Many resources discuss the benefits of using static analysis tools and how they can help you improve your codebase. They show you what you could gain by using them. But have you ever asked yourself what you lose by not using them?
Take, for example, memory corruption caused by freeing a pointer twice, which can lead to random crashes. It could take anywhere from a few hours to several days to find this kind of issue. Many similar risky problems exist in C/C++, especially concerning memory corruption. A single problem could cost anywhere from a few dollars to many thousands of dollars.
The impact of an issue also depends on the nature of the program: a problem in an embedded application controlling a machine does not have the same consequences as a crash in a painting application. Sometimes, a single problem can cost millions or even billions of dollars, as in the case of Ariane 5, where a bug cost $7 billion.
What do you lose if you use a static analysis tool?
Let’s take Cppcheck as an example; it primarily detects the types of bugs that compilers normally do not detect. Many interesting errors are reported by this tool.
It takes less than a minute to download and perhaps 20 minutes to configure; the analysis takes from a few minutes to many hours, but during this time you are free to do other tasks. After the analysis, you may have thousands of potential issues; initially, you can focus only on the highest-priority errors.
Finally, with free static analysis tools, you lose only 30 minutes to get a list of potential issues that could cost you many thousands of dollars.
For commercial tools, you lose more than time: you have to pay for them. Therefore, you also lose money. Let’s suppose that you purchase a tool for $1,000 and it helps you find a problem that would take a developer two or three days to find. Three days of a C/C++ developer’s time could cost more than $1,000, depending, of course, on where the company is located. But if you take into account the hidden cost of a single issue, you may be surprised by how much a seemingly simple issue can cost a company. Many stories on the web talk about the cost of simple issues.
Here are some free static analysis tools:
CppCheck (Free): Cppcheck provides many checks; here are some of the available ones:
- Out of bounds checking
- Checking exception safety
- Memory leak detection
- Warn if obsolete functions are used
- Check for invalid usage of STL
- Check for uninitialized variables and unused functions
Clang (Free): is a C/C++ compiler; its diagnostics are very interesting, and you could be surprised by the relevant issues reported. They could concern:
- Deprecated usage
- Cast problems
- Initialization problems
- OpenMP issues and more.
Clang-tidy (Free): is a clang-based C++ “linter” tool. Its purpose is to provide an extensible framework for diagnosing and fixing typical programming errors, like style violations, interface misuse, or bugs that can be deduced via static analysis. clang-tidy is modular and provides a convenient interface for writing new checks. Here’s the checks list of clang-tidy.
Many other static analysis tools exist. Some are easy to try, while others require you to contact the vendor and request a trial version.
If you can spare just 30 minutes to try Cppcheck, it will likely be time well spent.
Summary
It’s better to combine several C++ tools to detect issues in your C++ codebase: some tools detect bugs, while others also detect bug-prone situations. You can start with free tools and review the issues they report.