Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.arch.embedded > #30461

Re: Static analysis tool?

Show all headers | View raw

On 16/04/2021 21:24, Dave Nadler wrote:
> Perhaps someone here can help...
> 
> I'm doing a presentation on techniques for embedded, especially removing
> and keeping out bugs ;-) Using an example project from last year. A
> reviewer of my first draft suggested many of the bugs surfaced in the
> project would have been caught by static analysis - but I haven't had
> such great luck in the past.
> 
> Tried CPPcheck, and while it found some less-than-optimal stuff it only
> found one of the real bugs discussed.
> 
> Tried to get an evaluation copy of Coverity, but got a wildly annoying
> and clueless sales person who promises a member of the right team will
> contact me shortly (Real Soon Now).
> 
> Bugs I had to fix and amenable to static analysis included:
> - uninitialized variable (only one found by CPPcheck)
> - use of magic 0xff index value as subscript off end of array
> - C macro with unguarded arguments getting wrong answer
> - use of int8 to index 1kb buffer (so only 256 bytes got used)
> 
> Anybody able to recommend a tool they've used successfully?
> Thanks in advance,
> Best Regards, Dave

Your first step should always be the compiler - a good compiler, with
optimisation enabled (that's essential) and lots of warnings will pick
up many such things.  It won't do everything, but it is certainly a good
start.  gcc in particular has got better and better at this over time -
I have found bugs in code (other people's code, of course :-) ) after
switching to a newer gcc and enabling more warnings.

Actually, that is perhaps the /second/ step.  The first step is to adopt
good coding practices (and perhaps a formal standard) that make it
easier to avoid writing the bugs in the first place, and to spot them
when they are made accidentally.  For example, a strong emphasis on
static inline functions rather than macros means your risk of macro
problems drops dramatically - and a coding standard that insists on
always guarding the arguments means you don't get the macro bug you
mentioned above.

Back to comp.arch.embedded | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Static analysis tool? Dave Nadler <drn@nadler.com> - 2021-04-16 15:24 -0400
  Re: Static analysis tool? Helmut Giese <hgiese@ratiosoft.com> - 2021-04-16 21:44 +0200
  Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-04-16 12:56 -0700
    Re: Static analysis tool? Dave Nadler <drn@nadler.com> - 2021-04-16 16:26 -0400
      Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-04-16 13:47 -0700
        Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-04-16 13:54 -0700
    Re: Static analysis tool? Gerhard Hoffmann <dk4xp@arcor.de> - 2021-04-16 22:54 +0200
      Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-04-16 14:20 -0700
  Re: Static analysis tool? Paul Rubin <no.email@nospam.invalid> - 2021-04-17 01:04 -0700
  Re: Static analysis tool? Stefan Reuther <stefan.news@arcor.de> - 2021-04-17 10:09 +0200
  Re: Static analysis tool? Michael Kellett <mk@mkesc.co.uk> - 2021-04-17 10:45 +0100
  Re: Static analysis tool? David Brown <david.brown@hesbynett.no> - 2021-04-17 12:51 +0200
  Re: Static analysis tool? Dave Nadler <drn@nadler.com> - 2021-04-17 10:34 -0400
    Re: Static analysis tool? Dave Nadler <drn@nadler.com> - 2021-05-02 11:41 -0400
      Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-05-02 08:49 -0700

csiph-web