Hacker News Reader

Comment by adekok | Hacker News Reader

Once a code base gets mature (i.e. tested mature), static analysis becomes less useful. In my experience, though, it's worth still running it, just to catch issues with new code.

Every release of FreeRADIUS (http://freeradius.org) gets run through three different static analysis tools. They each find slightly different things.

At this point, the bulk of issues they find are false positives. Addressing those doesn't create bugs, and I'm not sure why it would.

View on HN

Addressing those doesn't create bugs, and I'm not sure why it would.

Anything that changes behaviour could create bugs. Here is an example

    signed bar = something_possibly_negative();
    if(some_case) {
        bar = calc_returning_unsigned_where_MSB_is_an_error_flag();
        if(bar < 0)
            return ERROR;
    }
    
    // now bar is valid, whether negative or positive.

This is a correct - if dodgy - way to test the MSB. But now if you get a warning about the signed integer not having the full range of the unsigned integer you might "fix" it by changing the first line to

    long long bar = something_possibly_negative();

Now the signed bar covers the full range of the unsigned calculation - including the garbage in the error case.

For more in this vein see: http://ithare.com/best-practices-vs-witch-hunts/

Could you share which 3 static analysis tools you use?

We found Coverity to be prohibitively expensive; but unfortunately there isn't any real alternative!

Reply on news.ycombinator.com