AI review of 2026-09-24_14-31-18-f775f03c9eec-results.txt PR: #8890 https://github.com/cppcheck-opensource/cppcheck/pull/8890 Tested: f775f03c9eecf26a09d00076bb5e39a701e24c4d Merge base: 8bb772daa62d60900b0e48535063f902aed45e41 Reviewed: 2026-10-27 13:27:22 UTC Model: claude-opus-5-5 (effort high) Results: 50 reviewed of 139 in the report (random sample) Verdicts: 15 improvement, 32 neutral, 2 regression, 1 unclear Tokens: 137054 input, 1123824 cache read, 46826 cache write, 26204 output The verdicts are written by AI and can be wrong. ---- 1 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/b/boxes/boxes_2.3.2.orig.tar.xz Result: main boxes-2.3.2/src/shape.c:358:50: style: Argument 'shape_name' shadows outer variable [shadowVariable] boxes-2.3.2/src/shape.h:28:14: note: Shadowed variable boxes-2.3.2/src/shape.c:358:50: note: Shadow argument Explanation: The global `shape_name` is declared `extern` in shape.h:28 and defined in shape.c:36. The parameter `shape_name` at shape.c:358 really does shadow this global, so the warning is a true positive in both versions. The PR merges the C redeclarations into one variable, so the 'Shadowed variable' note now points to the definition in shape.c:36 instead of the extern declaration in shape.h:28. The main line disappears only because its note changed; the same warning is reported by 'your'. Both locations name the same object, so this is just a different but equally valid note location. ---- 2 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/b/boxes/boxes_2.3.2.orig.tar.xz Result: main boxes-2.3.2/src/shape.c:372:34: style: Argument 'shape_name' shadows outer variable [shadowVariable] boxes-2.3.2/src/shape.h:28:14: note: Shadowed variable boxes-2.3.2/src/shape.c:372:34: note: Shadow argument Explanation: The `shadowVariable` warning for argument `shape_name` at line 372 is still reported. Only the 'Shadowed variable' note moved: main pointed at the extern declaration in `shape.h:28`, and the PR points at the definition in `shape.c:36`. The PR now merges C file-scope redeclarations into one object and keeps the definition as the canonical declaration. Both locations name the same global object, and the argument does shadow it either way, so the warning is equally correct and useful. ---- 3 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/b/boxes/boxes_2.3.2.orig.tar.xz Result: your boxes-2.3.2/src/shape.c:372:34: style: Argument 'shape_name' shadows outer variable [shadowVariable] boxes-2.3.2/src/shape.c:36:7: note: Shadowed variable boxes-2.3.2/src/shape.c:372:34: note: Shadow argument Explanation: The `shadowVariable` warning on the `shape_name` argument is unchanged; only the 'Shadowed variable' note moved. Main pointed at the extern declaration in `shape.h:28`; the PR merges C file-scope redeclarations into one variable and keeps the definition, so the note now points at the definition in `shape.c:36`. Both locations name the same global object, so the warning is equally valid. The location shift does not materially matter to users. ---- 4 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/d/dreamchess/dreamchess_0.3.0.orig.tar.gz Result: main dreamchess-dreamchess-ebdc775/dreamer/src/move.c:347:35: style: Argument 'moves' shadows outer variable [shadowVariable] dreamchess-dreamchess-ebdc775/dreamer/src/move.h:64:15: note: Shadowed variable dreamchess-dreamchess-ebdc775/dreamer/src/move.c:347:35: note: Shadow argument Explanation: The global `moves` is declared `extern` in move.h:64 and defined in move.c:43. The PR merges C file-scope redeclarations into one variable and keeps the definition as the canonical declaration. So the same true-positive shadowVariable warning for the parameter `moves` is still reported. Only the 'Shadowed variable' note changed: it now points to the definition in move.c instead of the extern declaration in move.h. Both locations name the same object, so this hardly matters to users. ---- 5 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/d/dreamchess/dreamchess_0.3.0.orig.tar.gz Result: your dreamchess-dreamchess-ebdc775/dreamer/src/move.c:347:35: style: Argument 'moves' shadows outer variable [shadowVariable] dreamchess-dreamchess-ebdc775/dreamer/src/move.c:43:8: note: Shadowed variable dreamchess-dreamchess-ebdc775/dreamer/src/move.c:347:35: note: Shadow argument Explanation: The shadowVariable warning is reported in both versions at the same place: parameter 'moves' in free_moves_ray shadows the global 'moves' array, so it is a true positive either way. The only difference is the 'Shadowed variable' note. Main pointed at the extern declaration in move.h:64. With the PR, C redeclarations are merged into one Variable that keeps the defining declaration, so the note now points at the definition in move.c:43. Both locations are valid for the same object, and the finding itself does not change. At most the note is slightly more convenient because it is in the same file. ---- 6 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/d/dreamchess/dreamchess_0.3.0.orig.tar.gz Result: your dreamchess-dreamchess-ebdc775/dreamer/src/move.c:363:37: style: Argument 'moves' shadows outer variable [shadowVariable] dreamchess-dreamchess-ebdc775/dreamer/src/move.c:43:8: note: Shadowed variable dreamchess-dreamchess-ebdc775/dreamer/src/move.c:363:37: note: Shadow argument Explanation: The warning itself did not change. The parameter `moves` of `free_moves_single` really does shadow the global `moves` array. Only the 'Shadowed variable' note moved. Main pointed to the extern declaration in move.h:64, while the PR points to the definition in move.c:43. This is because the PR merges C file-scope redeclarations into one Variable and keeps the definition as its name token. Both locations identify the same object, so the report stays a true positive and is equally correct either way. ---- 7 / 50 ---- Verdict: NEUTRAL (low confidence) Package: https://ftp.debian.org/debian/pool/main/d/dvi2ps/dvi2ps_5.1j.orig.tar.gz Result: main dvi2ps-5.1j/funcfont.c:37:26: style: Local variable 'falseop' shadows outer variable [shadowVariable] dvi2ps-5.1j/funcfont.c:127:5: note: Shadowed variable dvi2ps-5.1j/funcfont.c:37:26: note: Shadow local variable Explanation: Line 37 is a block-scope `extern struct fontop falseop;`. That names the same global object, so it does not really shadow anything. The shadowVariable warning is a false positive both before and after the PR. The PR now merges the C file-scope redeclarations of `falseop` into one variable. As a result, the 'Shadowed variable' note moves from line 127 to line 159, which is probably the actual definition. That location is arguably more accurate, but the warning stays and remains wrong, so nothing meaningful changes for users. ---- 8 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/d/dvi2ps/dvi2ps_5.1j.orig.tar.gz Result: your dvi2ps-5.1j/funcfont.c:37:26: style: Local variable 'falseop' shadows outer variable [shadowVariable] dvi2ps-5.1j/funcfont.c:159:15: note: Shadowed variable dvi2ps-5.1j/funcfont.c:37:26: note: Shadow local variable Explanation: Line 37 is a block-scope `extern struct fontop falseop;`. It names the same file-scope object as the global declarations later in the file, so it does not really shadow anything. The warning is a false positive both before and after the PR. The PR merges the C file-scope redeclarations and keeps the initialized definition, so the 'Shadowed variable' note now points at line 159 instead of line 127. The warning itself is unchanged and still wrong, so this does not matter to users. ---- 9 / 50 ---- Verdict: UNCLEAR (low confidence) Package: https://ftp.debian.org/debian/pool/main/k/kylin-wayland-compositor/kylin-wayland-compositor_1.3.2.orig.tar.xz Result: your kylin-wayland-compositor-1.3.2/src/output/output_p.h:132:48: style: Argument 'output_manager' shadows outer variable [shadowVariable] kylin-wayland-compositor-1.3.2/src/output/output.c:25:24: note: Shadowed variable kylin-wayland-compositor-1.3.2/src/output/output_p.h:132:48: note: Shadow argument Explanation: The new warning flags the parameter `output_manager` of an inline stub in output_p.h as shadowing a global defined at output.c:25. That header is presumably included near the top of output.c, so the global's definition comes after the function. In C, the parameter only truly shadows the global if an earlier declaration (e.g. an `extern` in some header) is visible at that point. The PR merges C global redeclarations into one variable, which suggests `output_manager` has several declarations, but none of them are shown. It is also not clear why main did not report the same warning. Without the declarations of `output_manager` it cannot be decided whether this is a real shadow or a false positive. ---- 10 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/m/mairix/mairix_0.24.orig.tar.xz Result: main mairix-0.24/dfasyn/dfasyn.c:481:16: style: Local variable 'prefix' shadows outer variable [shadowVariable] mairix-0.24/dfasyn/dfasyn.h:55:14: note: Shadowed variable mairix-0.24/dfasyn/dfasyn.c:481:16: note: Shadow local variable Explanation: Line 481 is `extern char *prefix;` inside `main`. This block-scope extern declaration refers to the same global object, so it does not shadow anything. The shadowVariable warning is a false positive both before and after the PR. The PR now merges the header's `extern char *prefix;` (dfasyn.h:55) with the definition in dfasyn.c:33, so the 'Shadowed variable' note moves from the header declaration to the definition. The warning is neither fixed nor made worse; only the note location changes, so users see no real difference. ---- 11 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/m/mairix/mairix_0.24.orig.tar.xz Result: main mairix-0.24/dfasyn/dfasyn.c:57:16: style: Local variable 'prefix' shadows outer variable [shadowVariable] mairix-0.24/dfasyn/dfasyn.h:55:14: note: Shadowed variable mairix-0.24/dfasyn/dfasyn.c:57:16: note: Shadow local variable Explanation: Line 57 is a block-scope `extern char *prefix;`. It names the same global object defined at dfasyn.c:33 and declared extern in dfasyn.h:55, so it does not really shadow anything. The shadowVariable warning is a false positive both before and after the PR. The PR now merges the C file-scope redeclarations into one variable, so the only change is that the 'Shadowed variable' note points to the definition at dfasyn.c:33 instead of the header declaration. The warning stays, and both note locations refer to the same object, so users see no meaningful difference. ---- 12 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/m/mairix/mairix_0.24.orig.tar.xz Result: your mairix-0.24/dfasyn/dfasyn.c:57:16: style: Local variable 'prefix' shadows outer variable [shadowVariable] mairix-0.24/dfasyn/dfasyn.c:33:7: note: Shadowed variable mairix-0.24/dfasyn/dfasyn.c:57:16: note: Shadow local variable Explanation: Line 57 is `extern char *prefix;` inside a function. That block-scope extern declaration refers to the same global object defined at line 33, so it does not shadow anything. The shadowVariable warning is a false positive both before and after the PR. The PR merges the C file-scope redeclarations (the extern in dfasyn.h and the definition in dfasyn.c), so the note now points at the definition instead of the header declaration. The false positive is neither fixed nor made worse; only the note location moved, which makes no practical difference to users. ---- 13 / 50 ---- Verdict: REGRESSION (low confidence) Package: https://ftp.debian.org/debian/pool/main/m/mdadm/mdadm_4.6.orig.tar.xz Result: main mdadm-4.6/super-gpt.c:53:14: style: Local variable 'gpt' shadows outer variable [shadowVariable] mdadm-4.6/mdadm.h:1325:32: note: Shadowed variable mdadm-4.6/super-gpt.c:53:14: note: Shadow local variable Explanation: The warning itself is unchanged. `examine_gpt` declares a local `struct GPT *gpt`, which really does shadow the global `gpt`. That global is declared `extern` in mdadm.h:1325 and is most likely defined at super-gpt.c:214 (the `struct superswitch gpt` object). The PR merges the C redeclarations into one variable and keeps the definition as its name token. As a result, the 'Shadowed variable' note now points to line 214 instead of the header declaration. Line 214 comes after the shadowing local at line 53. At line 53 the only visible declaration of the global is the extern in mdadm.h, so pointing to a later line is somewhat confusing. The note is arguably less precise, but the finding is still valid, so the impact is minor. ---- 14 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/m/mdadm/mdadm_4.6.orig.tar.xz Result: your mdadm-4.6/super-gpt.c:147:14: style: Local variable 'gpt' shadows outer variable [shadowVariable] mdadm-4.6/super-gpt.c:214:20: note: Shadowed variable mdadm-4.6/super-gpt.c:147:14: note: Shadow local variable Explanation: The local `gpt` in store_gpt really does shadow the global `struct superswitch gpt`, so the warning stays a true positive. The PR merges C file-scope redeclarations into one Variable and keeps the definition as its main declaration. As a result, the 'Shadowed variable' note now points to the definition at super-gpt.c:214 instead of the extern declaration at mdadm.h:1325. Both lines declare the same object. The header extern is the declaration visible at line 147, while the definition sits in the same file and is arguably easier to find. Neither location is clearly better, so the change does not matter to users. ---- 15 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/m/mdadm/mdadm_4.6.orig.tar.xz Result: your mdadm-4.6/super-gpt.c:53:14: style: Local variable 'gpt' shadows outer variable [shadowVariable] mdadm-4.6/super-gpt.c:214:20: note: Shadowed variable mdadm-4.6/super-gpt.c:53:14: note: Shadow local variable Explanation: The local `struct GPT *gpt` in examine_gpt does shadow the file-scope `gpt` object. That object is declared `extern` in mdadm.h:1325 and defined in super-gpt.c:214. The PR merges C redeclarations into one variable and keeps the defining declaration, so the 'Shadowed variable' note now points to the definition at line 214 instead of the extern declaration in the header. The warning itself is unchanged and still correct, and both notes name the same object. Pointing at the definition is reasonable, though it now cites a line after the shadowing local, while the declaration actually visible at line 53 is the header's. For users the difference is cosmetic. ---- 16 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/n/navit/navit_0.5.6+dfsg.1.orig.tar.xz Result: main navit-0.5.6/navit/support/espeak/voices.c:1242:127: style: Argument 'voice' shadows outer variable [shadowVariable] navit-0.5.6/navit/support/espeak/voice.h:75:17: note: Shadowed variable navit-0.5.6/navit/support/espeak/voices.c:1242:127: note: Shadow argument Explanation: The global 'voice' is declared 'extern' in voice.h:75 and defined in voices.c:195. The PR merges C file-scope redeclarations into one variable and keeps the definition as the primary declaration. The parameter 'voice' at line 1242 still shadows the global. Main's version of this warning pointed the 'Shadowed variable' note at the extern declaration in the header. The replacement warning points it at the actual definition in voices.c:195. The warning itself stays, and its location is arguably more accurate, matching the PR's intended testother change. The text-only change is a small improvement or at worst neutral. ---- 17 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/n/navit/navit_0.5.6+dfsg.1.orig.tar.xz Result: your navit-0.5.6/navit/support/espeak/synthesize.c:1334:28: style: Argument 'phoneme_list' shadows outer variable [shadowVariable] navit-0.5.6/navit/support/espeak/synthesize.c:43:14: note: Shadowed variable navit-0.5.6/navit/support/espeak/synthesize.c:1334:28: note: Shadow argument Explanation: The warning itself is unchanged: the parameter `phoneme_list` of `Generate()` shadows the file-scope global `phoneme_list`, and that is still correctly reported. The only difference is the 'Shadowed variable' note. Main pointed to the `extern` declaration in synthesize.h:445; the PR points to the definition in synthesize.c:43. This follows from the PR merging C redeclarations into one Variable that keeps the definition, as the updated testother expectation shows. Both locations name the same object, so the change makes little practical difference to users, though the definition is arguably slightly more useful. ---- 18 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/n/navit/navit_0.5.6+dfsg.1.orig.tar.xz Result: your navit-0.5.6/navit/support/espeak/voices.c:238:36: style: Argument 'voice' shadows outer variable [shadowVariable] navit-0.5.6/navit/support/espeak/voices.c:195:10: note: Shadowed variable navit-0.5.6/navit/support/espeak/voices.c:238:36: note: Shadow argument Explanation: Both versions report the same warning: the parameter 'voice' in SetToneAdjust shadows the global 'voice'. That is a valid style finding either way. Only the 'Shadowed variable' note moved. Main pointed at the extern declaration in voice.h:75. The PR merges C file-scope redeclarations into one Variable whose nameToken is the definition, so the note now points at voices.c:195:10 (`voice_t *voice;`). Both locations correctly identify the same global object. The definition in the same file is arguably slightly more useful, but users see no real difference. ---- 19 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/n/netgen-lvs/netgen-lvs_1.5.133.orig.tar.gz Result: main netgen-1.5.133/base/place.c:249:19: style: Argument 'outfile' shadows outer variable [shadowVariable] netgen-1.5.133/base/embed.h:137:14: note: Shadowed variable netgen-1.5.133/base/place.c:249:19: note: Shadow argument Explanation: The argument 'outfile' in PrintC really does shadow the global 'outfile', so this is a true positive in both versions. The PR merges C file-scope redeclarations into one variable. As a result, the 'Shadowed variable' note now points to the definition in place.c:99 ('FILE *outfile;') instead of the extern declaration in embed.h:137. Both lines name the same object and the warning itself is unchanged. Only the note location moved, between two equally valid spots, so this pair of lines does not matter much to users. ---- 20 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/n/netgen-lvs/netgen-lvs_1.5.133.orig.tar.gz Result: main netgen-1.5.133/base/place.c:277:27: style: Argument 'outfile' shadows outer variable [shadowVariable] netgen-1.5.133/base/embed.h:137:14: note: Shadowed variable netgen-1.5.133/base/place.c:277:27: note: Shadow argument Explanation: The shadowVariable warning for argument 'outfile' at place.c:277 is still reported. Only the 'Shadowed variable' note changed. Before, it pointed to the extern declaration in embed.h:137. Now it points to the definition at place.c:99, because the PR merges C file-scope redeclarations into one variable and keeps the definition. Both locations name the same global object, so the warning is equally valid. The new location is a different but not clearly better or worse reference, so this does not matter to users. ---- 21 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/n/netgen-lvs/netgen-lvs_1.5.133.orig.tar.gz Result: your netgen-1.5.133/base/place.c:263:23: style: Argument 'outfile' shadows outer variable [shadowVariable] netgen-1.5.133/base/place.c:99:7: note: Shadowed variable netgen-1.5.133/base/place.c:263:23: note: Shadow argument Explanation: The global 'outfile' has two declarations: an extern declaration in embed.h:137 and the definition at place.c:99. The PR merges C file-scope redeclarations into one variable and keeps the definition as the canonical declaration. So the 'Shadowed variable' note now points to the actual definition in place.c instead of the extern declaration in the header. The warning itself is still valid, because the parameter 'outfile' does shadow the global. Only the location shown in the note changed. Pointing at the definition is arguably more accurate, though both locations are legitimate declarations, so the benefit is small. ---- 22 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/p/postgresql-15/postgresql-15_15.18.orig.tar.bz2 Result: main postgresql-15.18/src/bin/pg_basebackup/streamutil.c:578:31: style: Argument 'conn' shadows outer variable [shadowVariable] postgresql-15.18/src/bin/pg_basebackup/streamutil.h:30:16: note: Shadowed variable postgresql-15.18/src/bin/pg_basebackup/streamutil.c:578:31: note: Shadow argument Explanation: The global `conn` is declared `extern` in streamutil.h:30 and defined in streamutil.c:54. With the PR, both declarations are merged into one Variable that keeps the definition token. So the shadowVariable note now points to the definition at streamutil.c:54 instead of the extern declaration in the header. The warning itself is unchanged: argument `conn` really does shadow the global `conn`. Only the location of the note moved. Pointing at the definition is arguably slightly better, but either location is valid, so the change hardly matters to users. ---- 23 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/p/postgresql-15/postgresql-15_15.18.orig.tar.bz2 Result: your postgresql-15.18/src/bin/pg_basebackup/streamutil.c:271:28: style: Argument 'conn' shadows outer variable [shadowVariable] postgresql-15.18/src/bin/pg_basebackup/streamutil.c:54:12: note: Shadowed variable postgresql-15.18/src/bin/pg_basebackup/streamutil.c:271:28: note: Shadow argument Explanation: The warning is unchanged. Only the 'Shadowed variable' note moved. `conn` is declared `extern PGconn *conn;` in streamutil.h:30 and defined `PGconn *conn = NULL;` at streamutil.c:54. The PR merges these C file-scope redeclarations into one variable and keeps the initialized definition as its canonical name token. The argument `conn` at line 271 really does shadow that global, so the warning stays a true positive. Both the old and new note locations point to a valid declaration of the same object, so users see no practical difference. ---- 24 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/p/postgresql-15/postgresql-15_15.18.orig.tar.bz2 Result: your postgresql-15.18/src/bin/pg_basebackup/streamutil.c:349:35: style: Argument 'conn' shadows outer variable [shadowVariable] postgresql-15.18/src/bin/pg_basebackup/streamutil.c:54:12: note: Shadowed variable postgresql-15.18/src/bin/pg_basebackup/streamutil.c:349:35: note: Shadow argument Explanation: The warning is unchanged: the parameter 'conn' of RetrieveDataDirCreatePerm still shadows the global 'conn'. Only the 'Shadowed variable' note moved. Before, it pointed to the extern declaration in streamutil.h:30. Now it points to the definition in streamutil.c:54. The PR merges C file-scope redeclarations into one variable and keeps the definition as the canonical declaration. Both locations name the same object, so the warning is equally correct either way. Pointing at the definition in the same file may be slightly handier, but the effect on users is negligible. ---- 25 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/p/postgresql-15/postgresql-15_15.18.orig.tar.bz2 Result: your postgresql-15.18/src/bin/pg_basebackup/streamutil.c:403:27: style: Argument 'conn' shadows outer variable [shadowVariable] postgresql-15.18/src/bin/pg_basebackup/streamutil.c:54:12: note: Shadowed variable postgresql-15.18/src/bin/pg_basebackup/streamutil.c:403:27: note: Shadow argument Explanation: The function parameter `conn` at line 403 really does shadow the global `PGconn *conn`, so the warning is a true positive both before and after the PR. The only difference is the 'Shadowed variable' note. Main pointed to the `extern PGconn *conn;` declaration in streamutil.h:30. The PR merges C file-scope redeclarations into one variable and keeps the initialized definition, so the note now points to the definition in streamutil.c:54. Both locations name the same object, so the warning is equally valid either way. Pointing at the definition is arguably slightly nicer, but users are not materially affected. ---- 26 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/p/postgresql-15/postgresql-15_15.18.orig.tar.bz2 Result: your postgresql-15.18/src/bin/pg_basebackup/streamutil.c:484:28: style: Argument 'conn' shadows outer variable [shadowVariable] postgresql-15.18/src/bin/pg_basebackup/streamutil.c:54:12: note: Shadowed variable postgresql-15.18/src/bin/pg_basebackup/streamutil.c:484:28: note: Shadow argument Explanation: The parameter `conn` of `GetSlotInformation` shadows the global `PGconn *conn`. That global is declared `extern` in streamutil.h:30 and defined at streamutil.c:54. The PR now merges C file-scope redeclarations into one Variable that keeps the defining declaration. As a result, the 'Shadowed variable' note moves from the header's extern declaration to the definition in the .c file. The warning itself is unchanged and still correct. Both locations name the same object, so this is only a cosmetic change of the note location, arguably slightly more useful but not materially different for users. ---- 27 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/p/postgresql-15/postgresql-15_15.18.orig.tar.bz2 Result: your postgresql-15.18/src/bin/pg_basebackup/streamutil.c:578:31: style: Argument 'conn' shadows outer variable [shadowVariable] postgresql-15.18/src/bin/pg_basebackup/streamutil.c:54:12: note: Shadowed variable postgresql-15.18/src/bin/pg_basebackup/streamutil.c:578:31: note: Shadow argument Explanation: The global 'conn' is declared `extern PGconn *conn;` in streamutil.h:30 and defined in streamutil.c:54. The PR merges these C redeclarations into one variable and keeps the definition as the canonical declaration. The warning itself is unchanged and still correct: the parameter 'conn' shadows the global. Only the 'Shadowed variable' note moved, from the extern declaration in the header to the actual definition. Pointing at the definition is arguably more accurate, which matches the PR's intent and its updated test in testother.cpp. ---- 28 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/p/postgresql-15/postgresql-15_15.18.orig.tar.bz2 Result: your postgresql-15.18/src/bin/pg_basebackup/streamutil.c:686:29: style: Argument 'conn' shadows outer variable [shadowVariable] postgresql-15.18/src/bin/pg_basebackup/streamutil.c:54:12: note: Shadowed variable postgresql-15.18/src/bin/pg_basebackup/streamutil.c:686:29: note: Shadow argument Explanation: The warning itself is unchanged: the parameter 'conn' of DropReplicationSlot does shadow the global 'conn'. Only the location in the 'Shadowed variable' note changed. Main pointed to the extern declaration in streamutil.h:30. The PR merges C file-scope redeclarations into one Variable whose name token is the definition, so the note now points to `PGconn *conn = NULL;` at streamutil.c:54. Both locations name the same object and both are visible in this file, so the report is equally correct. It is a cosmetic location change, not a gained or lost finding. ---- 29 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/r/r-base/r-base_4.6.1.orig.tar.xz Result: main R-4.6.1/src/gnuwin32/console.c:327:14: style: Argument 'guiColors' shadows outer variable [shadowVariable] R-4.6.1/src/gnuwin32/guicolors.h:35:12: note: Shadowed variable R-4.6.1/src/gnuwin32/console.c:327:14: note: Shadow argument Explanation: The shadowVariable warning is still reported, so the true positive stays. The parameter 'guiColors' at console.c:327 really does shadow the global 'guiColors'. Only the 'Shadowed variable' note moved. With this PR, the C file-scope redeclarations (the extern declaration in guicolors.h:35 and the definition at console.c:315) are merged into one variable, and the kept location is the initialized definition. Both locations name the same object, but the definition in the same file is a slightly more useful reference. This matches the intended test change in testother.cpp, so the change is mildly positive at worst neutral. ---- 30 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/r/r-base/r-base_4.6.1.orig.tar.xz Result: your R-4.6.1/src/gnuwin32/console.c:327:14: style: Argument 'guiColors' shadows outer variable [shadowVariable] R-4.6.1/src/gnuwin32/console.c:315:5: note: Shadowed variable R-4.6.1/src/gnuwin32/console.c:327:14: note: Shadow argument Explanation: The global 'guiColors' is declared 'extern' in guicolors.h:35 and defined at console.c:315. The PR merges the C file-scope redeclarations into one variable and keeps the definition as the canonical declaration. The argument at line 327 does shadow that global, so the warning is still valid. The 'Shadowed variable' note now points to the actual definition in console.c instead of the extern declaration in the header. This matches the intended change in testother.cpp, where the note moved to the definition. Pointing at the definition, which is also in the same file as the shadowing argument, is arguably more useful. ---- 31 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/s/seaview/seaview_5.1+20251106.orig.tar.gz Result: main seaview/csrc/seq.c:3907:22: style: Argument 'nonodes' shadows outer variable [shadowVariable] seaview/csrc/seq.h:82:13: note: Shadowed variable seaview/csrc/seq.c:3907:22: note: Shadow argument Explanation: The global 'nonodes' is declared extern in seq.h:82 and defined in seq.c:34, so both lines name the same object. The PR merges C redeclarations into one variable and keeps the definition as the canonical declaration. The shadowVariable warning for the parameter at 3907 is still reported (the matching 'your' line exists). Only the 'Shadowed variable' note changed: it now points to the definition in seq.c:34 instead of the extern declaration in the header. Both locations are valid. The definition is arguably the more natural target, and the PR's test update shows this change is intended, so this is a small improvement in message accuracy. ---- 32 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/s/seaview/seaview_5.1+20251106.orig.tar.gz Result: main seaview/csrc/seq.c:426:47: style: Argument 'weight' shadows outer variable [shadowVariable] seaview/csrc/seq.h:85:15: note: Shadowed variable seaview/csrc/seq.c:426:47: note: Shadow argument Explanation: The warning itself is unchanged. Only the location of the shadowed variable moved. Before the PR it pointed to the extern declaration in seq.h:85. Now it points to the definition in seq.c:36, because C redeclarations are merged into one variable and the definition is kept. The main line removed here is replaced by a matching your line for the same argument 'weight'. Pointing at the actual definition in the same file is at least as accurate, and slightly better. The change is mostly cosmetic, so this is a minor improvement. ---- 33 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/s/seaview/seaview_5.1+20251106.orig.tar.gz Result: main seaview/csrc/seq.c:472:34: style: Argument 'weight' shadows outer variable [shadowVariable] seaview/csrc/seq.h:85:15: note: Shadowed variable seaview/csrc/seq.c:472:34: note: Shadow argument Explanation: In seq.h:85 `weight` is declared `extern`, and seq.c:36 defines it. The PR merges the two C file-scope declarations into one variable and keeps the definition as the canonical declaration. The shadowVariable warning for the `weight` parameter is still reported (the matching 'your' line exists), but its 'Shadowed variable' note now points to the definition at seq.c:36:8 instead of the extern declaration in seq.h. The warning itself stays correct and only the location changes. Pointing to the definition is arguably more accurate, matching the updated testother expectation in the PR. This is a minor message-location change, not a lost true positive. ---- 34 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/s/seaview/seaview_5.1+20251106.orig.tar.gz Result: your seaview/csrc/phylip.c:1159:28: style: Argument 'spp' shadows outer variable [shadowVariable] seaview/csrc/phylip.c:62:6: note: Shadowed variable seaview/csrc/phylip.c:1159:28: note: Shadow argument Explanation: The warning is unchanged: parameter 'spp' in inputnumbersold() does shadow the global 'spp'. Only the 'Shadowed variable' note moved. It used to point at the extern declaration in phylip.h:362. It now points at the definition in phylip.c:62. This happens because the PR merges C file-scope redeclarations into one Variable and keeps the definition as the canonical declaration. Both locations name the same object, so the change makes no real difference to users. ---- 35 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/s/seaview/seaview_5.1+20251106.orig.tar.gz Result: your seaview/csrc/phylip.c:2375:74: style: Argument 'spp' shadows outer variable [shadowVariable] seaview/csrc/phylip.c:62:6: note: Shadowed variable seaview/csrc/phylip.c:2375:74: note: Shadow argument Explanation: The function parameter 'spp' really does shadow the global 'spp', so the warning is still a valid style finding. The only change is the 'Shadowed variable' note. It now points to the definition in phylip.c:62 instead of the extern declaration in phylip.h:362. The PR merges C file-scope redeclarations into one variable, which is why the location moved. Both locations name the same object, so users see the same warning with an equally valid reference location. ---- 36 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/s/seaview/seaview_5.1+20251106.orig.tar.gz Result: your seaview/csrc/seq.c:2300:43: style: Argument 'nextree' shadows outer variable [shadowVariable] seaview/csrc/seq.c:34:33: note: Shadowed variable seaview/csrc/seq.c:2300:43: note: Shadow argument Explanation: Only the 'Shadowed variable' note location changed. Before, it pointed at the extern declaration in seq.h:82. Now it points at the definition in seq.c:34. The PR merges C file-scope redeclarations into one variable and keeps the definition as the canonical declaration. The warning itself is unchanged and still correct: the parameter 'nextree' shadows the global 'nextree'. Pointing at the actual definition in the same file is at least as accurate, and arguably more so. The PR also updates the corresponding testother expectation in the same way. ---- 37 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/s/seaview/seaview_5.1+20251106.orig.tar.gz Result: your seaview/csrc/seq.c:3411:35: style: Argument 'nonodes' shadows outer variable [shadowVariable] seaview/csrc/seq.c:34:6: note: Shadowed variable seaview/csrc/seq.c:3411:35: note: Shadow argument Explanation: With the PR, C file-scope declarations of a global are merged into one variable. The kept location is the definition, or a tentative definition in preference to an extern declaration. seq.h:82 is most likely the `extern long nonodes, endsite, ...` declaration, and seq.c:34 is the actual definition `long nonodes, endsite, ...`. The shadowVariable warning itself is unchanged and still correct: the argument 'nonodes' does shadow the global. Only the 'Shadowed variable' note now points to the definition instead of the extern declaration in the header. This matches the updated testother expectation, so the message is slightly more accurate. ---- 38 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/s/seaview/seaview_5.1+20251106.orig.tar.gz Result: your seaview/csrc/seq.c:64:47: style: Argument 'endsite' shadows outer variable [shadowVariable] seaview/csrc/seq.c:34:15: note: Shadowed variable seaview/csrc/seq.c:64:47: note: Shadow argument Explanation: Both versions report the same warning: the parameter 'endsite' in alloctemp shadows the global 'endsite'. Only the 'Shadowed variable' note moved. Main pointed at the extern declaration in seq.h:82. The PR merges C file-scope redeclarations into one variable and keeps the definition, so the note now points at the definition in seq.c:34. Both locations declare the same object, so the warning is equally correct and equally useful either way. ---- 39 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/s/skycat/skycat_3.1.2+starlink1~b+dfsg.orig.tar.gz Result: main skycat-3.1.2-starlink-1b/astrotcl/press/gzip.c:106:10: style: Argument 'char_in' shadows outer variable [shadowVariable] skycat-3.1.2-starlink-1b/astrotcl/press/gzip.h:125:12: note: Shadowed variable skycat-3.1.2-starlink-1b/astrotcl/press/gzip.c:106:10: note: Shadow argument Explanation: The shadowVariable warning on gzip.c:106 is still reported. Only its 'Shadowed variable' note moved. Main pointed at the `extern` declaration of `char_in` in gzip.h:125. The PR merges C file-scope redeclarations into one variable, so the note now points at the definition `pfi char_in;` in gzip.c:77. Both lines name the same global object, and both are visible before the parameter that shadows it. The warning is a true positive either way, and the new location is just as valid, so this changes nothing meaningful for users. ---- 40 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/s/skycat/skycat_3.1.2+starlink1~b+dfsg.orig.tar.gz Result: main skycat-3.1.2-starlink-1b/astrotcl/press/gzip.c:107:10: style: Argument 'char_out' shadows outer variable [shadowVariable] skycat-3.1.2-starlink-1b/astrotcl/press/gzip.h:126:12: note: Shadowed variable skycat-3.1.2-starlink-1b/astrotcl/press/gzip.c:107:10: note: Shadow argument Explanation: The parameter 'char_out' of gzip_comp really does shadow the global 'char_out', so the warning is a true positive in both versions. The global is declared extern in gzip.h:126 and defined in gzip.c:78. Main used the header's extern declaration as the 'Shadowed variable' note. With the PR, C file-scope redeclarations are merged into one variable, and the definition is kept as the canonical declaration, so the note now points to gzip.c:78. The warning itself is unchanged. Only the note location moved, to the actual definition in the same file, which is slightly more accurate and more useful. ---- 41 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/s/skycat/skycat_3.1.2+starlink1~b+dfsg.orig.tar.gz Result: your skycat-3.1.2-starlink-1b/astrotcl/press/gzip.c:106:10: style: Argument 'char_in' shadows outer variable [shadowVariable] skycat-3.1.2-starlink-1b/astrotcl/press/gzip.c:77:6: note: Shadowed variable skycat-3.1.2-starlink-1b/astrotcl/press/gzip.c:106:10: note: Shadow argument Explanation: The parameter `char_in` of `gzip_comp` really does shadow the global `char_in`, so the warning is a true positive both before and after. The only change is the 'Shadowed variable' note. Main pointed to the extern declaration in gzip.h:125. The PR merges C file-scope redeclarations into one variable, so the note now points to the definition at gzip.c:77. Both locations declare the same object and both are valid, so the warning is equally correct and useful either way. ---- 42 / 50 ---- Verdict: IMPROVEMENT (low confidence) Package: https://ftp.debian.org/debian/pool/main/s/skycat/skycat_3.1.2+starlink1~b+dfsg.orig.tar.gz Result: your skycat-3.1.2-starlink-1b/astrotcl/press/gzip.c:107:10: style: Argument 'char_out' shadows outer variable [shadowVariable] skycat-3.1.2-starlink-1b/astrotcl/press/gzip.c:78:6: note: Shadowed variable skycat-3.1.2-starlink-1b/astrotcl/press/gzip.c:107:10: note: Shadow argument Explanation: The parameter `char_out` in `gzip_comp` really does shadow the file-scope variable `char_out`, so the warning itself stays a true positive. The only change is the 'Shadowed variable' note. Main pointed at the `extern` declaration in gzip.h:126. The PR merges C file-scope redeclarations into one variable and keeps the actual definition, so the note now points at `pfi char_out;` in gzip.c:78. Both locations name the same object. Pointing at the real definition in the same file is slightly more precise, and it matches the intended behavior in the updated testother expectation. ---- 43 / 50 ---- Verdict: REGRESSION (low confidence) Package: https://ftp.debian.org/debian/pool/main/s/snek/snek_1.13.orig.tar.gz Result: your snek-1.13/snek.h:772:23: error: Array '_snek_mems[0]' accessed at index -1, which is out of bounds. [negativeIndex] Explanation: Line 772 forms `&_snek_mems[-1]` on purpose; the GCC pragma shows the authors know the compiler warns about it. Main did not warn because the header only declares `extern ... _snek_mems[]` with an unknown size. The PR merges this extern declaration with the real definition, so the warning now appears. Forming a pointer before the start of an array is technically undefined behaviour, so a negativeIndex warning is defensible in principle. However, the message calls the array `_snek_mems[0]`, a zero-length array, even though the real table has several entries. That points to a wrong merged or computed dimension (for example the definition's initializer size not being picked up), so Cppcheck misunderstands the array. The new finding comes from incorrect symbol information and has an inaccurate message, so it is more likely a regression than a real improvement. ---- 44 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/s/sympow/sympow_2.023.7.orig.tar.bz2 Result: main sympow-2.023.7/main.c:218:38: style: Local variable 'SLOPPY' shadows outer variable [shadowVariable] sympow-2.023.7/sympow.h:80:20: note: Shadowed variable sympow-2.023.7/main.c:218:38: note: Shadow local variable Explanation: The shadowVariable warning for the local 'SLOPPY' in main() is still reported; only its 'Shadowed variable' note moved. Main pointed at the declaration in sympow.h:80 (presumably an extern declaration). The PR merges C file-scope redeclarations into one variable, so the note now points at main.c:14, presumably the definition. Both locations name the same global object, so the warning is equally correct either way. This is a change of note location, not of accuracy. ---- 45 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/s/sympow/sympow_2.023.7.orig.tar.bz2 Result: your sympow-2.023.7/main.c:218:38: style: Local variable 'SLOPPY' shadows outer variable [shadowVariable] sympow-2.023.7/main.c:14:13: note: Shadowed variable sympow-2.023.7/main.c:218:38: note: Shadow local variable Explanation: The shadowVariable warning is still reported at main.c:218, and it is still correct: the local `SLOPPY` shadows the global `SLOPPY`. The only change is the location in the 'Shadowed variable' note. It moved from the declaration in sympow.h:80 (likely `extern`) to main.c:14 (likely the definition). The PR merges C file-scope redeclarations into one variable and keeps the defining declaration, so the note now points there. Both locations name the same object and either is a valid reference for the user, so the change does not matter much either way. ---- 46 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/u/unrtf/unrtf_0.21.13.orig.tar.gz Result: main unrtf-0.21.13/src/main.c:116:43: style: Argument 'op' shadows outer variable [shadowVariable] unrtf-0.21.13/src/main.h:54:27: note: Shadowed variable unrtf-0.21.13/src/main.c:116:43: note: Shadow argument Explanation: main.h:54 most likely holds `extern OutputPersonality *op;`, and main.c:106 holds the definition `OutputPersonality *op = NULL;`. The PR merges C file-scope redeclarations into one variable and keeps the initialized definition as its name token. So the shadowVariable warning is still reported, but the 'Shadowed variable' note now points at the actual definition in main.c:106 instead of the extern declaration in the header. This matches the updated testother expectation in the PR. The warning stays valid either way, and the location is arguably more useful because it is in the same file, so this is a minor improvement in message accuracy. ---- 47 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/u/unrtf/unrtf_0.21.13.orig.tar.gz Result: your unrtf-0.21.13/src/main.c:116:43: style: Argument 'op' shadows outer variable [shadowVariable] unrtf-0.21.13/src/main.c:106:20: note: Shadowed variable unrtf-0.21.13/src/main.c:116:43: note: Shadow argument Explanation: The parameter `op` of `get_config()` really does shadow the global `OutputPersonality *op`. That global is declared `extern` in main.h:54 and defined with an initializer at main.c:106. Both versions report the same true-positive warning; only the 'Shadowed variable' note moves. The PR merges C file-scope redeclarations into one variable and keeps the initialized definition, so the note now points to the actual definition in the same file instead of the extern declaration in the header. This is slightly more useful, and it matches the PR's intended behaviour (the updated testother expectation shows the same change). ---- 48 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/y/yorick/yorick_2.2.04+dfsg1.orig.tar.xz Result: main yorick-2.2.04+dfsg1/play/any/test2d.c:618:20: style: Argument 'scr' shadows outer variable [shadowVariable] yorick-2.2.04+dfsg1/play/any/test2d.c:102:15: note: Shadowed variable yorick-2.2.04+dfsg1/play/any/test2d.c:618:20: note: Shadow argument Explanation: The `shadowVariable` warning for argument `scr` at line 618 is still reported; only the 'Shadowed variable' note moved. It used to point to 102:15 and now points to 103:8. Those columns fit an `extern p_scr *scr;` declaration followed by a `p_scr *scr...;` definition, though lines 102-103 are not shown. The PR merges C file-scope redeclarations into one variable and keeps the definition as the canonical name token, as in the updated testother expectation. Both locations name the same global object, so the warning is still a true positive. Pointing to the definition rather than the extern declaration makes little difference to users. ---- 49 / 50 ---- Verdict: IMPROVEMENT (medium confidence) Package: https://ftp.debian.org/debian/pool/main/y/yorick/yorick_2.2.04+dfsg1.orig.tar.xz Result: main yorick-2.2.04+dfsg1/yorick/ydata.c:108:16: debug: valueFlowConditionExpressions bailout: Skipping function due to incomplete variable ops [valueFlowBailoutIncompleteVar] Explanation: The removed debug message names the incomplete variable `ops`. That is the member in `sp[-i].ops`, which previously had no varid. `sp` is a C global that is most likely declared `extern` in a header and declared again elsewhere. Before the PR, each redeclaration got its own varid and Variable, which plausibly left the member access unresolved. The PR merges C file-scope redeclarations into one object, so the type of `sp` and its member `ops` can now be resolved, and valueflow no longer skips the function. This is a bailout disappearing because Cppcheck understands the code better. The source does not show the declarations of `sp`, so the exact cause is inferred. ---- 50 / 50 ---- Verdict: NEUTRAL (medium confidence) Package: https://ftp.debian.org/debian/pool/main/y/yorick/yorick_2.2.04+dfsg1.orig.tar.xz Result: your yorick-2.2.04+dfsg1/play/any/test2d.c:618:20: style: Argument 'scr' shadows outer variable [shadowVariable] yorick-2.2.04+dfsg1/play/any/test2d.c:103:8: note: Shadowed variable yorick-2.2.04+dfsg1/play/any/test2d.c:618:20: note: Shadow argument Explanation: The warning is still the same true positive: parameter 'scr' at line 618 shadows the global 'scr'. Only the 'Shadowed variable' note moved, from 102:15 to 103:8. The column positions suggest line 102 is an extern declaration ('extern p_scr *scr;') and line 103 is the definition ('p_scr *scr;'). This is not shown in the excerpt. The PR merges C file-scope redeclarations into one variable and keeps the definition as the canonical name token, so the note now points at the definition. Both locations name the same object. Pointing at the definition is equally valid and perhaps slightly nicer, so this makes no real difference to users.