611 Defects, 71 Vulnerabilities Found In Firefox

Posted by ryuzaki0 on Thursday September 7, 2006 @03:50AM from the rolling-in-bugs dept.

Danny Begonia writes, "Some folks at Klocwork examined the large and complicated code base of the popular open source browser, Firefox. Overall, Firefox is a well written and high quality piece of software. Several builds were performed on the code, culminating in the final analysis of version 1.5.0.6. The analysis resulted in 611 defects and 71 potential security vulnerabilities. The Firefox team has been given the analysis results, and they will determine if or how they will deal with the issues." What are your thoughts — do Firefox and the open source community welcome this kind of analysis?

1 of 434 comments (clear)

Min score:

Reason:

Sort:

Tools like this produce lots of false positives by Jimmy_B · 2006-09-07 04:00 · Score: 5, Informative

Static analysis tools like the one used to produce this list tend to produce lots of false positives, because they can't make as many assumptions as a programmer who knows what's going on, and they can't follow most interactions between different modules. So the headline should be "611 *possible* defects, 71 *possible* vulnerabilities" found. More likely, a small handful of those will turn out to be real (but minor) bugs, and the rest will be bogus.