A Root Canal Static Analysis Based Audit of Zephyr
summary
Zephyr 3.5 integrates CodeChecker with 10 linters (clang analyzer, clang‑tidy, CPPCheck, Infer) but most CI scanning relies on Coverity, which reports 77 issues from Jan–Mar 2024 (66 unique) with about 35 fixed (~50%), ~25% marked false positives and 17 pending. OpenRefactory runs a deeper manual audit plus tool runs, finds 68 sprintf uses (one suspicious overflow), and reports that new tools are noisy — e.g. Semgrep: 233 hits, 231 false positives. Overall, Coverity finds real issues; other tools add useful signals but lots of noise.
AI-written summary · about
chapters (9)
- 0:00Security audit journey
- 14:34Root canal static analysis
- 16:41Zephyr security with Coverity
- 25:54Zephyr CVEs and overflows
- 28:26Sprintf usage in Zephyr
- 31:58Code Checker and tools
- 33:24Newer tools: Sneak and SemGrep
- 37:39Findings and recommendations
- 39:25Q&A
related talks
47mA Root Canal Static Analysis Based Audit of Zephyr
46mInsights from Zephyr Security Audit and Vulnerability Experiences
29m“The Current State of (free) Static Analysis"
14mTool Talk: CodeChecker
43mZephyr Project: Results from Applying Open Source and Security Best Practices
55mSquash Bugs with Static Analysis
45m"Here Is a Clean Section of the Beach" - Proactively Auditing Op...
57mSecurity Engineering: Zcash Ecosystem Security and Learning From Safety-Critical Disciplines