Our website uses cookies to enhance your browsing experience.
Your message has been sent. We will email you at
If you do not see the email in your inbox, please check if it is filtered to one of the following folders:
Webinar: Evaluation - 05.12
I am really astonished by the capabilities of static code analysis even though I am one of the developers of PVS-Studio analyzer myself. The tool surprised me the other day as it turned out to be smarter and more attentive than I am.
You must be careful when working with static analysis tools. Code reported by the analyzer often looks fine and you are tempted to discard the warning as a false positive and move on. Even I, one of the PVS-Studio developers, fall into this trap and fail to spot bugs every now and then. A few days ago, I opened two tickets in our bug tracker reporting the V614 diagnostic, which looks for use of uninitialized variables and arrays.
In both cases, I was sure the analyzer was wrong and needed fixing up. Here's the first case:
I read this code four times but saw nothing suspicious. I concluded it was a false positive that needed fixing, but the analyzer was actually right, while I was not attentive enough.
The caption buffer remains uninitialized. Look at the first lines: both strings are written to buffer text. This is a typo and I overlooked it.
The second case is even more epic:
PVS-Studio warned about the use of uninitialized buffer buf. Nonsense! I reported it as a bug to be fixed since it was obvious that the sprintf function did initialize the buffer and the code was fine.
No way! Again, PVS-Studio was right and I was wrong. The creation excelled the creator. :)
Look what the mean author of that code wrote in one of the header files:
sprinf expands into std::printf. Yes, that is right, sprintf does the same as printf in this program.
What a shame! It turns out the printf function uses uninitialized buffer buf as a format string.
So, appreciate and use static code analyzers! They will help save your time and nerve cells.
0
0
0
0