Index: /trunk/configure.ac
===================================================================
--- /trunk/configure.ac	(revision 591)
+++ /trunk/configure.ac	(revision 592)
@@ -4,5 +4,5 @@
 dnl AU_ALIAS([_AC_INIT_help], [SH_INIT_HELP])
 
-AC_INIT([samhain],[4.5.3])
+AC_INIT([samhain],[4.5.4])
 AC_CONFIG_SRCDIR(src/samhain.c)
 
Index: /trunk/docs/Changelog
===================================================================
--- /trunk/docs/Changelog	(revision 591)
+++ /trunk/docs/Changelog	(revision 592)
@@ -1,3 +1,8 @@
-4.5.3:
+4.5.4 (31-10-2026):
+	* fix a slew of compiler warnings with gcc 15.2.0
+	* fix some cppcheck warnings (mostly false positives)
+	* modify test script for the case that the utmp file doesn't exist
+
+4.5.3 (31-10-2025):
 	* fix inadvertent inclusion of scripts/logrotate and init/samhain.startSystemd
 	(reported by kjd)
Index: /trunk/src/bignum.c
===================================================================
--- /trunk/src/bignum.c	(revision 591)
+++ /trunk/src/bignum.c	(revision 592)
@@ -649,6 +649,5 @@
 
 bigerr_t
-big_create(a)
-bignum *a;
+big_create(bignum * a)
 {
   /* Make sure that big_create alway returns a NULL bignum
@@ -681,6 +680,5 @@
 
 void
-big_destroy(a)
-bignum *a;
+big_destroy(bignum *a)
 {
   /* Mar 4, 2000 R. Wichmann: check for a == NULL */
@@ -691,6 +689,5 @@
 
 ulong
-big_bitcount(a)
-bignum *a;
+big_bitcount(bignum *a)
 {
     int bits = 0;
@@ -711,7 +708,5 @@
 
 bigerr_t
-big_set_big(a, b)
-bignum *a;
-bignum *b;
+big_set_big(bignum *a, bignum *b)
 {
     if ((big_errno != BIG_OK) || (a == b))
@@ -731,7 +726,5 @@
 
 void
-big_set_ulong(n, a)
-ulong n;
-bignum *a;
+big_set_ulong(ulong n, bignum *a)
 {
     unsigned int i;
@@ -766,7 +759,5 @@
 
 void
-big_set_long(n, a)
-long n;
-bignum *a;
+big_set_long(long n, bignum *a)
 {
     ulong m;
@@ -782,8 +773,5 @@
 
 bigerr_t
-big_set_string(numstr, base, a)
-char *numstr;
-int base;
-bignum *a;
+big_set_string(char * numstr, int base, bignum *a)
 {
     char *src, *maxdigit, *chrptr;
@@ -870,7 +858,5 @@
 
 int
-big_ulong(a, n)
-bignum *a;
-ulong *n;
+big_ulong(bignum *a, ulong *n)
 {
     ulong old_n;
@@ -900,7 +886,5 @@
 
 int
-big_long(a, n)
-bignum *a;
-long *n;
+big_long(bignum *a, long *n)
 {
     long old_n;
@@ -931,7 +915,5 @@
 
 char *
-big_string(a, base)
-bignum *a;
-int base;
+big_string(bignum *a, int base)
 {
     ulong bit_length, str_length;
@@ -993,7 +975,5 @@
 
 bigerr_t
-big_negate(a, b)
-bignum *a;
-bignum *b;
+big_negate(bignum *a, bignum *b)
 {
     big_set_big(a, b);
@@ -1003,6 +983,5 @@
 
 int
-big_sign(a)
-bignum *a;
+big_sign(bignum *a)
 {
     return a->sign;
@@ -1010,7 +989,5 @@
 
 bigerr_t
-big_abs(a, b)
-bignum *a;
-bignum *b;
+big_abs(bignum *a, bignum *b)
 {
     big_set_big(a, b);
@@ -1023,7 +1000,5 @@
 
 int
-big_compare(a, b)
-bignum *a;
-bignum *b;
+big_compare(bignum *a, bignum *b)
 {
     if (a->sign == b->sign)
@@ -1042,7 +1017,5 @@
 
 int
-big_lessp(a, b)
-bignum *a;
-bignum *b;
+big_lessp(bignum *a, bignum *b)
 {
     return big_compare(a, b) < 0;
@@ -1050,7 +1023,5 @@
 
 int
-big_leqp(a, b)
-bignum *a;
-bignum *b;
+big_leqp(bignum *a, bignum *b)
 {
     return !(big_compare(a, b) > 0);
@@ -1058,7 +1029,5 @@
 
 int
-big_equalp(a, b)
-bignum *a;
-bignum *b;
+big_equalp(bignum *a, bignum *b)
 {
     return big_compare(a, b) == 0;
@@ -1066,7 +1035,5 @@
 
 int
-big_geqp(a, b)
-bignum *a;
-bignum *b;
+big_geqp(bignum *a, bignum *b)
 {
     return !(big_compare(a, b) < 0);
@@ -1074,7 +1041,5 @@
 
 int
-big_greaterp(a, b)
-bignum *a;
-bignum *b;
+big_greaterp(bignum *a, bignum *b)
 {
     return big_compare(a, b) > 0;
@@ -1082,6 +1047,5 @@
 
 int
-big_zerop(a)
-bignum *a;
+big_zerop(bignum *a)
 {
     return a->sign == BIG_SIGN_0;
@@ -1089,6 +1053,5 @@
 
 int
-big_evenp(a)
-bignum *a;
+big_evenp(bignum *a)
 {
     return ((*a->dp & 0x01) == 0);
@@ -1096,6 +1059,5 @@
 
 int
-big_oddp(a)
-bignum *a;
+big_oddp(bignum *a)
 {
     return ((*a->dp & 0x01) == 1);
@@ -1103,8 +1065,5 @@
 
 bigerr_t
-big_add(a, b, c)
-bignum *a;
-bignum *b;
-bignum *c;
+big_add(bignum *a, bignum *b, bignum *c)
 {
     int cmp;
@@ -1160,8 +1119,5 @@
 
 bigerr_t
-big_sub(a, b, c)
-bignum *a;
-bignum *b;
-bignum *c;
+big_sub(bignum *a, bignum *b, bignum *c)
 {
     int cmp;
@@ -1225,8 +1181,5 @@
 
 bigerr_t
-big_mul(a, b, c)
-bignum *a;
-bignum *b;
-bignum *c;
+big_mul(bignum *a, bignum *b, bignum *c)
 {
     DIGIT *dp_x, *dp_xstart, *dp_xend;
@@ -1350,9 +1303,5 @@
 
 bigerr_t
-big_trunc(a, b, q, r)
-bignum *a;
-bignum *b;
-bignum *q;
-bignum *r;
+big_trunc(bignum *a, bignum *b, bignum *q, bignum *r)
 {
     DIGIT *v_end, *q_end, *r_end, *src, *dst;
@@ -1598,9 +1547,5 @@
 
 bigerr_t
-big_floor(a, b, q, r)
-bignum *a;
-bignum *b;
-bignum *q;
-bignum *r;
+big_floor(bignum *a, bignum *b, bignum *q, bignum *r)
 {
     int b_eq_qr, sign_eq;
@@ -1633,9 +1578,5 @@
 
 bigerr_t
-big_ceil(a, b, q, r)
-bignum *a;
-bignum *b;
-bignum *q;
-bignum *r;
+big_ceil(bignum *a, bignum *b, bignum *q, bignum *r)
 {
     int b_eq_qr, sign_diff;
@@ -1671,9 +1612,5 @@
  */
 bigerr_t
-big_round(a, b, q, r)
-bignum *a;
-bignum *b;
-bignum *q;
-bignum *r;
+big_round(bignum *a, bignum *b, bignum *q, bignum *r)
 {
     int b_eq_qr, b_neg_p, a_sgn_neq_b_sgn;
@@ -1740,7 +1677,5 @@
 
 bigerr_t
-big_random(a, b)
-bignum *a;
-bignum *b;
+big_random(bignum *a, bignum *b)
 {
     unsigned long i;
@@ -1791,8 +1726,5 @@
 
 int
-big_expt(a, z, x)
-bignum *a;
-unsigned long z;
-bignum *x;
+big_expt(bignum *a, unsigned long z, bignum *x)
 {
     bignum b;
@@ -1821,9 +1753,5 @@
 
 int
-big_exptmod(a_in, z_in, n, x)
-bignum *a_in;
-bignum *z_in;
-bignum *n;
-bignum *x;
+big_exptmod(bignum *a_in, bignum *z_in, bignum *n, bignum *x)
 {
     bignum a, z, b0, b1, b2, dummy;
@@ -1870,8 +1798,5 @@
 
 int
-big_gcd(a, b, g)
-bignum *a;
-bignum *b;
-bignum *g;
+big_gcd(bignum *a, bignum *b, bignum *g)
 {
     bignum a1, b1, tmp;
Index: /trunk/src/dnmalloc.c
===================================================================
--- /trunk/src/dnmalloc.c	(revision 591)
+++ /trunk/src/dnmalloc.c	(revision 592)
@@ -822,4 +822,5 @@
  * it may actually raise an error.
  */
+/* cppcheck-suppress syntaxError */
 #if defined(HAVE_MALLOC_H) && !defined(__OpenBSD__) && !defined(__FreeBSD__) && !defined(__NetBSD__) && defined(__GLIBC_PREREQ) && __GLIBC_PREREQ(2, 33)
 #include <malloc.h>
Index: /trunk/src/sh_checksum.c
===================================================================
--- /trunk/src/sh_checksum.c	(revision 591)
+++ /trunk/src/sh_checksum.c	(revision 592)
@@ -525,4 +525,5 @@
   *buffer = (char)0;
 
+  /* cppcheck-suppress uninitvar */
   return hexdigest;
 }
@@ -531,9 +532,10 @@
 {
   char   keybuf[KEYBUF_SIZE];
-  char * s   = strstr(str, before);
+  const char * s   = strstr(str, before);
 
   if (s)
     {
       char * p;
+      const char * p1;
 
       s += strlen(before);
@@ -555,6 +557,6 @@
 	  strcpy(r, hexbuf); /* flawfinder: ignore */
 	  r += strlen(hexbuf);
-	  p = strchr(s, after);
-	  strcpy(r, p);      /* flawfinder: ignore */
+	  p1 = strchr(s, after);
+	  strcpy(r, p1);      /* flawfinder: ignore */
 
 	  return ret;
Index: /trunk/src/sh_error.c
===================================================================
--- /trunk/src/sh_error.c	(revision 591)
+++ /trunk/src/sh_error.c	(revision 592)
@@ -1744,4 +1744,6 @@
     {
       /* use VA_COPY */
+      /* cppcheck-suppress va_list_usedBeforeStarted */
+      /* cppcheck-suppress syntaxError */
       /*@i@*/VA_COPY(vl2, vl);
       len      = sl_strlen(lmsg->msg);
@@ -1759,7 +1761,9 @@
 	  lmsg->msg = p;
 	  lmsg->msg_len = required + len + 4;
-	  (void) sl_vsnprintf(&(lmsg->msg[len]), 
-			      (required + 1), lmsg->format, vl2);
+	  /* cppcheck-suppress uninitvar */
+	  /* cppcheck-suppress va_list_usedBeforeStarted */
+	  (void) sl_vsnprintf(&(lmsg->msg[len]), (required + 1), lmsg->format, vl2);
 	}
+      /* cppcheck-suppress va_list_usedBeforeStarted */
       va_end(vl2);
     }
Index: /trunk/src/sh_filetype.c
===================================================================
--- /trunk/src/sh_filetype.c	(revision 591)
+++ /trunk/src/sh_filetype.c	(revision 592)
@@ -486,6 +486,8 @@
 	}
     }
-  sh_ftype_arr[nn] = NULL;
-  sh_ftype_nn      = nn;
+  if (sh_ftype_arr) {
+    sh_ftype_arr[nn] = NULL;
+    sh_ftype_nn      = nn;
+  }
 
   return;
Index: /trunk/src/sh_hash.c
===================================================================
--- /trunk/src/sh_hash.c	(revision 591)
+++ /trunk/src/sh_hash.c	(revision 592)
@@ -3018,4 +3018,7 @@
 {
   char * r = result;
+  
+  *r = '\0'; /* return empty string if !s */
+  
   if (s)
     {
@@ -3026,4 +3029,5 @@
       *r = '\0';
     }
+  /* cppcheck-suppress uninitvar */
   return result;
 }
Index: /trunk/src/sh_log_check.c
===================================================================
--- /trunk/src/sh_log_check.c	(revision 591)
+++ /trunk/src/sh_log_check.c	(revision 592)
@@ -423,4 +423,5 @@
 	  if (S_ISREG(buf.st_mode)
 #ifdef S_ISLNK
+	      /* cppcheck-suppress syntaxError */
 	      || S_ISLNK(buf.st_mode)
 #endif 
Index: /trunk/src/sh_login_track.c
===================================================================
--- /trunk/src/sh_login_track.c	(revision 591)
+++ /trunk/src/sh_login_track.c	(revision 592)
@@ -168,16 +168,16 @@
 static int get_bool(char *bitarray, unsigned int index)
 {
-  int bool;
+  int my_bool;
 
   bitarray += index / 8; /* skip to char */
-  bool = (*bitarray & (1 << (index % 8)));
-
-  return bool;
-}
-
-static void set_bool(char *bitarray, unsigned int index, int bool)
+  my_bool = (*bitarray & (1 << (index % 8)));
+
+  return my_bool;
+}
+
+static void set_bool(char *bitarray, unsigned int index, int my_bool)
 {
   bitarray += index / 8; /* skip to char */
-  if (bool)
+  if (my_bool)
     *bitarray |= 1 << (index % 8);
   else    
Index: /trunk/src/sh_mem.c
===================================================================
--- /trunk/src/sh_mem.c	(revision 591)
+++ /trunk/src/sh_mem.c	(revision 592)
@@ -150,9 +150,9 @@
     {
       memlist_t   * merr = calloc(1,sizeof(memlist_t));
-
-      memcpy(merr, this, sizeof(memlist_t));
-      merr->next = merrlist;
-      merrlist   = merr;
-
+      if (merr) {
+	  memcpy(merr, this, sizeof(memlist_t));
+	  merr->next = merrlist;
+	  merrlist   = merr;
+	}
       this = this->next;
     }
@@ -198,10 +198,10 @@
 	{
 	  merr = calloc (1,sizeof(memlist_t));
-
-	  memcpy(merr, this, sizeof(memlist_t));
-	  merr->size = 2;
-
-	  merr->next = merrlist;
-	  merrlist   = merr;
+	  if (merr) {
+	    memcpy(merr, this, sizeof(memlist_t));
+	    merr->size = 2;
+	    merr->next = merrlist;
+	    merrlist   = merr;
+	  }
 	}
       else
@@ -210,20 +210,20 @@
 	    {
 	      merr = calloc(1, sizeof(memlist_t));
-	      
-	      memcpy(merr, this, sizeof(memlist_t));
-	      merr->size = 1;
-	      
-	      merr->next = merrlist;
-	      merrlist   = merr;
+	      if (merr) {
+		memcpy(merr, this, sizeof(memlist_t));
+		merr->size = 1;
+		merr->next = merrlist;
+		merrlist   = merr;
+	      }
 	    }
 	  if ( this->real_address[SH_MEMMULT-1] != CHECKBYTE )
 	    {
 	      merr = calloc(1, sizeof(memlist_t));
-	      
-	      memcpy(merr, this, sizeof(memlist_t));
-	      merr->size = 0;
-	      
-	      merr->next = merrlist;
-	      merrlist   = merr;
+	      if (merr) {
+		memcpy(merr, this, sizeof(memlist_t));
+		merr->size = 0;
+		merr->next = merrlist;
+		merrlist   = merr;
+	      }
 	    }
 	}
@@ -378,10 +378,10 @@
 	{
 	  merr = calloc(1, sizeof(memlist_t));
-
-	  memcpy(merr, this, sizeof(memlist_t));
-	  merr->size = 1;
-
-	  merr->next = merrlist;
-	  merrlist = merr;
+	  if (merr) {
+	    memcpy(merr, this, sizeof(memlist_t));
+	    merr->size = 1;
+	    merr->next = merrlist;
+	    merrlist = merr;
+	  }
 	}
 
@@ -389,10 +389,10 @@
 	{
 	  merr = calloc(1,sizeof(memlist_t));
-
-	  memcpy(merr, this, sizeof(memlist_t));
-	  merr->size = 0;
-
-	  merr->next = merrlist;
-	  merrlist = merr;
+	  if (merr) {
+	    memcpy(merr, this, sizeof(memlist_t));
+	    merr->size = 0;
+	    merr->next = merrlist;
+	    merrlist = merr;
+	  }
 	}
 
Index: /trunk/src/sh_port2proc.c
===================================================================
--- /trunk/src/sh_port2proc.c	(revision 591)
+++ /trunk/src/sh_port2proc.c	(revision 592)
@@ -91,4 +91,5 @@
   sl_snprintf (path, sizeof(path), "/proc/%ld/exe", (unsigned long) add->pid);
 
+  /* cppcheck-suppress syntaxError */
   if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
     {
Index: /trunk/src/sh_portcheck.c
===================================================================
--- /trunk/src/sh_portcheck.c	(revision 591)
+++ /trunk/src/sh_portcheck.c	(revision 592)
@@ -492,4 +492,5 @@
   struct sh_portentry * new = SH_ALLOC (sizeof(struct sh_portentry));
 
+  if (!new) return;
   new->port = port;
   sh_ipvx_ntoa(new->interface, SH_INTERFACE_SIZE, paddr);
@@ -1960,4 +1961,5 @@
 {
   struct added_dev * new = SH_ALLOC(sizeof(struct added_dev));
+  if (!new) return;
   sl_strlcpy(new->dev, buf, 64);
   new->next = dev_list;
@@ -2122,4 +2124,5 @@
 
   black = SH_ALLOC (sizeof(struct sh_port));
+  if (!black) return -1;
   black->paddr = SH_ALLOC (sizeof(struct sh_sockaddr));
   black->port  = port;
@@ -2189,4 +2192,5 @@
 
   transient = SH_ALLOC (sizeof(struct sh_port));
+  if (!transient) return -1;
   transient->paddr = SH_ALLOC (sizeof(struct sh_sockaddr));
   transient->port  = port;
@@ -2324,9 +2328,10 @@
   if (strchr(str, ':'))
     {
-      char *last = strrchr(str, ':');
+      const char *last = strrchr(str, ':');
       if (last != NULL)
 	{
 	  size_t tolast = (last - str);
 	  interface = SH_ALLOC(tolast+1);
+	  if (!interface) return -1;
 	  sl_strlcpy(interface, str, tolast+1);
 	  interface[tolast] = '\0';
@@ -2341,4 +2346,5 @@
     {
       interface = SH_ALLOC(8);
+      if (!interface) return -1;
       sl_strlcpy(interface, _("0.0.0.0"), 8);
       interface[7] = '\0';
Index: /trunk/src/sh_processcheck.c
===================================================================
--- /trunk/src/sh_processcheck.c	(revision 591)
+++ /trunk/src/sh_processcheck.c	(revision 592)
@@ -210,4 +210,5 @@
   sl_snprintf (path, sizeof(path), _("/proc/%ld/exe"), (unsigned long) pid);
 
+  /* cppcheck-suppress syntaxError */
   if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
     {
@@ -217,4 +218,5 @@
   sl_snprintf (path, sizeof(path), _("/proc/%ld/file"), (unsigned long) pid);
 
+  /* cppcheck-suppress syntaxError */
   if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
     {
@@ -224,4 +226,5 @@
   sl_snprintf (path, sizeof(path), _("/proc/%ld/path/a.out"), (unsigned long) pid);
 
+  /* cppcheck-suppress syntaxError */
   if (0 == retry_lstat(FIL__, __LINE__, path, &sbuf) && S_ISLNK(sbuf.st_mode))
     {
Index: /trunk/src/sh_sig.c
===================================================================
--- /trunk/src/sh_sig.c	(revision 591)
+++ /trunk/src/sh_sig.c	(revision 592)
@@ -645,5 +645,6 @@
   int    flag_sig  = S_FALSE;
   SL_TICKET fdTmp  = (-1);
-  SL_TICKET open_tmp (void);
+  SL_TICKET open_tmp  (void);
+  int       close_tmp ( SL_TICKET);
 
   /* extract the data and copy to temporary file
@@ -660,6 +661,7 @@
 
   fin_cp = fdopen(dup(get_the_fd(fd)), "rb");
+  if (!fin_cp) { close_tmp(fdTmp); return -1; }
   buf = SH_ALLOC(fgets_buf_size);
-
+  
   while (NULL != fgets(buf, fgets_buf_size, fin_cp))
     {
@@ -720,4 +722,6 @@
   fin_cp = fdopen(dup(get_the_fd(fdTmp)), "rb");
   FILE * fout = fopen("xxx.out", "w+");
+  if (!fout) { close_tmp(fdTmp); return -1; }
+  if (!fin_cp) { close_tmp(fdTmp); fclose(fout); return -1; }
   while (NULL != fgets(buf, fgets_buf_size, fin_cp))
     {
@@ -1598,6 +1602,7 @@
   int    flag_nohead = S_FALSE;
   SL_TICKET fdTmp = (-1);
-  SL_TICKET open_tmp (void);
-
+  SL_TICKET open_tmp  (void);
+  int       close_tmp ( SL_TICKET);
+  
   /* extract the data and copy to temporary file
    */
@@ -1613,6 +1618,7 @@
 
   fin_cp = fdopen(dup(get_the_fd(fd)), "rb");
+  if (!fin_cp) { close_tmp(fdTmp); return -1; }
   buf = SH_ALLOC(fgets_buf_size);
-
+  
   while (NULL != fgets(buf, fgets_buf_size, fin_cp))
     {
Index: /trunk/src/sh_socket.c
===================================================================
--- /trunk/src/sh_socket.c	(revision 591)
+++ /trunk/src/sh_socket.c	(revision 592)
@@ -89,19 +89,17 @@
 int sh_socket_store_uuid(const char * cmd)
 {
-  char * p = sh_util_strdup(cmd);
-  char * q = strchr(cmd, ':');
+  const char * q = strchr(cmd, ':');
   char   entry[SH_BUFSIZE];
   SH_DELTA_DB db;
 
-  if (!q) { SH_FREE(p); return -1; }
+  if (!q) { return -1; }
 
   ++q;
 
-  if (0 != sh_uuid_check(q)) { SH_FREE(p); return -1; }
+  if (0 != sh_uuid_check(q)) { return -1; }
 
   db.count = 0;
   db.last_time = (time_t) 0;
   sl_strlcpy(db.uuid, q, SH_UUID_BUF);
-  SH_FREE(p);
 
   if (NULL != unparse_entry(&db, entry, sizeof(entry)))
@@ -495,5 +493,6 @@
     {
 #ifdef S_ISSOCK
-      if (S_ISSOCK (sbuf.st_mode))
+      /* cppcheck-suppress syntaxError */
+      if (S_ISSOCK(sbuf.st_mode))
 	{
 	  retval = retry_aud_unlink (FIL__, __LINE__, sh_sockname);
Index: /trunk/src/sh_static.c
===================================================================
--- /trunk/src/sh_static.c	(revision 591)
+++ /trunk/src/sh_static.c	(revision 592)
@@ -1170,5 +1170,5 @@
 
 	while (dotted && *dotted) {
-		char *c = strchr(dotted, '.');
+		const char *c = strchr(dotted, '.');
 		unsigned int l = c ? (unsigned int)(c - dotted) : strlen(dotted);
 
Index: /trunk/src/sh_string.c
===================================================================
--- /trunk/src/sh_string.c	(revision 591)
+++ /trunk/src/sh_string.c	(revision 592)
@@ -697,5 +697,5 @@
 
 void Test_string (CuTest *tc) {
-  int status, i, max = 120;
+  int status = -1, i, max = 120;
   FILE * fp;
   sh_string * s = NULL;
@@ -721,21 +721,23 @@
 
   fp = fdopen(status, "r+");
-  CuAssertPtrNotNull(tc, fp);
-
-  for (i = 0; i <  80; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 0 */
-  for (i = 0; i < 118; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 1 */
-  for (i = 0; i < 119; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 2 */
-  for (i = 0; i < 120; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 3 */
-  for (i = 0; i < 121; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 4 */
-  for (i = 0; i < 238; ++i) { fputc ('a', fp); } fputc ('\n', fp);
-  for (i = 0; i < 239; ++i) { fputc ('a', fp); } fputc ('\n', fp);
-  for (i = 0; i < 240; ++i) { fputc ('a', fp); } fputc ('\n', fp);
-  for (i = 0; i < 241; ++i) { fputc ('a', fp); } fputc ('\n', fp);
-
-  rewind(fp);
-
+  CuAssertPtrNotNull(tc, fp); /* cppcheck doesn't understand this */
+
+  if (fp) {
+    for (i = 0; i <  80; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 0 */
+    for (i = 0; i < 118; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 1 */
+    for (i = 0; i < 119; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 2 */
+    for (i = 0; i < 120; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 3 */
+    for (i = 0; i < 121; ++i) { fputc ('a', fp); } fputc ('\n', fp); /* 4 */
+    for (i = 0; i < 238; ++i) { fputc ('a', fp); } fputc ('\n', fp);
+    for (i = 0; i < 239; ++i) { fputc ('a', fp); } fputc ('\n', fp);
+    for (i = 0; i < 240; ++i) { fputc ('a', fp); } fputc ('\n', fp);
+    for (i = 0; i < 241; ++i) { fputc ('a', fp); } fputc ('\n', fp);
+
+    rewind(fp);
+  }
   for (i = 0; i < 9; ++i)
     {
-      status = sh_string_read(s, fp, max);
+      if (fp)
+	status = sh_string_read(s, fp, max);
 
       switch (i) {
@@ -784,5 +786,5 @@
     }
 
-  rewind(fp);
+  if (fp) rewind(fp);
 
   sh_string_truncate(s, 0);
@@ -791,7 +793,8 @@
   for (i = 0; i < 9; ++i)
     {
-      status = sh_string_read(s, fp, 240);
+      if (fp)
+	status = sh_string_read(s, fp, 240);
       if (status == -2)
-        sh_string_read(s, fp, 240);
+        { if (fp) sh_string_read(s, fp, 240); }
       else
         {
@@ -806,5 +809,6 @@
     }
 
-  status = fclose(fp); 
+  if (fp)
+    status = fclose(fp); 
   CuAssertTrue(tc, status == 0);
   status = remove(template);
Index: /trunk/src/sh_suidchk.c
===================================================================
--- /trunk/src/sh_suidchk.c	(revision 591)
+++ /trunk/src/sh_suidchk.c	(revision 592)
@@ -256,4 +256,5 @@
 	  return -1; 
 	}
+      /* cppcheck-suppress syntaxError */
       if (/*@-usedef@*/!S_ISDIR(one.st_mode)/*@+usedef@*/)
 	
@@ -350,4 +351,5 @@
 	  return -1;
 	}
+      /* cppcheck-suppress syntaxError */
       if (!S_ISREG(two.st_mode))
 	{ 
Index: /trunk/src/sh_xfer_client.c
===================================================================
--- /trunk/src/sh_xfer_client.c	(revision 591)
+++ /trunk/src/sh_xfer_client.c	(revision 592)
@@ -1549,7 +1549,7 @@
 #if !defined(SH_ENCRYPT)
 		  if (4 == sl_strlen(errmsg)) {  /* backward compatibility   */
-		    buffersize = sl_strlen(buffer);
-		    buffer[buffersize]   = theProto; /* nctl//DATA//theProto */
-		    buffer[buffersize+1] = '\0';
+		    size_t bufferlen = sl_strlen(buffer);
+		    buffer[bufferlen]   = (char) theProto; /* nctl//DATA//theProto */
+		    buffer[bufferlen+1] = '\0';
 		  }
 		  sh_tools_hash_add(foo_M1, buffer, buffersize+1);
Index: /trunk/src/slib.c
===================================================================
--- /trunk/src/slib.c	(revision 591)
+++ /trunk/src/slib.c	(revision 592)
@@ -1178,20 +1178,28 @@
   size_t          needle_len;
   size_t          haystack_len;
+#else
+  char *          result;
 #endif
   
   if (haystack == NULL || needle == NULL)
     return NULL;
-  if (*needle == '\0' || *haystack == '\0')
+  if (*needle == '\0')
+    return (char *)(uintptr_t)haystack;
+  if (*haystack == '\0')
     return NULL;
 
 #if defined(HAVE_STRSTR)
-  return (strstr(haystack, needle));
+  result = (char *)(uintptr_t)strstr(haystack, needle);
+  return result;
 #else
   needle_len   = strlen(needle);
   haystack_len = strlen(haystack);
 
+  if (needle_len > haystack_len)
+    return NULL;
+
   for (i = 0; i <= (haystack_len-needle_len); ++i)
     if (0 == sl_strncmp(&haystack[i], needle, needle_len))
-      return (needle);
+      return (&haystack[i]);
   return NULL;
 #endif
@@ -2107,5 +2115,5 @@
 
   len = sl_strlen(filename)+1;
-
+  
   if ( (ofiles[fd]->path = calloc(1,len) ) == NULL)
     {
@@ -2129,5 +2137,7 @@
     }
 
-  sl_strlcpy (ofiles[fd]->path, filename, len);
+  /* allocated length of path is strlen(filename)+1 */
+  memcpy(ofiles[fd]->path, filename, len);
+  
   ofiles[fd]->ticket  = ticket;
   ofiles[fd]->fd      = fd;
Index: /trunk/src/trustfile.c
===================================================================
--- /trunk/src/trustfile.c	(revision 591)
+++ /trunk/src/trustfile.c	(revision 592)
@@ -437,4 +437,6 @@
 #if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
   buffer = calloc(1,SH_GRBUF_SIZE);
+  if (!buffer)
+     goto end_false;
   status = sh_getgrgid_r(grp, &gr, buffer, SH_GRBUF_SIZE, &g);
 #else
@@ -456,4 +458,6 @@
 #if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
   pbuffer = calloc(1,SH_PWBUF_SIZE);
+  if (!pbuffer)
+     goto end_false;
 #endif
 
@@ -550,4 +554,8 @@
 #if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
   buffer = calloc(1,SH_GRBUF_SIZE);
+  if (!buffer) {
+    retval = S_FALSE;
+    goto end_retval;
+  }
   status = sh_getgrgid_r(grp, &gr, buffer, SH_GRBUF_SIZE, &g);
 #else
@@ -581,4 +589,8 @@
 #if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
   pbuffer = calloc(1,SH_PWBUF_SIZE);
+  if (!pbuffer) {
+    retval = S_FALSE;
+    goto end_retval;
+  }
 #endif
 
Index: /trunk/src/yulectl.c
===================================================================
--- /trunk/src/yulectl.c	(revision 591)
+++ /trunk/src/yulectl.c	(revision 592)
@@ -311,5 +311,5 @@
 	  if (i == 0)
 	    {
-	      char * p = strchr(str, ':'); ++p;
+	      const char * p = strchr(str, ':'); ++p;
 	      if ( 0 == check_uuid(p) )
 		return 0;
Index: /trunk/test/testrun_1.sh
===================================================================
--- /trunk/test/testrun_1.sh	(revision 591)
+++ /trunk/test/testrun_1.sh	(revision 592)
@@ -1100,7 +1100,7 @@
 	fi
 	#
-	# wtmp may not be readable
-	#
-	tmp=`./samhain -j -L $LOGFILE | grep ERR | grep -v wtmp | wc -l`
+	# wtmp may not be readable -- and utmp may not exist anymore
+	#
+	tmp=`./samhain -j -L $LOGFILE | grep ERR | grep -v wtmp | grep -v utmp | wc -l`
 	if [ $tmp -ne 0 ]; then
 	    [ -z "$verbose" ] || log_msg_fail "errors during check";
Index: /trunk/test/testrun_1a.sh
===================================================================
--- /trunk/test/testrun_1a.sh	(revision 591)
+++ /trunk/test/testrun_1a.sh	(revision 592)
@@ -55,5 +55,5 @@
 	return 1
     fi
-    "$CONVERT" --help | grep  ImageMagick >/dev/null 2>&1
+    "$CONVERT" -version | grep  ImageMagick >/dev/null 2>&1
     if [ $? -ne 0 ]; then
 	[ -z "$verbose" ] || log_msg_fail "Convert utility is not ImageMagick convert";
Index: /trunk/test/testrun_1b.sh
===================================================================
--- /trunk/test/testrun_1b.sh	(revision 591)
+++ /trunk/test/testrun_1b.sh	(revision 592)
@@ -363,5 +363,5 @@
 	    #
 	    PRECONV=`find_path convert`
-	    "${PRECONV}" --help | grep  ImageMagick >/dev/null 2>&1 && \
+	    "${PRECONV}" -version | grep  ImageMagick >/dev/null 2>&1 && \
  		CONVERT="${PRECONV}"
 
Index: /trunk/test/testrun_1i.sh
===================================================================
--- /trunk/test/testrun_1i.sh	(revision 591)
+++ /trunk/test/testrun_1i.sh	(revision 592)
@@ -299,5 +299,5 @@
 	    #
 	    PRECONV=`find_path convert`
-	    "${PRECONV}" --help | grep  ImageMagick >/dev/null 2>&1 && \
+	    "${PRECONV}" -version | grep  ImageMagick >/dev/null 2>&1 && \
  		CONVERT="${PRECONV}"