FFMpeg XTU Analysis

FFMpeg without XTU versus FFMpeg with XTU

(Tested with Clang 4.0)

Summary

|Analyzed project| New findings | Disappeared findings | Successfully analyzed | Failed to analyze | Analysis Time (NonXTU)|Analysis Time XTU|Average bug path length in baseline|Average bug path length XTU| |---|---|---|---|---|---|---|---|---|---| |FFMpeg| 151 (core.*(120), unix.malloc(31)| 55| 1409 files | 198 files |?|?|?|

✅ Most important true positives found with XTU

1. Called function pointer is null (core.callAndMessage) http://md-mtas2.tsp.eth.ericsson.se:4999/#baseline=6&newcheck=5&report=55
2. Memory leak (unix.malloc) http://md-mtas2.tsp.eth.ericsson.se:4999/#baseline=6&newcheck=5&report=34
3. Memory Leak (unix.malloc): http://md-mtas2.tsp.eth.ericsson.se:4999/#baseline=6&newcheck=5&report=56
4. core.unitialized.branch http://md-mtas2.tsp.eth.ericsson.se:4999/#baseline=6&newcheck=5&report=25
5. core.DivideZero http://md-mtas2.tsp.eth.ericsson.se:4999/#baseline=6&newcheck=5&report=316
6. core.DivideZero http://md-mtas2.tsp.eth.ericsson.se:4999/#baseline=6&newcheck=5&report=172
7. core.CallAndMessage http://md-mtas2.tsp.eth.ericsson.se:4999/#baseline=6&newcheck=5&report=100
8. unix.malloc use of memory after freed http://md-mtas2.tsp.eth.ericsson.se:4999/#baseline=6&newcheck=5&report=99
9. core.NullDereference http://cc.elte.hu:8080/#baseline=1&newcheck=2&report=699

• If oformat->priv_data_size is 0, we deref. a proper nullptr at the assignment. ✔️

10. core.uninitialized.Branch -- multiple occurences of the same error

• http://cc.elte.hu:8080/#baseline=1&newcheck=2&report=575
• http://cc.elte.hu:8080/#baseline=1&newcheck=2&report=688
• http://cc.elte.hu:8080/#baseline=1&newcheck=2&report=797
• The end: "destructor" path does not differentiate on how much "init" steps were successful and always call every "destructor", thus in this case, if no codec is found, the garbade &(AVFrame*) is passed.

❎ False positives

1. Memory leak http://md-mtas2.tsp.eth.ericsson.se:4999/#baseline=6&newcheck=5&report=56 ??
2. core.nulldereference http://md-mtas2.tsp.eth.ericsson.se:4999/#baseline=6&newcheck=5&report=116 ??
3. core.DivisionByZero http://cc.elte.hu:8080/#baseline=1&newcheck=2&report=528

• Analyser didn't enter av_mul_q