re: NULL ptr dereferences found with Calysto static checker
Domagoj wrote:
I've ran my static checker Calysto on Wine v0.9.35 and got 78 bug reports:... If you are interested in the reports, please: 1) read http://www.cs.ubc.ca/~babic/index_calysto_community.htm 2) if the conditions are acceptable, let me know where to send the reports.
The conditions look very minimal, we should be fine with them. A check once a month should be fine. Just send the results to wine-devel(a)winehq.org. (There's some chance we'll ask you to switch to sending them somewhere else, but that will do initially.) For the moment just put the calysto.org link in the mail. Once it's clear the results are useful, somebody will link to calysto at least from our wiki. Say, whatever happened to Coverity's scans of Wine? I just logged in to the Wine results at http://scan.coverity.com, and the last scan seems to have been last July. Did they set up a new, private site for us? Paul V., do you know? - Dan -- Wine for Windows ISVs: http://kegel.com/wine/isv
The web page is a bit sparse, so does calysto offer anything special e.g. anything that distinguishes it from coverity? Is it free software? On Wed, Jun 20, 2007 at 03:05:33PM -0700, Dan Kegel wrote:
Domagoj wrote:
http://www.cs.ubc.ca/~babic/index_calysto_community.htm 2) if the conditions are acceptable, let me know where to send the reports. The conditions look very minimal, we should be fine with them.
That page says "to provide me with prompt and precise feedback on the bug reports". We still have 284 errors with status uninspected on coverity and there are also more from smatch. I don't think we can guarantee "prompt" and I'm not sure if Dan Kegel wanted to imply that he would inspect each of your bug reports himself.
Say, whatever happened to Coverity's scans of Wine? I just logged in to the Wine results at http://scan.coverity.com, and the last scan seems to have been last July. Did they set up a new, private site for us? Paul V., do you know?
Use http://scan2.coverity.com:7479/ to login, there the last scan is from 2007-May-25 09:03:30. Jan
Hi, On 6/20/07, Jan Zerebecki <jan.wine(a)zerebecki.de> wrote:
The web page is a bit sparse, so does calysto offer anything special e.g. anything that distinguishes it from coverity?
Yes, it's a different technology - no pattern matching at all.
Is it free software?
Probably it will be free for non-commercial use. Projects that join Calysto community will get free checking. Source won't be released because there's plenty of unpublished research in there.
That page says "to provide me with prompt and precise feedback on the bug reports". We still have 284 errors with status uninspected on coverity and there are also more from smatch. I don't think we can guarantee "prompt" and I'm not sure if Dan Kegel wanted to imply that he would inspect each of your bug reports himself.
The false positve rates are very low. In the first iteration, I'll postprocess all the reports, later you will be getting the reports directly. Regards, -- Domagoj Babic http://www.domagoj.info/
Dan Kegel wrote:
Say, whatever happened to Coverity's scans of Wine? I just logged in to the Wine results at http://scan.coverity.com, and the last scan seems to have been last July. Did they set up a new, private site for us? Paul V., do you know? - Dan
HI Dan, No I'm sorry. I saw an email a few weeks ago where Marcus reported a problem with a full database. No messages since. I'll contact David to see what's up. Marcus also mentions a second site for Wine : http://scan2.coverity.com:7479/ instead of http://scan.coverity.com:7479/. The result are till the end of May, so still not good. As said, I'll contact Coverity and report back. Cheers, Paul.
On Thu, Jun 21, 2007 at 08:40:12AM +0200, Paul Vriens wrote:
Dan Kegel wrote:
Say, whatever happened to Coverity's scans of Wine? I just logged in to the Wine results at http://scan.coverity.com, and the last scan seems to have been last July. Did they set up a new, private site for us? Paul V., do you know? - Dan
HI Dan,
No I'm sorry. I saw an email a few weeks ago where Marcus reported a problem with a full database. No messages since. I'll contact David to see what's up.
Marcus also mentions a second site for Wine : http://scan2.coverity.com:7479/ instead of http://scan.coverity.com:7479/. The result are till the end of May, so still not good.
As said, I'll contact Coverity and report back.
The mainpage was not fixed to link to scan2. The scan2 results seems however more current. Ciao, Marcus
Marcus Meissner wrote:
On Thu, Jun 21, 2007 at 08:40:12AM +0200, Paul Vriens wrote:
Dan Kegel wrote:
Say, whatever happened to Coverity's scans of Wine? I just logged in to the Wine results at http://scan.coverity.com, and the last scan seems to have been last July. Did they set up a new, private site for us? Paul V., do you know? - Dan
HI Dan,
No I'm sorry. I saw an email a few weeks ago where Marcus reported a problem with a full database. No messages since. I'll contact David to see what's up.
Marcus also mentions a second site for Wine : http://scan2.coverity.com:7479/ instead of http://scan.coverity.com:7479/. The result are till the end of May, so still not good.
As said, I'll contact Coverity and report back.
The mainpage was not fixed to link to scan2.
The scan2 results seems however more current.
Ciao, Marcus
Yeah, I just wrote an email to Coverity about the official contacts for Wine (me and Jan Zerebecki for now). I also mentioned the same thing about scan and scan2 and the missing link on the main page. Cheers, Paul.
On 6/20/07, Paul Vriens <paul.vriens.wine(a)gmail.com> wrote:
Marcus also mentions a second site for Wine : http://scan2.coverity.com:7479/ instead of http://scan.coverity.com:7479/. The result are till the end of May,
That's recent enough to be able to compare with Calypso, though. It will be interesting to see how the two checkers do at finding NULL dereferences. - Dan
Dan Kegel wrote:
On 6/20/07, Paul Vriens <paul.vriens.wine(a)gmail.com> wrote:
Marcus also mentions a second site for Wine : http://scan2.coverity.com:7479/ instead of http://scan.coverity.com:7479/. The result are till the end of May,
That's recent enough to be able to compare with Calypso, though. It will be interesting to see how the two checkers do at finding NULL dereferences. The problem with NULL pointer dereferences is that those may be valid. If a function crashes in Windows on a NULL pointer dereference Wine should/has do the same.
bye michael -- Michael Stefaniuc Tel.: +49-711-96437-199 Sr. Network Engineer Fax.: +49-711-96437-111 Red Hat GmbH Email: mstefani(a)redhat.com Hauptstaetterstr. 58 http://www.redhat.de/ D-70178 Stuttgart
Hi, On 6/21/07, Michael Stefaniuc <mstefani(a)redhat.com> wrote:
The problem with NULL pointer dereferences is that those may be valid. If a function crashes in Windows on a NULL pointer dereference Wine should/has do the same.
Why? Wine is meant to run software "written for windows". I doubt that many people use Wine as a platform to write software intended for windows. So, if you run all the applications the Windows run, just better, what's wrong with that? Bug compatiblity is overpriced in many situations, I think this is one of them. Anyways, Wine reports are on my todo list, I'll get back to you as soon as I find time to check them out and postprocess a bit. -- Domagoj Babic http://www.domagoj.info/
On 6/21/07, Domagoj Babic <babic.domagoj(a)gmail.com> wrote:
Hi,
On 6/21/07, Michael Stefaniuc <mstefani(a)redhat.com> wrote:
The problem with NULL pointer dereferences is that those may be valid. If a function crashes in Windows on a NULL pointer dereference Wine should/has do the same.
Why?
Several apps depend on these 'bugs'.
Wine is meant to run software "written for windows". I doubt that many people use Wine as a platform to write software intended for windows. So, if you run all the applications the Windows run, just better, what's wrong with that?
If we don't conform to the API, it's not better. Like I said before, we've run into bugs where an app is expecting an exception, and it won't work if it doesn't get it.
Bug compatiblity is overpriced in many situations, I think this is one of them.
How is it overpriced? It's significantly easier to conform exactly to the test suite results then it is to pick willy nilly that we're going to deviate from the API.
Anyways, Wine reports are on my todo list, I'll get back to you as soon as I find time to check them out and postprocess a bit.
-- James Hawkins
On 6/21/07, James Hawkins <truiken(a)gmail.com> wrote:
On 6/21/07, Michael Stefaniuc <mstefani(a)redhat.com> wrote:
The problem with NULL pointer dereferences is that those may be valid. If a function crashes in Windows on a NULL pointer dereference Wine should/has do the same.
Why?
Several apps depend on these 'bugs'.
This is true, many applications are written to work around bugs in windows. If we fix these bugs, then the apps dont have anything to work around, and therefore they do unexpected things....
Wine is meant to run software "written for windows". I doubt that many people use Wine as a platform to write software intended for windows. So, if you run all the applications the Windows run, just better, what's wrong with that?
If we don't conform to the API, it's not better. Like I said before, we've run into bugs where an app is expecting an exception, and it won't work if it doesn't get it.
See above -- Thanks Tom
Hi, On 6/21/07, Tom Spear <speeddymon(a)gmail.com> wrote:
This is true, many applications are written to work around bugs in windows. If we fix these bugs, then the apps dont have anything to work around, and therefore they do unexpected things....
The software development process is soo broken. Anyways, you can expect a lot from an automatic checking tool, but you can't expect it to know the expected behavior of Windows :-) After I get the reports ready, I'll let you decide what's considered Windows-compatibility :-D Regards, -- Domagoj Babic http://www.domagoj.info/
participants (9)
-
Dan Kegel -
Dan Kegel -
Domagoj Babic -
James Hawkins -
Jan Zerebecki -
Marcus Meissner -
Michael Stefaniuc -
Paul Vriens -
Tom Spear