[Cs-dev] Coverity Scan
Date | 2014-01-23 14:45 |
From | Felipe Sateler |
Subject | [Cs-dev] Coverity Scan |
Coverity is a static analysis tool (supposedly one of the best). It offers free scans for open source projects, so I scanned the latest 6.02 release of csound (default options) to see what can be found. Csound has 424 outstanding issues, of which coverity rates 94 as high-impact. Problems types include: uninitialized variables, unbounded copies into fixed-length buffers, dereference before null checks, printf mismatches, and others. The full report is at https://scan.coverity.com/projects/1211, but you need to request access to be able to see it (I don't think it is possible to make the report public). If you are interested in looking at the report, send a request and I'll approve it ASAP. -- Saludos, Felipe Sateler ------------------------------------------------------------------------------ CenturyLink Cloud: The Leader in Enterprise Cloud Services. Learn Why More Businesses Are Choosing CenturyLink Cloud For Critical Workloads, Development Environments & Everything In Between. Get a Quote or Start a Free Trial Today. http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk _______________________________________________ Csound-devel mailing list Csound-devel@lists.sourceforge.net |
Date | 2014-01-23 14:50 |
From | Michael Gogins |
Subject | Re: [Cs-dev] Coverity Scan |
Attachments | None None |
Thanks! I have used other static analysis tools on Csound code myself, and have consistently recommended their use for some time. Please email me the scan, and I will try to fix some of these.
Regards, Mike ----------------------------------------------------- Michael GoginsIrreducible Productions http://michaelgogins.tumblr.com Michael dot Gogins at gmail dot com On Thu, Jan 23, 2014 at 9:45 AM, Felipe Sateler <fsateler@gmail.com> wrote: Coverity is a static analysis tool (supposedly one of the best). It |
Date | 2014-01-23 14:56 |
From | Felipe Sateler |
Subject | Re: [Cs-dev] Coverity Scan |
Unfortunately the report is not downloadable, it is viewed through a web report viewer. I have sent you an invite so that you can access the system (you can use your github account to login if you want to, no need to create a new account). On Thu, Jan 23, 2014 at 11:50 AM, Michael Gogins |
Date | 2014-01-23 15:04 |
From | Michael Gogins |
Subject | Re: [Cs-dev] Coverity Scan |
Attachments | None None |
Thanks again. I have created my account. Regards, Mike -----------------------------------------------------
Michael GoginsIrreducible Productions http://michaelgogins.tumblr.com Michael dot Gogins at gmail dot com On Thu, Jan 23, 2014 at 9:56 AM, Felipe Sateler <fsateler@gmail.com> wrote: Unfortunately the report is not downloadable, it is viewed through a |
Date | 2014-01-23 15:13 |
From | Michael Gogins |
Subject | Re: [Cs-dev] Coverity Scan |
Attachments | None None |
I now have a GitHub account and can sign into your Coverity project, but when I try to view the actual defects I seem to just keep going in circles... Regards, Mike ----------------------------------------------------- Michael GoginsIrreducible Productions http://michaelgogins.tumblr.com Michael dot Gogins at gmail dot com On Thu, Jan 23, 2014 at 10:04 AM, Michael Gogins <michael.gogins@gmail.com> wrote:
|
Date | 2014-01-23 16:59 |
From | jpff@cs.bath.ac.uk |
Subject | Re: [Cs-dev] Coverity Scan |
Attachments | None |
Date | 2014-01-23 17:04 |
From | Felipe Sateler |
Subject | Re: [Cs-dev] Coverity Scan |
Mike, could you log in to the report viewer? It is kind of slow but it works for me... John, I have sent you an invite too. Coverity does have tools to signal to it that a flagged error is not actually an error, but I have not explored them. On Thu, Jan 23, 2014 at 12:13 PM, Michael Gogins |
Date | 2014-01-23 17:49 |
From | Michael Gogins |
Subject | Re: [Cs-dev] Coverity Scan |
Attachments | None None |
John, all static analysis tools produce false positives. We just have to look at the code and try to remove the warnings. I think we should remove them if we can even if they are false positives. Sometimes this is not so easy, then a comment in the code to that effect is a very good idea. Best, Mike ----------------------------------------------------- Michael GoginsIrreducible Productions http://michaelgogins.tumblr.com Michael dot Gogins at gmail dot com On Thu, Jan 23, 2014 at 12:04 PM, Felipe Sateler <fsateler@gmail.com> wrote: Mike, could you log in to the report viewer? It is kind of slow but it |
Date | 2014-01-23 17:51 |
From | Michael Gogins |
Subject | Re: [Cs-dev] Coverity Scan |
Attachments | None None |
I am in the report viewer now. I guess it just takes a while for the machinery to catch up. Thanks, Mike ----------------------------------------------------- Michael GoginsIrreducible Productions http://michaelgogins.tumblr.com Michael dot Gogins at gmail dot com On Thu, Jan 23, 2014 at 12:49 PM, Michael Gogins <michael.gogins@gmail.com> wrote:
|
Date | 2014-01-24 10:46 |
From | Stephen Kyne |
Subject | Re: [Cs-dev] Coverity Scan |
Attachments | None None |
There is a way of telling Coverity to ignore certain items it might throw up rather than editing the code. Triage I think it's called. It's a good tool though, we use it at work and it can find a lot of tricky bugs and even some locking issues. I think for C/C++ though it can be overzealous with it's warnings, it's probably best to judge each item or just fix high severity issues initially. Stephen Date: Thu, 23 Jan 2014 12:49:33 -0500 From: michael.gogins@gmail.com To: csound-devel@lists.sourceforge.net Subject: Re: [Cs-dev] Coverity Scan John, all static analysis tools produce false positives. We just have to look at the code and try to remove the warnings. I think we should remove them if we can even if they are false positives. Sometimes this is not so easy, then a comment in the code to that effect is a very good idea. Best, Mike ----------------------------------------------------- Michael GoginsIrreducible Productions http://michaelgogins.tumblr.com Michael dot Gogins at gmail dot com On Thu, Jan 23, 2014 at 12:04 PM, Felipe Sateler <fsateler@gmail.com> wrote: Mike, could you log in to the report viewer? It is kind of slow but it ------------------------------------------------------------------------------ CenturyLink Cloud: The Leader in Enterprise Cloud Services. Learn Why More Businesses Are Choosing CenturyLink Cloud For Critical Workloads, Development Environments & Everything In Between. Get a Quote or Start a Free Trial Today. http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk _______________________________________________ Csound-devel mailing list Csound-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/csound-devel |
Date | 2014-01-24 12:11 |
From | jpff@cs.bath.ac.uk |
Subject | Re: [Cs-dev] Coverity Scan |
Attachments | None |
Date | 2014-01-24 12:54 |
From | Felipe Sateler |
Subject | Re: [Cs-dev] Coverity Scan |
On Fri, Jan 24, 2014 at 9:11 AM, |
Date | 2014-01-26 14:58 |
From | Victor Lazzarini |
Subject | Re: [Cs-dev] Coverity Scan |
How can we see the report? I can only see how many errors etc, but no list. On 24 Jan 2014, at 12:54, Felipe Sateler |
Date | 2014-01-27 13:04 |
From | Felipe Sateler |
Subject | Re: [Cs-dev] Coverity Scan |
You have to sign in to see it. Is your mail roet.fuss gmail? That mail has only observer status. If its yours, I will bump its permissions. On Sun, Jan 26, 2014 at 11:58 AM, Victor Lazzarini |
Date | 2014-01-27 13:24 |
From | Victor Lazzarini |
Subject | Re: [Cs-dev] Coverity Scan |
That’s me. Can you bump it? On 27 Jan 2014, at 13:04, Felipe Sateler |
Date | 2014-01-27 13:30 |
From | Felipe Sateler |
Subject | Re: [Cs-dev] Coverity Scan |
Bumped. On the project overview page, there is a red "view defects" button. The report viewer takes a while to load. BTW, I see some issues have been fixed. Great! If you want a newer git snapshot to be built I can do that. Perhaps I should set up an automated build every week or so. On Mon, Jan 27, 2014 at 10:24 AM, Victor Lazzarini |
Date | 2014-01-27 14:09 |
From | Victor Lazzarini |
Subject | Re: [Cs-dev] Coverity Scan |
Thanks, I can see it. I don’t seem to be able to “own” an issue and to make changes to it. How do I do it? On 27 Jan 2014, at 13:30, Felipe Sateler |
Date | 2014-01-27 15:22 |
From | Felipe Sateler |
Subject | Re: [Cs-dev] Coverity Scan |
When you select an issue and the source is displayed in the bottom pane, on the right pane there is a "triage" section. There you can set the owner and resolutions. On Mon, Jan 27, 2014 at 11:09 AM, Victor Lazzarini |
Date | 2014-01-27 15:30 |
From | jpff@cs.bath.ac.uk |
Subject | Re: [Cs-dev] Coverity Scan |
Attachments | None |
Date | 2014-01-27 15:47 |
From | Felipe Sateler |
Subject | Re: [Cs-dev] Coverity Scan |
I was scanning through the issues to see if I can fix any, and found an error in the function mytmpnam. But this function doesn't seem to be used anywhere (I can successfully build without it). Any objections to removing it? On Mon, Jan 27, 2014 at 12:30 PM, |
Date | 2014-01-27 16:08 |
From | jpff@cs.bath.ac.uk |
Subject | Re: [Cs-dev] Coverity Scan |
Attachments | None |
Date | 2014-01-27 16:46 |
From | Michael Gogins |
Subject | Re: [Cs-dev] Coverity Scan |
Attachments | None None |
I will deal with the c++ issues starting tomorrow. On Jan 27, 2014 10:31 AM, <jpff@cs.bath.ac.uk> wrote:
I hope someone is looking at the C++ issues. I have sorted into file |
Date | 2014-01-27 17:36 |
From | Victor Lazzarini |
Subject | Re: [Cs-dev] Coverity Scan |
I’ve looked at the main lib and interfaces C++ stuff in page 1. I left Michael’s code, as he agreed to deal with it. Victor On 27 Jan 2014, at 16:46, Michael Gogins |
Date | 2014-01-27 21:54 |
From | David Akbari |
Subject | Re: [Cs-dev] Coverity Scan |
Attachments | None None |
I am also interested in this tool. I have filed a request for access to the Csound project using the Coverity system. Please add me at your convenience.
Cheers, David On Mon, Jan 27, 2014 at 11:36 AM, Victor Lazzarini <Victor.Lazzarini@nuim.ie> wrote: I’ve looked at the main lib and interfaces C++ stuff in page 1. I left Michael’s code, as he agreed to deal with it. |
Date | 2014-01-27 22:38 |
From | Felipe Sateler |
Subject | Re: [Cs-dev] Coverity Scan |
Granted. On Mon, Jan 27, 2014 at 6:54 PM, David Akbari |
Date | 2014-01-27 22:47 |
From | David Akbari |
Subject | Re: [Cs-dev] Coverity Scan |
Attachments | None None |
Thank you! This is very interesting, indeed. On Mon, Jan 27, 2014 at 4:38 PM, Felipe Sateler <fsateler@gmail.com> wrote: Granted. |