Re: running pscan, rats. flawfinder and splint on classpath

2006-04-03 Thread Archie Cobbs
Dalibor Topic wrote: functions. Some of those are a little odd, for example it is not clear to me what to do if JNI function call ThrowNew fails. rats and Good question.. I think the only reasonable answer is "proceed with the knowledge that an exception was posted, but perhaps not the one you

Re: running pscan, rats. flawfinder and splint on classpath

2006-04-03 Thread Dalibor Topic
On Mon, 2006-04-03 at 15:14 -0500, Archie Cobbs wrote: > Dalibor Topic wrote: > > functions. Some of those are a little odd, for example it is not clear > > to me what to do if JNI function call ThrowNew fails. rats and > > Good question.. I think the only reasonable answer is "proceed with > the

running pscan, rats. flawfinder and splint on classpath

2006-04-03 Thread Dalibor Topic
Hi all, I've played around a bit with C vulnerability checkers today, and ran a few on them on the classpath code base, so I figured I'd tell you how to it, too. The first one I tried was pscan [1], which checks for format string vulnerabilities. I've fixed all the pscan warnings today. Running