Scribd Logo
Upload

Welcome to Scribd!

  • 176 views

    Coverity

    Uploaded by

    Syifana Mardhatilla

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    Coverity

    Uploaded by

    Syifana Mardhatilla
    176 views15 pages

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    176 views15 pages

    Coverity

    Uploaded by

    Syifana Mardhatilla

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    You are on page 1of 15

    Coverity Introduction

    Abhishek Dwivedi,
    Client Services , APAC

    © 2017 Synopsys, Inc. 1


    Known and unknown vulnerabilities in the applications

    quality Security Risk

    Security
    Own Code OSS components License Risk

    configuration

    Operational Risk

    Coverity (Static Application Security Testing)


    Blackduck (Software Composition Analysis)

    © 2017 Synopsys, Inc. 2


    What is Coverity Static Analysis?
    Coverity analyzes your source code and
    pinpoints:

    • Coding errors
    • Security flaws
    • Lines, files and functions, insufficiently
    tested

    © 2017 Synopsys, Inc. 3


    How does Coverity do this?

    © 2017 Synopsys, Inc. 4


    Generic Coverity Workflow Summary

    Source code is built Coverity analysis is Defects are Developers review


    to an intermediate performed on the committed to the defects and triage via
    directory intermediate directory defect database Coverity Connect

    Source Files Intermediate Directory Defects Database Coverity Connect

    Build Commit Web Server

    Analysis

    © 2017 Synopsys, Inc. 5


    What types of issues are detected?

    Coverity Analysis pinpoints defects in your code in myriad of categories, such as: –
     Memory corruption, resource leaks
     NULL object/pointer dereferences
     Thread Concurrency (Deadlock, Race Condition, etc.)
     Security
     Logic errors
     Incorrect program behavior
     Web Application security flaws
     Lines, files and functions, insufficiently tested (TA.de)

    © 2017 Synopsys, Inc. 6


    How Coverity Describes the Defect in UI

    © 2017 Synopsys, Inc. 7


    How Coverity Describes the Defect in UI

    © 2017 Synopsys, Inc. 8


    CC Layout Projects / Navigation

    Issue List
    Toggle Full
    Screen Mode

    © 2017 Synopsys,
    Synopsys, Inc.
    Inc. 9 9
    Source Code Issue Details
    CC Layout Projects / Navigation

    Views/Filtering
    © 2017 Synopsys,
    Synopsys, Inc.
    Inc. 1010
    Filtering with Views
    • Goal: quickly hone in on issues of interest
    – Filter by Checker, Category, etc.

    • Click a Heading and then click Triangle


    at furthest right to add a new View

    • Each Item under a Heading is


    a separate View

    • Click a View and then rightmost Triangle


    to get its context menu

    • To delete a View, select Delete from


    its context menu

    • What about Copy? (covered later!)

    © 2017 Synopsys,
    Synopsys, Inc.
    Inc. 1111
    Filtering: Results

    © 2017 Synopsys,
    Synopsys, Inc.
    Inc. 1212
    Filtering using “Group By”

    © 2017 Synopsys,
    Synopsys, Inc.
    Inc. 1313
    Triaging Issues

    • Each CID can be annotated by


    – Setting classification, severity and
    action
    – Assigning an owner
    – Cross referencing to an external BTS
    – Adding comments
    © 2017 Synopsys, Inc. 14
    Thank You

    You might also like