4 ms·

Well, http://www.opensource.apple.com/release/os-x-109/ http://www.opensource.apple.com/release/os-x-109/ has the list of open sourced code from Mavericks. Let

Well, http://www.opensource.apple.com/release/os-x-109/ http://www.opensource.apple.com/release/os-x-109/ has the list of open sourced code from Mavericks. Let the code analysis begin, it would help everyone out.

hengheng 13y ago
Honest question, what are decent tools to find bugs like this in C code nowadays? I was saddened to read that gcc cannot check for unreachable code.
- anon1385 13y ago
  The -Wunreachable-code flag does work in clang, to some extent at least (I have a rather old version here so YMMV). Other tools that may help: The clang static analyzer: http://clang-analyzer.llvm.org http://clang-analyzer.llvm.org Valgrind: http://www.valgrind.org http://www.valgrind.org Address Sanitizer: http://clang.llvm.org/docs/AddressSanitizer.html http://clang.llvm.org/docs/AddressSanitizer.html The various -fsanitize options in clang (undefined behaviours, integer overflows etc): http://clang.llvm.org/docs/UsersManual.html#id28 http://clang.llvm.org/docs/UsersManual.html#id28
  - mzs 13y ago
    There is a list here: http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis http://en.wikipedia.org/wiki/List_of_tools_for_static_code_a... Also there is oclint not listed there, which is pretty amazing, but it has a strange notation for ignoring wqrnings. splint is pretty good too though and still supports the legacy lint stuff like /* NOTREACHED / BSD lint seems to work still (though it looks like the lintlib is no longer built on FreeBSD and stdlib is not lint clean!) but even it would have caught this gotofail: 01: #include <stdlib.h> 02: 03: int 04: main(int argc, char *argv[]) 05: { 06: if (argc == 0) 07: goto fail; 08: goto fail; 09: 10: exit(0); 11: 12: 13: fail: 14: exit(1); 15: } $ lint a.c a.c: stdlib.h(286): warning: ANSI C does not support 'long long' [265] stdlib.h(287): warning: ANSI C does not support 'long long' [265] stdlib.h(287): warning: ANSI C does not support 'long long' [265] a.c(10): warning: statement not reached [193] a.c(15): warning: function main falls off bottom without returning value [217] a.c(4): warning: argument argv unused in function main [231] _types.h(61): warning: struct __timer never defined [233] _types.h(62): warning: struct __mq never defined [233] lint: cannot find llib-lc.ln Lint pass2: exit used( a.c(10) ), but not defined $ cc a.c $ ./a.out $ echo $? 1 edit: grrr, sorry small copy/paste mistakes before.
spiralpolitik 13y ago
The question I have is how many Open Source projects use static analysis tools as part of their development process? Given that the code is publicly available it seems likely that bad actors would be using such tools (both proprietary and open) to find exploits for each release. I remember Eric Raymond blogging about using Coverity to analyze gpsd but beyond that I don't recall any wider discussion about the issue.

hengheng 13y ago

Honest question, what are decent tools to find bugs like this in C code nowadays? I was saddened to read that gcc cannot check for unreachable code.

anon1385 13y ago
The -Wunreachable-code flag does work in clang, to some extent at least (I have a rather old version here so YMMV). Other tools that may help: The clang static analyzer: http://clang-analyzer.llvm.org http://clang-analyzer.llvm.org Valgrind: http://www.valgrind.org http://www.valgrind.org Address Sanitizer: http://clang.llvm.org/docs/AddressSanitizer.html http://clang.llvm.org/docs/AddressSanitizer.html The various -fsanitize options in clang (undefined behaviours, integer overflows etc): http://clang.llvm.org/docs/UsersManual.html#id28 http://clang.llvm.org/docs/UsersManual.html#id28
- mzs 13y ago
  There is a list here: http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis http://en.wikipedia.org/wiki/List_of_tools_for_static_code_a... Also there is oclint not listed there, which is pretty amazing, but it has a strange notation for ignoring wqrnings. splint is pretty good too though and still supports the legacy lint stuff like /* NOTREACHED / BSD lint seems to work still (though it looks like the lintlib is no longer built on FreeBSD and stdlib is not lint clean!) but even it would have caught this gotofail: 01: #include <stdlib.h> 02: 03: int 04: main(int argc, char *argv[]) 05: { 06: if (argc == 0) 07: goto fail; 08: goto fail; 09: 10: exit(0); 11: 12: 13: fail: 14: exit(1); 15: } $ lint a.c a.c: stdlib.h(286): warning: ANSI C does not support 'long long' [265] stdlib.h(287): warning: ANSI C does not support 'long long' [265] stdlib.h(287): warning: ANSI C does not support 'long long' [265] a.c(10): warning: statement not reached [193] a.c(15): warning: function main falls off bottom without returning value [217] a.c(4): warning: argument argv unused in function main [231] _types.h(61): warning: struct __timer never defined [233] _types.h(62): warning: struct __mq never defined [233] lint: cannot find llib-lc.ln Lint pass2: exit used( a.c(10) ), but not defined $ cc a.c $ ./a.out $ echo $? 1 edit: grrr, sorry small copy/paste mistakes before.

spiralpolitik 13y ago

The question I have is how many Open Source projects use static analysis tools as part of their development process? Given that the code is publicly available it seems likely that bad actors would be using such tools (both proprietary and open) to find exploits for each release. I remember Eric Raymond blogging about using Coverity to analyze gpsd but beyond that I don't recall any wider discussion about the issue.