Running head: LAB 3 REPORT 1
Lab 3 Report
Tricia Williams
Liberty University
CSCI 611
Mr. Jeff Humphries
February 14, 2017
LAB 3 REPORT AND CHALLENGE QUESTIONS 2
Lab 3 Report and Challenge Questions
Lab 3.6 In the Lab Report file, document any errors, bugs, or security flaws you find.
•
cd ~/stonesoup-c-mc/TC_C_121_v968/src - Static unsigned to a random table,
insecure number handling, resource drains - False negatives which miss bugs that
they should have caught.
•
cd ~/stonesoup-c-mc/TC_C_121_v968/src/solitaire.c - False positives which
produce alerts on code that is not buggy or vulnerable
Lab 3.13 Make a screen capture showing the run command and resulting error message and
paste it into the Lab Report file.
Lab 3.16 Make a screen capture showing the backtrace report and paste it into the Lab
Report file.
LAB 3 REPORT
3
Lab 3.19 Make a screen capture showing the line number of the program indicated by the
backtrace report and paste it into the Lab Report file.
LAB 3 REPORT
4
Lab 3.21 In the Lab Report file, describe any errors you can identify on that line.abc1
Null Pointer Deferences - False positives which produce alerts on code that is not buggy
or vulnerable.
Lab 3.3 Make a screen capture showing the Clang results and paste it into the Lab Report
file. You may need to make multiple images to capture the entire output.
LAB 3 REPORT
5
CLANG
OVF
LAB 3 REPORT
6
SPLINT
File
Edit
View
eeert
H
ree
m1
Jeclarati
inert,
eee
h
ieee
ieee
beet
reat
beet
ieaet
eget
ieaet
eerie)
reer
eerie
est
oe
rece
ener,
reerton
reset
eeertee
root
rest
keer
t
src:
bash
-
Konsole
src:
bash
-
Konsole
Bookmarks
Help
Settings
LAB 3 REPORT
7
OVF
LAB 3 REPORT
8
CPP
LAB 3 REPORT
9
OVF
LAB 3 REPORT
10
Lab 3.18 In the Lab Report file, describe the output of the report.
CLANG - "Function defined but not used" warning is only issued for functions with
internal linkage, i.e. functions that are declared as static. These functions are only
accessible in one translation unit, so the compiler always knows whether they are used (in
the program) or not. If you don't reference these functions in their translation unit, these
functions are known to be unused, and the warning is generated. False positives which
produce alerts on code that is not buggy or vulnerable.
CUSTOM_OVF – NO BUGS FOUND
LAB 3 REPORT
11
SPLINT – 45 errors found, False negatives which miss bugs that they should have
caught. Each line above the splint have a great storage model, so does not report an error
when a pointer to allocated but undefined storage is passed as an out parameter. If in the
body of a function an out parameter is allocated but not bounded to a value Splint reports
an error. You can see out as a parameter that will be defined inside a function.
CUSTOM_OVF – 9 Code Warnings found - False positives which produce alerts on
code that is not buggy or vulnerable. No error is reported since the dereference of Null is
only reached if isNull(s) is false, and since isNull is declared with the nullwhentrue must
not be null.
CPP - False positives which produce alerts on code that is not buggy or vulnerable.
Uninitialized variable: key considered out of bounds.
CUSTOM_OVF – NO BUGS FOUND – Files can’t be found
CQ 4.1 All the static analyzers you used in this lab, as well as most (if not all) commercial
analyzers, have options that suppress the messages. Discuss the advantages and
disadvantages of turning off a warning or a class of warnings.
Static analysis tools like Clang, Splint, and CPPCheck have good analysis techniques that
should produce more accurate results. If you tune and tweak some more you get better
results typically (after all, static analyzers must be able to run on all different types of
code from a tiny medical device to a network operating system). Defining "noise" is also
dependent upon your criteria for what constitutes a fix-worthy report. On one end of the
spectrum, some developers mark all reports they don't fix as "false" (even poorly written
code that they don't have the time to fix) and on the other end, companies should make
sure even false positives were "fixed" because if the code was confusing the tool, then it
probably should be written more clearly so it would be more maintainable.
LAB 3 REPORT
12
CQ 4.2 Gary McGraw said, "In the end, even the most extensive...static analysis regimen is
simply a badness-ometer." Explain what he means in your own words.
There is no such thing as a security meter. An effective software security initiative must
test software and then must resolve and prevent vulnerabilities. If you don’t fix what you
find, you haven’t solved the problem. After all, software security isn’t a feature – it’s a
property.
CQ 4.3 Static analysis systems exist not just for testing source code. Some can make use of
object (binary) code or Java/C# byte code. When might they be useful? What is a
drawback of them?
A static analysis system cannot reason about information that is not in the syntax of the
program. For example, it cannot determine whether you have correctly used
cryptography. Even with these limitations, the benefits of these types of tools normally
outweigh the drawbacks. They are help to improve code security and quality.
LA 1 In the backtrace report on solitaire.c, you saw a reported line number where the
program crashed. However, this is not where the bug is. Explain the discrepancy.
GDB can give you the line where a crash occurred with the "bt" (short for "backtrace")
command after the program has seg faulted. This will give you not only the line of the
crash, but the whole stack of the program (so you can see what called the function where
the crash happened).
LA 2 What are three advantages of static source code analysis systems?
1. It is relatively fast if automated tools are used.
2. Automated tools can scan the entire code base.
3. Automated tools can provide mitigation recommendations, reducing the research
time.
LA 3 What are three disadvantages of static source code analysis systems? (Note: Do not
include “slow” or “expensive” among the list of disadvantages.)
1. Automated tools do not support all programming languages.
2. Automated tools produce false positives and false negatives.
3. It does not find vulnerabilities introduced in the runtime environment.
LA 4 What are three techniques that static source code analysis systems normally use to
find bugs?
1. Data Flow Analysis
LAB 3 REPORT
13
2. Control Flow Graph
3. Taint Analysis
LA 5 For the C source files in the stonesoup-c-mc/TC_C_121_v968 set of test programs,
which bugs were found by all three analyzers? What is your estimation of the
seriousness of the bugs that were found?
CLANG – Unused Variable - False positive – Not an error
SLPINT – Out Message Not Completely Defined – False Negative – Maybe this error
should be caught to clean up. (Just my opinion)
CPPCHECK – Uninitialized variable: key considered out of bounds. – False positive –
Not an error
LA 6 Which of the bugs found in in the stonesoup-c-mc/TC_C_121_v968 set of test
programs were possible security or reliability problems? Explain the problem(s)
associated with each bug you list.
SLPINT - 45 errors found, False negatives which miss bugs that they should have
caught. Each line above the splint have a great storage model, so does not report an error
when a pointer to allocated but undefined storage is passed as an out parameter. If in the
body of a function an out parameter is allocated but not bounded to a value Splint reports
an error. You can see out as a parameter that will be defined inside a function.
LA 7 Where was the buffer overflow in the custom_ovf.cprogram file that you looked at
in Part 3 of the lab? Explain the problem.
SPLINT - 9 Code Warnings found - False positives which produce alerts on code that is
not buggy or vulnerable. No error is reported since the dereference of Null is only
reached if isNull(s) is false, and since isNull is declared with the nullwhentrue must not
be null.
LA 8 Which static analyzer, if any, found the bug in the custom_ovf.c file?
SPLINT
LA 9 Splint has annotations you can put in C comments to turn off messages for a specific
line of code. How would you suppress the message solitaire.c:2:13: File static
variable data_rights_legend declared but not used?
t<n> - Temporarily Suppress certain errors.
LAB 3 REPORT
14
