Add more checks

[DimitriPapadopoulos]

Just to see whether this raises a few (real) issues.

[DimitriPapadopoulos]

It looks like +security-extended mostly results in false positives. Is it worth the pain?

[DimitriPapadopoulos]

CodeQL generates false positives. It's disturbingly unable to analyse C code properly.

You can dismiss the error to have it go away.

[LB--]

Hm, I almost wondered if it was smart enough to see some code path where it got assigned from an uninitialized value after being assigned properly, but that doesn't seem to be the case. It does seem to be a false positive, weirdly, since root is unconditionally assigned to in both the first and second pass. I will report it as a false positive and I guess we shall see what happens...