How to work with static analyzer output

Question

We started using a static analyzer (Coverity) on our code base. We were stunned by the sheer number of warnings we received (hundreds of thousands of them), it only takes a few months to clear them all (unimaginably impossible).

the parameters that we have discussed so far,

1) hire a contractor to deal with the warning and fix them - it has a drawback: we will probably need a lot of people to make all these changes, and no contractor will need to understand the code.

2) filter the warning and apply it only to the dangerous ones - the problem is that our static analysis result will always be cluttered with a warning that makes it difficult for us to isolate the problems. also warning filtering is also a serious effort.

in any case, bringing our code to a state where a static analyzer can be a useful tool for us seems like a monumental task.

so how can you work with a static analyzer without going into ongoing full-rack development efforts?

Answer 1

The first thing to do is configure the analysis parameters; Coverage support probably left you with a pretty general configuration.

• , , , , , . ( Coveritys , , , - .)
  • , . ( , , , Coverity - .: -)
  • , ; . , .
• , . , , , , . (, , , . . , .)
  • - , - .
  • , , Ive, .
• URL. , No New Warnings.

:

• Coverity (http://forums.coverity.com/), , NDA. , .

• , , , (http://codeintegritysolutions.com/); . , , ; - , , . ; , .

  • Ive , : http://codeintegrity.blogspot.com/2010/01/handling-embarrassment-of-riches.html.

Answer 2

: ; 100 ; ; . : ; , ( ?); .

, ( ), , .

: ( ), / , , .

Answer 3

• . . . .
• . : , , , .

Answer 4

, , , . , Coverity - , NULL- , , .

, ​​, preFAST/preFIX - , Microsoft, . , , . , - , (-), .

- , , .

Answer 5

"" . : . , , , .

Answer 6

. Parasoft ++ Test, .

Answer 7

, ?

""

Static Analysis , , . Coverity , , . Coverity Software Development Kit C ++, . concurrency, . "

http://www.coverity.com/products/static-analysis.html

Answer 8

Coverity . , 100 , , .

- "", "" "" , , , , , .

Thirdly, if your code base is large (and whose one is not), subdivide it into components so that each team or group of developers can look only at the code that they directly support - this allows both more manageable pieces of work and also allows you determine component priorities (flaws in server code are more critical than defects in client code, or test code, or third-party code, etc.).