Upsetting Opinions about Static Analyzers

Andrey Karpov
Articles: 550

Static analysis tools have advanced far over the time they've been around. They no longer resemble the "linters" that were in active use 20 years ago. But some programmers still view them as extremely primitive tools. And that's very sad. It hurts to see the static analysis methodology in general and our PVS-Studio analyzer in particular treated that way.

https://import.viva64.com/docx/blog/0765_Sadness/image1.png

That feeling was evoked by a comment left under one of our articles. In that article, we said that the analyzer would detect a typo by issuing a warning on the following code pattern:

if (A[0] == 0)
{
  X = Y;
  if (A[0] == 0)
    ....
}

The analyzer says the second condition is always true. Indeed, a close look at the function's body reveals that the programmer intended some other element to be checked.

Now, someone commented on this along the following lines:

Yes, it's indeed an error in this particular case. But in the general case, this warning is wrong because the element may change its value during the time between the two identical checks, in which case the second check would make sense.

It's sad. Programmers still seem to think that code analyzers are based on the use of regular expressions – they believe the tool gets mad on simply seeing two identical nested ifs :(.

Of course, any modern static analyzer tracks the changes of variables' values. If a variable doesn't change, a warning is issued. If it does, no warning is issued. To ensure that, analyzers rely on data stream analysis.

And that's exactly how PVS-Studio works. Let's take a look at the following synthetic example:

char get();
int foo(char *p, bool arg)
{
    if (p[1] == 1)
    {
        if (arg)
            p[0] = get();
        if (p[1] == 1)          // Warning
            return 1;
    }
    if (p[2] == 2)
    {
        if (arg)
            p[2] = get();
        if (p[2] == 2)          // Ok
            return 2;
    }
    return 3;
}

This code consists of two similar blocks. In one, the variable being checked doesn't change, while in the other it does. That's why the analyzer issues a warning only on the first block: V547 Expression 'p[1] == 1' is always true.

Programmers needn't worry. Modern tools are advanced enough to issue warnings only on really suspicious code. Sure, false positives occur every now and then, but they usually have to do with complicated code structure, which even a human reviewer may have a hard time figuring out.

GetFreeTrialImage

Further reading


You can discuss this article with other readers on habr.com


Use PVS-Studio to search for bugs in C, C++, C# and Java

We offer you to check your project code with PVS-Studio. Just one bug found in the project will show you the benefits of the static code analysis methodology better than a dozen of the articles.

goto PVS-Studio;

Andrey Karpov
Articles: 550


Bugs Found

Checked Projects
411
Collected Errors
14 123
This website uses cookies and other technology to provide you a more personalized experience. By continuing the view of our web-pages you accept the terms of using these files. If you don't want your personal data to be processed, please, leave this site. Learn More →
Accept