Using Security Code Scanners on Samba

[Gerald (Jerry) Carter]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Cornelio Bondad Jr wrote:

| Has any code scanning tools like RATS and Flawfinder been
| used on Samba? I was wondering what people think about using
| such tools to uncover security vulnerabilities? Could
| the last security problem that was fixed on 2.2.9 have been
| uncovered with these tools?

There's come coding practices in Samba 3 that make it difficult
for generic code scanners to determine a problem.  However, this
has been done in the past with some success.  Normally the warning
list is so long that it makes it hard to locate real problems
vs. false positives.

We also regurlarly use valgrind to check for invalid
writes and memory leaks (but this is a run time check
and even branch testing).

If you have some resources to through at it, then a
code audit (automated or otherwise) would be good.
Can't say for sure whether then 2.2.10 security issue
would have been found that way or not.  I don't know
how the original reporter found the bug.



cheers, jerry
- ---------------------------------------------------------------------
Alleviating the pain of Windows(tm)      ------- http://www.samba.org
GnuPG Key                ----- http://www.plainjoe.org/gpg_public.asc
"If we're adding to the noise, turn off this song"--Switchfoot (2003)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFBIkjfIR7qMdg1EfYRApupAJ9PD0dg/N9oWf5yGA9GvHVcgaDLzACfcDHC
+GaSEnI/X0u3OJQbpxoggjk=
=fNZa
-----END PGP SIGNATURE-----