65
edits
Difference between revisions of "HOWTO-Static Analysis Tools"
Jump to navigation
Jump to search
m
HOWTO-Static Analysis Tools (view source)
Revision as of 10:31, 11 March 2023
, 10:31, 11 March 2023Fix markup for pvs studio link
m (Grammer fixis) |
m (Fix markup for pvs studio link) |
||
| (3 intermediate revisions by 2 users not shown) | |||
| Line 17: | Line 17: | ||
# Regarding the TAINTED SCALAR issues, we have tons of those that we used to dismiss. Yes, it may lead to an issue when manually crafted game data might lead to a crash or some memory overflow exploits, but once we have the data integrity subsystem implemented, those will be eliminated. | # Regarding the TAINTED SCALAR issues, we have tons of those that we used to dismiss. Yes, it may lead to an issue when manually crafted game data might lead to a crash or some memory overflow exploits, but once we have the data integrity subsystem implemented, those will be eliminated. | ||
== PVS-Studio == | |||
We use Open Source license from [https://pvs-studio.com/en/pvs-studio/?utm_source=github&utm_medium=organic&utm_campaign=open_source PVS-Studio] - static analyzer for C, C++, C#, and Java code. They were generous in providing us with free access. | |||
<font color=red>IMPORTANT:</font> Per our license requirement, you must mention PVS-Studio in your commit log messages. Please, use the following format: | |||
SUBSYSTEM: Description. PVS-Studio VXXXX | |||
Where VXXXX is the diagnostics number of PVS-Studio. | |||
The tool is run daily on the buildbot machine, every night at around 2am. The reports are available at [https://analysis.scummvm.org/ https://analysis.scummvm.org/]. | |||
To get access, please talk to [[User:Sev|sev]] or [[User:Rootfather|rootfather]], then we add you to .htpasswd | |||
There you may find a set of different log formats. The useful ones are: | |||
* scummvm.html Single downloadable HTML file | |||
* scummvm.fullhtml Multiple files HTML min-website, you may browse it online | |||
* scummvm.vscode.sarif You may load this into Sarif plugin for VSCode. [https://pvs-studio.com/en/docs/manual/6590/ Here is how]. | |||
* scummvm.xml These are consumed by PVS-Studio internal tools | |||
In general, read [https://pvs-studio.com/en/docs/ their manuals], they are comprehensive and nicely written. | |||
== Codacy == | == Codacy == | ||
We use it on | We use it on GitHub. | ||
In [[User:Sev | sev's]] opinion it is mostly useless. It is an AI-based tool that seemingly runs by pattern matching. As a result, it produces tons of strange complaints about somebody's code formatting standards, etc. | In [[User:Sev | sev's]] opinion it is mostly useless. It is an AI-based tool that seemingly runs by pattern matching. As a result, it produces tons of strange complaints about somebody's code formatting standards, etc. | ||