4 ms·
Once a code base gets mature (i.e. tested mature), static analysis becomes less useful. In my experience, though, it's worth still running it, just to catch is
by adekok 10y ago
Once a code base gets mature (i.e. tested mature), static analysis becomes less useful. In my experience, though, it's worth still running it, just to catch issues with new code.
Every release of FreeRADIUS (http://freeradius.org http://freeradius.org) gets run through three different static analysis tools. They each find slightly different things.
At this point, the bulk of issues they find are false positives. Addressing those doesn't create bugs, and I'm not sure why it would.
- psaccounts 10y agoCould you share which 3 static analysis tools you use? We found Coverity to be prohibitively expensive; but unfortunately there isn't any real alternative!
- adrianratnapala 10y agoAddressing those doesn't create bugs, and I'm not sure why it would. Anything that changes behaviour could create bugs. Here is an example signed bar = something_possibly_negative(); if(some_case) { bar = calc_returning_unsigned_where_MSB_is_an_error_flag(); if(bar < 0) return ERROR; } // now bar is valid, whether negative or positive. This is a correct - if dodgy - way to test the MSB. But now if you get a warning about the signed integer not having the full range of the unsigned integer you might "fix" it by changing the first line to long long bar = something_possibly_negative(); Now the signed bar covers the full range of the unsigned calculation - including the garbage in the error case. For more in this vein see: http://ithare.com/best-practices-vs-witch-hunts/ http://ithare.com/best-practices-vs-witch-hunts/