Interesting idea. We can give error base ( http://www.viva64.com/en/examples/ ) for C++ (V501-V762) and C# (V3001-V3105) :)
4,144 karma · joined February 11, 2011
Andrey is the author of many publications devoted to writing quality C++ code.
Articles published in the company's blog: https://pvs-studio.com/en/blog/posts/?author=andrey-karpov
And Coverity is not perfect: http://www.viva64.com/en/b/0408/#ID0EGMAC
Examples: http://www.viva64.com/en/b/0154/ , http://www.viva64.com/en/b/0360/
It should be said, that you won’t probably find a lot of bugs in the code. The thing is, that once we have already delved in code of this project and fixed those bugs that were found (at that moment of course)
It all started with an article http://www.viva64.com/en/b/0249/
Later we worked cooperatively with Epic Games company and this work had the following results: http://www.viva64.com/en/b/0330/
Which means that at this moment you will be finding bugs that appeared after our fixes. But it’s not a big deal, we’ll be still very interested to see the articles you write. I just wanted to let you know about the previous articles.
Thank you once more, we are looking forward to reading Part II.
Of course, we never mean to mock at project authors. We just show that no one is safe from making a typo and it won’t hurt if one takes some precautions against it. By means of real-life examples, we show how useful the static analysis methodology is. The list of our articles can be found here: http://www.viva64.com/en/a/0084/
People often suggest various projects for analysis. In particular, some of our readers have suggested trying to analyze the source codes of the James Webb Space Telescope or, even better, Mars rover autonomous driving system.
Indeed, let’s take a look at the list of cool C++ projects composed by Bjarne Stroustrup: http://www.stroustrup.com/applications.html
It turns out that C++ has already travelled to Mars (search through the list for the NASA keyword). And there is also a lecture CppCon 2014: Mark Maimone "C++ on Mars: Incorporating C++ into Mars Rover Flight Software" available on this topic: https://youtu.be/3SdSKZFoUa8
So we have grown highly enthusiastic about the idea of analyzing such interesting and safe software system as Mars rover flight software and probably finding at least a couple of bugs there. Well, the telescope is as interesting, too.
The hardest thing is how and where to get these source files, or at least their analogues. I guess no one will give us the source codes for the working spacecraft. But what if we could get the source codes of the older software versions or for spacecraft no longer in use?
This is why I am addressing the community. If anyone happens to know, please tell us whom we can contact to discuss this question. It won’t make any sense simply writing an email to NASA, will it? And there may be someone in this community who is directly involved in this area or knows someone who is. I will appreciate any information, contacts, and help you can offer. I’m sure it could bring us some interesting materials if it worked out. You can leave your comments right here or contact us at the following link: http://www.viva64.com/en/about-feedback/
P.S. I know about github.com/nasa. But there is nothing interesting in C/C++.
But they are wrong. They do make quite a lot of them. Here's, for instance, a bug database we have collected and keep updating: http://www.viva64.com/en/examples/.
Moreover, some bugs can take quite a while to find, despite being simple. Here's a nice example:
The conclusion is: the bug we had wasted about 50 hours to track was detected at once with the first run of the analyzer and fixed in less than an hour! Source: http://www.viva64.com/en/b/0221/
True, false positives aren't good, but they are not that much trouble. Static analysis tools provide numbers of means to suppress them. At least, we in PVS-Studio do have a lot of false positive suppression mechanisms. But it's a long story, so you'd better refer to the documentation.
1) PVS-Studio can instead be set to run in background immediately after the edited code has been successfully compiled.
2) PVS-Studio integrates with IncrediBuild. And soon we will publish an article about it. A little spoiler. :)
That is why we took part in this forum and tried to demonstrate how often programmers make mistakes or make it vulnerable without any suspicions. The report is based on checking more than 200 projects experience. We were finding various defects with the help of PVS-Studio.
Here we suggest you to acquaint with our report:
- English version of presentation : http://www.slideshare.net/Andrey_Karpov/200-open-sourceproje...
- Russian version of presentation : http://www.slideshare.net/Andrey_Karpov/200-open-sourceproje...
- The record of Russian version of presentation with English submits: http://www.phdays.ru/broadcast/ . The report's start: 06:13:21. You can easily find it by number 200 on the page and choosing this report in the list.
class SbiSymDef {
....
SbxDataType GetType() const { return eType; }
....
};Code analyzers never get tired and can find errors a human's eye cannot easily notice. We have picked a few code fragments with errors revealed by PVS-Studio, all the fragments taken from well-known open-source projects.
Let's simplify the code to make the error more obvious:
if (a & Min_Max) { Min[0] Min[1] }
else if (a & Max_Min) { Max[0] Min[1] }
else if (a & Max_Max) { Max[0] Max[1] }
else if (a & Min_Max) { Min[0] Max[1] }