Still working on pacifying Coverity. All regression tests pass.

7 files changed, 12 insertions, 8 deletions

diff --git a/driver_ubx.c b/driver_ubx.c
index 40721c7c..5e417461 100644
--- a/driver_ubx.c
+++ b/driver_ubx.c
@@ -515,7 +515,8 @@ bool ubx_write(struct gps_device_t * session,
 	       unsigned char *msg, size_t data_len)
 {
     unsigned char CK_A, CK_B;
-    ssize_t i, count;
+    ssize_t count;
+    size_t i;
     bool ok;
 
     /*@ -type @*/
@@ -550,9 +551,8 @@ bool ubx_write(struct gps_device_t * session,
     /*@ +type @*/
 
 
-    /* coverity[pwprintf_arg_mismatch] */
     gpsd_report(LOG_IO,
-		"=> GPS: UBX class: %02x, id: %02x, len: %d, crc: %02x%02x\n",
+		"=> GPS: UBX class: %02x, id: %02x, len: %zd, crc: %02x%02x\n",
 		msg_class, msg_id, data_len,
 		CK_A, CK_B);
     count = gpsd_write(session, session->msgbuf, session->msgbuflen);
diff --git a/gpsd.c b/gpsd.c
index b072e5b5..e92e3337 100644
--- a/gpsd.c
+++ b/gpsd.c
@@ -2324,7 +2324,7 @@ int main(int argc, char *argv[])
 		while ((rd = read(cfd, buf, sizeof(buf) - 1)) > 0) {
 		    buf[rd] = '\0';
 		    gpsd_report(LOG_IO, "<= control(%d): %s\n", cfd, buf);
-		    /* coverity[tainted_scalar] Safe, never handed to exec */
+		    /* coverity[tainted_data_argument] Safe, never handed to exec */
 		    handle_control(cfd, buf);
 		}
 		gpsd_report(LOG_SPIN, "close(%d) of control socket\n", cfd);
diff --git a/libgps_core.c b/libgps_core.c
index 687b8b82..d3822a48 100644
--- a/libgps_core.c
+++ b/libgps_core.c
@@ -140,7 +140,7 @@ int gps_read(struct gps_data_t *gpsdata)
 #endif /* SHM_EXPORT_ENABLE */
 
 #ifdef SOCKET_EXPORT_ENABLE
-    if (status == -1) {
+    if (status == -1 && gpsdata->gps_fd != -1) {
         status = gps_sock_read(gpsdata);
     }
 #endif /* SOCKET_EXPORT_ENABLE */
diff --git a/libgpsd_core.c b/libgpsd_core.c
index 04e01a73..95da9fa9 100644
--- a/libgpsd_core.c
+++ b/libgpsd_core.c
@@ -951,7 +951,7 @@ gps_mask_t gpsd_poll(struct gps_device_t *session)
     }
 
     /* can we get a full packet from the device? */
-    if (session->device_type) {
+    if (session->device_type != NULL) {
 	newlen = session->device_type->get_packet(session);
 	gpsd_report(LOG_RAW,
 		    "%s is known to be %s\n",
diff --git a/net_ntrip.c b/net_ntrip.c
index 83c0841a..0f4aca88 100644
--- a/net_ntrip.c
+++ b/net_ntrip.c
@@ -320,7 +320,7 @@ static int ntrip_stream_req_probe(const struct ntrip_stream_t *stream)
     if (r != (ssize_t)strlen(buf)) {
 	gpsd_report(LOG_ERROR, "ntrip stream write error %d on fd %d during probe request %zd\n",
 		errno, dsock, r);
-	close(dsock);
+	(int)close(dsock);
 	return -1;
     }
     /* coverity[leaked_handle] This is an intentional allocation */
diff --git a/ntpshm.c b/ntpshm.c
index c597c56b..bb41e348 100644
--- a/ntpshm.c
+++ b/ntpshm.c
@@ -911,6 +911,9 @@ static /*@null@*/ void *gpsd_ppsmonitor(void *arg)
 
     }
     gpsd_report(LOG_PROG, "PPS gpsd_ppsmonitor exited???\n");
+    /* pacify Coverity - falling through here is theoretically a handle leak */
+    if (chronyfd)
+	(void)close(chronyfd);
     return NULL;
 }
 /*@+mustfreefresh +type +unrecog@*/
diff --git a/packet.c b/packet.c
index d579206f..886e7a1b 100644
--- a/packet.c
+++ b/packet.c
@@ -1984,7 +1984,6 @@ ssize_t packet_get(int fd, struct gps_packet_t *lexer)
 
     /*@ -modobserver @*/
     errno = 0;
-    /* coverity[tainted_scalar] Safe, as it's never handed to exec */
     recvd = read(fd, lexer->inbuffer + lexer->inbuflen,
 		 sizeof(lexer->inbuffer) - (lexer->inbuflen));
     /*@ +modobserver @*/
@@ -2013,6 +2012,7 @@ ssize_t packet_get(int fd, struct gps_packet_t *lexer)
      * nothing from the device and there is nothing waiting in the
      * packet input buffer.
      */
+    /* coverity[tainted_scalar] */
     if (recvd <= 0 && packet_buffered_input(lexer) <= 0)
 	return recvd;
 
@@ -2021,6 +2021,7 @@ ssize_t packet_get(int fd, struct gps_packet_t *lexer)
 
     /* if input buffer is full, discard */
     if (sizeof(lexer->inbuffer) == (lexer->inbuflen)) {
+	/* coverity[tainted_scalar] */
 	packet_discard(lexer);
 	lexer->state = GROUND_STATE;
     }