ABR : Buffer overflow, array index of 'options' may be out of bounds. Array 'options' of size 68 may use index value(s) 68..USHRT_MAX : Code/lwip/src/core/dhcp.c : 1282 : Critical : Analyze ABR : Buffer overflow, array index of 'options' may be out of bounds. Array 'options' of size 68 may use index value(s) 68..USHRT_MAX : Code/lwip/src/core/dhcp.c : 1300 : Critical : Analyze ABR : Buffer overflow, array index of 'options' may be out of bounds. Array 'options' of size 68 may use index value(s) 68..USHRT_MAX. Also there are 2 similar errors on line(s) 1309, 1310. : Code/lwip/src/core/dhcp.c : 1308 : Critical : Analyze ABR : Buffer overflow, array index of 'hwaddr' may be out of bounds. Array 'hwaddr' of size 6 may use index value(s) 6..15 : Code/lwip/src/core/dhcp.c : 1683 : Critical : Analyze ABR : Buffer overflow, array index of 'options' may be out of bounds. Array 'options' of size 68 may use index value(s) 68..USHRT_MAX : Code/lwip/src/core/dhcp.c : 1741 : Critical : Analyze NPD.CHECK.CALL.MIGHT : Pointer 'prev' checked for NULL at line 166 may be passed to function and may be dereferenced there by passing argument 2 to function 'ip_reass_dequeue_datagram' at line 203. : Code/lwip/src/core/ipv4/ip_frag.c : 203 : Error : Analyze NPD.CHECK.MIGHT : Pointer 'p_to' checked for NULL at line 873 may be dereferenced at line 845. : Code/lwip/src/core/pbuf.c : 845 : Error : Analyze NPD.CHECK.MUST : Pointer 'netif' checked for NULL at line 585 will be dereferenced at line 587. : Code/lwip/src/core/dhcp.c : 587 : Error : Analyze NPD.CHECK.MUST : Pointer 'dhcp' checked for NULL at line 586 will be dereferenced at line 590. : Code/lwip/src/core/dhcp.c : 590 : Error : Analyze NPD.CHECK.MUST : Pointer 'netif' checked for NULL at line 604 will be dereferenced at line 606. : Code/lwip/src/core/dhcp.c : 606 : Error : Analyze NPD.CHECK.MUST : Pointer 'dhcp->msg_out' checked for NULL at line 1733 will be dereferenced at line 1735. : Code/lwip/src/core/dhcp.c : 1735 : Error : Analyze NPD.CHECK.MUST : Pointer 'prev' checked for NULL at line 313 will be dereferenced at line 314. : Code/lwip/src/core/ipv4/ip_frag.c : 314 : Error : Analyze NPD.CHECK.MUST : Pointer 'ipr->p' checked for NULL at line 444 will be dereferenced at line 446. : Code/lwip/src/core/ipv4/ip_frag.c : 446 : Error : Analyze NPD.CHECK.MUST : Pointer 'pcr' checked for NULL at line 643 will be dereferenced at line 645. : Code/lwip/src/core/ipv4/ip_frag.c : 645 : Error : Analyze NPD.CHECK.MUST : Pointer 'init' checked for NULL at line 142 will be dereferenced at line 185. : Code/lwip/src/core/netif.c : 185 : Error : Analyze NPD.CHECK.MUST : Pointer 'p' checked for NULL at line 413 will be dereferenced at line 414. : Code/lwip/src/core/pbuf.c : 414 : Error : Analyze NPD.CHECK.MUST : Pointer 'q' checked for NULL at line 441 will be dereferenced at line 433. Also there is one similar error on line 454. : Code/lwip/src/core/pbuf.c : 433 : Error : Analyze NPD.CHECK.MUST : Pointer 'pc->custom_free_function' checked for NULL at line 641 will be dereferenced at line 642. : Code/lwip/src/core/pbuf.c : 642 : Error : Analyze NPD.CHECK.MUST : Pointer 'p_to' checked for NULL at line 843 will be dereferenced at line 845. : Code/lwip/src/core/pbuf.c : 845 : Error : Analyze NPD.CHECK.MUST : Pointer 'p' checked for NULL at line 959 will be dereferenced at line 961. : Code/lwip/src/core/pbuf.c : 961 : Error : Analyze NPD.CHECK.MUST : Pointer 'inseg.p' checked for NULL at line 1145 will be dereferenced at line 1147. : Code/lwip/src/core/tcp_in.c : 1147 : Error : Analyze NPD.FUNC.MUST : Pointer 'q' returned from call to function 'mem_trim' at line 450 may be NULL and will be dereferenced at line 454. : Code/lwip/src/core/pbuf.c : 454 : Error : Analyze NPD.GEN.CALL.MIGHT : Null pointer 'prev' that comes from line 124 may be passed to function and can be dereferenced there by passing argument 2 to function 'ip_reass_free_complete_datagram' at line 143. : Code/lwip/src/core/ipv4/ip_frag.c : 143 : Critical : Analyze NPD.GEN.CALL.MIGHT : Null pointer 'prev' that comes from line 234 may be passed to function and can be dereferenced there by passing argument 2 to function 'ip_reass_free_complete_datagram' at line 254. : Code/lwip/src/core/ipv4/ip_frag.c : 254 : Critical : Analyze NPD.GEN.CALL.MIGHT : Null pointer 'ipr_prev' that comes from line 484 may be passed to function and can be dereferenced there by passing argument 2 to function 'ip_reass_dequeue_datagram' at line 596. : Code/lwip/src/core/ipv4/ip_frag.c : 596 : Critical : Analyze RNPD.DEREF : Suspicious dereference of pointer 'ptcb' before NULL check at line 387 : Code/Os/Src/task.c : 383 : Error : Analyze RNPD.DEREF : Suspicious dereference of pointer 'ipr->p' before NULL check at line 444 : Code/lwip/src/core/ipv4/ip_frag.c : 426 : Error : Analyze RNPD.DEREF : Suspicious dereference of pointer 'ipaddr' before NULL check at line 355 : Code/lwip/src/core/netif.c : 328 : Error : Analyze UNINIT.STACK.ARRAY.MIGHT : 'parts' array elements might be used uninitialized in this function. : Code/lwip/src/core/ipv4/ip_addr.c : 226 : Error : Analyze