Статический анализ кода презентация

раннее выявление дефектов;
статический анализатор не устаёт;
анализ всех ветвей программы;
хорошее распараллеливание анализа;
выявление ошибок такого типа, о которых программист даже не подозревает.

eLynxSDK

V501 There are identical sub-expressions 'sizeof (ms_2boolean)' to the left and to the right of the '/' operator.

void idBrushBSP::FloodThroughPortals_r(
idBrushBSPNode *node, ....)
{
...
if ( node->occupied ) {
common->Error(
"FloodThroughPortals_r: node already occupied\n");
}
if ( !node ) {
common->Error("FloodThroughPortals_r: NULL node\n");
}
...
}

V567 Undefined behavior. The 'iFloater' variable is modified while being used twice between sequence points.

saga

#include
void test()
{
const size_t Gbyte = 1024 * 1024 * 1024;
size_t i;
char *Pointers[3];
// Allocate
for (i = 0; i != 3; ++i)
Pointers[i] = (char *)malloc(Gbyte);
// Use
for (i = 0; i != 3; ++i)
Pointers[i][0] = 1;
// Free
for (i = 0; i != 3; ++i)
free(Pointers[i]);
}

отсутствует объявление функции malloc

Pointers[i] = (char *)malloc(Gbyte);
mov rcx,qword ptr [Gbyte]
call malloc (1400011A6h)
cdqe
mov rcx,qword ptr [i]
mov qword ptr Pointers[rcx*8],rax

int JoiningProc(HWND hwnd,UINT uMsg,
WPARAM wParam,LPARAM lParam)
{
...
OPENFILENAME lofn;
memset(&lofn, 0, sizeof(lofn));
...
lofn.lpstrFilter = uni("All Files (*.*)\0*.*");
...
}

V540 Member 'lpstrFilter' should point to string terminated by two 0 characters.

void drawShadedTexSubQuad(...,
const MathUtil::Rectangle* rDest, ...)
{
...
if (stsq_observer ||
memcmp(rDest,
&tex_sub_quad_data.rdest, sizeof(rDest))!=0 ||
tex_sub_quad_data.u1!=u1 || tex_sub_quad_data.v1!=v1 ||
tex_sub_quad_data.u2!=u2 || tex_sub_quad_data.v2!=v2 ||
tex_sub_quad_data.G != G)
...
}

Dolphin

void drawShadedTexSubQuad(...,
const MathUtil::Rectangle* rDest, ...)
{
...
if (stsq_observer ||
memcmp(rDest,
&tex_sub_quad_data.rdest, sizeof(rDest))!=0 ||
tex_sub_quad_data.u1!=u1 || tex_sub_quad_data.v1!=v1 ||
tex_sub_quad_data.u2!=u2 || tex_sub_quad_data.v2!=v2 ||
tex_sub_quad_data.G != G)
...
}

Dolphin

V579 The memcmp function receives the pointer and its size as arguments. It is possibly a mistake. Inspect the third argument.

bool ots_gdef_parse(...) {
...
const unsigned gdef_header_end =
static_cast(8) +
gdef->version_2 ? static_cast(2) :
static_cast(0);
...
}

vscap

vscap

V593 Consider reviewing the expression of the 'A = B != C' kind. The expression is calculated as following: 'A = (B != C)'.

V575 The 'memset' function processes '0' elements. Inspect the third argument.

V597 The compiler could delete the 'memset' function call, which is used to flush 'kappa' buffer. The RtlSecureZeroMemory() function should be used to erase the private data.

#define FILE_ATTRIBUTE_DIRECTORY 0x00000010

bool GetPlatformFileInfo(PlatformFile file,
PlatformFileInfo* info) {
...
info->is_directory =
file_info.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY != 0;
...
}

BCmenu

void BCMenu::InsertSpaces(void)
{
if(IsLunaMenuStyle())
if(!xp_space_accelerators)
return;
else
if(!original_space_accelerators)
return;
...
}

BCmenu

V547 Expression '* utf8CheckBuf == 0xC0' is always false. The value range of signed char type: [-128, 127].

eLynxSDK

eLynxSDK

V536 Be advised that the utilized constant value is represented by an octal form. Oct: 0713, Dec: 459.

V547 Expression 'current_idle_time < 0' is always false. Unsigned type value is never < 0.

V590 Consider inspecting this expression. The expression is excessive or contains a misprint.

V501 There are identical sub-expressions to the left and to the right of the '&&' operator: aXResolution > 0.0 && aXResolution > 0.0

Почему никто не составляет такие примеры?