Static Analysis and Program Safety in C++: Making it Real

on YouTube ↗01h 00m

" summary

Static analysis for C++ claims compile‑time safety with no runtime cost and actually ships as a Visual Studio Community Edition feature and a GitHub Action; the implementation (prefast + ESPX engine) runs path‑sensitive checks and scales with intraprocedural heuristics plus optional annotations. Real production defects found include a null‑dereference, a union type‑confusion leading to calling arbitrary functions, and an integer truncation heap overflow from allocation arithmetic; some checkers are noisy or experimental but the tooling demonstrably finds and helps fix real bugs.

AI-written summary · about

" chapters (29)

1. 0:00Start
2. 2:19Why Code Safety Matters and What Is Static Analysis
3. 3:14Why Code Safety Is Important
4. 4:59Guideline Support Library
5. 5:43What Is Static Analysis
6. 8:04Visual Studio Experience
7. 8:33Defects Should Be Easily Understandable
8. 9:03Key Events
9. 10:33Github Integration
10. 11:29Configure the Code Scanning Alerts in in Github
11. 13:32Code Scanning
12. 16:22.Code Scanning Alerts
13. 17:23Github Experience
14. 23:07Whole Program Analysis
15. 24:34Not Null Type Extension
16. 25:10Source Annotations
17. 27:59Pros and Cons of Annotations
18. 28:59Disadvantages
19. 35:23Usbx Engine
20. 39:04Memory Leaks
21. 41:01Accuracy and Speed
22. 43:41Make Static Analysis Universally Available
23. 48:10Can Static Analyzer Stop Reporting those Instances in Subsequent Analysis
24. 49:36What Are the Chances To Get the New Github Actions Supported beyond Cmake
25. 50:47Is There a Knob To Control the Severity of the of the Warnings That Get Reported
26. 51:58Visual Studio
27. 56:50To Find Memory Leaks
28. 58:07Lifetime Checks
29. 59:12Github Are There any Plans To Put these Checks in Azure Devops

" related talks

• 43mEverything I learned about static analysis and program safety in C++Sunny Chatterjee · Pure Virtual C++ 2022
• 36mCode Analysis: Empowering developers to write performant, reliable, and safe C++Sunny Chatterjee, Jim Radigan · Pure Virtual C++ 2021
• 01h 26mA Path to Practically Safe C++Yitzhak Mandelbaum · C++Now 2026
• 01h 01mClosing the Gap between Rust and C++ Using Principles of Static AnalysisSunny Chatterjee · CppCon 2020
• 29m“The Current State of (free) Static Analysis"Jason Turner · CppCon 2015
• 01h 03mLifetime Safety in C++: Past, Present and FutureGabor Horvath · CppCon 2023
• 01h 06mmemory-safe C++Jim Radigan · CppCon 2022
• 58mSecurity Static Analysis - Avoiding an Angry Mob of EngineersJosh Brown-White · NDC Oslo 2019