Situations when a static code analyzer can be useful

The static code analysis method is to search for those places in the program text that are highly likely to contain errors. To search for such places are used tools called static code analyzers. After receiving a list of suspicious lines, the programmer reviews the code and fixes the errors found.

Most often, static code analysis is used to control the quality of a developed project. But there are more unusual tasks, for solving which code analysis is used. In this small note I want to describe some of them.

Training

Static analysis can be used for training purposes. As a rule, the teacher, evaluating the student's work, looks at the code written by him and makes test runs of the program. Since there are many students and one teacher, he can additionally increase his attention using a static code analyzer. So he will be more likely to find a reason to send a student to redo his work.
')
Another way to use the analyzer for training is to check the code of young programmers. This will allow you to quickly find and explain a number of errors. And the ability to analyze indents, naming variables, and so on will allow a person to start writing code faster within a pleasant way of organizing coding style.

Transfer program to another system

It is very difficult to write programs portable, especially if it was not originally in the plans. Therefore, transferring a program to another operating system or to another hardware platform is always quite painful. It is almost impossible to know in advance all the nuances that await a program in another system and even more so how to find all the unsafe places in the code. Specialized code analyzers that point to all potentially dangerous places can help. Analyzers will tell you where the change in the dimension of types, data alignment rules, change of byte order, use of obsolete functions, and so on can damage.

Search for black holes

Static analysis can be used not only for good, but also for harm. Since code analysis helps developers identify buffer overflows, stacks, and other such defects, then an attacker can do the same. Studying fragile places, a hacker can quickly select an object to attack. That is, he does not need to view a huge amount of code. The static analyzer will do some of the work for it. He will indicate where the code is vulnerable, and the hacker will be able to proceed to the next stage of work - trying to figure out whether it is possible to take advantage of the defects found in the code, and if so, how.

Often, the attacker is not available source code. But it is possible to use static analyzers working directly with binary executable code.

Naturally, the search for holes can be turned into a blessing. For example, many companies reward people who discover vulnerabilities in a program. Using static analyzers to search for such vulnerabilities can be much easier.

Using third-party source codes

Programmers often use various open source tools. Other words use open free libraries or their fragments. Often the same problem can be solved using various third-party development. And the question is how to choose. An unusual interesting method would be to use static analysis. After all, the less errors will be found, the more likely it is better and more reliable code.

If your team is given a third-party project for maintenance and development, static analysis will reveal the most terrible places in the project, and therefore you will be able to guess which parts of the system should be given maximum attention.

Justification of the need for refactoring code

Often, programmers are aware that a project becomes too complex and begins to fall apart. They come to the conclusion that it is necessary to do refactoring of the project, otherwise, support and creation of supports will be eaten almost all the time so that the project does not collapse completely. But programmers always have urgent tasks. And to justify why you should not do another dialogue, and you should rewrite one of the old ones, is not so simple. Here, as one of the arguments can be a static analyzer, which screams about too large functions, about the multiple use of global variables, about too complicated class hierarchy, about using obsolete and therefore unsafe functions and about other horrors.

Conclusion

Of course, I listed far from everything, but what I remembered. There are plenty of other tasks that can be solved by static code analysis.

Write if you have had some interesting non-standard ways of using the static analysis methodology.