Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:46188
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain no-surprises.co.uk designates 80.68.93.37 as permitted sender)
Message-ID: <4B0D258E.3060403@no-surprises.co.uk>
Date: Wed, 25 Nov 2009 12:39:42 +0000
User-Agent: Thunderbird 2.0.0.23 (X11/20090817)
MIME-Version: 1.0
To: Jess Portnoy <jess@zend.com>
CC: internals@lists.php.net
References: <4B0BE3B5.1030606@no-surprises.co.uk> <4B0D23E4.4070305@zend.com>
In-Reply-To: <4B0D23E4.4070305@zend.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] [PATCH] potential null dereference in ext/ftp/ftp.c
From: michael@no-surprises.co.uk (Michael Maclean)

Hi,

Jess Portnoy wrote:
> clang is indeed a great tool but since it does a lot more than just 
> static analysis.

Yeah, it looked like an interesting thing and so I decided to play with 
it. Incidentally, I discovered later that clang appears to compile PHP 
5.3 pretty much flawlessly just now (at least for my particular set of 
configure options). The scan-build analyser thing I used ran the code 
through clang before forwarding it on to gcc for the actual compilation.

> For those cases where one wants source code analysis, especially 
> security oriented, I'd recommend flawfinder 
> [http://www.dwheeler.com/flawfinder].

I'll have a look. Thanks for the tip.

> I ran it against the PHP 5.2.11 sources and am now sorting through 
> results, patching suggestions may follow :)

Heh. If anyone wants to see the output from scan-build that I got, it's 
at http://mgdm.net/~michael/php-5.3-clang/ along with the notes.txt that 
I'm filling in as I go along.

Michael