[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 14 Sep 2012 03:14:41 +0400
From: Solar Designer <solar@...nwall.com>
To: john-dev@...ts.openwall.com
Subject: Re: Static analysis of John using Coverity
Robert,
On Thu, Sep 13, 2012 at 03:44:48PM -0400, Robert B. Harris wrote:
> What do you think about taking advantage of the free (since we are Open source) static analysis of John using Coverity software? This software seems to have a pretty good reputation. It appears that Alex or someone he designates, would submit the source code to their website below, and they would generate a report that could be view by again, the people Alex designates.
Personally, I don't need this at this time, except maybe to get a feel
of Coverity's current capabilities for its possible other uses. Maybe
we should run it on other/smaller Openwall programs, where, unlike in
JtR, it is more obvious what constitutes untrusted input. BTW, for JtR
it could be nice to specify this in some documentation file - after we
decide on it, of course.
Also, for JtR, I feel that only the core tree is worth such analysis
currently. Jumbo's code quality is too low. (The core tree's could be
improved as well, to be fair.) Well, maybe some of the positives will
make us identify and patch specific bugs... while keeping the overall
quality almost as low.
Overall, I don't mind someone else in here looking into this, indeed.
Thanks,
Alexander
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
