splint 与 gcc：外部静态代码分析工具值得为 C 代码库付出努力吗？
我正在开发一个相当复杂的项目，而且它是一个内核内的 Linux 模块，这让事情变得更加复杂。在这样的代码库上运行像 splint 这样的 linting 工具当然不是不可能的 [1]，但微不足道的努力不足以让事情顺利进行。
在我投入更多时间之前，我希望获得一些关于这个问题的反馈和意见。有了足够的标志，gcc 就会进行大量的检查。在实践中使用单独的静态代码分析工具是否仍然值得？
[1] http://www.cs.virginia。 edu/pipermail/splint-discuss/2005-January/000531.html
I'm working on a fairly complex project, and as an added complication it's an in-kernel Linux module. Running a linting tool like splint on such a codebase is certainly not impossible [1], but trivial effort was not enough to get something going.
Before I invest more time into this, I was hoping to garner some feedback and opinions on the issue. With enough flags, gcc does quite a lot of checking. Is using a separate static code analysis tool still worth it in practice?
[1] http://www.cs.virginia.edu/pipermail/splint-discuss/2005-January/000531.html
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
除了像
sparse这样的工具之外，我建议看看 LDV 项目。 LDV 首先面向检查 Linux 驱动程序。该系统比splint和sparse执行更深入的静态分析，并且可以检测非常难以捉摸的问题。LDV 是免费软件。
如果您想尝试但没有时间部署它，他们有一个在线验证服务，您可以在其中上传您的代码并进行检查。
除此之外，Coccinelle 系统也可能值得关注。与 LDV 一样，Coccinelle 也被用来检测 Linux 内核中的许多不同错误。
In addition to the tools like
sparse, I would suggest taking a look at LDV project. LDV is oriented towards checking Linux drivers in the first place. This system performs deeper static analysis thansplintandsparseand can detect very elusive problems.LDV is free software.
If you would like to try it but don't have time to deploy it, they have an online verification service where you can upload your code and have it checked.
Apart from that, Coccinelle system may also be worth looking at. Like LDV, Coccinelle was used to detect many different errors in the Linux kernel.
虽然
splint确实很简洁，但我认为在 Linux 内核源代码上使用它所需的努力可能比它所获得的回报更多。然而，内核开发人员拥有自己的稀疏工具来执行一些类似的检查，并且已经将其使用深度集成到内核源代码中。将它集成到您的源代码中也应该感觉很自然，因为它已经遍布内核源代码。有关使用
sparse的详细信息，请参阅Documentation/sparse.txt。有一个商业项目 Coverity，它偶尔会扫描许多“高度重要”的开源项目是否存在问题。他们使用他们的工具在 Linux 内核源代码中发现了数百个（如果不是数千个）错误。 （这是一个快乐的故事，他们为自己的产品做广告，美国政府获得了大量极其重要的代码审查，开源作者获得免费的错误报告，开源用户获得免费代码审查的好处。四方共赢！）
您是否值得购买 Coverity 的专业知识是另一个问题 - 但与
sparse集成将为您带来静态代码检查工具的一些好处，而无需支付许可费用。While
splintis definitely neat, I think the effort required to use it on Linux kernel sources is probably more than it would return.However, the kernel developers have their own
sparsetool for performing some similar checks and have already deeply integrated its use into the kernel sources. Integrating it into your sources too should feel pretty natural, since it is already all over the kernel source code. SeeDocumentation/sparse.txtfor details on usingsparse.There is a commercial project, Coverity, that occasionally scans many "high importance" open source projects for problems. They've discovered hundreds, if not thousands, of bugs in the Linux kernel sources with their tool. (It is a happy story of them advertising their product, the US government getting a giant pile of extremely important code reviewed, open source authors getting free bug reports, and open source users getting the benefits of free code reviews. A four-way win!)
Whether or not it is worth it to you to purchase Coverity's expert knowledge is another question -- but integrating with
sparsewill get you some of the benefits of static code checking tools without the licensing fees.