Difference between revisions of "HOWTO-Static Analysis Tools"

Our major tool, located at [https://scan.coverity.com/projects/scummvm?tab=overview this URL].

To get access, you must be a member of ScummVM Team and issue a request on that page. Ping [[Users::Sev sev]] for getting your request approved.

# The analysis runs every Monday night EU time, and completes at around 3am. Ping [[Users::Sev sev]] if you want to have it re-analysed. But due to the size of our project, the limitation is to run analysis every 24 hours.

# Use "Components -> All in Project" for viewing defect in your engine or subsystem (use hamburger menu for navigation)

# Once you fixed a bug, specify it classification, severity, Action should be "Fixed, tested & documented" and assign owner to yourself (autocompletion works there)

# Address all possible issues. If you clearly see that it is a false positive, which is rare but happens, feel free to specify "False Positive", "Ignore" but still assign to yourself

# Regarding TAINTED SCALAR issues, we have great tons of those and we used to dismiss them. Yes, it may lead to an issue when a manually crafted game data might lead to a crash or some memory overflow exploits, but once we have data integrity subsystem implemented, those will be eliminated.

In [[User::Sev sev's]] opinion it is mostly useless. It is an AI-based tool that seemingly runs by pattern matching. As a result, it produces tons of some strange complaints about somebody's standards of code formatting etc.