Re: Report on Coverity

2012-10-24 Thread Amos Jeffries
On 25/10/2012 6:05 p.m., Alex Rousskov wrote: On 10/24/2012 06:07 PM, Amos Jeffries wrote: If we were to take up this scanning I think it would be more beneficial to run periodically and check for new bugs rather than constantly. Once per year (~100K lines of code change each year) or after any

Re: Report on Coverity

2012-10-24 Thread Alex Rousskov
On 10/24/2012 06:07 PM, Amos Jeffries wrote: > If we were to take up this scanning I think it would be more beneficial > to run periodically and check for new bugs rather than constantly. Once > per year (~100K lines of code change each year) or after any large logic > changes should be sufficient

Re: dual-use http_port

2012-10-24 Thread Amos Jeffries
On 25.10.2012 13:00, Alex Rousskov wrote: Hello, I am facing a deployment case where a single http_port address is used for both direct and intercepted traffic. Do you have details on why it has to stay that way? Note that port for intercepted traffic ONLY exists between the Squid proces

Re: Report on Coverity

2012-10-24 Thread Amos Jeffries
On 25.10.2012 06:11, Kinkie wrote: A) Squid code review practices eliminate nearly all real bugs that static analysis can find. Thus, SA is not very helpful. B) We have already found (the "hard way") and fixed nearly all real bugs so static analysis cannot find them until new bugs

dual-use http_port

2012-10-24 Thread Alex Rousskov
Hello, I am facing a deployment case where a single http_port address is used for both direct and intercepted traffic. It appears to work in Squid v3.0, possibly using some small custom hacks (I do not know the details). The deployment scenario requires such dual use to continue, unfortunately

Re: [PATCH] c++-stream-ify purge/conffile.cc

2012-10-24 Thread Amos Jeffries
On 25.10.2012 06:14, Kinkie wrote: Hi, the attached patch changes purge/conffile.cc to use c++ file streams instaed of C-FILE handles. Ok for merging? +1. But please remove the whitespace around "!cfgin.good()" and before first parameter of cfgin.getline(). FYI: I'm in the process of

Re: Report on Coverity

2012-10-24 Thread Amos Jeffries
On 25.10.2012 05:24, Alex Rousskov wrote: On 10/23/2012 08:28 PM, Amos Jeffries wrote: On 22.10.2012 07:03, Kinkie wrote: Hi all, so far I have checked 134 defects uncovered by Coverity out of 334, I think I have seen enough to report some numbers. There are 49 false positives, and 24 inten

[PATCH] c++-stream-ify purge/conffile.cc

2012-10-24 Thread Kinkie
Hi, the attached patch changes purge/conffile.cc to use c++ file streams instaed of C-FILE handles. Ok for merging? -- /kinkie purge-conffile-fstreamify.patch Description: Binary data

Re: Report on Coverity

2012-10-24 Thread Kinkie
> A) Squid code review practices eliminate nearly all real bugs > that static analysis can find. Thus, SA is not very helpful. > > B) We have already found (the "hard way") and fixed nearly all > real bugs so static analysis cannot find them until new bugs > are added. When they

Re: Report on Coverity

2012-10-24 Thread Alex Rousskov
On 10/21/2012 12:03 PM, Kinkie wrote: > so far I have checked 134 defects uncovered by Coverity out of 334, > I think I have seen enough to report some numbers. > There are 49 false positives, and 24 intentional risky behaviors. > 61 are bugs; but in most cases they are not real issues, just poo

Re: Report on Coverity

2012-10-24 Thread Alex Rousskov
On 10/23/2012 08:28 PM, Amos Jeffries wrote: > On 22.10.2012 07:03, Kinkie wrote: >> Hi all, >> so far I have checked 134 defects uncovered by Coverity out of 334, >> I think I have seen enough to report some numbers. >> There are 49 false positives, and 24 intentional risky behaviors. >> 61 are