AI review of 2026-10-31_22-33-20-f74786318f63-results.txt
PR:          #8967 https://github.com/cppcheck-opensource/cppcheck/pull/8967
Tested:      f74786318f632549b7eaeea3037a3c6bafdc3bf4
Merge base:  ffe7e9be207e201c7b8d6ed5272b931889879a14
Reviewed:    2026-11-01 02:20:19 UTC
Model:       claude-opus-5-5 (effort high)
Results:     2 reviewed of 3 in the report, 1 not reviewed: valueFlowMaxIterations, the test is still running (100 analysed of 1000 requested packages)
Verdicts:    2 improvement
Tokens:      3321 input, 3075 cache read, 3075 cache write, 289 output

The verdicts are written by AI and can be wrong.

---- 1 / 2 ----
Verdict:     IMPROVEMENT (high confidence)
Package:     https://ftp.debian.org/debian/pool/main/j/john/john_1.9.0.orig.tar.xz
Result:      your john-1.9.0/src/loader.c:903:6: style: Condition '!hash' is always false [knownConditionTrueFalse]
     john-1.9.0/src/loader.c:902:14: note: Assignment 'hash=p[0]|0x20', assigned value is never 0
     john-1.9.0/src/loader.c:903:6: note: Condition '!hash' is always false
Explanation: On line 902, `hash = p[0] | 0x20` always has bit 0x20 set, so `hash` can never be 0. The check `!hash` on line 903 is therefore always false, and the `goto out` is dead code. The author probably meant to detect an empty string (p[0]==0), but OR-ing with 0x20 makes that impossible. This is a genuine logic bug, so the new warning is a true positive.

---- 2 / 2 ----
Verdict:     IMPROVEMENT (high confidence)
Package:     https://ftp.debian.org/debian/pool/main/j/john/john_1.9.0.orig.tar.xz
Result:      your john-1.9.0/src/loader.c:906:6: style: Condition '!extra' is always false [knownConditionTrueFalse]
     john-1.9.0/src/loader.c:905:15: note: Assignment 'extra=p[1]|0x20', assigned value is never 0
     john-1.9.0/src/loader.c:906:6: note: Condition '!extra' is always false
Explanation: `extra = p[1] | 0x20` always has bit 0x20 set, so it can never be 0 and `!extra` is always false. This is a true positive. It looks like an upstream bug: the author probably meant to test p[1] for the end of the string (NUL) before OR-ing. The new check reports it correctly.