3 ms·

I wonder how this tool compares against the likes of Coverity

wyldfire 5y ago
"The best camera is the one thats with you." Sure, the power of warnings and gcc/clang's dedicated static analyzer modes aren't usually as good as commercial alternatives. The commercial ones either have fewer false positives or a larger suite of checks, or both. But the fact that (at least with clang) you can throw on a "-Wall --analyze" while you're compiling means that there's a huge level of convenience that you don't even need to setup or play with the build environment in order to get coverity/klockwork/etc working. That PVS Studio is an interesting one. It has some very clever and (at one time) unique checks looking at similar consecutive statements and expressions and the identifier names used within in order to identify a pattern and find a deviation from the pattern.
- pletnes 5y ago
  This, and also the fact that everyone on the team has to use the compiler, no matter what they’re doing. Separate tools are much harder to get into everyone’s workflow.
  - hardware2win 5y ago
    Cannot it be just on cicd?
    - pletnes 5y ago
      Sure, but the feedback loop is much slower. It’s great if you can easily catch most issues locally.
jamesfinlayson 5y ago
Still seems a bit rudimentary compared to Coverity but I haven't used Coverity on any C code (only on Java and Javascript). The Coverity website seems a bit clunky but I think there's a CLI tool?
rwmj 5y ago
I've used both quite extensively and I think that Coverity is still better, but GCC's static analysis is the closest free tool I've found that is doing the kind of complicated dataflow analysis that Coverity does. In GCC 12, compared to GCC 10/11, it got a whole lot more "aggressive", to the point where it's no longer possible to compile the kernel with warn-error because of many static analysis warnings in core code, and I also had to rearrange and annotate [to disable some warnings] a lot of code in my own projects to get things to compile. So next time you compile some C code with GCC 10, 11 or 12, definitely try -fanalyzer to see what it says, but be warned that you might be presented with some complicated error messages which require quite a lot of time to analyse to see if they're real problems or false alarms. Here are some genuine problems found: https://github.com/libguestfs/libguestfs/commit/58599031f849728f0379bb03717db809112f0645 https://github.com/libguestfs/libguestfs/commit/58599031f849... https://github.com/libguestfs/libguestfs/commit/8dd09a16f59cf80b4d625bdb84dfd4b0abaef9cf https://github.com/libguestfs/libguestfs/commit/8dd09a16f59c... Here are some false alarms: https://github.com/libguestfs/libguestfs/commit/ea04d6b878ec4da073db925a594a0c2989e39791 https://github.com/libguestfs/libguestfs/commit/ea04d6b878ec... https://github.com/libguestfs/libguestfs/commit/d00c36410b7432fe74485589a750f99fcf05a23f https://github.com/libguestfs/libguestfs/commit/d00c36410b74... https://github.com/libguestfs/libguestfs/commit/9dddd8ec62d5322fd407ef883cd76e16d69d4343 https://github.com/libguestfs/libguestfs/commit/9dddd8ec62d5... https://github.com/libguestfs/libguestfs/commit/8a4275c5686de6e156b449581c9c91199447e2d3 https://github.com/libguestfs/libguestfs/commit/8a4275c5686d... Edit: In Coverity's favour, it supports many more languages than just C/C++

"The best camera is the one thats with you." Sure, the power of warnings and gcc/clang's dedicated static analyzer modes aren't usually as good as commercial alternatives. The commercial ones either have fewer false positives or a larger suite of checks, or both. But the fact that (at least with clang) you can throw on a "-Wall --analyze" while you're compiling means that there's a huge level of convenience that you don't even need to setup or play with the build environment in order to get coverity/klockwork/etc working. That PVS Studio is an interesting one. It has some very clever and (at one time) unique checks looking at similar consecutive statements and expressions and the identifier names used within in order to identify a pattern and find a deviation from the pattern.

pletnes 5y ago
This, and also the fact that everyone on the team has to use the compiler, no matter what they’re doing. Separate tools are much harder to get into everyone’s workflow.
- hardware2win 5y ago
  Cannot it be just on cicd?
  - pletnes 5y ago
    Sure, but the feedback loop is much slower. It’s great if you can easily catch most issues locally.

jamesfinlayson 5y ago

Still seems a bit rudimentary compared to Coverity but I haven't used Coverity on any C code (only on Java and Javascript). The Coverity website seems a bit clunky but I think there's a CLI tool?

rwmj 5y ago

I've used both quite extensively and I think that Coverity is still better, but GCC's static analysis is the closest free tool I've found that is doing the kind of complicated dataflow analysis that Coverity does. In GCC 12, compared to GCC 10/11, it got a whole lot more "aggressive", to the point where it's no longer possible to compile the kernel with warn-error because of many static analysis warnings in core code, and I also had to rearrange and annotate [to disable some warnings] a lot of code in my own projects to get things to compile. So next time you compile some C code with GCC 10, 11 or 12, definitely try -fanalyzer to see what it says, but be warned that you might be presented with some complicated error messages which require quite a lot of time to analyse to see if they're real problems or false alarms. Here are some genuine problems found: https://github.com/libguestfs/libguestfs/commit/58599031f849728f0379bb03717db809112f0645 https://github.com/libguestfs/libguestfs/commit/58599031f849... https://github.com/libguestfs/libguestfs/commit/8dd09a16f59cf80b4d625bdb84dfd4b0abaef9cf https://github.com/libguestfs/libguestfs/commit/8dd09a16f59c... Here are some false alarms: https://github.com/libguestfs/libguestfs/commit/ea04d6b878ec4da073db925a594a0c2989e39791 https://github.com/libguestfs/libguestfs/commit/ea04d6b878ec... https://github.com/libguestfs/libguestfs/commit/d00c36410b7432fe74485589a750f99fcf05a23f https://github.com/libguestfs/libguestfs/commit/d00c36410b74... https://github.com/libguestfs/libguestfs/commit/9dddd8ec62d5322fd407ef883cd76e16d69d4343 https://github.com/libguestfs/libguestfs/commit/9dddd8ec62d5... https://github.com/libguestfs/libguestfs/commit/8a4275c5686de6e156b449581c9c91199447e2d3 https://github.com/libguestfs/libguestfs/commit/8a4275c5686d... Edit: In Coverity's favour, it supports many more languages than just C/C++