Static Analysis in C++

Download PVS-Studio ► www.viva64.com...
Enter promo code #Cherno in the message field to get a 30 day free trial instead of 7.
Patreon ► / thecherno
Instagram ► / thecherno
Twitter ► / thecherno
Discord ► thecherno.com/...
Series Playlist ► thecherno.com/cpp
Favourite Articles:
-------------------
Static Analysis in Video Game Development: Top 10 Software Bugs
www.viva64.com...
Anomalies in X-Ray Engine
www.viva64.com...
A Long-Awaited Check of Unreal Engine 4
www.viva64.com...
John Carmack
In-Depth: Static Code Analysis
www.gamasutra....
This video is sponsored by PVS-Studio.

[@rudolflovrencic]

I understand you need sponsors, but you could mention clang-tidy since it is a free tool. Since you are in a position of an educator, I would appreciate you mention free and open source tools, especially since the video is named "Static Analysis in C++" not "Static Analysis in C++ using PVS-Studio". You don't have to use it, but simply mention it since it is used a lot. Anyhow, nice video! Keep em comming :)

[@Mono-ip2fx]

Thank you for the mention, never heard of Static Analysis and hoped he would mention a free tool, sadly he didn't.

[@chris1london]

There's also cppcheck.

[@infinitumscientiam]

PVS-Studio is the best static analyzer. I personally use all in place, and cppcheck + clang-tidy (if this is a unix-like OS) + pvs-studio. You can find the comparison of static analyzers and the most qualitative errors will find pvs-studio. But other static analyzers sometimes find errors that cannot be checked them.

[@dandan-gf4jk]

@@infinitumscientiam $5 has been deposited to your PVS-Studio wallet

[@AndrewKln]

PVS-Studio can be used for free for personal or open source projects, you just need to include a comment in your source files (I think they said in all files, but I include only in one and it works.) Look in their website, they explain how to do it. It just says something like "I'm using PVS Studio and here is the link" .

[@brunooliveirasoares7489]

Ohhh yeahh C++ series rocks!

[@furball_vixie]

Nobody: KZbin Autogenerated subtitles: "Welcome Back to my safe weight loss series"

[@yee3135]

even better, it says: "safe wealth loss series"

[@KurtVanBever]

It's a feature : aussie syntax.

[@felipecarlin8540]

*he is speaking the lenguage of gods*

[@luisendymion9080]

@@felipecarlin8540 The language of the Coders overrides the language of the Gods LOL

[@motbus3]

cherno still one of the best explaining c++

[@Pikachulover1735]

I'm really grateful to have found this channel. I'm learning so much and loving C++ even more thanks to you! :)

[@MyCiaoatutti]

Little advice for static analyzer users: they complement each other (e.g., I use Resharper C++ and PVS-Studio together). Also, dynamic analysis is quite critical too! For example, PVS-Studio and Resharper C++ can't detect every memory leak, so you have to do some dynamic analysis to catch them. For example, in Visual Studio, you can expose memory leaks easily using a simple function (_CrtSetDbgFlag ( _CRTDBG_ALLOC_MEM_DF | _CRTDBG_LEAK_CHECK_DF ); There exist static analyzers that can discover every bug: they are called "sound" static analyzers. Polyspace (by Mathworks) uses abstract interpretation to "prove the absence of certain run-time errors in source code for C/C++, and Ada," but it is computationally very expensive

[@yash1152]

thanks

[@jaszynek7640]

Static code analyzers+runtime analyzers like valgrind are quite useful but you definitely cannot rely on them while developing critical systems. Well designed(and implemented) testing strategy is the key to software quality.

[@andreykarpov3381]

You’re right. However your comment might be misunderstood so I’d like to make it clear. Well designed testing strategy doesn’t exclude but include static and dynamic code analysis necessarily. Also when working with critical systems, static code analyzers do not only allow find errors but they also make code more safe because programmers follow code standard such as MISRA. What Is MISRA and how to Cook It: www.viva64.com/en/b/0702/

[@luisendymion9080]

You're right, but with a language so prone to bugs as C++ any helpful tool is appreciated.

[@eigenfield]

Is PVS-Studio used in avionics software?

[@0xfadead]

​@@eigenfieldI think most avionics software is formally proven, though maybe static analysis is also used as an extra layer

[@siddharthsinghchauhan8664]

When I answer the question in interview the way cherno explains about c++... People get impressed. Watch him guys.. he not only knows in depth about what he is talking about he also knows how to present it to make us understand the underlying concept. @cherno can you please make a video about vtables and vptr.. I woulf like to hear yr way of explaining them

[@evanpudding9771]

yes vtables and vptr please!

[@a5cent]

Do you already understand them, and just want to hear his take, or are you not clear on how they work?

[@lnx648]

A tip to avoid the classic copy and paste and forgetting the old variable name error... You can just select the lasted portion of code and search and replace text only within the selected portion of text in Visual Studio, or VSCode... And probably many other editors. Just press Ctrl+F and there is a little button to enable it (probably with a shortcut that I don't remember), it will only highlight the matches inside the selected text so you can be sure... Pretty useful seems like a lot of people don't know about it tho

[@jonnykopp]

Great series Cherno, thanks for continuing to add to it!!

[@webinno]

Sometimes listening to some "cpp talks", they are always saying "Static Analysis" to be used quite often, I thought it's a programming technique but now some misplaced memories in my brain will find the right places. Thank you!

[@Tachi107]

Clang-tidy - free, open source, and just works*. I recommend using it with Visual Studio Code and the clangd extension (do not install Microsoft's C++ extension), then enabling Clang-tidy in the settings. I also recommend adding the following startup flags: "--clang-tidy-checks=*,-modernize-use-trailing-return-type,-cppcoreguidelines-special-member-functions,-hicpp-special-member-functions,-fuchsia-statically-constructed-objects,-fuchsia-default-arguments-calls,-fuchsia-default-arguments-declarations" *I mean, you have to use CMake to generate the compile commands of your project so that clangd can understand its structure, and if you never used it before it could take you form a few hours to one or two weeks before you get comfortable with it, but at the end your projects will be clean and platform-independent. You also need to install the LLVM suite on Windows or the clangd package on Linux, but that's pretty straightforward. (Oh, and Clang compiled programs are much faster than MSVC's)

[@soto2080]

Great

[@MichaelHazell]

I have Microsoft's C++ extension installed alongside clangd. It doesn't give me any problems really. I use Microsoft's extension for the debugging.

[@Tachi107]

@@MichaelHazell well, if you are on Windows i have no suggestions, but on Linux you can use GDB via the Native Debug extension

[@GeorgeValkov]

Visual Studio comes with built-in static analysis tools: Analyze, Run Code Analysis, On Solution. It would be nice if you make a video comparing them.

[@ctrlaltdebug]

Some of those checks are ridiculous though, and will flag the standard library.

[@irfanjames6551]

Thanks

[@apenasmeucanal5984]

thank you cherno, very useful!

[@felipecarlin8540]

You are amazing, even listening to a placement I learned a lot, and this seems like an actual thing can help me!

[@stevesmith7413]

I can tell you have a very clear and organized mind.

[@Kostu96]

2 videos in a row, heaven exists xD

[@b0606089]

Happy for you bro for getting sponsers

[@adriansrealm]

One of my worst code copying happened when I used the i variable as a counter for a loop, inside the scope of another loop

[@Loleexer]

Oh boy, I just cannot wait to discover all the errors in my current project :l

[@nortski78]

lmao

[@ShivamJha00]

Hahaha

[@not_ever]

It is recommended to use more than one static analysis tool since no one tool is good at catching 100% of bugs. If you are a hobbyist developer you might want to look into free tools such as cppcheck and clang tools. These are pretty easy to integrate into most IDEs or text editors like VS code. Cppcheck and clang tools give html output which can be integrated into gitlab pages, for example.

[@andreykarpov3381]

I agree, that it’s rational to use more than one code analyzer. Moreover, I can tell you in advance, that it’s worth considering such system as SonarQube in this case. This product can be integrated with different analyzers (PVS-Studio, Cppcheck, etc) and provide a single interface to work with them. It’s very useful for the projects written on different programming languages and where the different analyzers are to be used. By the way, PVS-Studio can also generate HTML: Html Report View in a Web Browser or an Email Client - www.viva64.com/en/m/0036/ and be used along with GitLab - www.viva64.com/en/b/0686/

[@sayedreda3694]

I guess you don't know, but watching your KZbin series is my college assignment LoL 😂

[@machine0man]

Subtitles : welcome back to my safe wealth loss series. btw , great videos Chernikov.

[@jeffzheng2355]

Truly love your cpp series. Could you make some video about cmake?

[@peterhaller5791]

I like to use the visual studio 19 build-in static analyzer. It also helps you if you want to write good modern c++ or if you want to follow the c++ core guidelines. I think I found a few little bugs in Hazel with it :-) Clang-tidy is also very good for multi platform analysis which is also build-in vs19. I will give PVS a try. Thank you Yan. Best regards

[@skrya1248]

Lol, that y was burning my eyes the moment he left it untouched... >

[@flyjanabeaali]

1st 4 minutes were so interesting.. so informative 😇

[@at2ectrebuke]

Cherno, huge thanks for this video, not only was it informative, but more importantly it managed to knock my 4 year old out for the night. Great stuff 👍🏾

[@sohrabkhan9823]

i < 3 your c++ series

[@syirogane]

Nested for loop bugs... I learned how to use gdb's hardware breakpoints because of a nested for loop bug in the quake source code (a month or two after id released the source code). Specifically, it was in the updating of beams (lightning gun). It took me a few days to figure everything out (programming in Linux was still new to me, gdb very new, and quake was pretty big (I now know it like the back of my hand))

[@suryabond0077]

Hey cherno , thanks for your awesome content . Its very helpful to me.i am literally watching full day your content to learn cpp. Please cover all the topics on cpp.keep rocking and thanks . One thing is that when u introduce a topic please give some idea to practise that to get into our head. Please give it like a challenge to code something so that we will understand by coding ourself on your particular topics.THANKS

[@TNothingFree]

There are many free tools but not so many great tools for VS integration. I mean, VS has it's own rules for static analysis but I feel it lacks interactive feeling with the user. Clang tidy and C++ Check are free tools to use as well. (I like C++ Check, it's awesome).

[@yonizerbib9934]

thanks u from paris !!! i like it !!!!!!!

[@florianschafers8879]

Wow 5 years into coding and never heard of it. I guess i will have to take a look into this.

[@bluehornet6752]

Good luck finding a price. They don't seem to have one on their website anymore, so you have to request a quote to get a price. I think there used to be a way to use it "free" for a while (longer than a 7- or 30-day free trial, I mean), but I never did. I use another analyzer, but the maintenance license for that has expired...so I'm kind of looking for other options.

[@lonartie1172]

There are more tools, even free ones For example sonarqube and cppcheck

[@andreykarpov3381]

@@bluehornet6752 Ways to Get a Free PVS-Studio License: www.viva64.com/en/b/0614/

[@PVSStudioTool]

@@bluehornet6752 There's nothing unusual in price request for the companies selling software. Instead of looking for another option, you can use PVS-Studio for free for an unlimited period of time. Visit the link to learn more about it: www.viva64.com/en/b/0614/

[@Ferocious_Imbecile]

Gotta say; damn these are enjoyable.

[@eigenfield]

Thank you. Can you demo any interesting find by PVS-Studio in a multithreaded C/C++ app?

[@stanislavlarionov1534]

Hey Cherno! Can you make video about cache misses optimisation?

[@HuanLeVuong]

Start from 4:56

[@insu_na]

Not C++, but I would never ever write a bash script without shellcheck anymore. It's soooo good.

[@pygmee6412]

Would you use it in the game engine series?

[@harikumar-cq1je]

please also list what are the disadvantages when using PVS tudio

[@SaifUlIslam-db1nu]

One thing I've realized about programming is that you should exactly have a clear picture of what direction you want to take, and where you want to go, and what kind of output you are exactly looking for. Thinking creatively is part and parcel of being a good developer. It's how you start to realize what tools to use when, when you start to do that, ideas automatically start to flow in you. My two cents which I got from static analysis.

[@andraskmeczo575]

I'm developing my engine with OpenGL and Vulkan, will i be able to use that tool? I suppose it won't catch my Vulkan errors, that's the work of the validation layers and other third party debuggers, but will it work and actually be useful or will it just be confused with the APIs and not help me too much? PS: your vids are awesome, I am so hyped for the next Hazel video!

[@motbus3]

i dont know vulkan. but as it is supposed to run on gpu, and it has a different bus, memory, processor, etc, it wouldn't work for remote code (run on gpu) but it might help catching host (cpu) errors. for debugging gpu code your gpu vendor might provide profilers and other tools. but in some sense it is probably doable (maybe not with vps) because i've seen some shader tools with this feature

[@zoltankurti]

@@motbus3 I think the question was more focused on the c++ calls from the vulkan api. Setting up vulkan for rendering to the screen takes a lot of calls, it can get quite complicated.

[@zoltankurti]

I didn't try it but I doubt a general tool could afford to check the internal workimgs of the vulkan api. But validation layers are quite useful, altough you need to make sure to test special cases which makes it inferior to static checking.

[@joshinils]

shouldnt it complain that you dont deallocate your memory?

[@andreykarpov3381]

Yes, PVS-Studio Can Detect Memory Leaks - www.viva64.com/en/b/0543/ However, there’s an exception made for main function. It’s ok if main function is completed and memory is not free. It will be free when terminating a program anyway. That’s a common practice in small utilities so there’s no reason to generate warnings.

[@APaleDot]

I don't think so. Without reference counting, it can't really tell when a piece of memory "should" be deallocated. If you reach the end of your program with some variables still on the heap, that's not a problem either, because when your program terminates they will still be deallocated.

[@Dosenwerfer]

I am seriously surprised to learn that in the Visual Studio world this is not taken for granted. I'm coming from JetBrains IDEs and they have all of those nice features built-in without question. And a very sophisticated and granular approach to warning levels as well; you can basically customize everything. To see that Visual Studio is only able to do all this nice stuff only by depending on 2 (paid) extensions (Visual Assist and PVS) while at the same time being the most buggy and unstable software I ever had on a computer is pretty sad. Especially considering its age and development time advantage. You'd expect it to be mature, but it is not. At work I am forced to use it and it gets in my way wherever possible. Only after you learn to ignore like 70% of all IntelliSense errors since they are false-positives, your programming experience gets bearable.

[@AmnesiaPhotography]

With how cheap compute is, I think you should be running a spell check and logical analyser. Spelling matters esp for public member functions that you’re defining. I’ve seen this a few times where someone spells the member wrong and this causes issues in dependencies.

[@dongwookim6360]

Summary: You need static analysis tool for your program as much as you need spell checker for your document. Here are some example usage of PBS (static analysis tool) for your program.

[@hybridspyda]

So I used PVS-Studio extension in MVS, and it suggested that I replace my std::vector with an std::array instead as the size was known at compile time. I said, alright, let me do just that... Switching over to use std::array now instead gives me an error: "incomplete type is not allowed"... Looking up solutions for similar issues with using an array and pair only says to add more curly brackets, but this doesn't seem to help... Any pointers?

[@andreivlad6874]

Did they checked the software with PVS? :D

[@andreykarpov3381]

An always up-to-date list of articles describing errors that we find in open source projects with PVS-Studio analyzer: www.viva64.com/en/inspections/

[@ashimxtha6407]

Can you make a play list like from beginner to step by step please i mean organized it would be really nice for beginner like us thank you and love your videos and ideas 😊

[@aliaksei_sala]

What about buffer overflow inside 'for loops' : buffer[x+y*width] where buffer size = width*height. Can it detect this one?

[@burnax9817]

CLion kind a has that functionality

[@lonartie1172]

All jetbrains products designed for c++ use clang tidy analysis in fact, all jetbrains products deliver static analysis

[@SriNiVi]

Yeah. CLion with clang, LLVM is pretty handy. Visual Studio also has this for visual c++.

[@barfourkyei3469]

Does Intellij for Java have this feature as well?

[@Gebes]

Kyei Barfour every jetbrains ide does have that. Some are better than the others. That one for java is quite good

[@demokraken]

or Resharper C++ for Visual Studio. JetBrains rocks!

[@rafalmichalski4893]

Cherno could you explain clang-tigy usage ?

[@SauvikRoy]

Cool!

[@bern_stock8946]

where can i get a 5000 line single file c++ code? i need it for static and dynamic analysis practice.

[@samibarbut-dica4690]

Hi, Cherno! How can I get a free license for PVS-Studio?

[@PVSStudioTool]

Hello! It's very easy. All you have to do is visit the link www.viva64.com/en/pvs-studio-download/?promo=Cherno and enter #Cherno promo code. We'll send you a month free trial :)

[@andreykarpov3381]

Ways to Get a Free PVS-Studio License: www.viva64.com/en/b/0614/

[@rohan_devarc]

Good advertisement for PVS studio. Instead you can use clang-static -analyzer

[@MichaelHazell]

I'm a little disappointed that you didn't mention clang-tidy, or clangd (which includes clang-tidy) in this video. I get that this was a sponsored video, but I think you should be fair and mention the free and open-source tools here.

[@avtem]

Thank *you* for mentioning it! Also i learned that Visual Studio has built-in static analyzer as well

[@glennstormdesign]

Can this be used as part of Continuous Integration? (as in, a server runs static analysis?) Because a static analyzer I’m trying out now (cppcheck) is taking a very long time. ‘Seems like a good candidate for CI, no?

[@mayankshigaonker7725]

What's the theme that you use? It's nice.

[@joestevenson5568]

Pretty sure its just the dark theme

[@avtem]

Well, yeah it spotted a typo in the copy-pasted loop with y++, but wow, it couldn't even detect an obvious memory leak!

[@battosaijenkins946]

I thought you were gonna do something with that tree in the background ... =(

[@headgames4945]

so is this the same as a C++ linter?

[@andreykarpov3381]

It’s more than linter. For example, it is also integration with such systems as SonarQube, PlatformIO, Azure DevOps, Travis CI, CircleCI, GitLab CI/CD, Jenkins, Visual Studio. And it’s more complex and deeper analysis: www.viva64.com/en/b/0592/

[@rajkishoreprasad7553]

I have metric analyzer in vs ultimate ..is it any different from that?

[@Hylocichla]

I wish you had shown how to install PVS Studio. I cannot get it to work because it keeps stating the license is not valid (or has not be activated?).

[@Stehocke]

angenommen ich nutze VS 2017, was diesen Extension Button im Menü nicht besitzt. Wie starte ich PVS-Studio in Visual Studio nach der Installation. Das Ausführen der exe lässt ja nur ein kleines Infofenster aufgehen. Ist PVS ohne Visual Studio 2019 nutzbar?

[@carolsanders9367]

I'm looking for a tool that will better help with syntax errors. Any suggestions?

[@Gebes]

All jetbrains products to that out of the box. They also automatically highlight such mistakes, which saved me lots of headaches in the past years

[@platinoob__2495]

is there somewhere we can find the music that plays at the start and end of the video;

[@whythosenames]

platinoob_ _ shazam

[@yekna459]

Why don't you make videos on data types like uint32_t or others that you use?

[@dj-maxus]

Привет, Ян!

[@dincerekin]

isnt using "new" in c++ meant to be frowned upon ?

[@ov3rcl0cked]

How so? It's the idiomatic way to allocate to free-store for things that will outlive the scope creating them. You just have to be careful to free the memory and not leave dangling pointers.

[@oracleoftroy]

Yeah. These days long lived objects should generally be movable so that when you create them, they still have value semantics and can outlive the scope that created them. You still need new on occasion, but I'd consider making a value type, then a more specialized type (e.g. std::vector), before using std::make_unique and unique_ptr. unique_ptr should be preferred over shared_ptr, as it turns out to be pretty rare that you actually need shared_ownership. Finally, if you are in a situation where none of the other approaches, use raw new/delete and take care to properly define all your copy/move constructors and assignment operators to avoid leaks. Too many people immediately reach for raw new/delete when std::vector or std::unique_ptr would work better.

[@Saturate0806]

Can something like this be added to github actions?

[@evanpudding9771]

hey cherno，can you make a vedio talking about move semantic 、copy constructor and copy operators and so on,whatever,I really can't think of anything to do about it,Complex and messy,Have a nice day!

[@kavishshah6441]

Can you do more tutorials instead of performance videos? Maybe like STL videos?

[@hiren07ec]

I want video end full music theme...

[@nexovec]

1:09 *condescending laughs of open-source contributors in the background

[@nexovec]

LNKERR: unresolved reference at 4:35

[@panstromek]

This was probably the first brand deal ever that offered something I am actually really interested in. Good job.

[@lowkienhorng9153]

Well maybe it has been 4 years since this video has been uploaded, so its prob outdated ady. However, you could mention a teensy bit more on how to actually make pvs studio run on windows, cause personally i had to do quite a bit of research before even getting to the code part, well its just my opinion so yeah, the video is still helpful, thanks

[@mr.anderson5077]

Charno The GOAT!!!

[@DrLazyCreature]

Less bugs? How about unit tests? :)

[@Antovolt]

Le frère caché d'Antoine Daniel

[@naimasivexo5294]

how i didn't know u befor e wtf just thx

[@h.hristov]

PVS Studio do not sell single-user licenses,

[@mdnarimani9473]

With that, why do you want to use lua in your game engine? Why not use a language that actually has IDEs?

[@davidroonie1336]

26 video cuts in first 5 minutes

[@madeso]

It doesn't detect the memory leaks. You can avoid the first error by stop copying code. If you copy because it's too much to type it should probably be refactored instead of copied. The second one can be solved by not using c functions and using string_view/std::string instead. That said, their blog _is_ useful and it's embarrassing how many errors they can find :)

[@debonairrose]

ty

[@greenb1ade]

Notification gang

[@paulzupan3732]

If only it were free software...

[@sacredgeometry]

1:23 "works"

[@fireballgfx]

pvs is free for students and teachers

[@Kricen]

PVS studio doesn't seem to have a single user license. Doesn't matter, I never buy anything if I can't see the price right away.

[@andreykarpov3381]

There are several ways to get a free license of the PVS-Studio static code analyzer, which is meant for searching for errors and potential vulnerabilities. Open source projects, small closed projects, public security specialists and owners of the Microsoft MVP status can use the license for free. www.viva64.com/en/b/0614/

[@dallenmasters7375]

They do but there are some minor restrictions. Check out their website, specifically www.viva64.com/en/pvs-studio-download/ and www.viva64.com/en/m/0046/

[@michaelrothkopf4088]

package me.michael.talk; class Main() { public static void main(String[] args) { System.out.println("Java is language native. Speak better then eNglish."); } }

[@Asdayasman]

Hold on... Do actual native-speaking adults use spellcheckers? Is that not a meme?

[@konstantinkonov]

Jesus, 5 mins of nonsense speaking before going to a code