ci: move scan-build and tests to Debian 13 (trixie)

.github/workflows/ci.yml

@@ -9,11 +9,11 @@ jobs:
   scan_build:
     runs-on: ubuntu-latest
     container:
-      image: debian:bullseye
+      image: debian:trixie
     steps:
       - name: install deps
         run: |
-          apt-get update && apt-get install -yq build-essential autotools-dev lsb-release pkg-config automake autoconf libtool-bin clang-tools-11
+          apt-get update && apt-get install -yq build-essential autotools-dev lsb-release pkg-config automake autoconf libtool-bin clang-tools
           apt-get install -yq cmake uuid-dev libssl-dev nlohmann-json3-dev git
       - name: Checkout
         uses: actions/checkout@v4
@@ -59,7 +59,7 @@ jobs:
   run_tests:
     runs-on: ubuntu-latest
     container:
-      image: debian:bullseye
+      image: debian:trixie
     steps:
       - name: Checkout
         uses: actions/checkout@v4

run_tests.sh

@@ -1,11 +1,11 @@
 #!/bin/bash
-apt-get update && apt-get install -yq build-essential autotools-dev lsb-release pkg-config automake autoconf libtool-bin clang-tools-11
+apt-get update && apt-get install -yq build-essential autotools-dev lsb-release pkg-config automake autoconf libtool-bin clang-tools
 apt-get install -yq cmake uuid-dev libssl-dev colorized-logs git
 ./build_dependencies.sh
 git config --global --add safe.directory `pwd`
 sed -i '/cotire/d' ./CMakeLists.txt
 mkdir -p scan-build
-scan-build-11 -o ./scan-build/ cmake . -DWITH_JSON_VALIDATION=on -DWITH_PACKAGING=off
+scan-build -o ./scan-build/ cmake . -DWITH_JSON_VALIDATION=on -DWITH_PACKAGING=off
 mkdir -p tests/unit/logs
 make -j`nproc --all` |& tee ./unit-tests-build-result.txt
 exitstatus=${PIPESTATUS[0]}

scan_build.sh

@@ -1,8 +1,8 @@
 #!/bin/bash
 sed -i '/cotire/d' ./CMakeLists.txt
 mkdir -p scan-build
-scan-build-11 -o ./scan-build/ cmake . -DWITH_JSON_VALIDATION=on -DWITH_PACKAGING=off
-scan-build-11 -o ./scan-build/ make -j`nproc --all` |& tee ./scan-build-result.txt
+scan-build -o ./scan-build/ cmake . -DWITH_JSON_VALIDATION=on -DWITH_PACKAGING=off
+scan-build -o ./scan-build/ make -j`nproc --all` |& tee ./scan-build-result.txt
 exitstatus=${PIPESTATUS[0]}
 echo "*** Exit status is $exitstatus";
 export SubString="scan-build: No bugs found";

src/ks_log.c

@@ -324,6 +324,7 @@ static void default_logger(const char *file, const char *func, int line, int lev
 		if (len > 0) {
 			ks_mutex_lock(g_log_mutex);
 			ks_size_t total = len;
+			if (total > sizeof(buf)) total = sizeof(buf); /* len is capped in ks_log_format_output; prove it for the static analyzer */
 
 			//fprintf(stdout, "[%s] %s:%d %s() %s", LEVEL_NAMES[level], fp, line, func, data);
 #if KS_PLAT_WIN

src/kws.c

@@ -1713,7 +1713,6 @@ KS_DECLARE(ks_status_t) kws_connect_ex(kws_t **kwsP, ks_json_t *params, kws_flag
 	ks_sockaddr_t addr = { 0 };
 	ks_socket_t cl_sock = KS_SOCK_INVALID;
 	int family = AF_INET;
-	const char *ip = "127.0.0.1";
 	ks_port_t port = 443;
 	// char buf[50] = "";
 	const char *url = ks_json_get_object_string(params, "url", NULL);

tests/testhttp.c

@@ -47,7 +47,7 @@ typedef struct ssl_profile_s {
 
 static int init_ssl(ssl_profile_t *profile)
 {
-	const char *err = "";
+	const char *err;
 
 	profile->ssl_ctx = SSL_CTX_new(profile->ssl_method);         /* create context */
 	assert(profile->ssl_ctx);

tests/testwebsock.c

@@ -47,7 +47,7 @@ typedef struct ssl_profile_s {
 
 static int init_ssl(ssl_profile_t *profile)
 {
-	const char *err = "";
+	const char *err;
 
 	profile->ssl_ctx = SSL_CTX_new(profile->ssl_method);         /* create context */
 	assert(profile->ssl_ctx);