crazylazy.info

txtFirst of all you may wonder why I don't wrote about the theoretical backgrounds of Static Code Analysis. The answer simply is: it's huge and I don't know them good enough. Other people did a good job explaining the theoretical backgrounds and I don't see any reason to repeat them.
- You may like to listen to Software Engineering Radio 59 to get some more inputs here and there... Here's just the pragmatic side featuring Eclipse and Vim.

splint it

Splint is the open-source static code-analyzer you want for C and C++. It's hard to do these kind of assumptions static code analysis uses to determine problems in code for C(++), because the model is not based in a virtual environment. Rules apply differently. Nevertheless splint does a good job.
I've tried out Klocwork (which has a nice GUI), too. Latter is much more powerful, but I prefer splint because it's fast and easy, integrates into Vim and Eclipse, and has got a lot of options. If you're using gcc in a Unix environment, try this .splintrc:



-I.
+unixlib
+charindex
+charintliteral
-realcompare
-exitarg
-booltype bool
-paramuse
-predboolint
-nestedextern
-abstract

-Dint8_t=char
-Du_int8_t=uchar
-Dint16_t=short
-Du_int16_t=ushort
-Dint32_t=int
-Du_int32_t=uint
-Dint64_t=long
-Du_int64_t=ulong
-Din_addr_t=int
-Dcaddr_t=short
-Disgps30bits_t=uint
-DFD_SETSIZE=31
-DB57600=010001
-DB115200=0010011
-DCRTSCTS=0x00020000
-DONLCR=0x00000002



Here's the link to the Eclipse plugin for splint. I assume it does only work for Windows. It's better to use splint from command-line. The Eclipse plugin needs some tuning. I may have a look at it but in my heart I'm not just an Eclipse user, but a commandline-junky and I use Vim if it's not in my way:


The csupport plugin integrates splint. Here you see the Quickfix list, if there's something to fix. In case of MacOS X and MacPorts you have to soft-link the splint binary from /opt/local/bin to /usr/bin. Otherwise the mentioned menu-option is invisible.

PMD and FindBugs - Java

For problem-focused analysis FindBugs is very good. It does a lot of testing within the formal model of Java, finds divisions by 0, marks problematic areas and suggests better options for you. I guess for now there's no Vim integration. Therefore... we lack this. For now.

PMD analyses - while creating good reports - code a little deeper and does more tests. It even links information to the violation your code represents. Try it ;). You can integrate PMD into Vim. And that works just fine.

- So I hope this helps a bit to integrate static code analysis into every day coding. Vim and Eclipse have got a modular design that allows us to extend their abilities. That's quite time-saving because it seems Computer are getting good in finding bugs. ;)

Have fun,
wishi