Pour obtenir une clé
d'essai remplissez le formulaire ci-dessous
Demandez des tariffs
Nouvelle licence
Renouvellement de licence
--Sélectionnez la devise--
USD
EUR
RUB
* En cliquant sur ce bouton, vous acceptez notre politique de confidentialité

Free PVS-Studio license for Microsoft MVP specialists
To get the licence for your open-source project, please fill out this form
** En cliquant sur ce bouton, vous acceptez notre politique de confidentialité.

I am interested to try it on the platforms:
** En cliquant sur ce bouton, vous acceptez notre politique de confidentialité.

Votre message a été envoyé.

Nous vous répondrons à


Si vous n'avez toujours pas reçu de réponse, vérifiez votre dossier
Spam/Junk et cliquez sur le bouton "Not Spam".
De cette façon, vous ne manquerez la réponse de notre équipe.

>
>
>
Appreciate Static Code Analysis!

Appreciate Static Code Analysis!

16 Oct 2017
Author:

I am really astonished by the capabilities of static code analysis even though I am one of the developers of PVS-Studio analyzer myself. The tool surprised me the other day as it turned out to be smarter and more attentive than I am.

0535_Appreciate_Static_Code_Analysis/image1.png

You must be careful when working with static analysis tools. Code reported by the analyzer often looks fine and you are tempted to discard the warning as a false positive and move on. Even I, one of the PVS-Studio developers, fall into this trap and fail to spot bugs every now and then. A few days ago, I opened two tickets in our bug tracker reporting the V614 diagnostic, which looks for use of uninitialized variables and arrays.

In both cases, I was sure the analyzer was wrong and needed fixing up. Here's the first case:

0535_Appreciate_Static_Code_Analysis/image2.png

I read this code four times but saw nothing suspicious. I concluded it was a false positive that needed fixing, but the analyzer was actually right, while I was not attentive enough.

The caption buffer remains uninitialized. Look at the first lines: both strings are written to buffer text. This is a typo and I overlooked it.

The second case is even more epic:

0535_Appreciate_Static_Code_Analysis/image3.png

PVS-Studio warned about the use of uninitialized buffer buf. Nonsense! I reported it as a bug to be fixed since it was obvious that the sprintf function did initialize the buffer and the code was fine.

No way! Again, PVS-Studio was right and I was wrong. The creation excelled the creator. :)

Look what the mean author of that code wrote in one of the header files:

0535_Appreciate_Static_Code_Analysis/image5.png

(definesTypes.h)

sprinf expands into std::printf. Yes, that is right, sprintf does the same as printf in this program.

What a shame! It turns out the printf function uses uninitialized buffer buf as a format string.

So, appreciate and use static code analyzers! They will help save your time and nerve cells.

Comments (0)

Next comments
Unicorn with delicious cookie
Nous utilisons des cookies pour améliorer votre expérience de navigation. En savoir plus
Accepter