Understanding Static Code Analysis
Understanding Static Code Analysis
Static Code Analysis is a way of analyzing source code to look for flaws in the constructs and semantics of a computer program. Your application is broken down into several flow models that simulate execution within several paths. The technical details are outlined in the section entitled "How the C/C++ Code Analyzer Works."
Static analysis through Team System (or a third-party static code analyzer) can deliver the following benefits:
-
Correctness: Static code analysis checks for bad coding practices, thus improving the quality of your code.
-
Machine detection: Static code analysis will help you hone in on defects that would be hard to find using manual processes.
-
Automation: Static code analysis automates your testing process, enabling you to fix
bugs , rather thanspend your time doingextensive code reviews.
Code Analysis for C/C++ looks for specific categories of defects. You can easily use these categories to plan or model your tests. These defect categories (covered later in the chapter) can help you develop solid code review methodologies. For a complete list of warnings and errors,
How the C/C++ Code Analyzer Works
During the normal compilation of a C++ application, the compiler creates an internal representation of the program as objects. The linker then links these objects and converts them into executables (
.exe
) or Dynamic Link Libraries (
.dll
). Code Analysis for C/C++ intercepts the build process and attempts to run through every single execution
The last three
Figure 9-1
An AST can be used for both code optimization and static analysis. The static code analyzer finds
if (NULL != parameter) { uninitVar = myFunction(parameter); } return uninitVar;
Figure 9-2 shows how this code looks represented as an AST structure. You can see precisely where the rule was violated and where PREfast throws a warning or error.
Figure 9-2
Visual Studio 2005 Integration
The incorporation of Code Analysis for C/C++ in Team System is a significant development. Until a few
Enabling and disabling C/C++ Code Analysis
Much of the work you will be doing with the C/C++ code analyzer will be within the Visual Studio 2005 test environment. You can access most of the Test
Windows from the main menu. To enable Code Analysis for C/C++, right-click on your C++ project in the Solutions Explorer and select Properties.
The project Property Pages window is shown in Figure 9-3.
-
Expand the Configuration Properties node.
-
Expand the Code Analysis node, and then click General.
-
Under the Enable Code Analysis for C/C++ Option, select Yes (/analyze).
Figure 9-3
You can also enable Code Analysis for C/C++ another way:
-
Right-click on your C/C++ project in the Solutions Explorer and select Properties.
-
Expand the Configuration Properties node.
-
Expand the C/C++ node.
-
Select Advanced.
-
Set Enable Code Analysis for C/C++ to Yes (/analyze), as shown in Figure 9-4.
Figure 9-4
To disable C/C++ Code Analysis, set any of the above options to No, rather than Yes (/analyze).
| Note |
Even though there are two ways of enabling C/C++ Code Analysis, you can enable or disable it in one spot, and it will automatically appear enabled or disabled in the other. |
Setting warning levels in Visual Studio 2005
You can set warning level options using the Configuration Properties section of the Property Pages window. Follow these steps to change the warning levels from within the Visual Studio 2005 IDE:
-
Right-click on your C++ project and select Properties.
-
Expand Configuration Properties, then C/C++, and then General.
Using this window, you can set several options, including the following: Warning Level (/W<n>), Detect 64-bit Portability Issues (/Wp64), and Treat Warnings as Errors (/WX). The C/C++ General options are shown in Figure 9-5.
Figure 9-5
| Note |
You can also programmatically set warning levels using #pragma directives and as options when you compile your code with the command-line compiler. Both scenarios are covered in detail later in the chapter. |
Viewing code analysis warnings and errors
From this point on, if you compile or build the project, all C/C++ code analysis–
Figure 9-6
One of the killer features from the integration of Code Analysis for C/C++ is code highlighting. If you click on any of the warnings, Visual Studio will automatically highlight in yellow the "defect