[gambit-list] Coverity open source project static code security analyser analyzed the sourcecode of Linux, FreeBSD, glibc, PgSQL, Nginx etc etc, what about ask them to analyze Gambit's sourcecode too?

Mikael mikael.rcv at gmail.com
Tue Feb 5 16:02:22 EST 2013


Dear Marc and list,

Coverity is an automated static sourcecode analysis tool that scans open
source projects such as Linux, FreeBSD, glibc, PostgreSQL, Nginx and
OpenSMTPD from the OpenBSD team <http://scan.coverity.com/all-projects.html>
.

As I got it originates from some project at Stanford and the open source
project scanning is free courtesy of sponsoring from the US Department of
Homeland Security<http://www.prnewswire.com/news-releases/lamp-software-stack-more-reliable-than-baseline-open-source-software---coverity-analysis-for-dhs-finds-55241072.html>
.

The general feedback is very positive: Published
reports<http://scan.coverity.com/report/> and for
instance the OpenSMTPD guys tell that they had good use of
it<https://www.poolp.org/>
:


Bret then asked me if I had ever tried the scanner at Coverity and told me
I should try to get our codebase scanned with it. I recalled seeing a
summary of issues uncovered by their scanner on Apache a while ago and it
was very impressive, so I asked to register OpenSMTPD and was happy when
they confirmed I could use their scanner without having to sign any NDA,
terms of services or random lawyer documents [rare and appreciable] :-)

..

We didn't find anything really scary, probably due to the fact we already
cleaned and removed scary code detected by Clang, but we did find lots of
little issues that we wouldn't spot just from reading, even several times.

Amongst the issues, we found a descriptor leak, several small memory leaks,
possible double-free, possible double-close, possible double-fclose,
use-after-free, various missing bzero, dead code and null-derefs. Many of
these would lead to a crash on OpenBSD but the reason we didn't experience
them is that they happened in error code paths for the most part. We have
fixed about 40 issues, there are 40 still, with several part of external
code (mail.local, aldap, etc) and some we believe are false positives but
require further reading with a clear mind. The scanner manages to find
errors which makes you wonder if they really are, until you realize that it
does a far better job at unrolling the code ;-)

This teaches us two lessons: find a way to better test error paths, run the
scanner from Coverity regularly !


What is to win is a third party security certification, which would be a
really valuable thing to have.

And, couldn't go worse than that they'd flag false positive or alike.

OpenSMTPD's authors say that it took *no* time from them to to do the scan
in terms of configuration, it was all about making the account and
exchanging some email.

What do you say about submitting <http://scan.coverity.com/start/> Gambit?

If you would want to do this would be cool. Also I could do the emailing
needed for it. Please tell know what you think.

Best regards,
Mikael
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.iro.umontreal.ca/pipermail/gambit-list/attachments/20130205/31b0baa9/attachment.htm>


More information about the Gambit-list mailing list