[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <50564353.80504@mccme.ru>
Date: Mon, 17 Sep 2012 01:23:31 +0400
From: Alexander Cherepanov <cherepan@...me.ru>
To: john-dev@...ts.openwall.com
Subject: Re: Static analysis of John using Coverity
On 2012-09-15 21:47, Robert B. Harris wrote:
> We'll I think there should be a plan to work on the jumbo and magnum's
> bleeding and magnum's stable code and increase the quality of it.
>
> This program can test for code quality, memory leaks, and many other code
> issues.
>
> Is anyone on list interested and have the time for this?
>
> I'm willing to take the lead and see if the Coverity static analysis scanner
> helps us find and fix issues. Or maybe magnum might want to do this?
>
> We would need a group from this list to help on deciding if and how the code
> should be fixed. Do we have any volunteers?
>
> There are other analyzers as well... Coverity is supposed to have a low
> false positive rate, so I think that might be a good program to start with
There are several free (free as in freedom) static analyzers available
so starting with a non-free solution is kinda strange IMHO. There are
clang analyzer, cppcheck and others:
https://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis .
(Unfortunately free analyzers are mixed with non-free.) There are free
dynamic analyzers also.
But there are some things to do which were already posted to this
mailing list. Look for example at the thread started at
http://openwall.com/lists/john-dev/2012/07/13/12. And I suspect that
every format with trivial valid() -- there are ~40-50 of them -- have
buffer overflows in get_salt and/or similar functions. You don't need a
code analyzer to find them.
There is also PR-angle in using Coverity. IIUC if you use it then the
number of bugs in the project will be displayed on their site. If we
know that the code is bad than IMHO it's better to fix it before
submitting to Coverity.
But if using Coverity will stimulate fixing the code which nobody wants
to fix now then it's probably a good thing;-)
--
Alexander Cherepanov
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
