Practical experience and evaluation of continuous code static analysis with C++Test

Abstract

The static code analysis tools are a fundamental instruments to validate the developed code. They allow detecting bugs (as memory leak, accessing arrays out of bounds, etc.. ), structural errors and preventing entire classes of errors. This work refers to the Parasoft's tool "C++test". It helps developers prevent and eliminate defects using rules tuned to nd code patterns that lead to reliability, performance, and security problems. To be practical, the static analysis must be seamlessly in- tegrated into the team's work- ow. The "`continuous static analysis"' allows executing automatically the analysis when the new code is released. In this way is possible to realize a further automation in the software development executing the tool during the night or weekend. The time saved to run the tool can be used to analyze and correct the bugs. When you deal with static analysis, it's important to under- line the problem of false positive. It would be attractive if we could develop a tool that could intercept all defects in a given piece of software with certainty. Not all real errors can always be caught, and not all errors caught can always be real. This work presents a quantitative evaluation on the percentile of false positive generated by C++test.