Re: Dealing with static code analysis in Fedora

2012-12-15 Thread Richard W.M. Jones
A long time ago I looked at automating some of the invariants in libvirt. I didn't get very far, but you can see what I did here: http://people.redhat.com/~rjones/cil-analysis-of-libvirt/ The thing that is interesting about libvirt is there are two classes of static error. The first is stuff li

Static Analysis SIG ? (was Re: Dealing with static code analysis in Fedora)

2012-12-14 Thread David Malcolm
On Thu, 2012-12-13 at 21:45 +0200, Alek Paunov wrote: > On 11.12.2012 23:52, David Malcolm wrote: > > We'd be able to run all of the code in Fedora through static analysis > > tools, and slurp the results into the database > > Dave, I really do not know what to say first :-). The subject is so >

Re: Dealing with static code analysis in Fedora

2012-12-13 Thread Alek Paunov
On 11.12.2012 23:52, David Malcolm wrote: We'd be able to run all of the code in Fedora through static analysis tools, and slurp the results into the database Dave, I really do not know what to say first :-). The subject is so important and there are so many aspects and application fields - IM

Re: Dealing with static code analysis in Fedora

2012-12-12 Thread David Malcolm
On Wed, 2012-12-12 at 15:03 -0500, Steve Grubb wrote: > On Wednesday, December 12, 2012 01:00:36 AM Paulo César Pereira de Andrade > wrote: > > > A while back I ran my static checker on all of the Python extension > > > > > > modules in Fedora 17: > > > http://fedoraproject.org/wiki/Features/Sta

Re: Dealing with static code analysis in Fedora

2012-12-12 Thread Steve Grubb
On Wednesday, December 12, 2012 01:00:36 AM Paulo César Pereira de Andrade wrote: > > A while back I ran my static checker on all of the Python extension > > > > modules in Fedora 17: > > http://fedoraproject.org/wiki/Features/StaticAnalysisOfPythonRefcounts > > > > I wrote various scripts to bu

Re: Dealing with static code analysis in Fedora

2012-12-12 Thread David Malcolm
On Wed, 2012-12-12 at 16:46 +0100, Michal Toman wrote: > Hi Dave! > > We have started a similar project in ABRT some year ago. The original > purpose was to automatically determine some crash characteristics > (security impact, unchecked user input etc.). The overall idea is > rebuilding the gi

Re: Dealing with static code analysis in Fedora

2012-12-12 Thread David Malcolm
On Wed, 2012-12-12 at 01:00 -0200, Paulo César Pereira de Andrade wrote: (Thanks; various replies inline below) > 2012/12/11 David Malcolm : > > A while back I ran my static checker on all of the Python extension > > modules in Fedora 17: > > http://fedoraproject.org/wiki/Features/StaticAnalysi

Re: Dealing with static code analysis in Fedora

2012-12-12 Thread Michal Toman
Hi Dave! We have started a similar project in ABRT some year ago. The original purpose was to automatically determine some crash characteristics (security impact, unchecked user input etc.). The overall idea is rebuilding the given package with some compiler plugin and go through the AST base

Re: Dealing with static code analysis in Fedora

2012-12-11 Thread Paulo César Pereira de Andrade
2012/12/11 David Malcolm : > A while back I ran my static checker on all of the Python extension > modules in Fedora 17: > http://fedoraproject.org/wiki/Features/StaticAnalysisOfPythonRefcounts > > I wrote various scripts to build the packages in a mock environment that > injects my checker into

Dealing with static code analysis in Fedora

2012-12-11 Thread David Malcolm
A while back I ran my static checker on all of the Python extension modules in Fedora 17: http://fedoraproject.org/wiki/Features/StaticAnalysisOfPythonRefcounts I wrote various scripts to build the packages in a mock environment that injects my checker into gcc, then wrote various scripts to tri