Static code analysis - Revision history

Sergey Bronnikov at 14:38, 23 July 2015

2015-07-23T14:38:08Z

Sergey Bronnikov: added PVS-studio

2015-07-03T07:47:16Z

added PVS-studio

Sergey Bronnikov: update hostname for repo

2015-05-15T13:26:40Z

update hostname for repo

Sergey Bronnikov: clang fixes

2015-05-15T13:25:36Z

clang fixes

Sergey Bronnikov: mention testing criu by coverity

2015-05-15T13:20:50Z

mention testing criu by coverity

Sergey Bronnikov at 13:06, 13 April 2015

2015-04-13T13:06:48Z

Sergey Bronnikov: Add info about vzctl changes fixes problems found by Coverity

2015-04-13T12:14:36Z

Add info about vzctl changes fixes problems found by Coverity

Sergey Bronnikov: Add category

2015-04-09T15:48:23Z

Add category

Sergey Bronnikov: Improve formatting

2015-04-09T15:47:49Z

Improve formatting

Sergey Bronnikov: Describe used static analysis tools

2015-04-09T15:46:38Z

Describe used static analysis tools

New page

{{Stub}}

Static analysis is a technique for finding bugs just by looking at source code without actually running it. That's great, because it can find bugs that are really hard to trigger.

== Tools used to static analysis of OpenVZ components ==

There are a number of tools which analyze C code and try to detect typical errors.
None of these tools is perfect, so using different tools with OpenVZ components
will detect more bugs. Be prepared to also get lots of false warnings!

=== cppcheck ===

Cppcheck is a static analysis tool for C/C++ code. Unlike C/C++ compilers
and many other analysis tools it does not detect syntax errors in the code.
Cppcheck primarily detects the types of bugs that the compilers normally do not detect.
The goal is to detect only real errors in the code (i.e. have zero false positives).

Some OpenVZ bugs were found using cppcheck: {{B|1309}}, {{B|1308}}, {{B|1307}}, {{B|1306}}.

=== Coverity ===

vzquota https://scan.coverity.com/projects/457

== Static analysis tools ==

* [http://clang.llvm.org/ Clang Static Analyzer]
* [http://coccinelle.lip6.fr/ Coccinelle]
* [http://repo.or.cz/w/smatch.git smatch]
* [http://saturn.stanford.edu/ Saturn]
* [http://www.dwheeler.com/flawfinder/ Flawfinder]

@@ Line 18: / Line 18: @@
 === Coverity ===
-* [https://scan.coverity.com/projects/457 vzquota] was submitted as project to Coverity services. There are no known bugs found by Coverity in vzquota though.
+* [https://scan.coverity.com/projects/457 vzquota]
+* [https://scan.coverity.com/projects/354 vzctl] fixes [https://src.openvz.org/projects/OVZL/repos/vzctl/commits/b2f9c254447837b987288bd14b40216943f8fba0 b2f9c254447],[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/138b341a23acdfad15667f35ddfa9bbd36603f2c 138b341a23a],[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/337f712eac4a47d8e46e4f505a0a9dc9399573ca 337f712eac4],[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/dfd699a3a525c60a06669a50d723a7680030ca40 dfd699a3a52],[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/767289a2eb03533973e4c186362ee8dee03a8db8 767289a2eb0],[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/1b01bb34a9e1effba8f8082ac4d809c30a560216 1b01bb34a9e],[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/eebe2c1201aef6c57b7717203db6a85bcc98cdb2 eebe2c1201a],[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/09f30856fb4784fe44fb8ae0ce20f8de960f263a 09f30856fb4],[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/54cbc8ae07afa6610308a38511ee1940afbc9623 54cbc8ae07a] and many others.
-* source code of vzctl was submitted to Coverity too. There are amount of issues were found and fixed with their help: [https://src.openvz.org/projects/OVZL/repos/vzctl/commits/b2f9c254447837b987288bd14b40216943f8fba0 b2f9c254447],
+* [https://scan.coverity.com/projects/4700 CRIU] fixes [https://github.com/xemul/criu/commit/08cdae901b566092370f03c23de83f544373e45b 08cdae901b56],[https://github.com/xemul/criu/commit/2b8f61393e0b99e36e292880f6b8da66317176a1 2b8f61393e0b],[https://github.com/xemul/criu/commit/4f9e509c1597d1782e953dc7a83acc4454b2b7ef 4f9e509c1597],[https://github.com/xemul/criu/commit/8d11952f6bc43cdd0a60d4cd8d62d180d4d50877 8d11952f6bc4],[https://github.com/xemul/criu/commit/5e82fba10ed4955385cf3183395a96d7f1121d24 5e82fba10ed4],[https://github.com/xemul/criu/commit/1e919423a845a16f41dc298bf11e20a3b29af4cf 1e919423a845],[https://github.com/xemul/criu/commit/1e0e83701f441852cccae40c97135884aff942b4 1e0e83701f44]
-[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/138b341a23acdfad15667f35ddfa9bbd36603f2c 138b341a23a],
+* [https://scan.coverity.com/projects/5649?tab=overview libvzctl]
-[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/337f712eac4a47d8e46e4f505a0a9dc9399573ca 337f712eac4],
+* [https://scan.coverity.com/projects/383 ploop]
 === Clang ===
-* source code of [http://criu.org/Main_Page CRIU] was checked clang static analyzer:
+* source code of [http://criu.org/Main_Page CRIU] was checked clang static analyzer:[https://github.com/xemul/criu/commit/3ea2fd78ebe21a9dc2f8d64498f3894d4cc310a8 3ea2fd78ebe21],[https://github.com/xemul/criu/commit/e2a0be63d4b8e1e032494f78fffb7f2c493b793c e2a0be63d4b8e],[https://github.com/xemul/criu/commit/a6c5953a80d2498b322c4c61ac5a4a52b7a76ee4 a6c5953a80d24],[https://github.com/xemul/criu/commit/f54f9f0efa8cd6ce14e66e7935bd2625b6f249ad f54f9f0efa8cd],[https://github.com/xemul/criu/commit/f238d56661dae6d555cae249fdf58864268c267d f238d56661dae],[https://github.com/xemul/criu/commit/fcfd705d39b10da4a01227bc0cba75ab2dbab4b3 fcfd705d39b10],[https://github.com/xemul/criu/commit/6ce8d8ab9309f31340edd1e1f5dfc5a6a23759e5 6ce8d8ab9309f]
 === PVS-Studio ===

@@ Line 21: / Line 21: @@
 * [https://scan.coverity.com/projects/457 vzquota] was submitted as project to Coverity services. There are no known bugs found by Coverity in vzquota though.
-* source code of vzctl was submitted to Coverity too. There are amount of issues were found and fixed with their help: [https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/b2f9c254447837b987288bd14b40216943f8fba0 b2f9c254447],
+* source code of vzctl was submitted to Coverity too. There are amount of issues were found and fixed with their help: [https://src.openvz.org/projects/OVZL/repos/vzctl/commits/b2f9c254447837b987288bd14b40216943f8fba0 b2f9c254447],
-[https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/138b341a23acdfad15667f35ddfa9bbd36603f2c 138b341a23a],
+[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/138b341a23acdfad15667f35ddfa9bbd36603f2c 138b341a23a],
-[https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/337f712eac4a47d8e46e4f505a0a9dc9399573ca 337f712eac4],
+[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/337f712eac4a47d8e46e4f505a0a9dc9399573ca 337f712eac4],
-[https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/dfd699a3a525c60a06669a50d723a7680030ca40 dfd699a3a52],
+[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/dfd699a3a525c60a06669a50d723a7680030ca40 dfd699a3a52],
-[https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/767289a2eb03533973e4c186362ee8dee03a8db8 767289a2eb0],
+[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/767289a2eb03533973e4c186362ee8dee03a8db8 767289a2eb0],
-[https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/1b01bb34a9e1effba8f8082ac4d809c30a560216 1b01bb34a9e],
+[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/1b01bb34a9e1effba8f8082ac4d809c30a560216 1b01bb34a9e],
-[https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/eebe2c1201aef6c57b7717203db6a85bcc98cdb2 eebe2c1201a],
+[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/eebe2c1201aef6c57b7717203db6a85bcc98cdb2 eebe2c1201a],
-[https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/09f30856fb4784fe44fb8ae0ce20f8de960f263a 09f30856fb4],
+[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/09f30856fb4784fe44fb8ae0ce20f8de960f263a 09f30856fb4],
-[https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/54cbc8ae07afa6610308a38511ee1940afbc9623 54cbc8ae07a]
+[https://src.openvz.org/projects/OVZL/repos/vzctl/commits/54cbc8ae07afa6610308a38511ee1940afbc9623 54cbc8ae07a]
 and many others.

← Older revision		Revision as of 13:25, 15 May 2015
Line 39:		Line 39:


−	=== ~~clang~~ ===	+	=== Clang ===
		+
		+	* source code of [http://criu.org/Main_Page CRIU] was checked clang static analyzer:
		+	[https://github.com/xemul/criu/commit/3ea2fd78ebe21a9dc2f8d64498f3894d4cc310a8 3ea2fd78ebe21],
		+	[https://github.com/xemul/criu/commit/e2a0be63d4b8e1e032494f78fffb7f2c493b793c e2a0be63d4b8e],
		+	[https://github.com/xemul/criu/commit/a6c5953a80d2498b322c4c61ac5a4a52b7a76ee4 a6c5953a80d24],
		+	[https://github.com/xemul/criu/commit/f54f9f0efa8cd6ce14e66e7935bd2625b6f249ad f54f9f0efa8cd],
		+	[https://github.com/xemul/criu/commit/f238d56661dae6d555cae249fdf58864268c267d f238d56661dae],
		+	[https://github.com/xemul/criu/commit/fcfd705d39b10da4a01227bc0cba75ab2dbab4b3 fcfd705d39b10],
		+	[https://github.com/xemul/criu/commit/6ce8d8ab9309f31340edd1e1f5dfc5a6a23759e5 6ce8d8ab9309f]

−	* source code of [http://criu.org/Main_Page CRIU] was checked clang static analyzer.

← Older revision		Revision as of 13:20, 15 May 2015
Line 31:		Line 31:
	[https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/54cbc8ae07afa6610308a38511ee1940afbc9623 54cbc8ae07a]		[https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/54cbc8ae07afa6610308a38511ee1940afbc9623 54cbc8ae07a]
	and many others.		and many others.
		+
		+	* [http://criu.org/Main_Page CRIU] was checked by Coverity too. We have found number of bugs with it: [https://github.com/xemul/criu/commit/08cdae901b566092370f03c23de83f544373e45b 08cdae901b56], [https://github.com/xemul/criu/commit/2b8f61393e0b99e36e292880f6b8da66317176a1 2b8f61393e0b], [https://github.com/xemul/criu/commit/4f9e509c1597d1782e953dc7a83acc4454b2b7ef 4f9e509c1597],
		+	[https://github.com/xemul/criu/commit/8d11952f6bc43cdd0a60d4cd8d62d180d4d50877 8d11952f6bc4],
		+	[https://github.com/xemul/criu/commit/5e82fba10ed4955385cf3183395a96d7f1121d24 5e82fba10ed4],
		+	[https://github.com/xemul/criu/commit/1e919423a845a16f41dc298bf11e20a3b29af4cf 1e919423a845],
		+	[https://github.com/xemul/criu/commit/1e0e83701f441852cccae40c97135884aff942b4 1e0e83701f44]
		+
		+
		+	=== clang ===
		+
		+	* source code of [http://criu.org/Main_Page CRIU] was checked clang static analyzer.

@@ Line 1: / Line 1: @@
 Static analysis is a technique for finding bugs just by looking at source code without actually running it. That's great, because it can find bugs that are really hard to trigger.
@@ Line 23: / Line 21: @@
 * [https://scan.coverity.com/projects/457 vzquota] was submitted as project to Coverity services. There are no known bugs found by Coverity in vzquota though.
-* source code of vzctl was submitted to Coverity too. There are amount of issues were found and fixed with their help:[https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/b2f9c254447837b987288bd14b40216943f8fba0 b2f9c254447],
+* source code of vzctl was submitted to Coverity too. There are amount of issues were found and fixed with their help: [https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/b2f9c254447837b987288bd14b40216943f8fba0 b2f9c254447],
 [https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/138b341a23acdfad15667f35ddfa9bbd36603f2c 138b341a23a],
 [https://stash.openvz.org/projects/OVZL/repos/vzctl/commits/337f712eac4a47d8e46e4f505a0a9dc9399573ca 337f712eac4],

@@ Line 15: / Line 15: @@
 Some OpenVZ bugs were found using cppcheck: {{B|1309}}, {{B|1308}}, {{B|1307}}, {{B|1306}}.
 === Coverity ===
@@ Line 51: / Line 50: @@
 == Static analysis tools ==

← Older revision		Revision as of 15:48, 9 April 2015
Line 32:		Line 32:
	* [http://saturn.stanford.edu/ Saturn]		* [http://saturn.stanford.edu/ Saturn]
	* [http://www.dwheeler.com/flawfinder/ Flawfinder]		* [http://www.dwheeler.com/flawfinder/ Flawfinder]
		+
		+	[[Category: QA]]