Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:102925
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain ctors.net designates 209.85.213.43 as permitted sender)
MIME-Version: 1.0
References: <CAN+C6bW7_zW7M5yWnNYch7eU94d4ZVY0BMK0+-_vq=6=5rqMfg@mail.gmail.com>
In-Reply-To: <CAN+C6bW7_zW7M5yWnNYch7eU94d4ZVY0BMK0+-_vq=6=5rqMfg@mail.gmail.com>
Date: Fri, 20 Jul 2018 13:18:36 +0200
Message-ID: <CAN+C6bXS-UkguBUd=kX0X6wH18YiziDypmsR0c41wtGSszRwRQ@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000a512bc05716c75bc"
Subject: Re: Improving php-src with static analyzers
From: tom@ctors.net (Tom Van Looy)

--000000000000a512bc05716c75bc
Content-Type: text/plain; charset="UTF-8"

Hi everyone

I am still regularly running Coverity scans on php-src. If you are
interested do not hesitate to get access on
https://scan.coverity.com/projects/php-src-tvlooy


On Sun, Dec 10, 2017 at 4:19 PM Tom Van Looy <tom@ctors.net> wrote:

> Hi folks
>
> I have the idea to improve the PHP source by using static analyzers. The
> first one that I would use for this is clang's scan-build and the second
> one is Coverity. The idea is not new, because I can find people talking
> about this on the internals mailing list, but that is all at least 4-6
> years ago.
>
> I found some interesting things with these tools already but there are
> some false positives too. It just takes time to look into the reports and
> figure it out, but for me it's a good way to learn more about C and
> php-src. If you could share your experience with static analyzers that
> would be great, maybe there are better analyzers out there that I don't
> know about, let me know. Is there are reasons why PHP doesn't use these
> tools in the build process, or maybe they are used but I just don't know,
> also let me know. Maybe you think this is just a bad idea, please share
> your opinion.
>
> I see that there is already a php-src project on Coverity but it was not
> analyzed for years. I have my own project on Coverity
> https://scan.coverity.com/projects/php-src-tvlooy just ask if you want
> access.
>
> I don't have much C experience. So before I get more people on board with
> this idea I would welcome some feedback from people that know better than
> me.
>
> Thanks in advance!
>
> Kind regards,
>
> Tom Van Looy
>
>

--000000000000a512bc05716c75bc--