More than 1 potential vulnerability per 4000 lines of code in Android
A year after writing the article about checking Tizen, developers of the PVS-Studio static analyzer checked the quality of the operating system code again, this time demonstrating the abilities of their product to detect errors and potential security vulnerabilities in the Android code.
Despite the fact that the Android code is of high quality and is well tested, and its development includes at least the use of Coverity static analyzer, PVS-Studio still managed to find a lot of interesting defects. Some errors are classified as CWE (Common Weakness Enumeration), which for a certain coincidence of circumstances can be used as vulnerability (CVE). That is why, if you want to protect your code from security vulnerabilities, you should find as many bugs as described in CWE and eliminate them.
According to developers, PVS-Studio is a tool for static application security testing (SAST) and can detect many potential vulnerabilities before they caused harm. This article describes examples of errors by the following categories:
- Pointless comparisons
- Null pointer dereference
- Private data is not cleared in memory
- Unspecified/implementation-defined behavior
- Incorrect memory control
- Array index out of bounds
- Broken loops
- and so on.
Thus, 490 CWE per 1855000 lines of code have been detected or more than 1 vulnerability per 4000 lines.
Development of large complex projects is impossible without the use of programming methodologies and tools to help monitor the quality of the code. First of all, this is a literate coding standard, code reviews, unit tests, static and dynamic code analyzers. All this helps to detect defects in code at the earliest stages of development. Use additional programs and methods to control the quality of your code and make your product secure!
Source - We Checked the Android Source Code by PVS-Studio, or Nothing is Perfect
