Coverity is a sophisticated static code analysis tool.
Among other things, it checks for the conditions listed here:
https://www.securecoding.cert.org/confluence/display/seccode/Coverity+Prevent
Below is the result of running a scan over the pcp src tree:
http://people.redhat.com/mgoodwin/pcp-cov/index.html
Nathan and Eric have already looked at some of these - each error
is numbered and in most cases the error is obvious, but certainly
not all. Perhaps we should divvy them up between ourselves, fix
the obvious ones, and then dive into the more complicated
cases. We'll probably get some new QA tests out of this too.
Cheers
-- Mark
|