The Use of Static Code Analysis When Teaching or Developing Open-Source Software

The Use of Static Code Analysis When Teaching
or Developing Open-Source Software
Presenter:
George Gribkov

1. Static analysis: short overview
2. Use of static analysis at colleges and universities
3. Use of static analysis in student and open projects
Contents
2

Static Analysis: Short Overview
3

 Write correct code
 Unit tests
 Regression testing
 Code review
 …is there some other way?
 Yes! For example – tools for automated analysis.
How to Improve Code Quality
4

 Static analysis tools: check code when it’s not
executed
 Dynamic analysis tools: check code when it’s being
executed
Automated Code Analysis Tools
5
 Both approaches compliment each other very well.

 Issues false positives
 Difficulties with multithreading
 Does not eliminate the need for code review
Static Analysis Disadvantages
7

 Covers the entire code
 Significantly faster than dynamic code analysis
 More convenient for large projects
Static Analysis Advantages
8

 Can check code style or whether the code complies
with a coding standard (MISRA, AUTOSAR C++)
 Easy to use
 Helps developers learn and teach
Static Analysis Advantages
9

Use of Static Analysis at Colleges and
Universitites
10

 Helps check homework
 Helps check final projects
 Saves instructors’ time
For Instructors
11

 Provides a chance to learn a new approach
 Helps with self-study and problem solving
 Facilitates development
 Shows and helps study error patterns
For Students
12

Pattern Examples (Vangers)
13
void aciPackFile(....)
{
int sz,sz1;
char *p,*p1;
....
p = new char[sz];
p1 = new char[sz1];
....
delete p;
delete p1;
}

14
{
int sz,sz1;
char *p,*p1;
....
p = new char[sz];
p1 = new char[sz1];
....
delete p; // <=
delete p1; // <=
}

15
{
int sz,sz1;
char *p,*p1;
....
p = new char[sz];
p1 = new char[sz1];
....
delete [] p;
delete [] p1;
}

Pattern Examples (Apache HTTP Server)
16
static void MD4Transform(
apr_uint32_t state[4],
const unsigned char block[64])
{
apr_uint32_t a = state[0], b = state[1],
c = state[2], d = state[3],
x[APR_MD4_DIGESTSIZE];
....
/* Zeroize sensitive information. */
memset(x, 0, sizeof(x));
}

17
{
....
memset(x, 0, sizeof(x)); // <=
}

18
{
....
memset_s(x, 0, sizeof(x));
}
*Or use the following flag: -fno-builtin-memset!

 Provides a chance to learn a new approach
 Helps with self-study and problem solving
 Facilitates development
 Shows and helps study error patterns
For Students
19

Use of Static Analysis in Student and
Open Projects
20

 Static analysis provides its maximum benefit
only when used regularly!
Regular Use is the Main Thing
21

Regular Use is the Main Thing
22

Efficient Static Analyzers
23
• PVS-Studio
• Clang Static Analyzer
• Cppcheck
• Infer
• IntelliJ IDEA
• FindBugs
• ...
• A detailed list of static
analyzers:

1. A classic development scenario
(in office)
2. Developing student and open-source projects
Introducing Analysis
24

 Locally on developers’ computer (plugins for IDE,
compilation monitoring system)
A Typical Scenario
25

 Continuous integration systems (command-line utilities,
plugins for CI systems, monitoring systems)
A Typical Scenario
26

What’s the difference?
Student and Open-Source Projects
28

30

31

32

33

Using an Analyzer on Open-Source Projects
34

35

How to Analyze Community Contribution?
36

What to Do After the First Check?
37

38

39

How to Analyze Community Contribution?
41

 Suppress bases are a mass suppression tool for
the analyzer’s warnings.
After the First Check
42

 Suppress bases are a mass suppression tool for
the analyzer’s warnings.
After the First Check
43

 Hide old errors – keep up the normal pace
 See only the latest warnings starting from this moment
 Get immediate benefits from the analyzer
 Do not forget about the old errors! Come back and fix them
one-by-one.
The Purpose of Suppress Bases
44

 A very convenient approach: the “ratcheting” method
 The number of errors in the base is committed to the repository.
 Changes are allowed only when they do not increase the total
number of errors.
How to Work with Suppress Base
45

How to Work with Suppress Base
46

 https://habr.com/en/post/440610/
An Article on the Topic
47

 Static analysis helps study programming
 It’s important to use static analysis regularly
 It’s okay to use static analysis in open-source projects!
Recap
49

A Free PVS-Studio License for Open-Source Project
Developers
50

The Use of Static Code Analysis When Teaching or Developing Open-Source Software

More Related Content

What's hot (20)

Similar to The Use of Static Code Analysis When Teaching or Developing Open-Source Software (20)

More from Andrey Karpov (20)

Recently uploaded (20)

The Use of Static Code Analysis When Teaching or Developing Open-Source Software