5. Static Code Analysis Day 2018

Dienstag, 6. März 2018, 10-17 Uhr

Das Aufdecken von Bugs mit Debugging-Sessions auf Systemebene ist zeit- und kostenintensiv. Statische Codeanalyse-Tools finden Fehler schnell und ohne großen Aufwand. Hierdurch ergibt sich ein enormes Kosteneinsparungspotential. Der Werkzeugeinsatz amortisiert sich früh und ist bei Systemen mit Sicherheitsrelevanz dringend empfohlen. Wir zeigen Ihnen, wie Sie durch Einsatz von statischer Codeanalyse Ihre Softwarequalität effizient verbessern. Sehen Sie, wie komplexe Softwaredefekte problemlos aufgedeckt werden und wie Sie Checker für individuelle Prüfungen erstellen.

Veranstaltungsort:
Technologiepark, In der Spöck 10-12, 77656 Offenburg
Anfahrt

Wie bei den letzten Static Code Analysis Days erwartet Verifysoft auch zur 6. Ausgabe 2019 zahlreiche Teilnehmer aus dem gesamten deutschsprachigen Raum.

Combining Static and Dynamic Analysis

(Dr. Paul Anderson, Vice President of Engineering, GrammaTech New York)
Static analysis tools are useful for finding serious programming defects and security vulnerabilities in source and binary code. These tools inevitably report some false positives, or bugs that are highly unlikely to manifest as real problems in deployed code. Consequently, results must be inspected by a human to determine whether they warrant action, and most tools provide program understanding features to make this easier. This inspection process, known as warning triage, can be much more effective if it is guided by information from dynamic analyses such as code coverage, crash analysis, and performance profiling. For example, a static analysis report of a resource leak that occurs on a path that has not been tested is more likely to be a real undiscovered bug than one that occurs in code that has been tested much more comprehensively. Furthermore, the results of static analysis tools can be used to guide testing too. For example, a developer can save a great deal of effort if the static analysis can prove that it is fundamentally impossible to achieve full condition coverage.
This talk describes how the results of static analyses and dynamic analyses can be fused to allow developers to get more value from both processes, and produce higher quality software more efficiently.

Detecting State Corruption

(M.Sc. Mark Hermeling, Senior Director Product Marketing, GrammaTech New York)
Static analysis is a must-have technology to improve software quality. It finds defects due to programming errors such as buffer overruns, or uninitialized variables early in the software development lifecycle, thereby reducing development cost and reducing time-to-market. However, static analysis is not perfect, in that it does not catch all problems and that some of the reports it provides are not real problems. We call these false negatives and false positives.
Dynamic analysis, or functional test, is aimed at confirming functional correctness of a software program or module. A particular test-case may contain, say, a buffer overrun, but this may not be observable, often the test case will still pass. The buffer overrun creates state corruption, but this state corruption may not fail the test case. These undetected state corruptions are extremely dangerous and can trip up a software program at a later stage, either during development, or after the product is fielded. One famous example of a state corruption this is HeartBleed problem that surfaced in 2014 (CVE-2014-0160).
In this presentation we will demonstrate how we can enhance dynamic test cases to detect memory and state corruption and combine that information together with the static analysis results to get a more complete picture of software quality.
In other words: I’ll talk about CodeSonarX. I will have demonstrations with me as well. Hope it is not too late to do the switch yet. This should connect very well and extend Paul’s section. We will have more announcements around CodeSonarX at Embedded World, so this would be a great time to talk more about it.

Static Analysis - under the hood

(Dr. Paul Anderson, Vice President of Engineering, GrammaTech New York)
Advanced static analysis tools are now widely accepted as essential tools to help software engineers develop high quality code. They are effective because they are designed to be capable of exploring all possible executions of a program, so can examine vastly more program states than can be covered by traditional testing.
The number of possible program states is extraordinarily large even for very simple programs, so the tools must use sophisticated analysis techniques if they are to work on real-world programs. These techniques are designed in a way that allows a user to make a three-way tradeoff between performance, precision, and recall. Static analysis users can increase the value they get from these tools if they have a good understanding of how to tune the tools to strike the right balance between these factors.
In this talk I will first describe some of the principles of advanced static analysis including flow-, context-, and path-sensitivity, and will discuss some of the innovative algorithms that the tools use to achieve scalability to multiple millions of lines of code. I will show how static analysis users can change tool parameters to help them get the most out of their tool. Finally I will show how give some examples of how an end user can customize these tools in order to find domain-specific properties.

Statische Analyse hört nicht beim Quellcode auf

(Dipl.-Ing. (FH) Royd Lüdtke, Director Static Code Analysis, Verifysoft Offenburg)
Viele Applikationen binden Binärdateien von Drittanbietern ein, über deren Qualität oftmals wenig bekannt ist. Die Beschränkung statischer Analyseverfahren auf den Quellcode allein, birgt ein hohes Risiko.
Der Vortrag thematisiert Möglichkeiten und Grenzen statischer Binäranalyse.

Extended Demo of GrammaTech CodeSonar

(Dr. Paul Anderson, Vice President of Engineering, GrammaTech New York)
Learn in this presentation all about the latest version of GrammaTech CodeSonar.

Referenten

  Seminarbroschüre

Archiv Static Code Analysis Days

1. Static Code Analysis Day 2014
2. Static Code Analysis Day 2015
3. Static Code Analysis Day 2016
4. Static Code Analysis Day 2017
weitere Veranstaltungen von Verifysoft

Ausgewählte Vorträge der Static Code Analysis Days

 Wegweiser zur Auswahl eines Werkzeuges zur Statischen Codeanalyse (Dipl.-Ing. Royd Lüdtke, Verifysoft)
 Auffinden von Nebenläufigkeitsfehlern durch Statische Codeanalyse (Dipl.-Ing. Royd Lüdtke, Verifysoft)
 Qualitätssicherung (Prof. Dr. Daniel Fischer, Hochschule Offenburg)