiled(tileMode))
      {
        return 0;
      }

      ....
      if (pipeConfig == kPipeConfigP16)
      {
        GpuAddress::getAltNumBanks(&numBanks, tileMode,
                                   totalBitsPerElement, numFragments);
        shift = 4;
      }
      else
      {
        ....
      }
      ....
    }

Overgrowth

V547 Expression 'connect_id_ == - 1' is always true. placeholderobject.cpp 342

class PlaceholderObject
{
private:
  int connect_id_;
  ....
};

ObjectSanityState PlaceholderObject::GetSanity()
{
  ....
  if( .... && connect_id_ == -1)
  {
    if( connect_id_ == -1)
    {
      ....
    }
  }
  ....
}

Overgrowth

V547 Expression 'imageBits == 8' is always false. texture_data.cpp 305

void TextureData::GetUncompressedData(unsigned char* data)
{
  int imageBits = 32;
  ....
  if (imageBits == 8)
  {
    ....
  }
  else if (imageBits == 24)
  {
    ....
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'imageBits == 24' is always false. texture_data.cpp 313

LLVM/Clang

V547 [CWE-570] Expression 'FirstSemiPos == std::string::npos' is always false. UnicodeNameMappingGenerator.cpp 46

static std::unordered_multimap<char32_t, std::string>
loadDataFiles(const std::string &NamesFile, const std::string &AliasesFile) {
  ....
  auto FirstSemiPos = Line.find(';');
  if (FirstSemiPos == std::string::npos)
    continue;
  auto SecondSemiPos = Line.find(';', FirstSemiPos + 1);
  if (FirstSemiPos == std::string::npos)
    continue;
  ....
}

LLVM/Clang

V547 [CWE-570] Expression '!data_sp' is always false. Host.cpp 248

Status Host::ShellExpandArguments(ProcessLaunchInfo &launch_info) {
  ....
  auto data_sp = StructuredData::ParseJSON(output);
  if (!data_sp) {
    error.SetErrorString("invalid JSON");
    return error;
  }

  auto dict_sp = data_sp->GetAsDictionary();
  if (!data_sp) {
    error.SetErrorString("invalid JSON");
    return error;
  }
  ....
}

VCMI

V547 Expression 'val > 1' is always false. CComponent.cpp 218

std::string CComponent::getSubtitleInternal()
{
  ....
  if (val)
    return ....;
  else
    return val > 1 ? creature->getNamePluralTranslated()
                   : creature->getNameSingularTranslated();
  ....
}

VCMI

V547 Expression 'first_block > 0' is always true. concurrent_vector.h 669

void deallocate_segment(....)
{
  ....
  if (seg_index >= first_block)
  {
    segment_element_allocator_traits::deallocate(....);
  }
  else
  if (seg_index == 0)
  {
    elements_to_deallocate = first_block > 0 ? this->segment_size(first_block)
                                             : this->segment_size(0);
    ....
  }
}

VCMI

V547 Expression 'currentAnimations.empty()' is always true. BattleStacksController.cpp 384

void BattleStacksController::updateBattleAnimations(uint32_t msPassed)
{
  ....
  if (hadAnimations && currentAnimations.empty())
  {
    //stackAmountBoxHidden.clear();
    owner.executeStagedAnimations();
    if (currentAnimations.empty())
      owner.onAnimationsFinished();
  }
  ....
}

VCMI

V547 Expression '(mask & 1) == 0' is always true. CStack.cpp 262

std::vector<BattleHex> CStack::meleeAttackHexes(....)
{
  ....
  int mask = 0;
  ....
  if (....)
  {
    if ((mask & 1) == 0)
    {
      mask |= 1;
      res.push_back(defenderPos);
    }
  }
  ....
}

GTK

V547 [CWE-570] Expression 'keysb[2] > keysa[2]' is always false. gtktreelistrowsorter.c 158

static int
gtk_tree_list_row_sort_keys_compare (gconstpointer a,
                                     gconstpointer b,
                                     gpointer      data)
{
  ....
  gpointer *keysa = (gpointer *) a;
  gpointer *keysb = (gpointer *) b;
  ....
  resa = unpack (keysa, &keysa, &sizea);
  resb = unpack (keysb, &keysb, &sizeb);
  if (!resa)
    return resb ? GTK_ORDERING_LARGER :
      (keysa[2] < keysb[2] ? GTK_ORDERING_SMALLER :
      (keysb[2] > keysa[2] ? GTK_ORDERING_LARGER : GTK_ORDERING_EQUAL));
  else if (!resb)
    return GTK_ORDERING_SMALLER;
  ....
}

Microsoft PowerToys

V547 Expression is always true. Settings.cpp 241

void FancyZonesSettings::LoadSettings()
{
  ....
  if (auto val = values.get_int_value(....))
  {
    // Avoid undefined behavior
    if (   *val >= 0
        || *val < static_cast<int>(OverlappingZonesAlgorithm::EnumElements))
    {
      auto algorithm = (OverlappingZonesAlgorithm)*val;
      if (m_settings.overlappingZonesAlgorithm != algorithm)
      {
        m_settings.overlappingZonesAlgorithm = algorithm;
        NotifyObservers(SettingId::OverlappingZonesAlgorithm);
      }
    }
  }
  ....
}

Microsoft PowerToys

V547 Expression 'placement.showCmd == 3' is always false. WindowUtils.cpp 336

....
#define SW_SHOWMINIMIZED    2
#define SW_SHOWMAXIMIZED    3
....
#define SW_MINIMIZE         6
....
#define SW_RESTORE          9
....

void FancyZonesWindowUtils::SizeWindowToRect(HWND window, RECT rect) noexcept
{
  ....
  if ((placement.showCmd != SW_SHOWMINIMIZED) &&
      (placement.showCmd != SW_MINIMIZE))
  {
    placement.showCmd = SW_RESTORE;
  }
  // Remove maximized show command to make sure
  // window is moved to the correct zone.
  if (placement.showCmd == SW_SHOWMAXIMIZED)     // <=
  {
    placement.showCmd = SW_RESTORE;
    placement.flags &= ~WPF_RESTORETOMAXIMIZED;
  }
  ....
}

Microsoft PowerToys

V547 Expression 'token_size < 0' is always false. Unsigned type value is never < 0. NtdllExtensions.cpp 314

std::wstring NtdllExtensions::pid_to_user(DWORD pid)
{
  ....
  DWORD token_size = 0;
  GetTokenInformation(token, TokenUser, nullptr, 0, &token_size);

  if (token_size < 0)
  {
    return user;
  }
  ....
}

YTsaurus

V547 Expression 'operandIndex >= 0' is always true. Unsigned type value is always >= 0. subquery.cpp:1061

std::vector<TSubquery> BuildThreadSubqueries(....)
{
  ....
  std::vector<TSubquery> subqueries;
  ....
  for (auto& stripe : subquery.StripeList->Stripes)
  {
    size_t operandIndex = stripe->GetInputStreamIndex();

    YT_VERIFY(operandIndex >= 0);
    ....
  }
  ....
}

YTsaurus

V547 Expression 'paddingSize >= 0' is always true. Unsigned type value is always >= 0. chunk_index_builder.cpp:278:1

TChunkIndexBlock BuildChunkIndexBlock( .... )
{
  ....
  for(int sectorIndex = 0;
      sectorIndex < bestFormatDetail->GetSectorCount();
      ++sectorIndex)
  {
    ....
    auto paddingSize = THashTableChunkIndexFormatDetail::SectorSize –
                         (buffer - sectorStart) - sizeof(TChecksum);
    YT_VERIFY(paddingSize >= 0);
    WriteZeroes(buffer, paddingSize);
    ....
  }
  ....
}

GZDoom

V547 Expression 'available % fuzzstep != 0' is always false. r_draw_rgba.cpp 328

void SWPalDrawers::DrawUnscaledFuzzColumn(const SpriteDrawerArgs& args)
{
  ....
  int fuzzstep = 1;
  int fuzz = _fuzzpos % FUZZTABLE;

  #ifndef ORIGINAL_FUZZ

  while (count > 0)
  {
    int available = (FUZZTABLE - fuzz);
    int next_wrap = available / fuzzstep;
    if (available % fuzzstep != 0)
      next_wrap++;
    ....
  }
  ....
}

GZDoom

V547 Expression 'c != 0x0c' is always false. pcxtexture.cpp 477

int FPCXTexture::CopyPixels(FBitmap *bmp, int conversion, int frame)
{
  ....
  uint8_t c = lump.ReadUInt8();
  c = 0x0c;  // Apparently there's many non-compliant PCXs out there...
  if (c != 0x0c)
  {
    for(int i=0;i<256;i++) pe[i]=PalEntry(255,i,i,i);// default to a gray map
  }
  ....
}

GZDoom

V547 Expression 'length < 0' is always false. Unsigned type value is never < 0. animlib.cpp 225

int32_t ANIM_LoadAnim(anim_t *anim, const uint8_t *buffer, size_t length)
{
  ....
  length -= sizeof(lpfileheader)+128+768;
  if (length < 0)
    return -1;
  ....
  length -= lpheader.nLps * sizeof(lp_descriptor);
  if (length < 0)
    return -2;
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'length < 0' is always false. Unsigned type value is never < 0. animlib.cpp 247

GZDoom

V547 Expression 'count == 1' is always false. codegen.cpp 9405

ExpEmit FxVMFunctionCall::Emit(VMFunctionBuilder *build)
{
  int count = 0;
  if (count == 1)
  {
    ExpEmit reg;
    if (CheckEmitCast(build, false, reg))
    {
      ArgList.DeleteAndClear();
      ArgList.ShrinkToFit();
      return reg;
    }
  }
  ....
}

GZDoom

V547 Expression 'dstFloatSize != srcFloatSize' is always false. x86regalloc.cpp 1115

static ASMJIT_INLINE bool X86RAPass_mustConvertSArg(X86RAPass* self,
                                                    uint32_t dstTypeId,
                                                    uint32_t srcTypeId) noexcept
{
  bool dstFloatSize = dstTypeId == TypeId::kF32   ? 4 :
                      dstTypeId == TypeId::kF64   ? 8 : 0;

  bool srcFloatSize = srcTypeId == TypeId::kF32   ? 4 :
                      srcTypeId == TypeId::kF32x1 ? 4 :
                      srcTypeId == TypeId::kF64   ? 8 :
                      srcTypeId == TypeId::kF64x1 ? 8 : 0;

  if (dstFloatSize && srcFloatSize)
    return dstFloatSize != srcFloatSize;
  else
    return false;
}

iSulad

V547 [CWE-571] Expression '(value & mask) == 0' is always true. deviceset.c 1126

static bool is_device_id_free(struct device_set *devset, int device_id)
{
    int mask = 0;
    int value = 0;
    int *value_ptr = NULL;
    int key = device_id / 8;

    mask = 1 << (device_id % 8);
    value_ptr = map_search(devset->device_id_map, &key);

    return value_ptr ? (*value_ptr & mask) == 0 : (value & mask) == 0;
}

iSulad

V547 [CWE-570] Expression 'arch_size < 0' is always false. Unsigned type value is never < 0. specs_security.c 492

static size_t docker_seccomp_arches_count(
    const char *seccomp_architecture,
    const docker_seccomp *docker_seccomp_spec)
{
  ....
  if (seccomp_architecture == NULL) {
    ERROR("Invalid input seccomp architecture");
    return -1;
  }
  ....
}

static int dup_architectures_to_oci_spec(....)
{
  ....
  size_t arch_size = 0;
  ....
  arch_size =
    docker_seccomp_arches_count(seccomp_architecture, docker_seccomp_spec);
  if (arch_size < 0) {
      ERROR("Failed to get arches count from docker seccomp spec");
      return -1;
  }
  ....
}

iSulad

V547 [CWE-570] Expression 'ret != 0' is always false. registry_apiv2.c 438

static int registry_request(....)
{
  int ret = 0;
  int sret = 0;
  ....
  ret = registry_ping(desc);
  if (ret != 0) {
     ERROR("ping failed");
     return -1;
  }

  sret = snprintf(url, sizeof(url), "%s://%s%s",
                  desc->protocol, desc->host, path);
  if (sret < 0 || (size_t)sret >= sizeof(url)) {
    ERROR("Failed to sprintf url, path is %s", path);
    ret = -1;
    goto out;
  }

  headers = util_str_array_dup((const char **)custom_headers,
                               util_array_len((const char **)custom_headers));
  if (ret != 0) {                             // <=
    ERROR("duplicate custom headers failed");
    ret = -1;
    goto out;
  }
  ....
}

This is what should have been written here: if (headers == NULL) {

Blender

V547 [CWE-570] Expression 'tot < 1' is always false. threads.cc 131

void BLI_threadpool_init(ListBase *threadbase,
                         void *(*do_thread)(void *),
                         int tot)
{
  ....
  if (threadbase != nullptr && tot > 0)
  {
    ....
    if (tot > RE_MAX_THREAD)
    {
      tot = RE_MAX_THREAD;
    }
    else if (tot < 1)
    {
      tot = 1;
    }
    ....
  }
  ....
}

Blender

V547 [CWE-570] Expression 'alignment == ALIGN_VIEW' is always false. object_add.cc 544

enum
{
  ALIGN_WORLD = 0,
  ALIGN_VIEW,
  ALIGN_CURSOR,
};

bool ED_object_add_generic_get_opts(bool *r_is_view_aligned, ....)
{
  ....
    if (RNA_struct_property_is_set(op->ptr, "rotation"))
    {
      ....
    }
    else
    {
      int alignment = ALIGN_WORLD;
      PropertyRNA *prop = RNA_struct_find_property(op->ptr, "align");

      if (RNA_property_is_set(op->ptr, prop))
      {
        *r_is_view_aligned = alignment == ALIGN_VIEW;       // <=
        alignment = RNA_property_enum_get(op->ptr, prop);
      }
    }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'changed == false' is always true. editmesh_tools.cc 1456
• V547 Expression 'ob->type == OB_GPENCIL_LEGACY' is always true. gpencil_edit.cc 130
• V547 Expression 'closure_count > i' is always true. eevee_raytrace.cc 371
• And 1 additional diagnostic messages.

LLVM/Clang

V547 Expression 'properties ++ > 0' is always false. CommandObjectTarget.cpp:100

static void DumpTargetInfo(uint32_t target_idx, Target *target,
                           const char *prefix_cstr,
                           bool show_stopped_process_status, Stream &strm)
{
  ....
  uint32_t properties = 0;
  if (target_arch.IsValid())
  {
    strm.Printf("%sarch=", properties++ > 0 ? ", " : " ( ");
    target_arch.DumpTriple(strm.AsRawOstream());
    properties++;
  }
}

OpenVINO

V547 Expression 'kernel_size.size() == 2' is always true. im2col.cpp 65

OutputVector translate_im2col(const NodeContext& context)
{
  num_inputs_check(context, 5, 5);
  auto input = context.get_input(0);
  auto kernel_size = context.const_input<std::vector<int64_t>>(1);
  PYTORCH_OP_CONVERSION_CHECK(kernel_size.size() == 2,
                              "kernel size should contains 2 elements");
  auto dilation = context.const_input<std::vector<int64_t>>(2);
  PYTORCH_OP_CONVERSION_CHECK(kernel_size.size() == 2,
                              "dilation should contains 2 elements");
  auto padding = context.const_input<std::vector<int64_t>>(3);
  PYTORCH_OP_CONVERSION_CHECK(kernel_size.size() == 2,
                              "padding should contains 2 elements");
  auto stride = context.const_input<std::vector<int64_t>>(4);
  PYTORCH_OP_CONVERSION_CHECK(kernel_size.size() == 2,
                              "stride should contains 2 elements");
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'kernel_size.size() == 2' is always true. im2col.cpp 67
• V547 Expression 'kernel_size.size() == 2' is always true. im2col.cpp 69
• V547 Expression 'roi_cols == 5' is always false. experimental_detectron_roi_feature_extractor.cpp 211

x64dbg

V547 Expression '!expr' is always true. parser.cpp 118

uptr<Expr> Parser::ParseExpr()
{
  return nullptr;
}

uptr<Return> Parser::ParseReturn()
{
  if(CurToken.Token == Lexer::tok_return)
  {
    NextToken();
    auto expr = ParseExpr();
    if(!expr)                              // <=
    {
      ReportError("failed to parse Return (ParseExpr failed)");
      return nullptr;
    }
    return make_uptr<Return>(move(expr));
  }
  return nullptr;
}

template<class T>
using uptr = unique_ptr<T>;

Similar errors can be found in some other places:

• V547 Expression '!bRedirectSupported' is always true. x64dbg_launcher.cpp 76

Godot Engine

V547 Expression is always true. material_storage.cpp 929

struct Uniform
{
  ....
  enum Hint
  {
    ....
    HINT_ROUGHNESS_R,
    HINT_ROUGHNESS_G,
    HINT_ROUGHNESS_B,
    HINT_ROUGHNESS_A,
    HINT_ROUGHNESS_GRAY,
    ....
  };
  ....
};

const auto hint_r = ShaderLanguage::ShaderNode::Uniform::HINT_ROUGHNESS_R;
const auto hint_gray = ShaderLanguage::ShaderNode::Uniform::HINT_ROUGHNESS_GRAY;

void MaterialStorage::MaterialData::update_textures(const HashMap<StringName,
    Variant> &p_parameters, const HashMap<StringName,
    HashMap<int, RID>> &p_default_textures,
    const Vector<ShaderCompiler::GeneratedCode::Texture> &p_texture_uniforms,
    RID *p_textures, bool p_use_linear_color, bool p_3d_material)
{
  ....
  if (tex->detect_roughness_callback
      && (   p_texture_uniforms[i].hint >= hint_r
          || p_texture_uniforms[i].hint <= hint_gray))
  {
    ....
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression is always true. material_storage.cpp 1003

DPDK

V547 Expression '* addrs == '\0'' is always false. main.c 234

static int
parse_lcore_dma(struct test_configure *test_case, const char *value)
{
  struct lcore_dma_map_t *lcore_dma_map;
  char *input, *addrs;
  char *ptrs[2];
  char *start, *end, *substr;
  uint16_t lcore_id;
  int ret = 0;

  if (test_case == NULL || value == NULL)
    return -1;

  input = strndup(value, strlen(value) + 1);
  if (input == NULL)
    return -1;
  addrs = input;

  while (*addrs == '\0')                           // <=
    addrs++;
  if (*addrs == '\0') {                            // <=
    fprintf(stderr, "No input DMA addresses\n");
    ret = -1;
    goto out;
  }
  ....
}

DPDK

V547 Expression 'sc->stats_pending' is always false. bnx2x_stats.c 76

struct bnx2x_softc {
  ....
  /* tracking a pending STAT_QUERY ramrod */
  uint16_t stats_pending;
  ....
};

static void
bnx2x_storm_stats_post(struct bnx2x_softc *sc)
{
  int rc;

  if (!sc->stats_pending) {
    if (sc->stats_pending)
      return;

  sc->fw_stats_req->hdr.drv_stats_counter =
    htole16(sc->stats_counter++);
  ....
}

DPDK

V547 Expression is always false. rte_vrb_pmd.c 1861

static inline int
vrb_dma_desc_ld_fill(struct rte_bbdev_dec_op *op, ....)
{
  ....
  if (op->ldpc_dec.harq_combined_input.data == 0) {
    rte_bbdev_log(ERR, "HARQ input is not defined");
    return -1;
  }
  h_p_size = fcw->hcin_size0 + fcw->hcin_size1;
  if (fcw->hcin_decomp_mode == 1)
    h_p_size = (h_p_size * 3 + 3) / 4;
  else if (fcw->hcin_decomp_mode == 4)
    h_p_size = h_p_size / 2;
  if (op->ldpc_dec.harq_combined_input.data == 0) {
    rte_bbdev_log(ERR, "HARQ input is not defined");
    return -1;
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression '!npa_lf' is always false. roc_nix_debug.c 770

DPDK

V547 Expression 'cpt == NULL' is always false. roc_cpt.c 970

struct roc_cpt {
  struct plt_pci_device *pci_dev;
  struct roc_cpt_lf *lf[ROC_CPT_MAX_LFS];
  uint16_t nb_lf;
  uint16_t nb_lf_avail;
  uintptr_t lmt_base;
  union cpt_eng_caps hw_caps[CPT_MAX_ENG_TYPES];
  uint8_t eng_grp[CPT_MAX_ENG_TYPES];
  uint8_t cpt_revision;
  void *opaque;
#define ROC_CPT_MEM_SZ (6 * 1024)
  uint8_t reserved[ROC_CPT_MEM_SZ] __plt_cache_aligned;
} __plt_cache_aligned;

static inline struct cpt *
roc_cpt_to_cpt_priv(struct roc_cpt *roc_cpt)
{
  return (struct cpt *)&roc_cpt->reserved[0];
}

int
roc_cpt_dev_fini(struct roc_cpt *roc_cpt)
{
  struct cpt *cpt = roc_cpt_to_cpt_priv(roc_cpt);

  if (cpt == NULL)
    return -EINVAL;
  ....
  return dev_fini(&cpt->dev, cpt->pci_dev);
}

Similar errors can be found in some other places:

• V547 Expression 'ls == NULL' is always false. ionic_lif.c 114
• V547 Expression 'cpt == NULL' is always false. roc_cpt.c 990
• V547 Expression 'cpt == NULL' is always false. roc_cpt_debug.c 269
• And 4 additional diagnostic messages.

DPDK

V547 Expression '!link.link_status' is always false. main.c 191

static inline int
port_init(uint16_t port, struct rte_mempool *mbuf_pool)
{
  ....
  struct rte_eth_link link;
  do {
    retval = rte_eth_link_get_nowait(port, &link);
    if (retval < 0) {
      printf("Failed link get (port %u): %s\n",
        port, rte_strerror(-retval));
      return retval;
    } else if (link.link_status)
      break;

    printf("Waiting for Link up on port %"PRIu16"\n", port);
    sleep(1);
  } while (!link.link_status);

  if (!link.link_status) {
    printf("Link down on port %"PRIu16"\n", port);
    return 0;
  }
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'status->status < 0' is always false. sa.c 785
• V547 Expression 'status->status < 0' is always false. sa.c 800
• V547 Expression '!bman_ip_rev' is always false. bman_driver.c 218
• And 2 additional diagnostic messages.

PPSSPP

V547 Expression 'retval < 0' is always false. Unsigned type value is never < 0. Buffer.cpp 114

void Buffer::Printf(const char *fmt, ...)
{
  ....
  size_t retval = vsnprintf(buffer, sizeof(buffer), fmt, vl);
  if ((int)retval >= (int)sizeof(buffer))
  {
    // Output was truncated. TODO: Do something.
    ERROR_LOG(IO, "Buffer::Printf truncated output");
  }

  if (retval < 0)
  {
    ERROR_LOG(IO, "Buffer::Printf failed");
  }
  ....
}

PPSSPP

V547 Expression 'press.duration < 0' is always false. Unsigned type value is never < 0. InputSubscriber.cpp 179

struct PressInfo
{
  ....
  uint32_t duration;
  ....
};
....
void WebSocketInputState::ButtonsPress(DebuggerRequest &req)
{
  ....
  PressInfo press;
  press.duration = 1;
  if (!req.ParamU32("duration", &press.duration, false,
                    DebuggerParamType::OPTIONAL))
    return;
  if (press.duration < 0)
    return req.Fail("Parameter 'duration' must not be negative");
  ....
}

Similar errors can be found in some other places:

• V547 Expression 'press.duration < 0' is always false. Unsigned type value is never < 0. InputSubscriber.cpp 208

PPSSPP

V547 Expression 'reg2 != RSI' is always true. ABI.cpp 465

#define ABI_PARAM2 RSI
....
void XEmitter::ABI_CallFunctionRR(const void *func, X64Reg reg1, X64Reg reg2)
{
  if (reg2 != ABI_PARAM1)
  {
    if (reg1 != ABI_PARAM1)
      MOV(64, R(ABI_PARAM1), R(reg1));
    if (reg2 != ABI_PARAM2)
      MOV(64, R(ABI_PARAM2), R(reg2));
  }
  else
  {
    if (reg2 != ABI_PARAM2)            // <=
      MOV(64, R(ABI_PARAM2), R(reg2));
    if (reg1 != ABI_PARAM1)
      MOV(64, R(ABI_PARAM1), R(reg1));
  }
}

Telegram

V547 Expression 'result < 0' is always true. session.cpp 405

int32 Session::getState() const
{
  int32 result = -86400000;

  if (_private)
  {
    const auto s = _private->getState();
    if (s == ConnectedState) {
      return s;
    } else if (s == ConnectingState || s == DisconnectedState) {
      if (result < 0) {                                          // <=
        return s;
      }
    } else ....
  }
  return result;
}

Similar errors can be found in some other places:

• V547 Expression 'index >= 0' is always true. storage_settings_scheme.cpp 1062
• V547 Expression 'type == ShowOrPremium::ReadTime' is always true. show_or_premium_box.cpp 120