The Use of Static Code Analysis When Teaching or Developing Open-Source Software

The Use of Static Code Analysis When Teaching or Developing Open-Source Software Presenter: George Gribkov

1. Static analysis: short overview 2. Use of static analysis at colleges and universities 3. Use of static analysis in student and open projects Contents 2

Static Analysis: Short Overview 3

 Write correct code  Unit tests  Regression testing  Code review  …is there some other way?  Yes! For example – tools for automated analysis. How to Improve Code Quality 4

 Static analysis tools: check code when it’s not executed  Dynamic analysis tools: check code when it’s being executed Automated Code Analysis Tools 5  Both approaches compliment each other very well.

 Issues false positives  Difficulties with multithreading  Does not eliminate the need for code review Static Analysis Disadvantages 7

 Covers the entire code  Significantly faster than dynamic code analysis  More convenient for large projects Static Analysis Advantages 8

 Can check code style or whether the code complies with a coding standard (MISRA, AUTOSAR C++)  Easy to use  Helps developers learn and teach Static Analysis Advantages 9

Use of Static Analysis at Colleges and Universitites 10

 Helps check homework  Helps check final projects  Saves instructors’ time For Instructors 11

 Provides a chance to learn a new approach  Helps with self-study and problem solving  Facilitates development  Shows and helps study error patterns For Students 12

Pattern Examples (Vangers) 13 void aciPackFile(....) { int sz,sz1; char *p,*p1; .... p = new char[sz]; p1 = new char[sz1]; .... delete p; delete p1; }

Pattern Examples (Vangers) 14 void aciPackFile(....) { int sz,sz1; char *p,*p1; .... p = new char[sz]; p1 = new char[sz1]; .... delete p; // <= delete p1; // <= }

Pattern Examples (Vangers) 15 void aciPackFile(....) { int sz,sz1; char *p,*p1; .... p = new char[sz]; p1 = new char[sz1]; .... delete [] p; delete [] p1; }

Pattern Examples (Apache HTTP Server) 16 static void MD4Transform( apr_uint32_t state[4], const unsigned char block[64]) { apr_uint32_t a = state[0], b = state[1], c = state[2], d = state[3], x[APR_MD4_DIGESTSIZE]; .... /* Zeroize sensitive information. */ memset(x, 0, sizeof(x)); }

Pattern Examples (Apache HTTP Server) 17 static void MD4Transform( apr_uint32_t state[4], const unsigned char block[64]) { apr_uint32_t a = state[0], b = state[1], c = state[2], d = state[3], x[APR_MD4_DIGESTSIZE]; .... /* Zeroize sensitive information. */ memset(x, 0, sizeof(x)); // <= }

Pattern Examples (Apache HTTP Server) 18 static void MD4Transform( apr_uint32_t state[4], const unsigned char block[64]) { apr_uint32_t a = state[0], b = state[1], c = state[2], d = state[3], x[APR_MD4_DIGESTSIZE]; .... /* Zeroize sensitive information. */ memset_s(x, 0, sizeof(x)); } *Or use the following flag: -fno-builtin-memset!

 Provides a chance to learn a new approach  Helps with self-study and problem solving  Facilitates development  Shows and helps study error patterns For Students 19

Use of Static Analysis in Student and Open Projects 20

 Static analysis provides its maximum benefit only when used regularly! Regular Use is the Main Thing 21

Regular Use is the Main Thing 22

Efficient Static Analyzers 23 • PVS-Studio • Clang Static Analyzer • Cppcheck • Infer • IntelliJ IDEA • FindBugs • ... • A detailed list of static analyzers:

1. A classic development scenario (in office) 2. Developing student and open-source projects Introducing Analysis 24

 Locally on developers’ computer (plugins for IDE, compilation monitoring system) A Typical Scenario 25

 Continuous integration systems (command-line utilities, plugins for CI systems, monitoring systems) A Typical Scenario 26

What’s the difference? Student and Open-Source Projects 28

Student and Open-Source Projects 30

Using an Analyzer on Open-Source Projects 34

How to Analyze Community Contribution? 36

What to Do After the First Check? 37

How to Analyze Community Contribution? 41

 Suppress bases are a mass suppression tool for the analyzer’s warnings. After the First Check 42

 Suppress bases are a mass suppression tool for the analyzer’s warnings. After the First Check 43

 Hide old errors – keep up the normal pace  See only the latest warnings starting from this moment  Get immediate benefits from the analyzer  Do not forget about the old errors! Come back and fix them one-by-one. The Purpose of Suppress Bases 44

 A very convenient approach: the “ratcheting” method  The number of errors in the base is committed to the repository.  Changes are allowed only when they do not increase the total number of errors. How to Work with Suppress Base 45

How to Work with Suppress Base 46

 https://habr.com/en/post/440610/ An Article on the Topic 47

 Static analysis helps study programming  It’s important to use static analysis regularly  It’s okay to use static analysis in open-source projects! Recap 49

A Free PVS-Studio License for Open-Source Project Developers 50

The Use of Static Code Analysis When Teaching or Developing Open-Source Software

More Related Content

What's hot

Similar to The Use of Static Code Analysis When Teaching or Developing Open-Source Software

More from Andrey Karpov

Recently uploaded

The Use of Static Code Analysis When Teaching or Developing Open-Source Software