4 ms·

Purify is proprietary and memcheck is dynamic, so you need to be able to run the software on the host machine.

• pjmlp 5y ago
  So what if it is proprietary, there are other alternatives if you don't like to pay for tooling. As for the rest, I really don't get the point, given the plethora of such tooling for C and C++, both as free beer and commercial for the last 25 years.
  • xxpor 5y ago
    Yet we have basic vulnerabilities in C and C++ code ALL THE TIME. Empirically, even if perfect tooling exists, you still have to go out of your way to use it. The right place to enforce these things are in the language and compiler (which I think you agree with). Make it impossible to make mistakes. Which is also why I'm not that excited about Zig. But the point is the tooling story for C isn't a land of puppies and roses, even in 2021.
    • pjmlp 5y ago
      In fact, because most people don't use them, yet another reason for Zig to have been designed better in regards to use-after-free. Right now, in regards to security in systems programming, Zig is no better than using Modula-2 compiler.
• marcodiego 5y ago
  Consider Valgrind, drmemory and sanitizers already implemented by GCC and LLVM. Also there a list a FLOSS static analyzers: https://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis https://en.wikipedia.org/wiki/List_of_tools_for_static_code_...
  • xxpor 5y ago
    memcheck is Valgrind (it's one of the main modules). I use sanitizers, but they're dynamic as well. There's also additional work to make them work with custom allocators, but that's not too surprising. I am excited for the day I can finally use the ARMv8.3 (or is it v9?) feature that adds essentially HW acceleration so the overhead becomes ~1.2x instead of 5x.