4 ms·

Another OOB? At this point, hasn't anyone run a static analyzer on the darn thing and fixed all the warnings? 11/16 - NPR - https://mta.openssl.org/pipermail/o

by imglorp 10y ago

Another OOB? At this point, hasn't anyone run a static analyzer on the darn thing and fixed all the warnings? 11/16 - NPR - https://mta.openssl.org/pipermail/openssl-announce/2016-November/000087.html https://mta.openssl.org/pipermail/openssl-announce/2016-Nove... 9/16 - dangling pointer - https://mta.openssl.org/pipermail/openssl-announce/2016-September/000083.html https://mta.openssl.org/pipermail/openssl-announce/2016-Sept... 5/16 - buffer underflow - https://mta.openssl.org/pipermail/openssl-announce/2016-May/000072.html https://mta.openssl.org/pipermail/openssl-announce/2016-May/... 3/16 - NPE, double free, etc - https://mta.openssl.org/pipermail/openssl-announce/2016-March/000066.html https://mta.openssl.org/pipermail/openssl-announce/2016-Marc... ... I'm tired looking...

acdha 10y ago
Every time I've looked at the code, it's been … idiosyncratic to the point where I would imagine that “fixing all of the warnings” would be a significant exercise.
aninteger 10y ago
The OpenBSD team runs coverity on their LibreSSL fork and continues to improve the codebase constantly. More distributions are switching to LibreSSL too.
MichaelGG 10y ago
If static analyzers could find all problems in C with a low false positive rate, then that'd eliminate one of the big problems with C and partially negate the need for Rust.
- technion 10y ago
  I've run several respected static analyzers against several well respected projects and I'm lucky if I get more than 2-3 false positives. In the Argon2 reference library, the one alert from Infer was a genuine bug I sent a PR for, followed by one alert from tis-interpreter that was another genuine bug. clang-analyser produces clean output. It's true that you get so many false positives under OpenSSL it's not feasible to review. I would contend this is an indicator of code quality more than an indicator of poor static analysers.

by imglorp 10y ago

acdha 10y ago

Every time I've looked at the code, it's been … idiosyncratic to the point where I would imagine that “fixing all of the warnings” would be a significant exercise.

aninteger 10y ago

The OpenBSD team runs coverity on their LibreSSL fork and continues to improve the codebase constantly. More distributions are switching to LibreSSL too.

MichaelGG 10y ago

If static analyzers could find all problems in C with a low false positive rate, then that'd eliminate one of the big problems with C and partially negate the need for Rust.

technion 10y ago
I've run several respected static analyzers against several well respected projects and I'm lucky if I get more than 2-3 false positives. In the Argon2 reference library, the one alert from Infer was a genuine bug I sent a PR for, followed by one alert from tis-interpreter that was another genuine bug. clang-analyser produces clean output. It's true that you get so many false positives under OpenSSL it's not feasible to review. I would contend this is an indicator of code quality more than an indicator of poor static analysers.