I don't like it when people use artificial code examples to evaluate the diagnostic capabilities of static code analyzers. There is one particular example I'm going to discuss to explain my negative attitude to synthetic tests.
Comparing PVS-Studio with other code analyzersPVS-Studio
The article discusses comparison of PVS-Studio code analyzer with other solutions in this sphere. As PVS-Studio contains modules for diagnosing 64-bit and parallel errors, it is compared to various types of tools.
The article describes a new direction in development of static code analyzers - verification of parallel programs. The article reviews several static analyzers which can claim to be called "Parallel Lint".
My name is Andrey Karpov. I develop software for developers, and I'm fond of writing articles on code quality issues. In this connection, I have met the wonderful man Walter Bright who has created the D language. In the form of an interview, I will try to learn from him how the D language helps programmers get rid of errors we all make when writing code.
A Bonus to the "Three Interviews About Static Analyzers" Article, or Intervie...Andrey Karpov
About a week ago, I published the "Three Interviews About Static Code Analyzers" article at Habrahabr.
This article presents opinions of three experienced programmers from the companies Acronis,
AlternativaPlatform and Echelon Company concerning software development methodologies as well as
some of their ideas about using static code analyzers.
Since the article was sponsored by the OOO "Program Verification Systems" company, developer of the
PVS-Studio static analyzer, I asked Andrey Karpov (CTO) to answer some questions too. In particular, I
asked him to comment upon the most interesting aspects and ideas of all the three interviews and say a
few words for colleagues and readers, too. Here's what we've got - one more interesting interview.
Errors that static code analysis does not find because it is not usedAndrey Karpov
Readers of our articles occasionally note that the PVS-Studio static code analyzer detects a large number of errors that are insignificant and don't affect the application. It is really so. For the most part, important bugs have already been fixed due to manual testing, user feedback, and other expensive methods. At the same time, many of these errors could have been found at the code writing stage and corrected with minimal loss of time, reputation and money. This article will provide several examples of real errors, which could have been immediately fixed, if project authors had used static code analysis.
PVS-Studio advertisement - static analysis of C/C++ codePVS-Studio
This document advertises the PVS-Studio static analyzer. It describes how using PVS-Studio reduces the number of errors in code of C/C++/C++11 projects and costs on code testing, debugging and maintenance. A lot of examples of errors are cited found by the analyzer in various Open-Source projects. The document describes PVS-Studio at the time of version 4.38 on October 12-th, 2011, and therefore does not describe the capabilities of the tool in the next versions. To learn about new capabilities, visit the product's site http://www.viva64.com or search for an updated version of this article.
Microsoft opened the source code of Xamarin.Forms. We couldn't miss a chance ...PVS-Studio
You probably already know that the Microsoft Corporation bought the Xamarin Company. Even though Microsoft has started gradually opening the source code of some of its products, the Xamarin.Forms code was a big surprise. I couldn't give it the go-by, and decided to check the code using a static code analyzer.
PVS-Studio analyzed the Boost library and found 7 potential bugs or issues. The issues included a misprint that caused division by zero, incorrect class member initialization, memory being released incorrectly with auto_ptr, a condition that would always be true due to unsigned socket type, another misprint where a variable wasn't assigned a value, potential for infinite loop when reading from a stream, and suspicious subtraction of identical values. Finding even a small number of issues in a heavily used and reviewed library like Boost demonstrates the tool's effectiveness at static analysis.
Comparing PVS-Studio with other code analyzersPVS-Studio
The article discusses comparison of PVS-Studio code analyzer with other solutions in this sphere. As PVS-Studio contains modules for diagnosing 64-bit and parallel errors, it is compared to various types of tools.
The article describes a new direction in development of static code analyzers - verification of parallel programs. The article reviews several static analyzers which can claim to be called "Parallel Lint".
My name is Andrey Karpov. I develop software for developers, and I'm fond of writing articles on code quality issues. In this connection, I have met the wonderful man Walter Bright who has created the D language. In the form of an interview, I will try to learn from him how the D language helps programmers get rid of errors we all make when writing code.
A Bonus to the "Three Interviews About Static Analyzers" Article, or Intervie...Andrey Karpov
About a week ago, I published the "Three Interviews About Static Code Analyzers" article at Habrahabr.
This article presents opinions of three experienced programmers from the companies Acronis,
AlternativaPlatform and Echelon Company concerning software development methodologies as well as
some of their ideas about using static code analyzers.
Since the article was sponsored by the OOO "Program Verification Systems" company, developer of the
PVS-Studio static analyzer, I asked Andrey Karpov (CTO) to answer some questions too. In particular, I
asked him to comment upon the most interesting aspects and ideas of all the three interviews and say a
few words for colleagues and readers, too. Here's what we've got - one more interesting interview.
Errors that static code analysis does not find because it is not usedAndrey Karpov
Readers of our articles occasionally note that the PVS-Studio static code analyzer detects a large number of errors that are insignificant and don't affect the application. It is really so. For the most part, important bugs have already been fixed due to manual testing, user feedback, and other expensive methods. At the same time, many of these errors could have been found at the code writing stage and corrected with minimal loss of time, reputation and money. This article will provide several examples of real errors, which could have been immediately fixed, if project authors had used static code analysis.
PVS-Studio advertisement - static analysis of C/C++ codePVS-Studio
This document advertises the PVS-Studio static analyzer. It describes how using PVS-Studio reduces the number of errors in code of C/C++/C++11 projects and costs on code testing, debugging and maintenance. A lot of examples of errors are cited found by the analyzer in various Open-Source projects. The document describes PVS-Studio at the time of version 4.38 on October 12-th, 2011, and therefore does not describe the capabilities of the tool in the next versions. To learn about new capabilities, visit the product's site http://www.viva64.com or search for an updated version of this article.
Microsoft opened the source code of Xamarin.Forms. We couldn't miss a chance ...PVS-Studio
You probably already know that the Microsoft Corporation bought the Xamarin Company. Even though Microsoft has started gradually opening the source code of some of its products, the Xamarin.Forms code was a big surprise. I couldn't give it the go-by, and decided to check the code using a static code analyzer.
PVS-Studio analyzed the Boost library and found 7 potential bugs or issues. The issues included a misprint that caused division by zero, incorrect class member initialization, memory being released incorrectly with auto_ptr, a condition that would always be true due to unsigned socket type, another misprint where a variable wasn't assigned a value, potential for infinite loop when reading from a stream, and suspicious subtraction of identical values. Finding even a small number of issues in a heavily used and reviewed library like Boost demonstrates the tool's effectiveness at static analysis.
What's the Difference Between Static Analysis and Compiler Warnings?Andrey Karpov
Visiting forums, you can often meet people who believe that compiler warnings are more than enough for controlling the basic types of errors in programs' code. I want to show you that it's a wrong belief.
Specialized static analysis tools and standard compiler warnings are both oriented towards improving the quality of the source code and minimizing potential bugs which are difficult to catch through debugging. One way or another, the compiler relies on static analysis of the source code during compilation to generate its warnings, but the quality of diagnostics and their scope of use vary greatly from one analysis method to another.
Logical Expressions in C/C++. Mistakes Made by ProfessionalsPVS-Studio
In programming, a logical expression is a language construct that is evaluated as true or false. Many books that teach programming "from scratch" discuss possible operations on logical expressions familiar to every beginner. In this article, I won't be talking about the AND operator having higher precedence than OR. Instead, I will talk about common mistakes that programmers make in simple conditional expressions consisting of no more than three operators, and show how you can check your code using truth tables. Mistakes described here are the ones made by the developers of such well-known projects as FreeBSD, Microsoft ChakraCore, Mozilla Thunderbird, LibreOffice, and many others.
How to Improve Visual C++ 2017 Libraries Using PVS-StudioPVS-Studio
The title of this article is a hint for the Visual Studio developers that they could benefit from the use of PVS-Studio static code analyzer. The article discusses the analysis results of the libraries in the recent Visual C++ 2017 release and gives advice on how to improve them and eliminate the bugs found. Read on to find out how the developers of Visual C++ Libraries shoot themselves in the foot: it's going to be interesting and informative.
Programming katas for Software Testers - CounterStringsAlan Richardson
What would be suitable Code Katas for people wanting to learn how to code to support their testing?
CounterStrings
- `*3*5*7*9*12*15*`
A CounterString is a string like this `*3*5*7*9*12*15*` where the `*` represent the position in the string of the number immediately proceeding it. This is a 15 character CounterString.
These are useful because if you paste them into a field, and are truncated then it is easy to see what they were truncated to, it is as James Bach describes it, self documenting test data.
https://www.eviltester.com/blog/eviltester/2019-02-27-programming-katas-for-testers/
Analysis of PascalABC.NET using SonarQube plugins: SonarC# and PVS-StudioPVS-Studio
In November 2016, we posted an article about the development and use of the PVS-Studio plugin for SonarQube. We received great feedback from our customers and interested users who requested testing the plugin on a real project. As the interest in this subject is not decreasing, we decided to test the plugin on a C# project PascalABC.NET. Also, it should be borne in mind, that SonarQube have their own static analyzer of C# code - SonarC#. To make the report more complete, we decided to test SonarC# as well. The objective of this work was not the comparison of the analyzers, but the demonstration of the main peculiarities of their interaction with the SonarQube service. Plain comparison of the analyzers would not be fair due to the fact that PVS-Studio is a specialized tool for bug detection and potential vulnerabilities, while SonarQube is a service for the assessment of the code quality by a large number of parameters: code duplication, compliance with the code standards, unit tests coverage, potential bugs in the code, density of comments in the code, technical debt and so on.
Interview with Dmitriy Vyukov - the author of Relacy Race Detector (RRD)PVS-Studio
This is an interview with Dmitriy Vyukov - the author of Relacy Race Detector (RRD) tool intended for verifying parallel applications. In this article you will learn about the history of creating RRD, its basic abilities and also about some other similar tools and the way they differ from RRD.
Errors detected in the Visual C++ 2012 librariesPVS-Studio
Static code analysis is one of the error detection methodologies. We are glad that this methodology is becoming more and more popular nowadays. Visual Studio which includes static analysis as one of its many features contributes to this process to a large extent. This feature is easy to try and start using regularly. When one understands one likes static code analysis, we are glad to offer a professional analyzer PVS-Studio for the languages C/C++/C++11.
I regularly communicate with potential users who are worried about errors in C++ programs. Their worry is expressed in the following way: they try the PVS-Studio tool and start to write that it finds too few errors during tests. And although we feel that they find the tool interesting, still they their reaction is quite skeptical.
I regularly communicate with potential users who are worried about errors in C++ programs. Their worry is expressed in the following way: they try the PVS-Studio tool and start to write that it finds too few errors during tests. And although we feel that they find the tool interesting, still they their reaction is quite skeptical.
This document discusses program analysis methods and the Valgrind tool. It begins with an introduction to program analysis, including dynamic and static analysis. It then provides an example of bad code containing bugs and demonstrates how Valgrind can detect these bugs, such as invalid reads, writes, and memory leaks. The document also covers some limitations of Valgrind and describes additional tools in Valgrind for profiling and thread error detection. It concludes with sections on how Valgrind works using binary translation and an intermediate representation, as well as tuning Valgrind through suppression files and client requests.
War of the Machines: PVS-Studio vs. TensorFlowPVS-Studio
The document summarizes the analysis of the TensorFlow machine learning library using the PVS-Studio static code analyzer. Some key findings include:
1. PVS-Studio found 64 instances of false positives related to the DCHECK debugging macro that were suppressed. Explanations of how to address false positives were provided.
2. Various PVS-Studio settings like disabling diagnostics rules and excluding automatically generated files helped filter the analysis output.
3. Genuine errors found include a null pointer dereference that could lead to undefined behavior and a redundant null check.
UNIT 2 covers verification tools including linting tools, simulators, verification intellectual property, code coverage, functional coverage, verification languages, and metrics. Linting tools check source code for errors and potential problems without requiring stimulus or expected outputs. They have limitations as they only find statically deduced problems and not algorithm or data flow issues. Guidelines for effective use of linting tools include carefully filtering errors, linting during writing, and enforcing coding standards.
Why Students Need the CppCat Code AnalyzerPVS-Studio
CppCat is a simple static code analyzer capable of detecting bugs in C/C++ programs. We started granting free academic licenses to all interested (students, teachers, and so on). For the sake of popularizing CppCat among students, I decided to write this post about errors that can be found in student lab work tasks posted at Pastebin.com.
The document discusses exceptions handling in .NET. It defines exceptions as objects that deliver a powerful mechanism for centralized handling of errors and unusual events. It describes how exceptions can be handled using try-catch blocks, and how finally blocks ensure code execution regardless of exceptions. It also covers the Exception class hierarchy, throwing exceptions with the throw keyword, and best practices like ordering catch blocks and avoiding exceptions for normal flow control.
Machine Learning in Static Analysis of Program Source CodeAndrey Karpov
Machine learning has firmly entrenched in a variety of human fields, from speech recognition to medical diagnosing. The popularity of this approach is so great that people try to use it wherever they can. Some attempts to replace classical approaches with neural networks turn up unsuccessful. This time we'll consider machine learning in terms of creating effective static code analyzers for finding bugs and potential vulnerabilities.
Static Analysis: From Getting Started to IntegrationAndrey Karpov
Sometimes, tired of endless code review and debugging, you start wondering if there are ways to make your life easier. After some googling or merely by accident, you stumble upon the phrase, "static analysis". Let's find out what it is and how it can be used in your project.
Clang static analyzer found some errors in PVS-Studio source code when it was checked against Clang. The errors included using uninitialized variables, uninitialized pointers, and unsafe type conversions. While not critical bugs, they indicate areas for improvement. Clang also reported some false positives but helped uncover unused code that could be removed. Overall, using Clang provided a useful review of PVS-Studio and highlighted opportunities to strengthen the code quality.
This document discusses exception handling in .NET. It defines what exceptions are, how they are handled using try, catch, and finally blocks, and common exception types in .NET like IndexOutOfRangeException and NullReferenceException. It explains that exceptions allow error handling code to be separated from the main program logic and that finally blocks ensure cleanup code is always executed.
Best Coding Practices For Android Application DevelopmentKetan Raval
Learn how to make coding at the time of android application development. Best practices for coding for android app development. Points to take care at the time of development application.
Finding bugs in the code of LLVM project with the help of PVS-StudioPVS-Studio
About two months ago I wrote an article about the analysis of GCC using PVS-Studio. The idea of the article was as follows: GCC warnings are great, but they're not enough. It is necessary to use specialized tools for code analysis, for example, PVS-Studio. As proof of my words I showed errors that PVS-Studio was able to find the GCC code. A number of readers have noticed that the quality of the GCC code, and its diagnosis, aren't really great; while Clang compiler is up to date, of high quality, and fresh. In general Clang is awesome! Well, apparently, it's time to check LLVM project with the help of PVS-Studio.
Serena Keogh took photos for her magazine project in the school photography studio and classroom. In the studio, she used artificial lighting and plain backgrounds to create good lighting and editing options. She took additional photos against a plain white wall in her classroom to test natural lighting. For her cover photo, Serena used a medium close-up shot of student Will Eze under studio lighting to match her inspiration magazine. For interior photos, she photographed Will again with natural lighting and had him remove his jacket for variation. Serena obtained permission from Will via email to photograph and feature him in her magazine. Potential hazards of shooting in the studio included loose wires, unsecured backgrounds, equipment breakage and overheating lights.
Human:
What's the Difference Between Static Analysis and Compiler Warnings?Andrey Karpov
Visiting forums, you can often meet people who believe that compiler warnings are more than enough for controlling the basic types of errors in programs' code. I want to show you that it's a wrong belief.
Specialized static analysis tools and standard compiler warnings are both oriented towards improving the quality of the source code and minimizing potential bugs which are difficult to catch through debugging. One way or another, the compiler relies on static analysis of the source code during compilation to generate its warnings, but the quality of diagnostics and their scope of use vary greatly from one analysis method to another.
Logical Expressions in C/C++. Mistakes Made by ProfessionalsPVS-Studio
In programming, a logical expression is a language construct that is evaluated as true or false. Many books that teach programming "from scratch" discuss possible operations on logical expressions familiar to every beginner. In this article, I won't be talking about the AND operator having higher precedence than OR. Instead, I will talk about common mistakes that programmers make in simple conditional expressions consisting of no more than three operators, and show how you can check your code using truth tables. Mistakes described here are the ones made by the developers of such well-known projects as FreeBSD, Microsoft ChakraCore, Mozilla Thunderbird, LibreOffice, and many others.
How to Improve Visual C++ 2017 Libraries Using PVS-StudioPVS-Studio
The title of this article is a hint for the Visual Studio developers that they could benefit from the use of PVS-Studio static code analyzer. The article discusses the analysis results of the libraries in the recent Visual C++ 2017 release and gives advice on how to improve them and eliminate the bugs found. Read on to find out how the developers of Visual C++ Libraries shoot themselves in the foot: it's going to be interesting and informative.
Programming katas for Software Testers - CounterStringsAlan Richardson
What would be suitable Code Katas for people wanting to learn how to code to support their testing?
CounterStrings
- `*3*5*7*9*12*15*`
A CounterString is a string like this `*3*5*7*9*12*15*` where the `*` represent the position in the string of the number immediately proceeding it. This is a 15 character CounterString.
These are useful because if you paste them into a field, and are truncated then it is easy to see what they were truncated to, it is as James Bach describes it, self documenting test data.
https://www.eviltester.com/blog/eviltester/2019-02-27-programming-katas-for-testers/
Analysis of PascalABC.NET using SonarQube plugins: SonarC# and PVS-StudioPVS-Studio
In November 2016, we posted an article about the development and use of the PVS-Studio plugin for SonarQube. We received great feedback from our customers and interested users who requested testing the plugin on a real project. As the interest in this subject is not decreasing, we decided to test the plugin on a C# project PascalABC.NET. Also, it should be borne in mind, that SonarQube have their own static analyzer of C# code - SonarC#. To make the report more complete, we decided to test SonarC# as well. The objective of this work was not the comparison of the analyzers, but the demonstration of the main peculiarities of their interaction with the SonarQube service. Plain comparison of the analyzers would not be fair due to the fact that PVS-Studio is a specialized tool for bug detection and potential vulnerabilities, while SonarQube is a service for the assessment of the code quality by a large number of parameters: code duplication, compliance with the code standards, unit tests coverage, potential bugs in the code, density of comments in the code, technical debt and so on.
Interview with Dmitriy Vyukov - the author of Relacy Race Detector (RRD)PVS-Studio
This is an interview with Dmitriy Vyukov - the author of Relacy Race Detector (RRD) tool intended for verifying parallel applications. In this article you will learn about the history of creating RRD, its basic abilities and also about some other similar tools and the way they differ from RRD.
Errors detected in the Visual C++ 2012 librariesPVS-Studio
Static code analysis is one of the error detection methodologies. We are glad that this methodology is becoming more and more popular nowadays. Visual Studio which includes static analysis as one of its many features contributes to this process to a large extent. This feature is easy to try and start using regularly. When one understands one likes static code analysis, we are glad to offer a professional analyzer PVS-Studio for the languages C/C++/C++11.
I regularly communicate with potential users who are worried about errors in C++ programs. Their worry is expressed in the following way: they try the PVS-Studio tool and start to write that it finds too few errors during tests. And although we feel that they find the tool interesting, still they their reaction is quite skeptical.
I regularly communicate with potential users who are worried about errors in C++ programs. Their worry is expressed in the following way: they try the PVS-Studio tool and start to write that it finds too few errors during tests. And although we feel that they find the tool interesting, still they their reaction is quite skeptical.
This document discusses program analysis methods and the Valgrind tool. It begins with an introduction to program analysis, including dynamic and static analysis. It then provides an example of bad code containing bugs and demonstrates how Valgrind can detect these bugs, such as invalid reads, writes, and memory leaks. The document also covers some limitations of Valgrind and describes additional tools in Valgrind for profiling and thread error detection. It concludes with sections on how Valgrind works using binary translation and an intermediate representation, as well as tuning Valgrind through suppression files and client requests.
War of the Machines: PVS-Studio vs. TensorFlowPVS-Studio
The document summarizes the analysis of the TensorFlow machine learning library using the PVS-Studio static code analyzer. Some key findings include:
1. PVS-Studio found 64 instances of false positives related to the DCHECK debugging macro that were suppressed. Explanations of how to address false positives were provided.
2. Various PVS-Studio settings like disabling diagnostics rules and excluding automatically generated files helped filter the analysis output.
3. Genuine errors found include a null pointer dereference that could lead to undefined behavior and a redundant null check.
UNIT 2 covers verification tools including linting tools, simulators, verification intellectual property, code coverage, functional coverage, verification languages, and metrics. Linting tools check source code for errors and potential problems without requiring stimulus or expected outputs. They have limitations as they only find statically deduced problems and not algorithm or data flow issues. Guidelines for effective use of linting tools include carefully filtering errors, linting during writing, and enforcing coding standards.
Why Students Need the CppCat Code AnalyzerPVS-Studio
CppCat is a simple static code analyzer capable of detecting bugs in C/C++ programs. We started granting free academic licenses to all interested (students, teachers, and so on). For the sake of popularizing CppCat among students, I decided to write this post about errors that can be found in student lab work tasks posted at Pastebin.com.
The document discusses exceptions handling in .NET. It defines exceptions as objects that deliver a powerful mechanism for centralized handling of errors and unusual events. It describes how exceptions can be handled using try-catch blocks, and how finally blocks ensure code execution regardless of exceptions. It also covers the Exception class hierarchy, throwing exceptions with the throw keyword, and best practices like ordering catch blocks and avoiding exceptions for normal flow control.
Machine Learning in Static Analysis of Program Source CodeAndrey Karpov
Machine learning has firmly entrenched in a variety of human fields, from speech recognition to medical diagnosing. The popularity of this approach is so great that people try to use it wherever they can. Some attempts to replace classical approaches with neural networks turn up unsuccessful. This time we'll consider machine learning in terms of creating effective static code analyzers for finding bugs and potential vulnerabilities.
Static Analysis: From Getting Started to IntegrationAndrey Karpov
Sometimes, tired of endless code review and debugging, you start wondering if there are ways to make your life easier. After some googling or merely by accident, you stumble upon the phrase, "static analysis". Let's find out what it is and how it can be used in your project.
Clang static analyzer found some errors in PVS-Studio source code when it was checked against Clang. The errors included using uninitialized variables, uninitialized pointers, and unsafe type conversions. While not critical bugs, they indicate areas for improvement. Clang also reported some false positives but helped uncover unused code that could be removed. Overall, using Clang provided a useful review of PVS-Studio and highlighted opportunities to strengthen the code quality.
This document discusses exception handling in .NET. It defines what exceptions are, how they are handled using try, catch, and finally blocks, and common exception types in .NET like IndexOutOfRangeException and NullReferenceException. It explains that exceptions allow error handling code to be separated from the main program logic and that finally blocks ensure cleanup code is always executed.
Best Coding Practices For Android Application DevelopmentKetan Raval
Learn how to make coding at the time of android application development. Best practices for coding for android app development. Points to take care at the time of development application.
Finding bugs in the code of LLVM project with the help of PVS-StudioPVS-Studio
About two months ago I wrote an article about the analysis of GCC using PVS-Studio. The idea of the article was as follows: GCC warnings are great, but they're not enough. It is necessary to use specialized tools for code analysis, for example, PVS-Studio. As proof of my words I showed errors that PVS-Studio was able to find the GCC code. A number of readers have noticed that the quality of the GCC code, and its diagnosis, aren't really great; while Clang compiler is up to date, of high quality, and fresh. In general Clang is awesome! Well, apparently, it's time to check LLVM project with the help of PVS-Studio.
Serena Keogh took photos for her magazine project in the school photography studio and classroom. In the studio, she used artificial lighting and plain backgrounds to create good lighting and editing options. She took additional photos against a plain white wall in her classroom to test natural lighting. For her cover photo, Serena used a medium close-up shot of student Will Eze under studio lighting to match her inspiration magazine. For interior photos, she photographed Will again with natural lighting and had him remove his jacket for variation. Serena obtained permission from Will via email to photograph and feature him in her magazine. Potential hazards of shooting in the studio included loose wires, unsecured backgrounds, equipment breakage and overheating lights.
Human:
Moving from CruiseControl.NET to Jenkins in the PVS-Studio development teamPVS-Studio
This document summarizes the PVS-Studio development team's experience moving from CruiseControl.NET (CCNet) to Jenkins as their continuous integration server. Some key issues with CCNet included that it was no longer being developed and had unstable source code management. Jenkins provided more flexibility through plugins and allowed separating build steps and logs through the Multijob plugin. This helped replicate CCNet's task visualization. Overall, Jenkins met their needs and provided ongoing support through active development.
PVS-Studio analyzer is continuously improving, and the C#-code analysis module is developing most actively: ninety new diagnostic rules were added in 2016. However, the best way to estimate the analyzer's efficiency is to look at the bugs it can catch. It's always interesting, as well as useful, to do recurring checks of large open-source projects at certain intervals and compare their results. Today I will talk about the results of the second analysis of SharpDevelop project.
How to capture a variable in C# and not to shoot yourself in the footPVS-Studio
Back in 2005, with the release of C# 2.0 standard we got a possibility to pass a variable to the body of an anonymous delegate by capturing it from the current context. In 2008 the C# 3.0 brought us lambdas, user anonymous classes, LINQ requests and much more. Now it January, 2017 and the majority of C# developers are looking forward to the release of the C# 7.0 standard that should provide us a bunch of new useful features. However, there are still old features that need to be fixed. That's why there are plenty of ways to shoot yourself in the foot. Today we are going to speak about one of them, and it is related with quite an unobvious mechanism of variable capture in the body of anonymous functions in C#.
How to capture a variable in C# and not to shoot yourself in the footSofia Fateeva
Back in 2005, with the release of C# 2.0 standard we got a possibility to pass a variable to the body of an anonymous delegate by capturing it from the current context. In 2008 the C# 3.0 brought us lambdas, user anonymous classes, LINQ requests and much more. Now it January, 2017 and the majority of C# developers are looking forward to the release of the C# 7.0 standard that should provide us a bunch of new useful features. However, there are still old features that need to be fixed. That's why there are plenty of ways to shoot yourself in the foot. Today we are going to speak about one of them, and it is related with quite an unobvious mechanism of variable capture in the body of anonymous functions in C#.
Moving from CruiseControl.NET to Jenkins in the PVS-Studio development teamSofia Fateeva
Now it's hard to imagine software development without automated project builds and testing. There are various ready-made solutions to minimize the time expenses for the integration of the modifications into the project. In this article I am going to speak about the way PVS-Studio team changed the continuous integration server from CruiseControl.NET to Jenkins I will also be talking about the motives behind this decision, the goals we tried to pursue and the issues we had to deal with during that process.
Este documento resume diferentes tipos de redes de computadoras, incluyendo redes de área amplia (WAN), redes de área local (LAN), redes de área metropolitana (MAN), y protocolos de comunicación como TCP/IP. También describe conceptos como topologías de red, señales digitales vs. analógicas, y comunicación simétrica vs. asimétrica.
Diapositivas Con Sonido De Derechos De AutorNICOL141090
El documento habla sobre los derechos de autor. Explica que una obra está protegida desde su creación y que los derechos de autor protegen las obras artísticas y literarias de cualquier explotación. También cubre los derechos morales y patrimoniales del autor, el derecho de transformación de una obra, y algunas excepciones a los derechos de autor como el derecho de cita y la ilustración para fines educativos según la ley colombiana. Finalmente, menciona que las licencias obligatorias buscan facilitar el acceso a
Un blog es un sitio web dinámico donde se publica información de forma cronológica y permite comentarios de otros usuarios, generando diálogo. Blogger de Google es un servicio gratuito para crear blogs donde se elige una plantilla, se agrega contenido y se personaliza el diseño.
El documento presenta información sobre varios eventos y proyectos en San Cristóbal Verapaz, Guatemala. Se anuncia la elección de la Reina Maya Amilda Yolanda Xuc para 2010-2011. También se informa sobre una kermesse realizada por el Colegio Nuestra Señora de los Desamparados y las elecciones del gobierno escolar en el INEB Central. Por último, se describe un proyecto de sistema de agua potable en Quixalito financiado por la municipalidad de San Cristóbal Verapaz.
Este documento proporciona información sobre el Panel de Control en Windows, el cual permite configurar diferentes aspectos del sistema operativo y hardware. El Panel de Control incluye iconos para modificar la apariencia, conexiones de red, programas instalados, sonido, rendimiento, impresoras, cuentas de usuario, configuración regional e idioma, accesibilidad y seguridad. También explica brevemente sobre la compresión de archivos y tipos de medios y particiones de almacenamiento.
El documento argumenta que la sociedad ha ido alejando a Dios de las escuelas y el gobierno, y ha permitido la promoción de la violencia, el sexo y las drogas. Ahora nos preguntamos por qué los niños no pueden distinguir el bien del mal o por qué cometen actos violentos, cuando lo que sembramos es lo que cosechamos.
El documento habla sobre la propiedad intelectual y los derechos de autor. Menciona que las ideas y creaciones de una persona no deben ser tomadas sin permiso y que existen diferentes tipos de licencias para el uso de obras protegidas.
Este documento presenta una secuencia didáctica sobre la producción de vinagre de piña. La secuencia busca que los estudiantes identifiquen las condiciones para el crecimiento de microorganismos y valoren la biotecnología. Incluye actividades como ver videos sobre la producción de alimentos y leer textos sobre biodiversidad a nivel micro y macro.
Mero Studios propone desarrollar un videojuego llamado Nutricuates para combatir la obesidad infantil. El juego enseñará a los niños sobre una alimentación saludable a través de monstruos llamados Nutricuates que los niños pueden alimentar escaneando códigos de barras de alimentos. El juego llevará un registro de la dieta del niño y ofrecerá recompensas por comer de manera saludable.
Este documento presenta un módulo instruccional sobre el uso del diccionario dirigido a estudiantes de tercer grado. Explica los tipos de diccionarios, como monolingües, bilingües y enciclopédicos, y cómo se usa un diccionario para buscar significados de palabras, verificar ortografía y determinar la clase de palabras. También incluye preguntas de práctica para que los estudiantes apliquen lo aprendido sobre el uso apropiado de cada tipo de diccionario.
Os veículos 385, 143 e 451 estão se aproximando de algum lugar. O documento lista três veículos e suas respectivas aproximações, mas não fornece detalhes adicionais sobre seus destinos ou cargas.
La Dirección de Servicios y Recursos de Información (SYRI) de la Universidad Icesi ofrece varios servicios y recursos de apoyo a estudiantes, profesores y personal, incluyendo la biblioteca, e-learning, salas de cómputo, operaciones de TI, multimedia y sistemas. El objetivo de SYRI es facilitar los procesos académicos y administrativos a través del uso de tecnologías de información.
Searching for bugs in Mono: there are hundreds of them!PVS-Studio
It's very interesting to check large projects. As a rule, we do manage to find unusual and peculiar errors, and tell people about them. Also, it's a great way to test our analyzer and improve all its different aspects. I've long been waiting to check 'Mono'; and finally, I got the opportunity. I should say that this check really proved its worth as I was able to find a lot of entertaining things. This article is about the bugs we found, and several nuances which arose during the check.
Accord.Net: Looking for a Bug that Could Help Machines Conquer HumankindPVS-Studio
Articles discussing the results of analysis of open-source projects are a good thing as they benefit everyone: some, including project authors themselves, can find out what bugs lurk in a project; others discover for themselves the static analysis technology and start using it to improve their code's quality. For us, it is a wonderful means to promote PVS-Studio analyzer, as well as to put it through some additional testing. This time I have analyzed Accord.Net framework and found lots of interesting issues in its code.
PVS-Studio and CppCat: An Interview with Andrey Karpov, the Project CTO and D...Andrey Karpov
The developers of PVS-Studio analyzer regularly publish new articles about their tool (and sometimes about other analyzers as well) where they share the analysis results of various software projects produced by the analyzer and demonstrate code samples in which defects were found. Quite recently, a new product, CppCat, was released, which is a lightweight version of PVS-Studio at a low cost - compared to that of its heavier counterpart. You can find a brief description of the PVS-Studio project for Visual C++ here and here, and for a description of the new product see the article "An Alternative to PVS-Studio at $250".
As a PVS-Studio's developer, I am often asked to implement various new diagnostics in our tool. Many of these requests are based on users' experience of working with dynamic code analyzers, for example Valgrind. Unfortunately, it is usually impossible or hardly possible for us to implement such diagnostics. In this article, I'm going to explain briefly why static code analyzers cannot do what dynamic analyzers can and vice versa. Each of these analysis methodologies has its own pros and cons; and one cannot replace the other, but they do complement each other very well.
How PVS-Studio does the bug search: methods and technologiesPVS-Studio
PVS-Studio is a static code analyzer, that searches for errors and vulnerabilities in programs written in C, C++ and C#. In this article, I am going to uncover the technologies that we use in PVS-Studio analyzer. In addition to the general theoretical information, I will show practical examples of how certain technology allows the detection of bugs.
A new static analysis tool for C++ code CppCat was presented just recently. You probably heard a lot about the previous product (PVS-Studio) by the same authors. I was pretty doubtful about it then: on the one hand, static analysis is definitely a must-have methodology - things go better with than without it; on the other hand, PVS-Studio may scare users off with its hugeness, an enterprise-like character and the price, of course. I could imagine a project team of 50 developers buying it but wasn't sure about single developers or small teams of 5 developers. I remember suggesting to the PVS-Studio authors deploying "PVS as a cloud service" and sell access to it by time. But they chose to go their own way and created an abridged version at a relatively small price (which any company or even a single developer can afford).
Characteristics of PVS-Studio Analyzer by the Example of EFL Core Libraries, ...PVS-Studio
After I wrote quite a big article about the analysis of the Tizen OS code, I received a large number of questions concerning the percentage of false positives and the density of errors (how many errors PVS-Studio detects per 1000 lines of code). Apparently, my reasoning that it strongly depends on the project to be analyzed and the settings of the analyzer didn't seem sufficient enough. Therefore, I decided to provide specific figures by doing a more thorough investigation of one of the project of the Tizen OS. I decided that it would be quite interesting to take EFL Core Libraries, because one of the developers, Carsten Haitzler, took an active part in the discussion of my articles. I hope this article would prove to Carsten that PVS-Studio is a worthy tool.
Espressif IoT Development Framework: 71 Shots in the FootAndrey Karpov
The article summarizes the author's analysis of errors found in the Espressif IoT Development Framework using the PVS-Studio static analyzer. The analyzer found 71 errors in the framework code related to security vulnerabilities like incorrect argument order, loss of significant bits, and failure to clear private data from memory. The author notes that additional errors may be found with a more complete analysis. Conditional compilation directives and macros used in the framework code generated many false positives from the analyzer.
An important event has taken place in the PVS-Studio analyzer's life: support of C#-code analysis was added in the latest version. As one of its developers, I couldn't but try it on some project. Reading about scanning small and little-known projects is not much interesting of course, so it had to be something popular, and I picked MonoDevelop.
The way static analyzers fight against false positives, and why they do itPVS-Studio
In my previous article I wrote that I don't like the approach of evaluating the efficiency of static analyzers with the help of synthetic tests. In that article, I give the example of a code fragment that the analyzer treats as a special case, and deliberately doesn't issue a warning for. To be honest, I didn't expect such an overflow of comments regarding the fact that an analyzer may not issue warnings because of the mechanisms of false positive elimination. In general the topic of battling against false positives is such a huge part of any static analyzer that it's really not clear what we can discuss here; but still, let's talk about it. Such mechanisms exist not only in our analyzer but also in another analyzers/compilers. Nevertheless, if this topic brought about so much discussion, I think it's worth talking about, and so I wrote this explanatory article.
The Source SDK is a software development kit compiled by Valve Corporation that is used to create games or mods for the Source engine. I downloaded and checked the project's source codes at the end of 2013 already and intended to write an article about it during the New Year holidays. But laziness prevailed over the craving for creativity, and I sat down to writing the article only on getting back to work. However, I doubt that the source codes have changed during this time. Now you are welcome to have a look at the suspicious code fragments found in the project code by the PVS-Studio code analyzer.
The document discusses an employee who left the company to work for an embedded systems company. The employee was concerned about the poor code quality at the new company. The employee is now trying to improve the code quality by introducing concepts like static analysis and version control that were emphasized at the previous company. The document includes examples of common coding issues and a paper the employee wrote to address these issues at the new company. The conclusion expresses hope that the situation is improving at the new company but also sadness that many programmers at large companies are unaware of modern development practices.
How to find 56 potential vulnerabilities in FreeBSD code in one eveningPVS-Studio
It's high time to recheck FreeBSD project and to show that even in such serious and qualitative projects PVS-Studio easily finds errors. This time I decided to take a look at the analysis process in terms of detecting potential vulnerabilities. PVS-Studio has always been able to identify defects that could potentially be used for a hacker attack. However, we haven't focused on this aspect of the analyzer and described the errors as typos, consequences of sloppy Copy-Paste and so on, but have never classified them according to CWE, for example. Nowadays it is very popular to speak about security and vulnerabilities that's why I will try to broaden at the perception of our analyzer. PVS-Studio helps not only to search for bugs, but it is also a tool that improves the code security.
The document analyzes the source code of the Godot game engine using the PVS-Studio static code analyzer. It finds and discusses several types of errors identified by the analyzer, including duplicated comparisons, array overruns due to enum/array mismatches, incorrect data type checks, typos causing logic errors or infinite loops, and unsafe pointer usage. The analysis aims to both introduce readers to the Godot project and help its developers fix bugs and improve code quality.
We have checked the Windows 8 Driver Samples pack with our analyzer PVS-Studio and found various bugs in its samples. There is nothing horrible about it - bugs can be found everywhere, so the title of this article may sound a bit high-flown. But these particular errors may be really dangerous, as it is a usual practice for developers to use demo samples as a basis for their own projects or borrow code fragments from them.
Comparing PVS-Studio for C# and a built-in Visual Studio analyzer, using the ...Ekaterina Milovidova
Recently I have done comparison of C# analyzers by PVS-Studio and SonarQube on the base of PascalABC.NET code. The research turned out to be pretty engaging, so I decided to continue working in this direction. This time I compared a C# analyzer of PVS-Studio with a static analyzer built into Visual Studio. In my opinion, this is a very worthy adversary. Despite the fact that the analyzer from the Visual Studio kit is primarily designed to improve the quality of the code, not to look for bugs, this does not mean that it cannot be used to detect real errors, although this may be not easy. Let's see which peculiarities in the work of the analyzers will be detected in the course of our investigation. Let's start!
I just cannot pass by the source code of ICQ messenger. It is a kind of a cult project, and when I saw the source code on GitHub, it was just a matter of time, when we will check it with PVS-Studio. Of course, we have a lot of other interesting projects that are waiting to be checked. For example, we have recently checked GCC, GDB, Mono. Finally, it's the turn of ICQ.
The article describes the testing technologies used when developing PVS-Studio static code analyzer. The developers of the tool for programmers talk about the principles of testing their own program product which can be interesting for the developers of similar packages for processing text data or source code.
Konstantin Knizhnik: static analysis, a view from asidePVS-Studio
The article is an interview with Konstantin Knizhnik taken by Andrey Karpov, "Program Verification Systems" company's worker. In this interview the issues of static code analysis, relevance of solutions made in this sphere and prospects of using static analysis while developing applications are discussed.
Malibou Pitch Deck For Its €3M Seed Roundsjcobrien
French start-up Malibou raised a €3 million Seed Round to develop its payroll and human resources
management platform for VSEs and SMEs. The financing round was led by investors Breega, Y Combinator, and FCVC.
Hand Rolled Applicative User ValidationCode KataPhilip Schwarz
Could you use a simple piece of Scala validation code (granted, a very simplistic one too!) that you can rewrite, now and again, to refresh your basic understanding of Applicative operators <*>, <*, *>?
The goal is not to write perfect code showcasing validation, but rather, to provide a small, rough-and ready exercise to reinforce your muscle-memory.
Despite its grandiose-sounding title, this deck consists of just three slides showing the Scala 3 code to be rewritten whenever the details of the operators begin to fade away.
The code is my rough and ready translation of a Haskell user-validation program found in a book called Finding Success (and Failure) in Haskell - Fall in love with applicative functors.
Measures in SQL (SIGMOD 2024, Santiago, Chile)Julian Hyde
SQL has attained widespread adoption, but Business Intelligence tools still use their own higher level languages based upon a multidimensional paradigm. Composable calculations are what is missing from SQL, and we propose a new kind of column, called a measure, that attaches a calculation to a table. Like regular tables, tables with measures are composable and closed when used in queries.
SQL-with-measures has the power, conciseness and reusability of multidimensional languages but retains SQL semantics. Measure invocations can be expanded in place to simple, clear SQL.
To define the evaluation semantics for measures, we introduce context-sensitive expressions (a way to evaluate multidimensional expressions that is consistent with existing SQL semantics), a concept called evaluation context, and several operations for setting and modifying the evaluation context.
A talk at SIGMOD, June 9–15, 2024, Santiago, Chile
Authors: Julian Hyde (Google) and John Fremlin (Google)
https://doi.org/10.1145/3626246.3653374
What to do when you have a perfect model for your software but you are constrained by an imperfect business model?
This talk explores the challenges of bringing modelling rigour to the business and strategy levels, and talking to your non-technical counterparts in the process.
Flutter is a popular open source, cross-platform framework developed by Google. In this webinar we'll explore Flutter and its architecture, delve into the Flutter Embedder and Flutter’s Dart language, discover how to leverage Flutter for embedded device development, learn about Automotive Grade Linux (AGL) and its consortium and understand the rationale behind AGL's choice of Flutter for next-gen IVI systems. Don’t miss this opportunity to discover whether Flutter is right for your project.
UI5con 2024 - Keynote: Latest News about UI5 and it’s EcosystemPeter Muessig
Learn about the latest innovations in and around OpenUI5/SAPUI5: UI5 Tooling, UI5 linter, UI5 Web Components, Web Components Integration, UI5 2.x, UI5 GenAI.
Recording:
https://www.youtube.com/live/MSdGLG2zLy8?si=INxBHTqkwHhxV5Ta&t=0
Transform Your Communication with Cloud-Based IVR SolutionsTheSMSPoint
Discover the power of Cloud-Based IVR Solutions to streamline communication processes. Embrace scalability and cost-efficiency while enhancing customer experiences with features like automated call routing and voice recognition. Accessible from anywhere, these solutions integrate seamlessly with existing systems, providing real-time analytics for continuous improvement. Revolutionize your communication strategy today with Cloud-Based IVR Solutions. Learn more at: https://thesmspoint.com/channel/cloud-telephony
Top Benefits of Using Salesforce Healthcare CRM for Patient Management.pdfVALiNTRY360
Salesforce Healthcare CRM, implemented by VALiNTRY360, revolutionizes patient management by enhancing patient engagement, streamlining administrative processes, and improving care coordination. Its advanced analytics, robust security, and seamless integration with telehealth services ensure that healthcare providers can deliver personalized, efficient, and secure patient care. By automating routine tasks and providing actionable insights, Salesforce Healthcare CRM enables healthcare providers to focus on delivering high-quality care, leading to better patient outcomes and higher satisfaction. VALiNTRY360's expertise ensures a tailored solution that meets the unique needs of any healthcare practice, from small clinics to large hospital systems.
For more info visit us https://valintry360.com/solutions/health-life-sciences
Most important New features of Oracle 23c for DBAs and Developers. You can get more idea from my youtube channel video from https://youtu.be/XvL5WtaC20A
Microservice Teams - How the cloud changes the way we workSven Peters
A lot of technical challenges and complexity come with building a cloud-native and distributed architecture. The way we develop backend software has fundamentally changed in the last ten years. Managing a microservices architecture demands a lot of us to ensure observability and operational resiliency. But did you also change the way you run your development teams?
Sven will talk about Atlassian’s journey from a monolith to a multi-tenanted architecture and how it affected the way the engineering teams work. You will learn how we shifted to service ownership, moved to more autonomous teams (and its challenges), and established platform and enablement teams.
WWDC 2024 Keynote Review: For CocoaCoders AustinPatrick Weigel
Overview of WWDC 2024 Keynote Address.
Covers: Apple Intelligence, iOS18, macOS Sequoia, iPadOS, watchOS, visionOS, and Apple TV+.
Understandable dialogue on Apple TV+
On-device app controlling AI.
Access to ChatGPT with a guest appearance by Chief Data Thief Sam Altman!
App Locking! iPhone Mirroring! And a Calculator!!
Artificia Intellicence and XPath Extension FunctionsOctavian Nadolu
The purpose of this presentation is to provide an overview of how you can use AI from XSLT, XQuery, Schematron, or XML Refactoring operations, the potential benefits of using AI, and some of the challenges we face.
Everything You Need to Know About X-Sign: The eSign Functionality of XfilesPr...XfilesPro
Wondering how X-Sign gained popularity in a quick time span? This eSign functionality of XfilesPro DocuPrime has many advancements to offer for Salesforce users. Explore them now!
Enums On Steroids - let's look at sealed classes !
Why I Dislike Synthetic Tests
1. Why I Dislike Synthetic Tests
Author: Andrey Karpov
Date: 06.02.2017
I don't like it when people use artificial code examples to evaluate the diagnostic capabilities of static
code analyzers. There is one particular example I'm going to discuss to explain my negative attitude to
synthetic tests.
Bill Torpey recently wrote a blog post entitled "Even Mo' Static", where he shared his view on the results
of testing Cppcheck and PVS-Studio analyzers on the itc-benchmarks project, which is a set of static
analysis benchmarks by Toyota ITC.
That post upset me because it would leave you with an impression that Cppcheck's and PVS-Studio's
capabilities were very similar. What follows from the article is that one analyzer is better at diagnosing
some types of errors and the other, at diagnosing other types of errors, but their capabilities are
generally the same.
I think it's a wrong conclusion. My opinion is that our analyzer, PVS-Studio, is several times more
powerful than Cppcheck. Well, it's not even an "opinion" - it's what I know for sure!
However, since it's not obvious to an outside observer that PVS-Studio is ten times better than
Cppcheck, there must be a reason for that. I decided to take a look at that project, itc-benchmarks, and
figure out why PVS-Studio didn't perform at its best on that code base.
The more I was digging, the greater irritation I felt. There was one particular example that drove me
really crazy, and I'm going to tell you about it in a moment. What I have to say as a conclusion is this: I
have no complaints against Bill Torpey. He wrote a good, honest article. Thank you, Bill! But I do have
complaints against Toyota ITC. I personally think their code base is crap. Yes, it's a blunt statement, but I
believe I have enough competence and experience to debate about static code analyzers and ways of
evaluating them. In my opinion, itc-benchmarks can't be used to adequately evaluate tools' diagnostic
capabilities.
Now, here's the test that killed me.
It's a test for null pointer dereference:
2. void null_pointer_001 ()
{
int *p = NULL;
*p = 1; /*Tool should detect this line as error*/
/*ERROR:NULL pointer dereference*/
}
Cppcheck analyzer reports an error in this code:
Null pointer dereference: p
PVS-Studio analyzer keeps silent, although it does have diagnostic V522 for cases like that.
So, does it mean that PVS-Studio is worse at diagnosing this example than Cppcheck? No, it's just the
opposite: it's better!
PVS-Studio understands that this code was written on purpose and there is no error there.
In certain cases, programmers write code like that intentionally to make the program throw an
exception when a null pointer dereference occurs. This trick is used in tests and specific code fragments,
and I have seen it more than once. Here's, for example, how it can be in a real-life project:
void GpuChildThread::OnCrash() {
LOG(INFO) << "GPU: Simulating GPU crash";
// Good bye, cruel world.
volatile int* it_s_the_end_of_the_world_as_we_know_it = NULL;
*it_s_the_end_of_the_world_as_we_know_it = 0xdead;
}
That's why we have included a number of exceptions into PVS-Studio's V522 diagnostic rule so that it
doesn't go mad about code like that. The analyzer understands that null_pointer_001 is an artificial
function; there are just no errors that deal with assigning zero to a pointer and then immediately
dereferencing it in real functions. The function name itself is also a sign for the analyzer that the "null
pointer" here is not an accident.
For cases like that, the V522 diagnostic has exception A6. It is this exception that synthetic function
null_pointer_001 falls under. This is the description of the A6 exception:
The variable is dereferenced in the body of a function whose name contains one of the following words:
error
default
crash
null
test
violation
throw
exception
Before being dereferenced, the variable is assigned 0 one line earlier.
3. The synthetic test in question totally fits into this description. Firstly, the function name contains the
word "null". Secondly, the variable is assigned zero exactly one line earlier. The exception revealed
unreal code, which it really is because it's a synthetic test.
It's for these subtle details that I dislike synthetic tests!
It's not the only complaint I have against itc-benchmarks. For example, there is another test in the same
file:
void null_pointer_006 ()
{
int *p;
p = (int *)(intptr_t)rand();
*p = 1; /*Tool should detect this line as error*/
/*ERROR:NULL pointer dereference*/
}
The rand function can return 0, which will then turn into NULL. PVS-Studio analyzer doesn't know yet
what rand can return, so it has no suspicions about this code.
I asked my colleagues to teach the analyzer to better understand how exactly function rand works.
There's no choice; we have to smooth the tool manually so that it could do better on the test base in
question. We are forced to do it, since people use test suits like that to evaluate analyzers.
But don't you worry. I promise that we will be still working on real-life, useful diagnostics as before
instead of adapting the analyzer for tests. We might polish PVS-Studio slightly for itc-benchmarks, but
not as a top-priority task and only for those cases that do make at least some sense.
I want developers to understand that the example with rand does not actually show anything. It's
synthetic, totally far-fetched. No one writes programs that way; there are no real errors like that.
By the way, if the rand function returns 1400 instead of 0, it won't be any better. A pointer like that
can't be dereferenced in any case. So, this null pointer dereference is some strange private case of
completely incorrect code, which was simply made up by the suite authors and which you are never
going to see in reality.
I know what the real programming problems are. These are, among others, typos, and our tool is
regularly catching hundreds of them using, say, diagnostic V501. It's funny, but I haven't found a test in
itc-benchmarks that checks if tools can spot the "if (a.x == a.x)" typo pattern. Not a single test!
It turns out that itc-benchmarks ignores the analyzers' typo-search capabilities, while our readers surely
know how widespread defects of this type are. And what that project does have is test cases that I find
stupid and that are never found in real programs. I can't imagine stumbling upon code like the one
below, resulting in an array overrun, in a real, serious project:
void overrun_st_014 ()
{
int buf[5];
int index;
index = rand();
4. buf[index] = 1; /*Tool should detect this line as error*/
/*ERROR: buffer overrun */
sink = buf[idx];
}
The only type of programs where you could probably find that is students' programming exercises.
At the same time, I do know that you are very likely to come across the following typo in a serious
project:
return (!strcmp (a->v.val_vms_delta.lbl1,
b->v.val_vms_delta.lbl1)
&& !strcmp (a->v.val_vms_delta.lbl1,
b->v.val_vms_delta.lbl1));
This error was found by PVS-Studio in GCC compiler's code: the same strings are compared twice.
So, the suite includes tests for diagnosing exotic code with rand but zero tests for classic typos.
I could go on and on, but I'd rather stop. I've let off steam and feel better now. Thank you for reading.
Now I have an article to support my opinion about synthetic error bases.
Welcome to install and try a most powerful code analyzer PVS-Studio.
References:
1. PVS-Studio's diagnostic capabilities.
2. Database of real-life errors found by PVS-Studio in open-source projects.
3. Myths about static analysis. The fifth myth - a small test program is enough to evaluate a tool.