On 5/2/2021 8:41 AM, Dave Nadler wrote:
On 4/17/2021 10:34 AM, Dave Nadler wrote:
On 4/16/2021 3:24 PM, Dave Nadler wrote:
Perhaps someone here can help...
I'm doing a presentation on techniques for embedded, especially removing and
keeping out bugs ;-) Using an example project from last year. A reviewer of >>> my first draft suggested many of the bugs surfaced in the project would have
been caught by static analysis - but I haven't had such great luck in the past.
Tried CPPcheck, and while it found some less-than-optimal stuff it only
found one of the real bugs discussed.
Tried to get an evaluation copy of Coverity, but got a wildly annoying and >>> clueless sales person who promises a member of the right team will contact >>> me shortly (Real Soon Now).
Bugs I had to fix and amenable to static analysis included:
- uninitialized variable (only one found by CPPcheck)
- use of magic 0xff index value as subscript off end of array
- C macro with unguarded arguments getting wrong answer
- use of int8 to index 1kb buffer (so only 256 bytes got used)
Anybody able to recommend a tool they've used successfully?
Thanks in advance,
Best Regards, Dave
Thanks all for the comments. I should have explained this project came from >> elsewhere; landed in my lap to add a minor feature which resulted in needing >> to do lots of debug of existing problems. I even rewrote part of it in C++ >> ;-) Project is proprietary so Coverity scan is not applicable as that's only
for FOSS. Only 5 (maybe 6?) of the top dozen bugs COULD be found by static >> analysis but certainly that would have been helpful.
If anybody has an hour and would be interested to review the presentation
first draft video PM me - I can always use some constructive comments and
suggestions!
Thanks again,
Best Regards, Dave
Further follow-up: Never heard back from Coverity (as expected).
Tried Perforce Klocworks and got a very perky and slightly less annoying sales
person who promised prompt follow-up, and as usual none was forthcoming.
Any other static analysis tools you folks can suggest?
You're not going to find anything of the same caliber as Klocwork/Coverity
in the "discount/FOSS" aisle.
But, as I said, elsewhere, with enough (machine) "eyes" looking at your code, you may eke out some insights that would evade a normal review.
Look at PVS Studio. ConQAT won't necessarily give you the sorts of flags
that you're likely expecting from a static analysis tool; but, can help with things like clone detection (more "smells" than actual "problems")
[Of course, there are other tools that do similar things]
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)