We've been running the Fortify app against our source code and the section that I'm responsible for has been pretty clean for the most part. But there was one set of routines (that I did not write) that was being stubbornly difficult in being changed to avoid an unreleased resource leak. I tried one approach (a poor one, as it turned out) that just broke everything in the area, so I backed it out and went after it again.
This time, I refactored the code to avoid the particular construct that causes Fortify to lose its mind as it scans our code. Once I did that, the code still worked, which was good.
And it passed the Fortify scan that just finished.
Yay, me.
This time, I refactored the code to avoid the particular construct that causes Fortify to lose its mind as it scans our code. Once I did that, the code still worked, which was good.
And it passed the Fortify scan that just finished.
Yay, me.