3 ms·
If static analyzers could find all problems in C with a low false positive rate, then that'd eliminate one of the big problems with C and partially negate the n
by MichaelGG 10y ago
If static analyzers could find all problems in C with a low false positive rate, then that'd eliminate one of the big problems with C and partially negate the need for Rust.
- technion 10y agoI've run several respected static analyzers against several well respected projects and I'm lucky if I get more than 2-3 false positives. In the Argon2 reference library, the one alert from Infer was a genuine bug I sent a PR for, followed by one alert from tis-interpreter that was another genuine bug. clang-analyser produces clean output. It's true that you get so many false positives under OpenSSL it's not feasible to review. I would contend this is an indicator of code quality more than an indicator of poor static analysers.