Errors seen in LOGS/libxml2-2.7.8-6.fc16

This is a summary of errors seen when compiling with an experimental static analysis tool

Raw build logs can be seen here

Reference count too low

Code paths in which the reference count of an object is left too low. This could lead to the object being deallocated too early, triggering segfaults when later accessed. Over repeated calls, these errors could accumulate, increasing the likelihood of a segfault.

./libxml.c pythonExternalEntityLoader ob_refcnt of '*ret' is 1 too low
./libxml.c pythonAttributeDecl ob_refcnt of '*newName' is 1 too low
./libxml.c xmlParserInputBufferCreatePythonFile ob_refcnt of '*file' is 1 too low
./libxml.c xmlOutputBufferCreatePythonFile ob_refcnt of '*file' is 1 too low

Reference leaks

Code paths in which the reference count of an object is left too high, leading to memory leaks

./libxml.c libxml_xmlXPathFuncCallback ob_refcnt of '*result' is 1 too high

Segfaults within error-handling paths

Code paths in error-handling that will lead to a segmentatation fault (e.g. under low memory conditions)

./libxml.c pythonAttributeDecl dereferencing NULL (newName->ob_refcnt) at ./libxml.c:1177
./libxml.c pythonAttributeDecl calling PyList_SetItem with NULL as argument 1 (nameList) at ./libxml.c:1176
./types.c libxml_xmlXPathObjectPtrWrap calling PyList_SetItem with NULL as argument 1 (ret) at ./types.c:407
./types.c libxml_xmlXPathObjectPtrWrap calling PyList_SetItem with NULL as argument 1 (ret) at ./types.c:411
./libxml.c libxml_xmlParserCtxtGetErrorHandler calling PyTuple_SetItem with NULL as argument 1 (py_retval) at ./libxml.c:1696
./libxml.c libxml_xmlParserCtxtGetErrorHandler calling PyTuple_SetItem with NULL as argument 1 (py_retval) at ./libxml.c:1703
./libxml.c libxml_xmlTextReaderGetErrorHandler calling PyTuple_SetItem with NULL as argument 1 (py_retval) at ./libxml.c:2010
./libxml.c libxml_xmlTextReaderGetErrorHandler calling PyTuple_SetItem with NULL as argument 1 (py_retval) at ./libxml.c:2018
./libxml.c libxml_xmlErrorFuncHandler calling PyTuple_SetItem with NULL as argument 1 (list) at ./libxml.c:1487

Possible reference leaks

Code paths in which the reference count of an object might too large - but in which the reference in question came from a function not known to the analyzer.

The analyzer assumes such references are new references, but if the function returns a borrowed reference instead, it's probably not a bug

./libxml.c libxml_xmlXPathFuncCallback ob_refcnt of new ref from (unknown) libxml_xmlXPathParserContextPtrWrap is 1 too high
./libxml.c libxml_xmlXPathFuncCallback ob_refcnt of '*cur' is 1 too high