“The Current State of (free) Static Analysis"

on YouTube ↗29m

" summary

Survey of free tools (Cppcheck, Clang static analyzer, Visual Studio analyzer, Coverity Scan, Metrics++, copy‑paste detector) compares real failures: several analyzers miss assert with side effects, many miss lambdas that capture a dangling reference, and only Coverity flags mixed‑vector iterator misuse; Cppcheck finds empty vector loops and clang‑modernize recommends range‑for to avoid size_t/int truncation bugs. Sanitizers and fuzzing later find ~15 crashes in one project, so tools help but leave false negatives and platform‑dependent failures (use many tools and warnings).

AI-written summary · about

" chapters (26)

1. 0:00Introduction
2. 0:52Static Analysis
3. 1:23Compiler Warnings
4. 1:54CVPCheck
5. 2:49What is wrong
6. 3:26Tools
7. 3:42Uni
8. 5:00X
9. 7:12clang
10. 7:42Google
11. 8:40Go
12. 9:32Null pointer
13. 10:37Smart pointer
14. 11:13C style arrays
15. 12:26Capture by reference
16. 14:18STD Move
17. 17:50Hither Raters
18. 18:46Metrics Plus
19. 19:45CopyPaste Detector
20. 20:31Warnings
21. 22:36False Sense of Security
22. 23:41RealWorld Example
23. 24:10Conclusion
24. 25:06Warning Levels
25. 25:55Writing Your Own Analysis
26. 26:47CVP Check

" related talks

• 52m“Tools from the C++ eco-system to save a leg”Anastasia Kazakova · CppCon 2017
• 36mThings I learned from the static analyzerBart Verhagen · Meeting C++ 2019
• 01h 01mMake Friends with the Clang Static Analysis ToolsGabor Horvath · CppCon 2016
• 01h 01mCode Analysis++Anastasia Kazakova · CppCon 2021
• 43mEverything I learned about static analysis and program safety in C++Sunny Chatterjee · Pure Virtual C++ 2022
• 01h 03m“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (2 of 2)”Matthew Butler · CppCon 2018
• 51mCode Analysis ++Anastasia Kazakova · NDC TechTown 2022
• 01h 00mAdvanced Tools for Better ProductivityGabor Horvath · Meeting C++ 2017