430328 - (static_analyses) [meta] Tracking requests for Static Analyses.

Status: RESOLVED FIXED

(Developer Infrastructure :: Source Code Analysis, task)

Description

[(dormant account)]

This is to make it easier to track ongoing analyses involving *hydras and Pork.

Comment 1

[David Teller [:Yoric] - still alive but not very active]

What kind of analyses are expected ?

Comment 2

[(dormant account)]

This is a tracking bug. "Depends on" lists the analyses under way.

Comment 3

[georgi - hopefully not receiving bugspam]

i am not familiar with hydra yet.

here are some random thoughts.

code analysis tools can't be made perfect, so the primary goal should
be to be effective imho.

refactoring kinda scares me - debugging a program generated by a
program generated by program is hard if possible at all.

besides a systematic scientific approach, i suggest additional
heuristic/chaotic approach - checking for blacklisted constructs that
may be dangerous - basically gcc's -Wall on steroids.

off the top of my head some checks that may help:
1. assignment in |if| - e.g. |if (a = 1)|. in some cases this
is valid, yet it may be a bug
2. misuse of preprocessing macros - macros changing stuff in unexpected
ways, e.g. in pseudocode
#define max(a,b) ((a)>(b) ? (a) : (b))

...
c=max(a++,b++);

this example is kinda fabricated, though i reported a real bug because
of similar misuse

very useful but probably hard to implement feature will be value
reachability:

on line X in file Y what are the possible values of int variable Z ?
basically Z may be anything, it may be just a singe number, it may be
in a given range or in a finite set of ranges.

Comment 4

[georgi - hopefully not receiving bugspam]

Attachment: cppcheck static analysis 2009-02-27, 290 lines

Comment 5

[georgi - hopefully not receiving bugspam]

cppcheck seems interesting static analysis tool:
http://sourceforge.net/project/showfiles.php?group_id=195752&package_id=231124&release_id=657693

bugs found by it:
http://cppcheck.wiki.sourceforge.net/found_bugs

seems nice their goal is to keep false positives very low (sure there are FP)

Comment 6

[georgi - hopefully not receiving bugspam]

> 1. assignment in |if| - e.g. |if (a = 1)|

FYI:
i patched cppcheck to search for this. the way cppcheck works i am not sure i caught all cases. caught 2 occurrences of this and they look legitimate to me.

Comment 7

[georgi - hopefully not receiving bugspam]

i am investigating using hydra for security stuff.

http://mxr.mozilla.org/mozilla-central/source/security/manager/ssl/src/nsCrypto.cpp#384

while (isspace(*end)) end--;

this will crash in layout:
<UNMAPPED> <SPACES> end

is it worth a bug?

can hydra check for constructs like:

while( SINGLECONDITION( *ptr ) ) ptr--;
or
while( SINGLECONDITION( *ptr ) ) --ptr;

i think both of the above are in most cases real crashes.

Comment 8

[Sylvestre Ledru [:Sylvestre]]

I think we should instead use bug 1287757 with its dependencies.
Closing this one.