title: What preprocessor symbols does Coverity define for a build using 'cov-build'?
body: <p>We use Coverity's <a href="http://scan.coverity.com/" rel="noreferrer">Scan Build</a> service for free and open source projects. I am working through two Coverity findings on tainted parameters (<code>TAINTED_SCALAR</code>). The taint is a false positive, so I am trying to instrument the code with Coverity's <code>__coverity_tainted_data_sanitize__</code> to clear the issue.</p>
  
  <p>I want to guard the code that needs to use <code>__coverity_tainted_data_sanitize__</code> because the function is only used with analysis builds using Coverity's <a href="https://scan.coverity.com/download" rel="noreferrer"><code>cov-build</code></a> tool. That is, I want to do something like:</p>
  
  <pre><code>void Foo(std::istream&amp; is, ...)
  {
      std::string name;
      is &gt;&gt; name;
  
  #if &lt;SOME_COVERITY_PREPROCESSOR_MACRO&gt;
      __coverity_tainted_data_sanitize__(name);
  #endif
  
      ...
  }
  </code></pre>
  
  <p>Coverity has a couple of examples on using <code>__coverity_tainted_data_sanitize__</code>, but they don't show how to guard it. See for example, <a href="http://communities.coverity.com/thread/2303" rel="noreferrer">Function model example for Tainted Scalar</a> and <a href="http://communities.coverity.com/thread/1987" rel="noreferrer">Explicitly document parameter passing mechanisms</a>. I also could not find it when asking the preprocessor (see below).</p>
  
  <p>What preprocessor macros does Coverity define to determine an analysis build?</p>
  
  <hr>
  
  <p><strong><em>Preprocessor Output</em></strong></p>
  
  <pre><code>$ cov-build --dir ~/temp cpp -x c++ -dM &lt;/dev/null 2&gt;&amp;1 | egrep -i "(cov|anal)"
  Coverity Build Capture (64-bit) version 7.7.0.4 on Linux 3.13.0-68-generic x86_64
  </code></pre>
  
  <hr>
  
  <p><strong><em>Environmental Variables</em></strong></p>
  
  <p>I did find some environmental variables, but I prefer to avoid mapping environmental variables to preprocessor defines.</p>
  
  <pre><code>$ cov-build --dir ~/temp printenv 2&gt;&amp;1 | egrep -i "(cov|anal)"
  Coverity Build Capture (64-bit) version 7.7.0.4 on Linux 3.13.0-68-generic x86_64
  LD_LIBRARY_PATH=/home/cov-analysis/jars
  LD_PRELOAD=/home/cov-analysis/bin/libcapture-linux64-${PLATFORM}.so
  COVERITY_TEMP=/tmp/cov-98db841699284e11e33be37fe7061776
  COVERITY_LD_LIBRARY_PATH=/home/cov-analysis/jars
  COVERITY_JAVA14_WARNING_FILE=/home/temp/warn_about_java14_compilations
  COVERITY_ENABLE_CEJ_PER_CLASS_ERROR_RECOVERY=1
  COVERITY_IS_COMPILER_DESCENDANT=0
  COVERITY_CONFIG_FILE=/home/cov-analysis/config/coverity_config.xml
  COVERITY_COMMON_TEMP=/tmp
  COVERITY_JAVA_CONFIG=javac#TEMPLATE##java#TEMPLATE##apt#TEMPLATE##javaw#TEMPLATE###
  COVERITY_PREV_XML_CATALOG_FILES=
  COVERITY_OUTPUT_ENCODING=UTF-8
  COVERITY_COMPILER_PATH_MISMATCH_FILE=/home/temp/has_path_mismatches
  COVERITY_ENABLE_CECS_WATCHDOG=1
  COVERITY_PATHLESS_CONFIGS_FILE=/home/temp/has_pathless_configs
  COVERITY_LD_PRELOAD=/home/cov-analysis/bin/libcapture-linux64-${PLATFORM}.so
  COVERITY_BUILD_INVOCATION_ID=1
  PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/home/cov-analysis/bin
  COVERITY_BIN=/home/cov-analysis/bin
  COVERITY_IDIR=/home/temp
  COVERITY_TOP_PROCESS=0
  COVERITY_OUTPUT=/home/temp/build-log.txt
  COVERITY_EMIT=/home/temp/emit
  PWD=/home/cov-analysis
  COVERITY_SITE_CC=VBCSCompiler;apt;c++;cc;cl;clang;clang++;csc;csc2;devenv;g++;g++-4.8;g++-4.9;g++-5.1.0;gcc;gcc-4.8;gcc-4.9;gcc-5.1.0;java;javac;javaw;ld;msbuild;xgcc
  COVERITY_LOG=/home/temp/build-log.txt
  COVERITY_SYSTEM_ENCODING=UTF-8
  COVERITY_TOP_CONFIG=/tmp/cov-98db841699284e11e33be37fe7061776/cov-configure/coverity_config.xml
  COVERITY_IS_COMPILER=0
  </code></pre>
  
  <hr>
  
  <p>Just in case its discussed... the library does read what appears to be a tainted value. However, its a datafile used for self tests, its located in <code>/usr/share</code>, and its not arbitrary user input. The library does not expose this particular functions to users, so I dont believe it can be abused in unexpected ways.</p>