Examples of errors detected by the V535 diagnostic

V535. The 'X' variable is used for this loop and outer loops.

OGRE

V535 The variable 'i' is being used for this loop and for the outer loop. OgreMain ogreedgelistbuilder.cpp 587

void EdgeListBuilder::log(Log* l)
{
  ....
  size_t i, j;
  for(i = 0; i < mGeometryList.size(); i++)
  {
    ....
    for (i = 0; i < mVertices.size(); ++i)
    {
      CommonVertex& c = mVertices[i];
      ....
    }
  }
}

Lugaru

V535 The variable 'j' is being used for this loop and for the outer loop. Lugaru skeleton.cpp 392

float Skeleton::DoConstraints(XYZ *coords,float *scale)
{
  ....
  static int i,j,k,l,m;
  ....
  for(j=0; j<numrepeats; j++){
    ....
    for(i=0; i<num_joints; i++){
      ....
      for(j=0;j<num_joints;j++){
        if(joints[j].locked)freely=0;
      }
      ....
    }
    ....
  }
  ....
}

In general, there are a lot of fragments in Lugaru where one and the same variable is used both for inner and outer loops. But functions are huge and it's difficult to understand if there is really an error.

Similar errors can be found in some other places:

• V535 The variable 'i' is being used for this loop and for the outer loop. Lugaru gametick.cpp 3865
• V535 The variable 'i' is being used for this loop and for the outer loop. Lugaru gametick.cpp 4259
• V535 The variable 'i' is being used for this loop and for the outer loop. Lugaru gametick.cpp 4284
• And 13 additional diagnostic messages.

IPP Samples

V535 The variable 'c' is being used for this loop and for the outer loop. jpegcodec jpegdec.cpp 4652

JERRCODE CJPEGDecoder::DecodeScanBaselineNI(void)
{
  ....
  for(c = 0; c < m_scan_ncomps; c++)
  {
    block = m_block_buffer +
            (DCTSIZE2*m_nblock*(j+(i*m_numxMCU)));

    // skip any relevant components
    for(c = 0; c < m_ccomp[m_curr_comp_no].m_comp_no; c++)
    {
      block += (DCTSIZE2*m_ccomp[c].m_nblocks);
    }
  ....
}

Doom 3

V535 The variable 'i' is being used for this loop and for the outer loop. idLib matrix.cpp 3128

bool idMatX::IsOrthonormal( const float epsilon ) const {
  ....
  for ( int i = 0; i < numRows; i++ ) {
    ....
    for ( i = 1; i < numRows; i++ ) {
      ....
    }
    if ( idMath::Fabs( sum ) > epsilon ) {
      return false;
    }
  }
  return true;
}

Visualization Toolkit (VTK)

V535 The variable 'i' is being used for this loop and for the outer loop. vtkIO vtklsdynareader.cxx 506

FillBlock(....)
{
  ....
  for (vtkIdType i=0; i<p->Dict["NSURF"]; ++i)
  {
    ....
    for (vtkIdType t=0; t<segSz; ++t, ++currentCell)
    {
      ....
      for ( i=0; i<4; ++i )
      { ... }
      ....
    }
    ....
  }
  ....
}

Similar errors can be found in some other places:

• V535 The variable 'i' is being used for this loop and for the outer loop. vtklibxml2 xmlregexp.c 590

Wine Is Not an Emulator

V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 980, 1003. iphlpapi_main.c 1003

static ULONG adapterAddressesFromIndex(....)
{
  ....
  for (i = 0; i < num_v6addrs; i++)    // <=
  {
    ....
    for (i = 0; i < 8 && !done; i++)   // <=
    {
      ....
    }
    ....
    if (i < num_v6addrs - 1)
    {
      prefix->Next = (IP_ADAPTER_PREFIX *)ptr;
      prefix = prefix->Next;
    }
  }
  ....
}

Haiku Operation System

V535 The variable 'k' is being used for this loop and for the outer loop. Check lines: 3598, 3610. rules.c 3610

void
solver_get_unneeded(Solver *solv, Queue *unneededq, int filtered)
{
  ....
  if (dep_possible(solv, *dp, &installedm))
  {
    Queue iq;
    Id iqbuf[16];
    queue_init_buffer(&iq, iqbuf, sizeof(iqbuf)/sizeof(*iqbuf));
    dep_pkgcheck(solv, *dp, 0, &iq);
    for (k = 0; k < iq.count; k++)            // <=
      {
  Id p = iq.elements[k];
  Solvable *sp = pool->solvables + p;
  if (....)
    continue;
  for (j = 0; j < count; j++)
    if (p == unneededq->elements[j])
      break;
  /* now add edge from j + 1 to i + 1 */
  queue_insert(....);
  /* addapt following edge pointers */
  for (k = j + 2; k < count + 2; k++)         // <=
    edges.elements[k]++;
      }
    queue_free(&iq);
  }
  ....
}

Similar errors can be found in some other places:

• V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 2319, 2349. solver.c 2349

FreeBSD Kernel

V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 182, 183. mfi_tbolt.c 183

mfi_tbolt_adp_reset(struct mfi_softc *sc)
{
  ....
  for (i=0; i < 10; i++) {
    for (i = 0; i < 10000; i++);
  }
  ....
}

FreeBSD Kernel

V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 197, 208. linux_vdso.c 208

void
__elfN(linux_vdso_reloc)(struct sysentvec *sv, long vdso_adjust)
{
  ....
  for(i = 0; i < ehdr->e_shnum; i++) {                      // <=
    if (!(shdr[i].sh_flags & SHF_ALLOC))
      continue;
    shdr[i].sh_addr += vdso_adjust;
    if (shdr[i].sh_type != SHT_SYMTAB &&
        shdr[i].sh_type != SHT_DYNSYM)
      continue;

    sym = (Elf_Sym *)((caddr_t)ehdr + shdr[i].sh_offset);
    symcnt = shdr[i].sh_size / sizeof(*sym);

    for(i = 0; i < symcnt; i++, sym++) {                    // <=
      if (sym->st_shndx == SHN_UNDEF ||
          sym->st_shndx == SHN_ABS)
        continue;
      sym->st_value += vdso_adjust;
    }
  }
  ....
}

Similar errors can be found in some other places:

• V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 2573, 2729. dsp.c 2729

The GTK+ Project

V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 895, 936. gtkstyleproperties.c 936

void
gtk_style_properties_merge (....)
{
  ....
  guint i;
  ....
  for (i = 0; i < prop_to_merge->values->len; i++)
    {
     ....
      else if (_gtk_is_css_typed_value_of_type (data->value,
                G_TYPE_PTR_ARRAY) && value->value != NULL)
        {
          ....
          for (i = 0; i < array_to_merge->len; i++)
            g_ptr_array_add (array,
              g_ptr_array_index (array_to_merge, i));
        }
    ....
    }
  ....
}

CryEngine V

V535 The variable 'j' is being used for this loop and for the outer loop. Check lines: 3447, 3490. physicalworld.cpp 3490

void CPhysicalWorld::SimulateExplosion(....)
{
  ....
  for(j=0;j<pmd->nIslands;j++)                 // <= line 3447
  {
    ....
    for(j=0;j<pcontacts[ncont].nborderpt;j++)  // <= line 3490
    {
  ....
}

Similar errors can be found in some other places:

• V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 1630, 1683. entity.cpp 1683
• V535 The variable 'i1' is being used for this loop and for the outer loop. Check lines: 1521, 1576. softentity.cpp 1576
• V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 2315, 2316. physicalentity.cpp 2316
• And 1 additional diagnostic messages.

Blender

V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 2204, 2212. bmesh_queries.c 2212

bool BM_face_exists_overlap_subset(...., const int len)
{
  int i;
  ....
  for (i = 0; i < len; i++) {
   BM_ITER_ELEM (f, &viter, varr[i], BM_FACES_OF_VERT) {
    if ((f->len <= len) && (....)) {
     BMLoop *l_iter, *l_first;

     if (is_init == false) {
         is_init = true;
         for (i = 0; i < len; i++) {                  // <=
          BM_ELEM_API_FLAG_ENABLE(varr[i], _FLAG_OVERLAP);
         }
      }
      ....
    }
   }
  }
}

Tizen

V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 950, 985. media_codec_test.c 985

static void _mediacodec_process_input(App *app)
{
  int i;
  ....

  for (i = 0; i < app->frame; i++) {
    ....
    for (i = 0; i < app->height; i++) {
      memcpy(buf_data_ptr, tmp, app->width);
      buf_data_ptr += stride_width;
      tmp += app->width;
    }

    if (app->hardware == TRUE) {
      ....
      for (i = 0; i < app->height / 2; i++) {
        memcpy(buf_data_ptr, tmp, app->width);
        buf_data_ptr += stride_width;
        tmp += app->width;
      }
    } else {
      ....
      for (i = 0; i < app->height/2; i++) {
        memcpy(buf_data_ptr, tmp, app->width/2);
        buf_data_ptr += stride_width;
        tmp += app->width/2;
      }
      ....
      for (i = 0; i < app->height/2; i++) {
        memcpy(buf_data_ptr, tmp, app->width/2);
        buf_data_ptr += stride_width;
        tmp += app->width/2;
    }
  }
  ....
}

Similar errors can be found in some other places:

• V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 950, 996. media_codec_test.c 996
• V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 950, 1007. media_codec_test.c 1007
• V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 950, 1018. media_codec_test.c 1018

Android

V535 CWE-691 The variable 'i' is being used for this loop and for the outer loop. Check lines: 398, 452. ce_t3t.cc 452

void ce_t3t_handle_check_cmd(....) {
  ....
  for (i = 0; i < p_cb->cur_cmd.num_blocks; i++) {
    ....
    for (i = 0; i < T3T_MSG_NDEF_ATTR_INFO_SIZE; i++) {
      checksum += p_temp[i];
    }
    ....
  }
  ....
}

Similar errors can be found in some other places:

• V535 CWE-691 The variable 'xx' is being used for this loop and for the outer loop. Check lines: 801, 807. sdp_db.cc 807
• V535 CWE-691 The variable 'xx' is being used for this loop and for the outer loop. Check lines: 424, 438. nfa_hci_act.cc 438

NCBI Genome Workbench

V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 302, 309. sls_alp.cpp 309

alp::~alp()
{
  ....
  if(d_alp_states)
  {
    for(i=0;i<=d_nalp;i++)           // <=
    {
      if(i<=d_alp_states->d_dim)
      {
        if(d_alp_states->d_elem[i])
        {
          for(i=0;i<=d_nalp;i++)     // <=
          {
            ....
  ....
}

libcurl

V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 2220, 2241. multi.c 2241

static CURLMcode singlesocket(struct Curl_multi *multi,
                              struct Curl_easy *data)
{
  ....
  for(i = 0; (i< MAX_SOCKSPEREASYHANDLE) &&                           // <=
        (curraction & (GETSOCK_READSOCK(i) | GETSOCK_WRITESOCK(i)));
      i++) {
    unsigned int action = CURL_POLL_NONE;
    unsigned int prevaction = 0;
    unsigned int comboaction;
    bool sincebefore = FALSE;

    s = socks[i];

    /* get it from the hash */
    entry = sh_getentry(&multi->sockhash, s);

    if(curraction & GETSOCK_READSOCK(i))
      action |= CURL_POLL_IN;
    if(curraction & GETSOCK_WRITESOCK(i))
      action |= CURL_POLL_OUT;

    actions[i] = action;
    if(entry) {
      /* check if new for this transfer */
      for(i = 0; i< data->numsocks; i++) {                            // <=
        if(s == data->sockets[i]) {
          prevaction = data->actions[i];
          sincebefore = TRUE;
          break;
        }
      }
    }
  ....
}

DPDK

V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 2239, 2291. test_link_bonding.c 2291

#define MAX_PKT_BURST      (512)

static int
test_activebackup_rx_burst(void)
{
  ....
  int i, j, burst_size = 17;
  ....
  for (i = 0; i < test_params->bonding_member_count; i++) {
    /* Generate test bursts of packets to transmit */
    TEST_ASSERT_EQUAL(generate_test_burst(
        &gen_pkt_burst[0], burst_size, 0, 1, 0, 0, 0),
        burst_size, "burst generation failed");
    ....
    /* free mbufs */
    for (i = 0; i < MAX_PKT_BURST; i++) {
      if (rx_pkt_burst[i] != NULL) {
        rte_pktmbuf_free(rx_pkt_burst[i]);
        rx_pkt_burst[i] = NULL;
      }
    }

    /* reset bonding device stats */
    rte_eth_stats_reset(test_params->bonding_port_id);
  }
  ....
}

Similar errors can be found in some other places:

• V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 4340, 4390. test_link_bonding.c 4390

DPDK

V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 1368, 1384. ecore_dcbx.c 1384

#define MAX_TLV_BUFFER      128 /* In dwords. 512 in bytes*/

typedef enum _lldp_agent_e {
  LLDP_NEAREST_BRIDGE = 0,
  LLDP_NEAREST_NON_TPMR_BRIDGE,
  LLDP_NEAREST_CUSTOMER_BRIDGE,
  LLDP_MAX_LLDP_AGENTS
} lldp_agent_e;

enum _ecore_status_t
ecore_lldp_mib_update_event(struct ecore_hwfn *p_hwfn, struct ecore_ptt *p_ptt)
{
  ....
  struct ecore_dcbx_mib_meta_data data;
  enum _ecore_status_t rc = ECORE_SUCCESS;
  struct lldp_received_tlvs_s tlvs;
  int i;

  for (i = 0; i < LLDP_MAX_LLDP_AGENTS; i++) {
    OSAL_MEM_ZERO(&data, sizeof(data));
    data.addr = p_hwfn->mcp_info->port_addr +
          offsetof(struct public_port, lldp_received_tlvs[i]);
    data.lldp_tlvs = &tlvs;
    data.size = sizeof(tlvs);
    rc = ecore_dcbx_copy_mib(p_hwfn, p_ptt, &data,
           ECORE_DCBX_LLDP_TLVS);
    if (rc != ECORE_SUCCESS) {
      DP_NOTICE(p_hwfn, false, "Failed to read lldp TLVs\n");
      return rc;
    }

    if (!tlvs.length)
      continue;

    for (i = 0; i < MAX_TLV_BUFFER; i++)
      tlvs.tlvs_buffer[i] =
        OSAL_CPU_TO_BE32(tlvs.tlvs_buffer[i]);

    OSAL_LLDP_RX_TLVS(p_hwfn, tlvs.tlvs_buffer, tlvs.length);
  }

  return rc;
  ....
}

Similar errors can be found in some other places:

• V535 The variable 'i' is being used for this loop and for the outer loop. Check lines: 445, 455. nicvf_ethdev.c 455