Coverity suppressions

client/sub_client_output.c

@@ -857,6 +857,7 @@ void print_message(struct mosq_config *lcfg, const struct mosquitto_message *mes
 #ifdef WIN32
 		rand_s(&r);
 #else
+		/* coverity[dont_call] - we don't care about random() not being cryptographically secure here */
 		r = random();
 #endif
 		if((long)(r%10000) >= lcfg->random_filter){

lib/socks_mosq.c

@@ -406,6 +406,13 @@ int socks5__read(struct mosquitto *mosq)
 				packet__cleanup(&mosq->in_packet);
 				return MOSQ_ERR_PROTOCOL;
 			}
+			/* coverity[tainted_data] - we know the value of
+			 * mosq->in_packet.packet_lenth is within a bound. At the start of
+			 * this if statement, it was 5. The next set of if statements add
+			 * either (4+2-1)=5 to its value, or (16+2-1)=17 to its value, or
+			 * the contents of a uint8_t, which can be a maximum of 255. So the
+			 * range is 10 to 260 bytes. Coverity most likely doesn't realise
+			 * this because the += promotes to the size of packet_length. */
 			payload = mosquitto__realloc(mosq->in_packet.payload, mosq->in_packet.packet_length);
 			if(payload){
 				mosq->in_packet.payload = payload;

plugins/examples/delayed-auth/mosquitto_delayed_auth.c

@@ -125,7 +125,8 @@ static int tick_callback(int event, void *event_data, void *userdata)
 #ifdef WIN32
 				r = rand() % 1000;
 #else
-				 r = random() % 1000;
+				/* coverity[dont_call] - we don't care about random() not being cryptographically secure here */
+				r = random() % 1000;
 #endif
 				if(r > 740){
 					mosquitto_complete_basic_auth(client->id, MOSQ_ERR_AUTH);

src/bridge.c

@@ -464,7 +464,9 @@ int bridge__connect(struct mosquitto *context)
 
 	mosquitto__set_state(context, mosq_cs_new);
 	context->sock = INVALID_SOCKET;
+	/* coverity[missing_lock] - broker is single threaded, so no lock required */
 	context->last_msg_in = db.now_s;
+	/* coverity[missing_lock] - broker is single threaded, so no lock required */
 	context->next_msg_out = db.now_s + context->bridge->keepalive;
 	context->keepalive = context->bridge->keepalive;
 	context->clean_start = context->bridge->clean_start;

src/keepalive.c

@@ -212,6 +212,7 @@ int keepalive__update(struct mosquitto *context)
 {
 #ifndef WITH_OLD_KEEPALIVE
 	keepalive__remove(context);
+	/* coverity[missing_lock] - broker is single threaded, so no lock required */
 	context->last_msg_in = db.now_s;
 	keepalive__add(context);
 #else

src/plugin_public.c

@@ -771,6 +771,7 @@ BROKER_EXPORT int mosquitto_persist_base_msg_add(struct mosquitto_base_msg *msg_
 		if(message_expiry_interval_tt > UINT32_MAX){
 			message_expiry_interval = UINT32_MAX;
 		}else{
+			/* coverity[store_truncates_time_t] - we check above whether the value will fit in a uint32_t */
 			message_expiry_interval = (uint32_t)message_expiry_interval_tt;
 		}
 	}

test/unit/keepalive_test.c

@@ -188,6 +188,7 @@ static void TEST_100k_random_clients(void)
 
 	for(int i=0; i<client_count; i++){
 		contexts[i].id = strdup("clientid");
+		/* coverity[dont_call] - we don't care about rand() not being cryptographically secure here */
 		contexts[i].keepalive = (uint16_t)rand() % UINT16_MAX;
 		contexts[i].last_msg_in = rand() % 60000;
 	}