<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Consolas",serif;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi Tamas: We currently are using Coverity for static scans. There’s a Github action/workflow that runs weekly (Sundays) on the main branch (<a href="https://github.com/MapServer/MapServer/actions/workflows/coverity-scan.yml">https://github.com/MapServer/MapServer/actions/workflows/coverity-scan.yml</a>)
- although it failed yesterday owing to upgrades on the Coverity side of things. I need to read through the changes to understand what we need to change in our workflow. Obviously Coverity didn’t catch this particular problem. Having some overlap using separate
tools might not be a bad thing. --Steve<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> MapServer-dev <mapserver-dev-bounces@lists.osgeo.org>
<b>On Behalf Of </b>Tamas Szekeres<br>
<b>Sent:</b> Monday, February 14, 2022 10:07 AM<br>
<b>To:</b> mapserver-dev@lists.osgeo.org<br>
<b>Subject:</b> Re: [mapserver-dev] Mapserver assertion handling causing potential crashes<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left" width="100%" style="width:100.0%">
<tbody>
<tr>
<td style="background:#FFC845;padding:5.25pt 1.5pt 5.25pt 1.5pt"></td>
<td width="100%" style="width:100.0%;background:#FFF3DD;padding:5.25pt 3.75pt 5.25pt 11.25pt">
<div>
<div>
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<b><span style="color:#003865">This message may be from an external email source.</span></b><span style="color:#003865"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<span style="font-size:9.0pt;color:#003865">Do not select links or open attachments unless verified. Report all suspicious emails to Minnesota IT Services Security Operations Center.<o:p></o:p></span></p>
</div>
</div>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<div>
<div>
<div>
<p class="MsoNormal">As far as I can see such kind of issues can easily be detected by a static code analyzer tool like this:
<a href="https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsonarcloud.io%2F&data=04%7C01%7Csteve.lime%40state.mn.us%7C1fefb794372b41efde2308d9efd40348%7Ceb14b04624c445198f26b89c2159828c%7C0%7C0%7C637804517455122173%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=PdHAdrscwD6OykPMrEZBAJlmiy86D2v7jVODoJalCko%3D&reserved=0">
https://sonarcloud.io/</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">This seems to be free of use for any open source projects.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">What do you think using such tools regularly as part of the continuous integration?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Best regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Tamas<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Tamas Szekeres <<a href="mailto:szekerest@gmail.com">szekerest@gmail.com</a>> ezt írta (időpont: 2022. febr. 12., Szo, 21:26):<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Even, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thank you for the fix. I agree that assert does have it's own purpose (when debugging), but the code should never expect that assert will do anything to prevent the code to continue the execution (like what throwing an exception would do).
So dereferencing a null pointer in the subsequent code without checking the pointer against null is prohibited.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Best regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Tamas<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Even Rouault <<a href="mailto:even.rouault@spatialys.com" target="_blank">even.rouault@spatialys.com</a>> ezt írta (időpont: 2022. febr. 12., Szo, 20:25):<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p>Hopefully <a href="https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FMapServer%2FMapServer%2Fpull%2F6477&data=04%7C01%7Csteve.lime%40state.mn.us%7C1fefb794372b41efde2308d9efd40348%7Ceb14b04624c445198f26b89c2159828c%7C0%7C0%7C637804517455122173%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=aEUqheVdwCvJCKv1%2FcxRQLadND3%2Bw%2FBXzDSrIzmFgro%3D&reserved=0" target="_blank">
https://github.com/MapServer/MapServer/pull/6477</a> should fix that<o:p></o:p></p>
<p>to use or not to use assert(), and where, is one of the many debates for which devs will have different opinions :
<a href="https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fstackoverflow.com%2Fquestions%2F1081409%2Fwhy-should-i-use-asserts&data=04%7C01%7Csteve.lime%40state.mn.us%7C1fefb794372b41efde2308d9efd40348%7Ceb14b04624c445198f26b89c2159828c%7C0%7C0%7C637804517455122173%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=NEfqfY3R9dyHf9PGzqgWfPhTRcexJ5EqPj4KwcYJGoE%3D&reserved=0" target="_blank">
https://stackoverflow.com/questions/1081409/why-should-i-use-asserts</a> . I'd say assert() are supposed to be used for conditions you don't anticipate to happen in practice and thus for which you don't have a plan if they occur (a good reason is because you
can't test it and thus the error handling might be broken because untested). Of course practice sometimes/often later contradicts your theories, as the impossible has a trend to occur more often than you'd like :-)<o:p></o:p></p>
<p>Even<o:p></o:p></p>
<div>
<p class="MsoNormal">Le 12/02/2022 à 19:49, Steve Lime a écrit :<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><i><span style="color:red">ert( layer->layerinfo != N</span></i><o:p></o:p></p>
</blockquote>
<pre>-- <o:p></o:p></pre>
<pre><a href="https://gcc02.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.spatialys.com%2F&data=04%7C01%7Csteve.lime%40state.mn.us%7C1fefb794372b41efde2308d9efd40348%7Ceb14b04624c445198f26b89c2159828c%7C0%7C0%7C637804517455122173%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=X%2BKdBNOzHTRmpNiCch6pMzvLTLWPsx%2B9RW0WbSvcvnQ%3D&reserved=0" target="_blank">http://www.spatialys.com</a><o:p></o:p></pre>
<pre>My software is free, but my time generally not.<o:p></o:p></pre>
</div>
<p class="MsoNormal">_______________________________________________<br>
MapServer-dev mailing list<br>
<a href="mailto:MapServer-dev@lists.osgeo.org" target="_blank">MapServer-dev@lists.osgeo.org</a><br>
<a href="https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.osgeo.org%2Fmailman%2Flistinfo%2Fmapserver-dev&data=04%7C01%7Csteve.lime%40state.mn.us%7C1fefb794372b41efde2308d9efd40348%7Ceb14b04624c445198f26b89c2159828c%7C0%7C0%7C637804517455122173%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=kIpkbJOYs1jZZL9cb2tTYJzQDKA6SK%2BADhwaKYy%2Fe4s%3D&reserved=0" target="_blank">https://lists.osgeo.org/mailman/listinfo/mapserver-dev</a><o:p></o:p></p>
</blockquote>
</div>
</blockquote>
</div>
</div>
</div>
</div>
</body>
</html>