nginx / unit

NGINX Unit - universal web app server - a lightweight and versatile open source server that simplifies the application stack by natively executing application code across eight different programming language runtimes.
https://unit.nginx.org
Apache License 2.0
5.36k stars 322 forks source link

Suggestion: Use GCC-12 with -fanalyzer for tests #741

Open vt-alt opened 2 years ago

vt-alt commented 2 years ago

If you have CI please use gcc-12 with -fanalyzer option to find potential bugs. (Many major distro already have gcc-12). For example, there are such warnings currently in 1.27.0:

src/nxt_isolation.c: In function 'nxt_isolation_make_private_mount':
src/nxt_isolation.c:891:9: error: leak of 'strdup(*ent.mnt_dir)' [CWE-401] [-Werror=analyzer-malloc-leak]
  891 |         shared[index] = hasmntopt(ent, "shared") != NULL;
      |         ^~~~~~

src/nxt_router.c: In function 'nxt_router_listen_socket_update':
src/nxt_router.c:3503:17: error: dereference of NULL '0' [CWE-476] [-Werror=analyzer-null-dereference]
 3503 |     lev->listen = joint->socket_conf->listen;
      |     ~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~

src/nxt_router.c: In function 'nxt_router_listen_socket_update':
src/nxt_router.c:3503:17: error: dereference of NULL '0' [CWE-476] [-Werror=analyzer-null-dereference]
 3503 |     lev->listen = joint->socket_conf->listen;
      |     ~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In function 'nxt_unit_mmap_buf_unlink',
    inlined from 'nxt_unit_mmap_buf_release' at src/nxt_unit.c:2469:5:
src/nxt_unit.c:816:10: error: use of uninitialized value 'mmap_buf_7(D)->prev' [CWE-457] [-Werror=analyzer-use-of-uninitialized-value]
  816 |     prev = mmap_buf->prev;
      |     ~~~~~^~~~~~~~~~~~~~~~

[Last one if building with LTO (-flto -ffat-lto-objects), otherwise it's not detected.]

alejandro-colomar commented 2 years ago

Hi!

I have a branch where I'm experimenting with adding it (BTW, the flag was added to GCC in version 10).

The problem is that there are so many warnings, that it would crash all the time. So, I'll try fixing them one by one, and when we have a clean build, I'll add it to the default flags.

Cheers,

Alex

vt-alt commented 2 years ago

(BTW, the flag was added to GCC in version 10).

Yes, but it's only stabilized and became more useful than experimental in gcc-12 so I would not recommend previous versions. Thanks!