https://www.meetup.com/St-Petersburg-CPP-User- Group/ ● C++ Russia: https://cppconf.ru/en/Why Code Analysis?Software QualityReadability Maintainability tools fuzzer battery life Repeatable tests Undefined Behavior – Fun with NULL pointers, part 1: https://lwn.net/Articles/342330/Why code analysis – ● Improve software quality ● Lower developer frustration ● Avoid UBLanguageLanguage helps Built-in compiler check ○ Current LLVM implementation gives 5% overhead ○ Annotations to help analysis: gsl::SharedOwner, gsl::Owner, gsl::Pointer void sample1() { int* p = nullptr; {

Finding Bugs using Path-Sensitive Static Analysis Gábor Horváth Gabor.Horvath@microsoft.com @XazaxHunWelcome to CppCon 2021! Join #visual_studio channel on CppCon Discord https://aka.ms/cppcon/discord latest announcements Take our survey https://aka.ms/cppconAgenda • Intro to path-sensitive static analysis • Path-sensitive checks in MSVC • A look under the hood • Upcoming features • Lessons learned2012 -> Unknown p -> Null p -> MaybeNull p -> MaybeNull Warning Unknown Null NotNull MaybeNull Analysis state Transition semi-lattice• Some paths are infeasible: • Not taking branch 1, but taking branch

accounts • Isolate untrusted inputs Management • Keep dependencies up to date • Use static code analysis tools built into your CICD pipeline • Use fuzzing in your CICD pipelineStrategies for Secure Security DevOps has these built in ● BinSkim ● CodeQL ● PreFast and SAL annotations ● OASIS Static Analysis Results Interchange Format (SARIF) ● C++ Core Check rulesThird Party or Open Source Software ● without ASan is unsupported Compiler Options /fsanitize-coverage=inline-bool-flag /fsanitize-coverage=edge /fsantize- coverage=trace-cmp /fsanitize-coverage=grace-div Link the libraries: • clang_rt.fuzzer_no_main-x86_64

its built-in checks. Static analysis is great, but you also get tons of false positives. Now that you’re hooked on smart tools, you have to try dynamic/runtime analysis. After years of improvements Ciura | @ciura_victor - 2020: The Year of Sanitizers? Vignette in 3 parts Static Analysis Dynamic Analysis Warm Fuzzy Feelings10 2020 Victor Ciura | @ciura_victor - 2020: The Year of Sanitizers I Static Analysis15 2020 Victor Ciura | @ciura_victor - 2020: The Year of Sanitizers? C++ Core Guidelines Checker docs.microsoft.com/en-us/cpp/code-quality/quick-start-code-analysis-for-c-cpp

into smaller chunks •Static analysis tools99 How can we test it? •Remove old code and add new code at the same time •Separate tasks into smaller chunks •Static analysis tools •Formal Design100 How •Remove old code and add new code at the same time •Separate tasks into smaller chunks •Static analysis tools •Formal Design •Code Review101 How can we test it? •Remove old code and add new code at Control Tracking) 2. Enumeration/Constant Versioning and Deprecation 3. Automated Static Code Analysis for Renaming 4. Semantic Versioning for Enums 5. Refactor Scripts and Tools to Validate Renaming

Navigation ☑️� Linters ☑️� Colorization & Formatting ☑️� IntelliSense ⌛; ☑️�MSVC ☑️�MSVC Code Analysis ☑️�MSBuild ; CMake ⌛ ; GCC ⌛ ; Clang/LLVM ⌛ ☑️�Stepping ☑️�Parallel Stacks ☑️�Debugger Cross-platform development 4. Developer and Team Productivity Static Analysis ✴ New and improved checkers in MSVC Code Analysis • Returning a local variable with std::move • Path-sensitive bounds checking 4:45pm / Fri, Oct 29 – 12:00pm Finding bugs using path-sensitive static analysis Gabor Horvath – _3 Tue, Oct 26 – 3:15pm Static Analysis and Program Safety in C++: Making it Real Sunny Chatterjee – _2

templates ○ New linters ○ New type-checking ○ Code changes needed to adopt ● A goal to increase test coverage ○ “Refactoring” to make code more testable“X% of your code will be rewritten in 5 years.ˮKubrick clang-formatImproving with static analysis ● Always provide a clang-format file ● git-hooks to automatically apply formatting to changes ● Formatting verified in CIImproving with static analysis …with ASAN, UBSAN Undefined Behavior & Intel Assumptions in a Legacy C Codebase23 xkcd.com/2030/Improving with static analysis Success ● Incremental rollout of ASAN / UBSAN Failure? ● Full product testing with TSANWrite tests

and data is moved using explicit routines SYCL runtime does not perform any data dependency analysis Dependencies are managed manuallySome platforms will support variants of USM where memory allocations the C++ Core Guidelines ▪ Static analysis ▪ Library components as alternatives to error-prone constructs (casts, naked pointers, etc.) ▪ Rules to make static analysis more feasible 2022 37FUTURE OF units • Formalised code review • Failure analysis – Avoid bugs • Avoid error-prone features • Adhere to coding guidelines / best-practice • Rigorous testing & coverage checking – Ensure errors are handled

adequate analytical scrutiny. It’s not that all cases receive equal scrutiny; some case require more analysis, some less. The actual difference between cases starts with their descriptions. Some cases have circumstances accrue, the longer the description and the greater the analysis to fully comprehend it. The proper goal is complete coverage of all cases, a full portfolio that understands everything that can difficult is the combinatorial expansion of cases. There are no edge cases in stdx::interval because the analysis is exhaustive. Reliability: Testing the intersection operator Eliminating edge cases means exhaustively

bad tests are almost always better than no tests! Easy to run Fast to run TDD Deterministic Code coverage / regulatory requirement ... 3Unit Testing OO Code Test using only the public interface ("Black quantum mechanics Solutions: Isolate Subtract Detect and eliminate erroneous results Statistical analysis 27Reproducibility (handling unreliable results) Unreliable or "flaky" tests: depend on timing