Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.arch.embedded > #30448

Re: Static analysis tool?

Show all headers | View raw

On 4/16/2021 3:56 PM, Don Y wrote:
> On 4/16/2021 12:24 PM, Dave Nadler wrote:
>> Perhaps someone here can help...
>>
>> I'm doing a presentation on techniques for embedded, especially 
>> removing and keeping out bugs ;-) Using an example project from last 
>> year. A reviewer of my first draft suggested many of the bugs surfaced 
>> in the project would have been caught by static analysis - but I 
>> haven't had such great luck in the past.
> 
> Presumably, C.

Sorry, yes, C (and later C++).

>> Tried CPPcheck, and while it found some less-than-optimal stuff it 
>> only found one of the real bugs discussed.
>>
>> Tried to get an evaluation copy of Coverity, but got a wildly annoying 
>> and clueless sales person who promises a member of the right team will 
>> contact me shortly (Real Soon Now).
>>
>> Bugs I had to fix and amenable to static analysis included:
>> - uninitialized variable (only one found by CPPcheck)
>> - use of magic 0xff index value as subscript off end of array
>> - C macro with unguarded arguments getting wrong answer
>> - use of int8 to index 1kb buffer (so only 256 bytes got used)
>>
>> Anybody able to recommend a tool they've used successfully?
> 
> Coverity will require deep pockets/"high visibility" (they're out
> to make money).

Presumably they'd like a recommendation in a presentation that will be 
seen by ~1k people. But at the current pace more likely they will get a 
dis-recommendation. Sales person just emailed me an incorrect summary of 
my requirements though I repeated them at least 3 times, Yikes.

> Eclipse includes some tools.  Lint/PCLint are old standbys.

Haven't found anything that works with current Eclipse.
For this one I'm actually looking for stand-alone tool.

> There are a few IDEs that include support for MISRA compliance
> checking.  PVS-Studio under Windows.

These bugs would probably pass any MISRA checker.
As do hundreds of bugs I've seen in the past few years.
But hey, MISRA is a religion.

> Note that what some folks would consider a bug might really
> just be a coding style preference (e.g., multiple returns
> from a function)
> 
> My approach has mimicked that implicit in code reviews:  let lots
> of eyes (in this case, tools) look at the code and then interpret
> their reports.  The more you veer from plain vanilla C, the more
> you;ll have to hand-hold the tool.

The presentation emphasizes actual human code reviews, but one of the 
early reviewers suggested static analysis, so I thought I'd give it a try...

Thanks Don!

Back to comp.arch.embedded | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Static analysis tool? Dave Nadler <drn@nadler.com> - 2021-04-16 15:24 -0400
  Re: Static analysis tool? Helmut Giese <hgiese@ratiosoft.com> - 2021-04-16 21:44 +0200
  Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-04-16 12:56 -0700
    Re: Static analysis tool? Dave Nadler <drn@nadler.com> - 2021-04-16 16:26 -0400
      Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-04-16 13:47 -0700
        Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-04-16 13:54 -0700
    Re: Static analysis tool? Gerhard Hoffmann <dk4xp@arcor.de> - 2021-04-16 22:54 +0200
      Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-04-16 14:20 -0700
  Re: Static analysis tool? Paul Rubin <no.email@nospam.invalid> - 2021-04-17 01:04 -0700
  Re: Static analysis tool? Stefan Reuther <stefan.news@arcor.de> - 2021-04-17 10:09 +0200
  Re: Static analysis tool? Michael Kellett <mk@mkesc.co.uk> - 2021-04-17 10:45 +0100
  Re: Static analysis tool? David Brown <david.brown@hesbynett.no> - 2021-04-17 12:51 +0200
  Re: Static analysis tool? Dave Nadler <drn@nadler.com> - 2021-04-17 10:34 -0400
    Re: Static analysis tool? Dave Nadler <drn@nadler.com> - 2021-05-02 11:41 -0400
      Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-05-02 08:49 -0700

csiph-web