# V1001. Variable is assigned but not used by the end of the function.

The analyzer detected a potential error related to the fact that before the exit from the function, a local variable is assigned with a value that is not used later.

Perhaps, this variable should be in subsequent operations or returned as a result of a function, but because of a typo another variable is used, or the programmer forgot to write the necessary code. Let's consider several examples.

Example 1.

    bool IsFitRect(TPict& pict)
    {
      TRect pictRect;
      ...
      pictRect = pict.GetRect();
      return otherRect.dx >= 16 && otherRect.dy >= 16;
    }

In this example, in the 'return' operator, the sizes 'otherRect' are used by mistake instead of the sizes 'pictRect', while the variable 'pictRect' isn't used in any other evaluations. The correct code should be as follows:

    bool IsFitRect(TPict& pict)
    {
      TRect pictRect;
      ...
      pictRect = pict.GetRect();
      return pictRect.dx >= 16 && pictRect.dy >= 16;
    }

Example 2.

    bool CreateMiniDump()
    {
      BOOL bStatus = FALSE;
      CString errorMsg;
      ...
      if (hDbgHelp == NULL)
      {
        errorMsg = _T("dbghelp.dll couldn't be loaded");
        goto cleanup;
      }
      ...
      if (hFile == INVALID_HANDLE_VALUE)
      {
        errorMsg = _T("Couldn't create minidump file");
        return FALSE;
      }
      ...
    cleanup:
      if (!bStatus)
        AddToReport(errorMsg);
      return bStatus;
    }

In this example, in all the 'if' blocks except one, after the error message there is a transit to the end of the function, where this error is added to the report. But when processing one of the conditions, there is an exit from the function immediately without adding the message to the report, which gets lost later. Correct code should look as follows:

    bool CreateMiniDump()
    {
      BOOL bStatus = FALSE;
      CString errorMsg;
      ...
      if (hDbgHelp == NULL)
      {
        errorMsg = _T("dbghelp.dll couldn't be loaded");
        goto cleanup;
      }
      ...
      if (hFile == INVALID_HANDLE_VALUE)
      {
        errorMsg = _T("Couldn't create minidump file");
        goto cleanup;
      }
      ...
    cleanup:
      if (!bStatus)
        AddToReport(errorMsg);
      return bStatus;
    }

Sometimes, working with cryptographic functions, programmers clean the variables at the end by writing a null value. This is the wrong approach, because the compiler will most likely remove the code during the optimization, if a variable is no longer used. For example:

    void ldns_sha256_update(...)
    {
      size_t freespace, usedspace;
      ...
      /* Clean up: */
      usedspace = freespace = 0;
    }

To clear the memory, you should use special functions that won't be removed by the compiler during the optimization.

    void ldns_sha256_update(...)
    {
      size_t freespace, usedspace;
      ...
      /* Clean up: */
      RtlSecureZeroMemory(&usedspace, sizeof(usedspace));
      RtlSecureZeroMemory(&freespace, sizeof(freespace));
    }

More details about this error can be found in the description of the V597 diagnostic.

In some cases, when programmers deal with the compiler warnings about the unused variables, they assign them some values or assign the value to itself. This is not the best method, because upon the absence of the comments, it can mislead those programmer who will work on this code later.

    static stbi_uc *stbi__tga_load(...)
    {
      //   read in the TGA header stuff
      int tga_palette_start = stbi__get16le(s);
      int tga_palette_len = stbi__get16le(s);
      int tga_palette_bits = stbi__get8(s);
      ...
      //   the things I do to get rid of an error message,
      //   and yet keep Microsoft's C compilers happy... [8^(
      tga_palette_start = tga_palette_len = tga_palette_bits =
          tga_x_origin = tga_y_origin = 0;
      //   OK, done
      return tga_data;
    }

There are more graceful solutions for such cases, for example, you can use the function:

    template<class T> void UNREFERENCED_VAR( const T& ) { }
    static stbi_uc *stbi__tga_load(...)
    {
      //   read in the TGA header stuff
      int tga_palette_start = stbi__get16le(s);
      ...
      UNREFERENCED_VAR(tga_palette_start);
      ...
      //   OK, done
      return tga_data;
    }

Another option is to use special macros, declared in the system header files. For example, in Visual C++ such a macro is UNREFERENCED_PARAMETER. In this case the analyzer also won't issue warnings.

This diagnostic is classified as:

CWE-14 CWE-563 CERT-MSC06-C CERT-MSC13-C

You can look at examples of errors detected by the V1001 diagnostic.