mkb218/opera-omnia: upload.go; 79 LoC

Found a possible issue in [mkb218/opera-omnia](https://www.github.com/mkb218/opera-omnia) at [upload.go](https://github.com/mkb218/opera-omnia/blob/e304d3dea4c451426fc5a1b561e1fcad312f42df/upload.go#L401-L479)

Below is the message reported by the analyzer for this snippet of code. Beware that the analyzer only reports the first issue it finds, so please do not limit your consideration to the contents of the below message.

> range-loop variable r used in defer or goroutine at line 442

[Click here to see the code in its original context.](https://github.com/mkb218/opera-omnia/blob/e304d3dea4c451426fc5a1b561e1fcad312f42df/upload.go#L401-L479)

Click here to show the 79 line(s) of Go which triggered the analyzer.

```go
for r := range UploadChan {
log.Println("got", len(r.Data), "bytes",r.Filetype,"add",r.Add, "playback", r.Playback)
// md5 data and see if we have analysis already
var m md5sum
hasher.Write(r.Data)
copy(m[:], hasher.Sum(nil))
hasher.Reset()
var id string
var ok bool
var a Analysis
var url string
var err error
if id, ok = GetIDForChecksum(m); !ok {
// log.Println("no id for md5", m)
// if not upload it to analyzer.
id, url, err = e.Upload(r.Filetype, r.Data)
if err != nil {
log.Println("error uploading track to EN", err)
continue
}
// log.Println("got ID", id, "url", url, "err", err)

// update md5 to id mapping
AddIDForChecksum(m, id)
}

// if it comes back with an ID that we have, then great!
// if not then fetch the detailed analysis
// update id to analysis mapping
if a, ok = GetSegmentsForID(id); !ok {
a, err = DetailsForID(url, id)
if err != nil {
log.Println("error getting details from EN", err)
continue
}
SetSegmentsForID(id, a)
}

go func() {
// if it's marked "add" open data with sox sub process (for mp3, mp4, and m4a support) to get raw samples
has := (a.Segments[0].File != "")
if r.Add && !has {
buf, err := openBuf(r.Data, r.Filetype)
if err != nil {
log.Println("couldn't get sox to run", err)
return
}
// put raw samples into files
for i := range a.Segments {
filename := id + "_" + strconv.Itoa(a.Segments[i].Index)
filename = path.Join(samplepath, filename)
file, err := os.Create(filename)
if err != nil {
log.Println("couldn't open file", filename, err)
continue
}
bytecount := int(a.Segments[i].Duration * float64(samplerate)) * 4 // 2 bytes per sample * 2 channels per frame
// log.Println(a.segments[i].Duration, bytecount)
_, err = file.Write(buf[:bytecount])
if err != nil {
log.Println("error writing sample", err)
}
file.Close()
a.Segments[i].File = filename

}
// add to all segments
// log.Println("adding to all segs")
go func() { attributionChan <- en_tuple{id, playq{a.Artist, a.Title, r.Fma_url} } }()
AddToAllSegs(a.Segments)
// log.Println("done adding to all segs")
}

// if request is marked "playback" add the ID to the request queue
if r.Playback {
RequestQueue <- id
}
}()
}

```

Leave a reaction on this issue to contribute to the project by classifying this instance as a **Bug** :-1:, **Mitigated** :+1:, or **Desirable Behavior** :rocket:
See the descriptions of the classifications [here](https://github.com/github-vet/rangeclosure-findings#how-can-i-help) for more information.

commit ID: e304d3dea4c451426fc5a1b561e1fcad312f42df

Start in upload.go around lines 401-479, especially the goroutine beginning near line 442 and the nested attribution goroutine. Trace which per-iteration values are captured by each goroutine and verify that completed work uses the intended upload data, analysis, and identifiers without range-variable reuse.

Written by the indexing model from the issue text.