Questions tagged [coverity-prevent]

Coverity Prevent is a commercial static source code analyzer that looks for errors such as inconsistent NULL checks, dead code, unused return values, missing break statement, etc.

Coverity Prevent is the old name for Coverity Static Analysis, a commercial product produced by Coverity, Inc.

Coverity Static Analysis exists for C/C++, Java and C#. The analysis works on the AST rather than on the source code. The AST is generated by Coverity's compiler which observes the native compiler and then outputs the AST for the analysis phase emulating the behavior of the native compiler.

The analysis phase runs multiple "checkers" which look for common defects along multiple paths (excluding those which are not feasible at run-time).

Common problems with running Coverity Static Analysis would be errors from "cov-build" or "cov-analyze" steps. Those are best addressed with Coverity support or on Coverity Developer Forums (http://communities.coverity.com/)

Questions which may be of interest to general development communities would be discussions of why a particular piece of code was flagged as being incorrect or suboptimal.

In most cases, it will be necessary to provide sufficient context to make clear what the analysis is flagging - this would include the code flagged as well as all relevant definitions of types, etc.

There have already been extensive discussions about the benefits of Static Analysis tools and comparison of free and commercial offerings, but any completely new questions of that type could be appropriate candidates for this tag.

35 questions
17
votes
4 answers

Coverity for Java static analysis

I'd like to get comments from people who have used or evaluated Coverity for statically analysing Java-code. I know it's popular in C/C++ world, but is it worth spending the money for Java analysis or am I better off with PMD, Findbugs and other…
auramo
  • 13,167
  • 13
  • 66
  • 88
13
votes
6 answers

"x = ++x" is it really undefined?

I am using Coverity Prevent on a project to find errors. It reports an error for this expression (The variable names are of course changed): x= (a>= b) ? ++x: 0; The message is: EVALUATION_ORDER defect: In "x=(a>= b) ? ++x: 0;", "x" is…
Magnus Andermo
  • 353
  • 4
  • 8
9
votes
4 answers

Tainted string message from Coverity using getenv

Running Coverity on my code results in tainted string error message. I am using the "path" variable declared in the stack, so I am not sure why I am seeing errors. I can only think that using getenv() directly in the strncpy() is causing the error.…
Jay Chung
  • 175
  • 1
  • 1
  • 11
7
votes
3 answers

How to get Coverity static analysis compatible with C++0x standard?

I am using a Wind River Compiler 4 (gcc (C) and g++ (C++)) and it compiles all my projects without any problems. Now I have to use Coverity Static Analysis to check my code. I have configured the specific compilers. For the C-Code (gcc) there are no…
6
votes
1 answer

Coverity Prevent: how to handle "checked return" warning when I deliberately don't check the return?

As the title suggest, for example, in 85% of the situation, I'd like to check the return code of foo(), but sometimes I really don't care about it, but this will raise Coverity warning. What's the best way to deal with this problem? Changing…
solotim
  • 1,826
  • 4
  • 24
  • 41
5
votes
3 answers

Is underscore allowed in case labels?

In some header file which I can not modify I have the following set of defines: #define FLAG1 (0x0000_0001) #define FLAG2 (0x0000_0002) ... Then, in my code I use them in switch: switch (aaa) { case…
pmod
  • 10,450
  • 1
  • 37
  • 50
5
votes
4 answers

How well does static code analysis work with Spring and other abstractions?

I'm in a situation where I'm required to make at least some effort to remove never-used code from my source code. The general preference is to use a static code analysis tool. We've had great luck with this in other projects, but the folks I hear…
bethlakshmi
  • 4,581
  • 22
  • 44
4
votes
3 answers

C++ and coverity issues

MyClass* const Func(const std::string& statename) for this coverity is giving the error Parse warning (PW.USELESS_TYPE_QUALIFIER_ON_RETURN_TYPE) type qualifier on return type is meaningless . Do we really need to remove the const here.?
3
votes
1 answer

Silencing false positives in Coverity Prevent

I am using Coverity Prevent on a C++ project. Is there some way of flagging false positives directly in the source code?
Magnus Andermo
  • 353
  • 4
  • 8
3
votes
1 answer

Coverity installation and database setup (cov-install-gui)

I am new to using coverity and this might not be a very challenging question, but I would appreciate it greatly if someone could guide me through the process of setting up the . I first ran the following command: cov-configure --compiler…
GKK
  • 43
  • 1
  • 5
2
votes
1 answer

Overflowed return value warning in Coverity

I am getting a coverity static checker tool warning for a piece of code below. double value = 0; std::string origValue("0.50"); value = 0.10 * boost::lexical_cast(origValue); The warning is "Overflowed return…
polapts
  • 5,493
  • 10
  • 37
  • 49
1
vote
1 answer

Coverity issue: noescape: Resource dataview is not closed or saved in Table.get

this.btnSaveChanges.Visible = false; //Error: alloc_fn: A new resource is returned from allocation method Grp_des. //Error: var_assign: Assigning: dtv = resource returned from this.dal.Grp_des(this.sParent). DataView dtv =…
Chandu
  • 97
  • 1
  • 9
1
vote
1 answer

Avoid TOCTOU (time-of-check, time-of-use) race condition between stat and rename

How to avoid TOCTOU(time-of-check, time-of-use) race condition for race condition between stat and rename for LOGFILE ? Required to move the log file after its size value exceeds the max size. result = stat(LOGFILE, & data); if (result != 0) { //…
Amruth A
  • 66
  • 5
  • 17
1
vote
0 answers

Coverity: PARSE ERROR

Could any one help me in figuring out if something wrong #define ESS_DESC(c, t) \ C99_INIT([ESSIF_OID_ORD(c)], {.oid = c, .str = #c ":" #t}) static const struct ESS_DESC ESS_DESC_verb[] = { ---> At all the below lines, i am getting the aprse…
Kumar
  • 11
  • 3
1
vote
0 answers

Coverity Prevent 5 for .NET development?

Do you use Coverity Prevent or Coverity Prevent 5 with .NET development? If yes, what are your feelings about it?
Bill Campbell
  • 2,413
  • 6
  • 27
  • 32
1
2 3