el_programmer

PVS-Studio team regularly checks different open projects and publishes articles on the results of these checks. This time, Andrey Karpov (CTO) accomplished the checking of some projects that are part of the Tizen operating system and has detected about 900 errors. The article is devoted to the review of many of these errors and will be useful both for beginners and experienced developers. The types of errors that will be discussed in the article: CWE-14: Compiler Removal of Code to Clear Buffers CWE-131: Incorrect Calculation of Buffer Size CWE-134 Use of Externally-Controlled Format String CWE-393 Return of Wrong Status Code CWE-457: Use of Uninitialized Variable CWE-476: NULL Pointer Dereference CWE-562: Return of Stack Variable Address CWE-563: Assignment to Variable without Use ('Unused Variable') CWE-570: Expression is Always False CWE-571: Expression is Always True CWE-690: Unchecked Return Value to NULL Pointer Dereference CWE-697: Insufficient Comparison CWE-762: Mismatched Memory Management Routines CWE-770: Allocation of Resources Without Limits or Throttling CWE-787: Out-of-bounds Write CWE-805: Buffer Access with Incorrect Length Value It is impossible to describe all the 900 errors, that is why most of them will be provided in a list. However, if you wish, you can examine each of the found defects, using the information provided about the location of the error. According to the results, there is a prediction in the article, that the PVS-Studio analyzer can identify about 27000 errors in this project. This article demonstrates that during the development of the large projects, static analysis is not just a useful, but an absolutely necessary part of the development process. Get some coffee and cookies, as there is a programmer thriller waiting for us. Link to the article: https://www.viva64.com/en/b/0519/