Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.arch.embedded > #30462

Re: Static analysis tool?

Show all headers | View raw

On 4/16/2021 3:24 PM, Dave Nadler wrote:
> Perhaps someone here can help...
> 
> I'm doing a presentation on techniques for embedded, especially removing 
> and keeping out bugs ;-) Using an example project from last year. A 
> reviewer of my first draft suggested many of the bugs surfaced in the 
> project would have been caught by static analysis - but I haven't had 
> such great luck in the past.
> 
> Tried CPPcheck, and while it found some less-than-optimal stuff it only 
> found one of the real bugs discussed.
> 
> Tried to get an evaluation copy of Coverity, but got a wildly annoying 
> and clueless sales person who promises a member of the right team will 
> contact me shortly (Real Soon Now).
> 
> Bugs I had to fix and amenable to static analysis included:
> - uninitialized variable (only one found by CPPcheck)
> - use of magic 0xff index value as subscript off end of array
> - C macro with unguarded arguments getting wrong answer
> - use of int8 to index 1kb buffer (so only 256 bytes got used)
> 
> Anybody able to recommend a tool they've used successfully?
> Thanks in advance,
> Best Regards, Dave

Thanks all for the comments. I should have explained this project came 
from elsewhere; landed in my lap to add a minor feature which resulted 
in needing to do lots of debug of existing problems. I even rewrote part 
of it in C++ ;-)  Project is proprietary so Coverity scan is not 
applicable as that's only for FOSS. Only 5 (maybe 6?) of the top dozen 
bugs COULD be found by static analysis but certainly that would have 
been helpful.

If anybody has an hour and would be interested to review the 
presentation first draft video PM me - I can always use some 
constructive comments and suggestions!

Thanks again,
Best Regards, Dave

Back to comp.arch.embedded | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Static analysis tool? Dave Nadler <drn@nadler.com> - 2021-04-16 15:24 -0400
  Re: Static analysis tool? Helmut Giese <hgiese@ratiosoft.com> - 2021-04-16 21:44 +0200
  Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-04-16 12:56 -0700
    Re: Static analysis tool? Dave Nadler <drn@nadler.com> - 2021-04-16 16:26 -0400
      Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-04-16 13:47 -0700
        Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-04-16 13:54 -0700
    Re: Static analysis tool? Gerhard Hoffmann <dk4xp@arcor.de> - 2021-04-16 22:54 +0200
      Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-04-16 14:20 -0700
  Re: Static analysis tool? Paul Rubin <no.email@nospam.invalid> - 2021-04-17 01:04 -0700
  Re: Static analysis tool? Stefan Reuther <stefan.news@arcor.de> - 2021-04-17 10:09 +0200
  Re: Static analysis tool? Michael Kellett <mk@mkesc.co.uk> - 2021-04-17 10:45 +0100
  Re: Static analysis tool? David Brown <david.brown@hesbynett.no> - 2021-04-17 12:51 +0200
  Re: Static analysis tool? Dave Nadler <drn@nadler.com> - 2021-04-17 10:34 -0400
    Re: Static analysis tool? Dave Nadler <drn@nadler.com> - 2021-05-02 11:41 -0400
      Re: Static analysis tool? Don Y <blockedofcourse@foo.invalid> - 2021-05-02 08:49 -0700

csiph-web