The great guys at scan.coverity.com published their Open Source Report 2008 in which they detail findings about source code they’ve monitored and how quality and bug density etc have changed over time since they started scanning over 250 popular open source projects. curl is one of the projects included.
Some highlights from the report:
- curl is mentioned as one of the (few) projects that fixed all defects identified by coverity
- from their start, the average defect frequency has gone down from one defect per 3333 lines of code to one defect per 4000 lines
- they find no support to backup the old belief that there’s a correlation between function length and bug count
- the average function length is 66 lines
And the top-5 most frequently detected defects are:
- NULL Pointer Dereference 28%
- Resource Leak 26%
- Unintentional Ignored Expressions 10%
- Use Before Test (NULL) 8%
- Buffer Overrun (statically allocated) 6%
For all details and more fun reading, see the full Open Source Report 2008 (1MB pdf)