Fix scan-build detected bugs: undefined behavior, dead stores, and add defensive checks

[Copilot]

Scan-build identified 46 static analysis warnings. Fixed 6 actual bugs, reducing warnings to 40 (remaining are false positives where static analysis cannot verify program invariants).

Fixes

Undefined Behavior in Bitwise Shifts

cuddHarwell.c:359, 497 - Left shift by negative amount when lny == 0:

// Before: undefined behavior when lny == 0
*n = (1 << (lny - 1)) + nrhs;

// After: guard against negative shift
*n = (lny > 0) ? ((1 << (lny - 1)) + nrhs) : nrhs;

Dead Stores

• cuddZddGroup.c:971 - Removed write to size never subsequently read
• cuddDecomp.c:912 - Removed initialization of gPresent, hPresent immediately overwritten by st_lookup_int

Defensive NULL Checks

Added checks for non-debug builds where assert() is disabled:

• cuddLinear.c:404 - Guard last->next dereference (loop invariant guarantees non-null)
• cuddTable.c:993 - Guard sentry->next dereference (GC guarantees at least one dead node)

Documentation

Added SCAN_BUILD_ANALYSIS.md documenting all 46 warnings:

• Categorized by severity and type
• Identified false positives (NULL checks where invariants guarantee safety)
• Noted complex memory patterns in cuddApa.c that confuse static analysis but warrant manual review

Remaining Warnings (40)

Mostly false positives in three categories:

1. NULL dereferences (25) - pointers guaranteed non-null by program logic
2. Debug-only dead stores (2) - values used in DD_DEBUG assertions
3. Reference-counted memory (13) - conditional freeing patterns in arbitrary precision arithmetic

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• esm.ubuntu.com
  • Triggering command: /usr/lib/apt/methods/https /usr/lib/apt/methods/https (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Analyze and investigate prombles detected by scan-build tool. Offer suggestions to address these bugs.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.