Merge pull request #63 from douzzer/20231228-release-1v6v2

20231228-release-1v6v2
wolfSSL · Jan 2, 2024 · 88387fe · 88387fe
2 parents 4acb2d8 + a3a1531
commit 88387fe
Showing 14 changed files with 119 additions and 53 deletions.
diff --git a/ChangeLog.md b/ChangeLog.md
@@ -2,6 +2,31 @@
 
 <br>
 
+# wolfSentry Release 1.6.2 (December 29, 2023)
+
+Release 1.6.2 of the wolfSentry embedded firewall/IDPS has enhancements,
+additions, and improvements including:
+
+## Noteworthy Changes and Additions
+
+In scripts and Makefile, interpreters (`bash` and `awk`) now follow search `PATH`.  Explicit override paths to `bash` and `awk` can be supplied by passing values for `SHELL` and `AWK` to `make`.
+
+Change type of length argument to `wolfsentry_action_res_assoc_by_name()` to `int`, to allow it to accept `WOLFSENTRY_LENGTH_NULL_TERMINATED` (negative number).
+
+## Bug Fixes, Cleanups, and Debugging Aids
+
+In `handle_route_endpoint_clause()`, add casts to work around an implicit-promotion bug in gcc-7.5.
+
+Various fixes for benign `cppcheck` reports (`duplicateCondition`, `unsignedLessThanZero`, `unreadVariable`, `invalidPrintfArgType_uint`, `invalidPrintfArgType_sint`, `shadowFunction`, `constVariablePointer`, `preprocessorErrorDirective`).
+
+## Self-Test Enhancements
+
+Add `replace_rule_transactionally()`, now used in `test_static_routes()` for a thorough workout.
+
+Split cppcheck-analyze recipe into cppcheck-library, cppcheck-force-library, cppcheck-extras, and cppcheck-force-extras, with increased coverage.  Only cppcheck-library and cppcheck-extras are included in the "check-all" dependency list.
+
+<br>
+
 # wolfSentry Release 1.6.1 (November 18, 2023)
 
 Release 1.6.1 of the wolfSentry embedded firewall/IDPS has enhancements,

diff --git a/Makefile.analyzers b/Makefile.analyzers
@@ -231,24 +231,62 @@ clang-tidy-build-test:
 	 CLANG=clang CLANG_TIDY=clang-tidy CLANG_TIDY_EXTRA_ARGS='--use-color=1' $(MAKE) $(EXTRA_MAKE_FLAGS) $(QUIET_FLAG) -f $(THIS_MAKEFILE) VERY_QUIET=1 BUILD_TOP="$(BUILD_PARENT)/wolfsentry-clang-tidy-builds" CC="$(REPO_ROOT)/../testing/git-hooks/clang-tidy-builder.sh" clean && \
 	 echo 'passed: $@.'
 
-.PHONY: cppcheck-analyze
-cppcheck-analyze:
+CPPCHECK := cppcheck
+
+CPPCHECK_COMMON_ARGS = --error-exitcode=2 --inline-suppr -j $$(($$(nproc) / 2)) $(QUIET_FLAG) --std=c99 -D__STDC__ -D__STDC_VERSION__=199901L -U__STRICT_ANSI__ -UFP_NAN -UFP_INFINITE -UFP_ZERO -UFP_SUBNORMAL -UFP_NORMAL -USIZE_T_32 -DWOLFSENTRY_CPPCHECK --suppress=legacyUninitvar --suppress=constParameterPointer  --suppress=constParameterCallback --suppress=unusedStructMember --suppress=variableScope --suppress=knownConditionTrueFalse --suppress=knownArgument --suppress=syntaxError:/usr/\* --suppress=unknownMacro:/usr/\* -I. -I/usr/include -I"$(shell $(CC) -print-file-name=include)" -I"$(LWIP_TOP_FOR_TEST)/src/include" -I"$(SRC_TOP)/ports/Linux-lwIP/include" -UWOLFSENTRY_SEMAPHORE_INCLUDE -UWOLFSENTRY_THREAD_INCLUDE
+
+.PHONY: cppcheck-library
+cppcheck-library:
+	@[ -r "$(REPO_ROOT)/scripts/analyzer-config.sh" ] || { echo "analyzer-config.sh not found -- skipping $@."; exit 0; }; \
+	 command -v cppcheck 1>/dev/null || { echo 'cppcheck not found -- skipping $@.'; exit 0; }; \
+	 $(MAKE) $(EXTRA_MAKE_FLAGS) $(QUIET_FLAG) -f $(THIS_MAKEFILE) VERY_QUIET=1 BUILD_TOP="$(BUILD_PARENT)/wolfsentry-cppcheck-library-builds" clean; \
+	 . $(REPO_ROOT)/scripts/analyzer-config.sh && \
+	 $(MAKE) $(EXTRA_MAKE_FLAGS) $(QUIET_FLAG) -f $(THIS_MAKEFILE) VERY_QUIET=1 BUILD_TOP="$(BUILD_PARENT)/wolfsentry-cppcheck-library-builds" "$(BUILD_PARENT)/wolfsentry-cppcheck-library-builds/wolfsentry/wolfsentry_options.h" && \
+	 cd "$(SRC_TOP)" && \
+	 $(CPPCHECK) --enable=warning,portability,performance,missingInclude,style $(CPPCHECK_COMMON_ARGS) -I"$(BUILD_PARENT)/wolfsentry-cppcheck-library-builds" -UWOLFSENTRY_LOCK_SHARED_ERROR_CHECKING -DBUILDING_LIBWOLFSENTRY -UWOLFSENTRY_USER_SETTINGS_FILE -D__linux__ -D__GNUC__ -UWOLFSENTRY_SINGLETHREADED -DWOLFSENTRY_THREADSAFE -UWOLFSENTRY_NO_ALLOCA --include="$(BUILD_PARENT)/wolfsentry-cppcheck-library-builds/wolfsentry/wolfsentry_options.h" --include=wolfsentry/wolfsentry_settings.h --include=wolfsentry/wolfsentry_util.h --include=wolfsentry/wolfsentry_errcodes.h --include=wolfsentry/wolfsentry_af.h --include=wolfsentry/wolfsentry.h $(CPPCHECK_EXTRA_ARGS) $(addprefix $(SRC_TOP)/src/,$(SRCS)) && \
+	 $(MAKE) $(EXTRA_MAKE_FLAGS) $(QUIET_FLAG) -f $(THIS_MAKEFILE) VERY_QUIET=1 BUILD_TOP="$(BUILD_PARENT)/wolfsentry-cppcheck-library-builds" clean && \
+	 echo 'passed: $@.'
+
+#force --suppress=preprocessorErrorDirective
+#force  -D__linux__ -UFREERTOS -UWOLFSENTRY_SINGLETHREADED -DWOLFSENTRY_THREADSAFE -DWOLFSENTRY_NO_ALLOCA
+
+.PHONY: cppcheck-force-library
+cppcheck-force-library:
+	@[ -r "$(REPO_ROOT)/scripts/analyzer-config.sh" ] || { echo "analyzer-config.sh not found -- skipping $@."; exit 0; }; \
+	 command -v cppcheck 1>/dev/null || { echo 'cppcheck not found -- skipping $@.'; exit 0; }; \
+	 . $(REPO_ROOT)/scripts/analyzer-config.sh && \
+	 cd "$(SRC_TOP)" && \
+	 $(CPPCHECK) --enable=warning,portability,performance,missingInclude,style --force --suppress=missingIncludeSystem $(CPPCHECK_COMMON_ARGS) -D'__attribute__(x)=' -D__GNUC__ --include=wolfsentry/wolfsentry_settings.h --include=wolfsentry/wolfsentry_util.h --include=wolfsentry/wolfsentry_errcodes.h --include=wolfsentry/wolfsentry_af.h --include=wolfsentry/wolfsentry.h $(CPPCHECK_EXTRA_ARGS) $(addprefix $(SRC_TOP)/src/,$(SRCS)) && \
+	 echo 'passed: $@.'
+
+.PHONY: cppcheck-extras
+cppcheck-extras:
 	@[ -r "$(REPO_ROOT)/scripts/analyzer-config.sh" ] || { echo "analyzer-config.sh not found -- skipping $@."; exit 0; }; \
 	 command -v cppcheck 1>/dev/null || { echo 'cppcheck not found -- skipping $@.'; exit 0; }; \
-	 $(MAKE) $(EXTRA_MAKE_FLAGS) $(QUIET_FLAG) -f $(THIS_MAKEFILE) VERY_QUIET=1 BUILD_TOP="$(BUILD_PARENT)/wolfsentry-cppcheck-analyzer-builds" clean; \
+	 $(MAKE) $(EXTRA_MAKE_FLAGS) $(QUIET_FLAG) -f $(THIS_MAKEFILE) VERY_QUIET=1 BUILD_TOP="$(BUILD_PARENT)/wolfsentry-cppcheck-extras-builds" clean; \
 	 . $(REPO_ROOT)/scripts/analyzer-config.sh && \
-	 $(MAKE) $(EXTRA_MAKE_FLAGS) $(QUIET_FLAG) -f $(THIS_MAKEFILE) VERY_QUIET=1 BUILD_TOP="$(BUILD_PARENT)/wolfsentry-cppcheck-analyzer-builds" "$(BUILD_PARENT)/wolfsentry-cppcheck-analyzer-builds/wolfsentry/wolfsentry_options.h" && \
-	 CPPCHECK_COMMON_ARGS+=(--suppress=legacyUninitvar -I"$(BUILD_PARENT)/wolfsentry-cppcheck-analyzer-builds" -I/usr/include -I"$$($(CC) -print-file-name=include)" -I$(LWIP_TOP_FOR_TEST)/src/include -I$(SRC_TOP)/ports/Linux-lwIP/include) && \
+	 $(MAKE) $(EXTRA_MAKE_FLAGS) $(QUIET_FLAG) -f $(THIS_MAKEFILE) VERY_QUIET=1 BUILD_TOP="$(BUILD_PARENT)/wolfsentry-cppcheck-extras-builds" "$(BUILD_PARENT)/wolfsentry-cppcheck-extras-builds/wolfsentry/wolfsentry_options.h" && \
 	 cd "$(SRC_TOP)" && \
-	 cppcheck -j $$(($$(nproc) / 2)) $(QUIET_FLAG) "$${CPPCHECK_COMMON_ARGS[@]}" -DWOLFSENTRY_CPPCHECK -DTEST_INIT -DTEST_STATIC_ROUTES -DTEST_DYNAMIC_RULES -DTEST_USER_VALUES -DTEST_USER_ADDR_FAMILIES -DTEST_JSON -DTEST_JSON_CORPUS -D__linux__ -D__GNUC__ -U__STRICT_ANSI__ -UWOLFSENTRY_SINGLETHREADED -DWOLFSENTRY_THREADSAFE -DWOLFSENTRY_NO_ALLOCA --include="$(BUILD_PARENT)/wolfsentry-cppcheck-analyzer-builds/wolfsentry/wolfsentry_options.h" --include=wolfsentry/wolfsentry_settings.h --include=wolfsentry/wolfsentry_util.h --include=wolfsentry/wolfsentry_errcodes.h --include=wolfsentry/wolfsentry.h "$${CPPCHECK_EXTRA_ARGS[@]}" $(addprefix $(SRC_TOP)/src/,$(SRCS)) $(SRC_TOP)/tests/unittests.c && \
-	 cppcheck -j $$(($$(nproc) / 2)) --force $(QUIET_FLAG) "$${CPPCHECK_COMMON_ARGS[@]}" -DWOLFSENTRY_CPPCHECK -D__linux__ -UFREERTOS -D'__attribute__(x)=' -D__GNUC__ -U__STRICT_ANSI__ -UWOLFSENTRY_SINGLETHREADED -DWOLFSENTRY_THREADSAFE -DWOLFSENTRY_NO_ALLOCA --include="$(BUILD_PARENT)/wolfsentry-cppcheck-analyzer-builds/wolfsentry/wolfsentry_options.h" --include=wolfsentry/wolfsentry_settings.h --include=wolfsentry/wolfsentry_util.h --include=wolfsentry/wolfsentry_errcodes.h --include=wolfsentry/wolfsentry.h "$${CPPCHECK_EXTRA_ARGS[@]}" $(addprefix $(SRC_TOP)/src/,$(SRCS)) $(SRC_TOP)/tests/unittests.c && \
-	 $(MAKE) $(EXTRA_MAKE_FLAGS) $(QUIET_FLAG) -f $(THIS_MAKEFILE) VERY_QUIET=1 BUILD_TOP="$(BUILD_PARENT)/wolfsentry-cppcheck-analyzer-builds" clean && \
+	 $(CPPCHECK) --enable=warning,portability,performance,missingInclude,style $(CPPCHECK_COMMON_ARGS) -I"$(BUILD_PARENT)/wolfsentry-cppcheck-extras-builds" -DTEST_INIT -DTEST_STATIC_ROUTES -DTEST_DYNAMIC_RULES -DTEST_USER_VALUES -DTEST_USER_ADDR_FAMILIES -DTEST_JSON -DTEST_JSON_CORPUS -UTEST_LWIP -UWOLFSENTRY_LWIP -UWOLFSENTRY_TEST_HPI -DWOLFSENTRY_TEST_HPI_POSIX_VANILLA -DWOLFSENTRY_UNITTEST_BENCHMARKS -UWOLFSENTRY_LOCK_SHARED_ERROR_CHECKING -UBUILDING_LIBWOLFSENTRY -UWOLFSENTRY_USER_SETTINGS_FILE -D__linux__ -D__GNUC__ -UWOLFSENTRY_SINGLETHREADED -DWOLFSENTRY_THREADSAFE -UWOLFSENTRY_NO_ALLOCA --include="$(BUILD_PARENT)/wolfsentry-cppcheck-extras-builds/wolfsentry/wolfsentry_options.h" --include=wolfsentry/wolfsentry_settings.h --include=wolfsentry/wolfsentry_util.h --include=wolfsentry/wolfsentry_errcodes.h --include=wolfsentry/wolfsentry_af.h --include=wolfsentry/wolfsentry.h $(CPPCHECK_EXTRA_ARGS) $(SRC_TOP)/tests/unittests.c && \
+	 $(MAKE) $(EXTRA_MAKE_FLAGS) $(QUIET_FLAG) -f $(THIS_MAKEFILE) VERY_QUIET=1 BUILD_TOP="$(BUILD_PARENT)/wolfsentry-cppcheck-extras-builds" clean && \
 	 echo 'passed: $@.'
 
+.PHONY: cppcheck-force-extras
+cppcheck-force-extras:
+	@[ -r "$(REPO_ROOT)/scripts/analyzer-config.sh" ] || { echo "analyzer-config.sh not found -- skipping $@."; exit 0; }; \
+	 command -v cppcheck 1>/dev/null || { echo 'cppcheck not found -- skipping $@.'; exit 0; }; \
+	 . $(REPO_ROOT)/scripts/analyzer-config.sh && \
+	 cd "$(SRC_TOP)" && \
+	 $(CPPCHECK) --enable=warning,portability,performance,missingInclude,style --force --suppress=missingIncludeSystem $(CPPCHECK_COMMON_ARGS) -D'__attribute__(x)=' -D__GNUC__ -DTEST_INIT -DTEST_STATIC_ROUTES -DTEST_DYNAMIC_RULES -DTEST_USER_VALUES -DTEST_USER_ADDR_FAMILIES -DTEST_JSON -DTEST_JSON_CORPUS --include=wolfsentry/wolfsentry_settings.h --include=wolfsentry/wolfsentry_util.h --include=wolfsentry/wolfsentry_errcodes.h --include=wolfsentry/wolfsentry_af.h --include=wolfsentry/wolfsentry.h $(CPPCHECK_EXTRA_ARGS) $(SRC_TOP)/tests/unittests.c && \
+	 echo 'passed: $@.'
+
+.PHONY: cppcheck-force
+cppcheck-force: cppcheck-force-library cppcheck-force-extras
+
 .PHONY: analyze-all
 # valgrind-all-clang disabled until the valgrind team fixes https://bugs.kde.org/show_bug.cgi?id=452758
 # "Valgrind does not read properly DWARF5 as generated by Clang14"
-analyze-all: valgrind-all-gcc sanitize-all-gcc linux-lwip-sanitize-all-gcc sanitize-all-clang sanitize-aarch64-be-test sanitize-all-no-inline-gcc sanitize-all-NO_POSIX_MEMALIGN-gcc clang-tidy-build-test cppcheck-analyze
+analyze-all: valgrind-all-gcc sanitize-all-gcc linux-lwip-sanitize-all-gcc sanitize-all-clang sanitize-aarch64-be-test sanitize-all-no-inline-gcc sanitize-all-NO_POSIX_MEMALIGN-gcc clang-tidy-build-test cppcheck-library cppcheck-extras
 	@echo 'passed: analyzers found no defects.'
 
 .PHONY: analyze-macosx
@@ -478,7 +516,7 @@ static-build-test:
 .PHONY: benchmark-test
 benchmark-test:
 	@$(MAKE) $(EXTRA_MAKE_FLAGS) $(QUIET_FLAG) -f $(THIS_MAKEFILE) VERY_QUIET=1 BUILD_TOP="$(BUILD_PARENT)/wolfsentry-benchmark-builds" clean
-	@$(MAKE) $(EXTRA_MAKE_FLAGS) $(QUIET_FLAG) -f $(THIS_MAKEFILE) VERY_QUIET=1 BUILD_TOP="$(BUILD_PARENT)/wolfsentry-benchmark-builds" EXTRA_CFLAGS+='-DWOLFSENTRY_UNITTEST_BENCHMARKS -DWOLFSENTRY_MAX_CYCLES_PER_CALL_EMPTY_TABLE=350 -DWOLFSENTRY_MAX_CYCLES_PER_CALL_JSON_LOADED=1400' test
+	@$(MAKE) $(EXTRA_MAKE_FLAGS) $(QUIET_FLAG) -f $(THIS_MAKEFILE) VERY_QUIET=1 BUILD_TOP="$(BUILD_PARENT)/wolfsentry-benchmark-builds" EXTRA_CFLAGS+='-DWOLFSENTRY_UNITTEST_BENCHMARKS -DWOLFSENTRY_MAX_CYCLES_PER_CALL_EMPTY_TABLE=360 -DWOLFSENTRY_MAX_CYCLES_PER_CALL_JSON_LOADED=1400' test
 	@$(MAKE) $(EXTRA_MAKE_FLAGS) $(QUIET_FLAG) -f $(THIS_MAKEFILE) VERY_QUIET=1 BUILD_TOP="$(BUILD_PARENT)/wolfsentry-benchmark-builds" clean
 	@echo "passed: benchmark test."
 

diff --git a/src/action_builtins.c b/src/action_builtins.c
@@ -118,7 +118,7 @@ static wolfsentry_errcode_t wolfsentry_builtin_action_track_peer(
 
     /* can't pass action_results directly to _route_insert -- it would get zeroed. */
     WOLFSENTRY_WARN_ON_FAILURE(
-        ret = wolfsentry_route_insert_by_exports_into_table(
+        wolfsentry_route_insert_by_exports_into_table(
             WOLFSENTRY_CONTEXT_ARGS_OUT,
             route_table,
             NULL /* void *caller_arg*/,

diff --git a/src/actions.c b/src/actions.c
@@ -631,7 +631,7 @@ WOLFSENTRY_LOCAL wolfsentry_errcode_t wolfsentry_action_list_dispatch(
         if (! (rule_route->flags & WOLFSENTRY_ROUTE_FLAG_DONT_COUNT_HITS))
             WOLFSENTRY_ATOMIC_INCREMENT(i->action->header.hitcount, 1);
 #ifdef WOLFSENTRY_DEBUG_ACTIONS
-        fprintf(stderr,"calling action %s for event %s and action type %u\n", wolfsentry_action_get_label(i->action), wolfsentry_event_get_label(trigger_event), action_type);
+        fprintf(stderr,"calling action %s for event %s and action type %u\n", wolfsentry_action_get_label(i->action), wolfsentry_event_get_label(trigger_event), (unsigned)action_type);
 #endif
         if ((ret = i->action->handler(WOLFSENTRY_CONTEXT_ARGS_OUT, i->action, i->action->handler_arg, caller_arg, trigger_event, action_type, target_route, route_table, rule_route, action_results)) < 0)
             WOLFSENTRY_ERROR_RERETURN(ret);

diff --git a/src/addr_families.c b/src/addr_families.c
@@ -368,7 +368,7 @@ WOLFSENTRY_API wolfsentry_errcode_t wolfsentry_addr_family_drop_reference(
 {
     wolfsentry_errcode_t ret;
     wolfsentry_refcount_t refs_left;
-    if (family_bynumber->header.refcount <= 0)
+    if (family_bynumber->header.refcount == 0)
         WOLFSENTRY_ERROR_RETURN(INTERNAL_CHECK_FATAL);
     if ((family_bynumber->header.parent_table != NULL) &&
         (family_bynumber->header.parent_table->ent_type != WOLFSENTRY_OBJECT_TYPE_ADDR_FAMILY_BYNUMBER))

diff --git a/src/events.c b/src/events.c
@@ -405,7 +405,7 @@ WOLFSENTRY_API wolfsentry_errcode_t wolfsentry_event_get_reference(WOLFSENTRY_CO
 WOLFSENTRY_API wolfsentry_errcode_t wolfsentry_event_drop_reference(WOLFSENTRY_CONTEXT_ARGS_IN, struct wolfsentry_event *event, wolfsentry_action_res_t *action_results) {
     wolfsentry_errcode_t ret;
     wolfsentry_refcount_t refs_left;
-    if (event->header.refcount <= 0)
+    if (event->header.refcount == 0)
         WOLFSENTRY_ERROR_RETURN(INTERNAL_CHECK_FATAL);
     if ((event->header.parent_table != NULL) &&
         (event->header.parent_table->ent_type != WOLFSENTRY_OBJECT_TYPE_EVENT))

diff --git a/src/json/centijson_value.c b/src/json/centijson_value.c
@@ -334,17 +334,17 @@ json_value_path(JSON_VALUE* root, const char* path)
             token_end++;
 
         if(token_end - token_beg > 2  &&  token_beg[0] == '['  &&  token_end[-1] == ']') {
-            size_t index = 0;
+            size_t path_index = 0;
 
             token_beg++;
             while('0' <= *token_beg  &&  *token_beg <= '9') {
-                index = index * 10U + (*token_beg - (unsigned)'0');
+                path_index = path_index * 10U + (*token_beg - (unsigned)'0');
                 token_beg++;
             }
             if(*token_beg != ']')
                 return NULL;
 
-            v = json_value_array_get(v, index);
+            v = json_value_array_get(v, path_index);
         } else if(token_end - token_beg > 0) {
             v = json_value_dict_get_(v, token_beg, (size_t)(token_end - token_beg));
         }
@@ -684,7 +684,7 @@ json_value_bool(const JSON_VALUE* v)
 WOLFSENTRY_API int32_t
 json_value_int32(const JSON_VALUE* v)
 {
-    uint8_t* payload = json_value_payload((JSON_VALUE*) v);
+    const uint8_t* payload = json_value_payload((JSON_VALUE*) v);
     union {
         int32_t i32;
         uint32_t u32;
@@ -708,7 +708,7 @@ json_value_int32(const JSON_VALUE* v)
 WOLFSENTRY_API uint32_t
 json_value_uint32(const JSON_VALUE* v)
 {
-    uint8_t* payload = json_value_payload((JSON_VALUE*) v);
+    const uint8_t* payload = json_value_payload((JSON_VALUE*) v);
     union {
         int32_t i32;
         uint32_t u32;
@@ -732,7 +732,7 @@ json_value_uint32(const JSON_VALUE* v)
 WOLFSENTRY_API int64_t
 json_value_int64(const JSON_VALUE* v)
 {
-    uint8_t* payload = json_value_payload((JSON_VALUE*) v);
+    const uint8_t* payload = json_value_payload((JSON_VALUE*) v);
     union {
         int32_t i32;
         uint32_t u32;
@@ -756,7 +756,7 @@ json_value_int64(const JSON_VALUE* v)
 WOLFSENTRY_API uint64_t
 json_value_uint64(const JSON_VALUE* v)
 {
-    uint8_t* payload = json_value_payload((JSON_VALUE*) v);
+    const uint8_t* payload = json_value_payload((JSON_VALUE*) v);
     union {
         int32_t i32;
         uint32_t u32;
@@ -780,7 +780,7 @@ json_value_uint64(const JSON_VALUE* v)
 WOLFSENTRY_API float
 json_value_float(const JSON_VALUE* v)
 {
-    uint8_t* payload = json_value_payload((JSON_VALUE*) v);
+    const uint8_t* payload = json_value_payload((JSON_VALUE*) v);
     union {
         int32_t i32;
         uint32_t u32;
@@ -804,7 +804,7 @@ json_value_float(const JSON_VALUE* v)
 WOLFSENTRY_API double
 json_value_double(const JSON_VALUE* v)
 {
-    uint8_t* payload = json_value_payload((JSON_VALUE*) v);
+    const uint8_t* payload = json_value_payload((JSON_VALUE*) v);
     union {
         int32_t i32;
         uint32_t u32;
@@ -1130,7 +1130,7 @@ json_value_dict_leftmost_path(RBTREE** path, RBTREE* node)
 WOLFSENTRY_API unsigned
 json_value_dict_flags(const JSON_VALUE* v)
 {
-    DICT* d = json_value_dict_payload((JSON_VALUE*) v);
+    const DICT* d = json_value_dict_payload((JSON_VALUE*) v);
     unsigned flags = 0;
 
     if(d != NULL  &&  (v->data.data_bytes[0] & HAS_ORDERLIST))

diff --git a/src/json/load_config.c b/src/json/load_config.c
@@ -456,7 +456,7 @@ static wolfsentry_errcode_t handle_eventconfig_clause(struct wolfsentry_json_pro
             if (type != JSON_STRING)
                 WOLFSENTRY_ERROR_RETURN(CONFIG_INVALID_VALUE);
 
-            ret = wolfsentry_action_res_assoc_by_name((const char *)data, data_size, &flag);
+            ret = wolfsentry_action_res_assoc_by_name((const char *)data, (int)data_size, &flag);
             WOLFSENTRY_RERETURN_IF_ERROR(ret);
 
             if (! strcmp(jps->cur_keyname, "action-res-filter-bits-set"))

diff --git a/src/kv.c b/src/kv.c
@@ -89,7 +89,7 @@ WOLFSENTRY_LOCAL wolfsentry_errcode_t wolfsentry_kv_drop_reference(
     wolfsentry_errcode_t ret;
     wolfsentry_refcount_t refs_left;
     (void)action_results;
-    if (kv->header.refcount <= 0)
+    if (kv->header.refcount == 0)
         WOLFSENTRY_ERROR_RETURN(INTERNAL_CHECK_FATAL);
     if ((kv->header.parent_table != NULL) &&
         (kv->header.parent_table->ent_type != WOLFSENTRY_OBJECT_TYPE_KV))

diff --git a/src/routes.c b/src/routes.c
@@ -599,7 +599,7 @@ static wolfsentry_errcode_t wolfsentry_route_drop_reference_1(
     struct wolfsentry_eventconfig_internal *config = (route->parent_event && route->parent_event->config) ? route->parent_event->config : &wolfsentry->config;
     wolfsentry_errcode_t ret;
     wolfsentry_refcount_t refs_left;
-    if (route->header.refcount <= 0)
+    if (route->header.refcount == 0)
         WOLFSENTRY_ERROR_RETURN(INTERNAL_CHECK_FATAL);
     if ((route->header.parent_table != NULL) &&
         (route->header.parent_table->ent_type != WOLFSENTRY_OBJECT_TYPE_ROUTE))