The NASA Open Source Tool You Never Heard About (I like it)
This YouTube video demonstrates the use of the open-source static code analyzer, iOS (likely a typo for “icos”). Key takeaways include:
icos Functionality:
- Single File Analysis: Easily identifies buffer overflows and other vulnerabilities in individual C files. The presenter shows examples of identifying buffer overflows on specific lines.
- Project Analysis: Can analyze entire projects (using CMake/Make build systems shown as example), though it has limitations. It may stop analysis after encountering a critical error, potentially missing subsequent issues in the same file or other files within the project. This behavior depends on the optimization level. Disabling optimization leads to a more thorough, though potentially slower, analysis.
- Dashboard Tool: A web-based dashboard visualizes analysis results, highlighting problematic lines of code within specific files.
- Optimization Level: The analysis depth is affected by the optimization level. Turning optimization off reveals more potential issues but increases analysis time.
- C++ Support Limitations: The analyzer doesn’t fully support C++ projects; it may incorrectly mark code as unreachable.
Testing icos:
- Built-in Tests: The icos repository includes comprehensive test cases, covering various vulnerability types (buffer overflows, null pointer dereferences, etc.). These tests can be built and run to verify the analyzer’s functionality.
- Regression Tests: A dedicated folder contains examples demonstrating both safe and unsafe code, useful for learning about specific vulnerabilities.
Building icos:
- Dependencies: Requires a compiler (like clang), CMake, Boost, and other libraries (specific versions mentioned). The presenter encountered issues using Homebrew and instead successfully built from source.
- Build Process: The video details the steps to build from source, including creating symbolic links for LLVM.
Overall:
The video provides a practical tutorial on using icos for static code analysis, highlighting its strengths (easy single-file analysis, informative dashboard) and limitations (C++ support, incomplete project analysis in some cases). It also serves as a guide for building the analyzer from source. The presenter emphasizes the importance of static analysis for preventing vulnerabilities, particularly in production code.