Analyzing Apache Tomcat6

This page provides instructions for analyzing a pre-compiled and pre-analyzed version of Tomcat 6.

Table of Contents

1. Task: compiling and analyzing Apache Tomcat using Coverity static analysis.
   1. Setup
   2. Interpereting the Output

Example: Compiling and Analyzing Apache Tomcat

Setting up the Task

In this task, you will be inspecting warning messages resulting from running Coverity static analysis on Tomcat6. Tomcat6 is a Java application server developed by the Apache group. Since Tomcat6 is fairly large (~6 MLOC), it takes over an hour to compile with Coverity. We have therefore compiled and analyzed a version of Tomcat6 for you. This pre-analyzed code is stored in an intermediary directory which you can find at /homes/cs510/tomcat6_intermediate_r729554. You will also need access to the Tomcat6 source code. A copy of the source code is located on the cs linux servers at /homes/cs510/tomcat6. You can also check out Tomcat6 here. Make sure you check out the correct revision, which is revision 729554. You could check it out using:

Interpreting the Output

ls /homes/cs510/tomcat6_intermediate_r729554/output/*.errors.xml

There are results from six different checkers for you to look at. For details on each checker, read the checker documentation. Your task is to use the warnings from the analysis to fix the problems indicated. Some results may be false positives. If this is the case, label the warning as such and give a brief explanation of why you think this is the case. To reduce the ammount of work for you, we have reduced the total number of warnings to 8.