Folks thanks for that

ill keep it in mind.. next thing is to somehow mark reviewed and confirmed
false positives as part of the build / release process...
thanks agiain



On Tue, 27 Aug 2024 at 15:27, Florian Obser <florian@openbsd.org> wrote:

> On 2024-08-27 15:35 +02, Janne Johansson <icepic.dz@gmail.com> wrote:
> > Den mån 26 aug. 2024 kl 00:14 skrev Tom Smyth <
> tom.smyth@wirelessconnect.eu>:
> >> Folks,
> >> Im just wondering what other porters experience of  scan-build  for the
> projects that you are maintaining ?
> >> has it been useful in identifying bugs?... or is the analysis engine
> too basic  or shallow to properly analyse code ?
> >
> > When I run it on "openbsd" code, the things it finds are often super
> > deep, requiring 37 steps and that syscalls or libc calls return 0 when
>
> yeah, everything that's more than 10 deep is probably BS. Things that
> are 5 or less deep are actionable in my experience.
>
> [...]
>
> > It does find trivial things like
> >
> http://c66.it.su.se:8080/obsd/2019-10-25/scan-build-2019-10-25-192004-30128-1/report-36d1ed.html#EndPath
>
> I like to look at dead stores, they are either there for symmetry
> reasons or they indicate that something was not quite thought through.
>
> In both cases just removing the dead store and sending a patch is
> wrong. In the first case you are destroying the symmetry and you are
> just creating noise, and in the 2nd case you didn't put in the effort to
> figure out how that whole function could be written better.
>
> I think scan-build can guide someone who has dabbled in C before where
> to look.
>
> scan-build guidance is not always well received.
>
> Story time: I once considered using and contributing to a project, so
> first step was to run it through scan-build to get a feel for the
> structure of the code and have some ideas where the skeletons are
> buried or where someone was sloppy. So I carefully analysed the reports
> and submitted some patches. They were all happily accepted.
>
> I never mentioned that this came out of scan-build, because it was 99%
> my work anyway. So by patch 10 or 11 I write something like, hey,
> scan-build pointed me at this other thing, it technically can not happen
> because you get lucky all the way over there, but it is a pretty well
> aimed foot gun, and this should be written more defensive over
> here. Patch attached.
>
> Their (only!) response: Yeah, we are not interested in scan-build
> reports.
>
> OK then, good luck to you I guess...
>
> --
> In my defence, I have been left unsupervised.
>


-- 
Kindest regards,
Tom Smyth.