Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:46187
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain zend.com designates 212.25.124.185 as permitted sender)
Message-ID: <4B0D23E4.4070305@zend.com>
Date: Wed, 25 Nov 2009 14:32:36 +0200
User-Agent: Mozilla-Thunderbird 2.0.0.22 (X11/20090706)
MIME-Version: 1.0
To: Michael Maclean <michael@no-surprises.co.uk>
CC: internals@lists.php.net
References: <4B0BE3B5.1030606@no-surprises.co.uk>
In-Reply-To: <4B0BE3B5.1030606@no-surprises.co.uk>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [PATCH] potential null dereference in ext/ftp/ftp.c
From: jess@zend.com (Jess Portnoy)

Hello,

clang is indeed a great tool but since it does a lot more than just 
static analysis.
For those cases where one wants source code analysis, especially 
security oriented, I'd recommend flawfinder 
[http://www.dwheeler.com/flawfinder].
This is a very good tool and it exists in the official repos for Debian, 
Ubuntu and FC [and probably many others but these I checked]. It can 
operate on both C and C++ source files [less relevant for the PHP engine 
but good to know, right?].

I ran it against the PHP 5.2.11 sources and am now sorting through 
results, patching suggestions may follow :)

May the source be with you,
Best regards,
Jess Portnoy



Michael Maclean wrote:
> Hi,
> Gwynne pointed me at the clang static analyser earlier on today, and so
> I've run it against current PHP_5_3. In the course of messing with it,
> it noticed a potential null dereference in ext/ftp - I've attached a
> one-liner to fix it.
>
> Michael
>