5 ms·

Didn't see any mention of any static analysis tools for C++. Any HN recommendations?

• tcoff91 7y ago
  Coverity is used at my company and seems to work reasonably well.
• linuxlizard 7y ago
  I hear about PVS-Studio often.
  • account42 7y ago
    I only hear about PVS-Studio from their adticles that they agressively post to programming-related communities.
• jcelerier 7y ago
  - https://clang.llvm.org/extra/clang-tidy/ https://clang.llvm.org/extra/clang-tidy/ - cppcheck is sometimes updated also - clazy : https://github.com/KDE/clazy https://github.com/KDE/clazy
  • Fronzie 7y ago
    Note that https://clang-analyzer.llvm.org/scan-build.html https://clang-analyzer.llvm.org/scan-build.html is another llvm-based static analyzer. It does a more deep analysis into the control flow, whereas clang-tidy does (mostly?) comparatively simpler checks on the AST.
    • pnako 7y ago
      You can actually run the static analysis checks from clang-tidy.
      • jcelerier 7y ago
        yep, see all the clang-analyzer checks listed here : https://clang.llvm.org/extra/clang-tidy/checks/list.html https://clang.llvm.org/extra/clang-tidy/checks/list.html
      • account42 7y ago
        But you won't get the detailed HTML output that tells you why Clang Analyzer things a problem exists.
  • Thieum22 7y ago
    direct link to cppcheck releases: https://github.com/danmar/cppcheck/releases https://github.com/danmar/cppcheck/releases
• The_rationalist 7y ago
  https://github.com/facebook/infer https://github.com/facebook/infer Seems cool.
• imagiko 7y ago
  I'm interested in this too! I've been looking for one that can be used with arm-gcc for cross compiling on embedded platforms. What do people use in such situations?
  • account42 7y ago
    Clang has support for cross-compiling [1] without needing separate builds for each target so you should be able to use clang-analyzer and clang-tidy whit the right -target flag for your ARM platform. https://clang.llvm.org/docs/CrossCompilation.html https://clang.llvm.org/docs/CrossCompilation.html Besides that, most bugs found by static analysis are platform independent so you should be able to use any static analyzer you get your hands on as long as your code is cross-platform.
    • imagiko 7y ago
      Oh cool, thanks!
• pjmlp 7y ago
  I use what Visual C++ offers, which is already quite nice. Plus VC++ debug builds do bounds checking, even for [].
  • account42 7y ago
    You can also get run-time checks in libstdc++ and libc++ with -D_GLIBCXX_DEBUG -D_GLIBCXX_DEBUG_PEDANTIC and -D_LIBCPP_DEBUG=1.
    • pjmlp 7y ago
      Thanks, I guess I spend too much time on Windows. :)
• wallstprog 7y ago
  I wrote a few posts on this topic that may be helpful: http://btorpey.github.io/blog/categories/static-analysis/ http://btorpey.github.io/blog/categories/static-analysis/