Uma an\'alise comparativa de ferramentas de an\'alise est\'atica para dete\c{c}\~ao de erros de mem\'oria

TL;DR

This paper compares four static analysis tools for C/C++ to evaluate their usability and effectiveness in detecting memory errors, highlighting their potential impact on software validation and revealing new errors in popular open source projects.

Contribution

It provides a comparative analysis of four static analysis tools for C/C++, demonstrating their effectiveness and identifying new errors in widely-used open source software.

Findings

Tools have high potential for software validation

Identified new errors in popular open source projects

Tools vary in usability and efficiency

Abstract

--- Portuguese version As falhas de software est\~ao com frequ\^encia associadas a acidentes com graves consequ\^encias econ\'omicas e/ou humanas, pelo que se torna imperioso investir na valida\c{c}\~ao do software, nomeadamente daquele que \'e cr\'itico. Este artigo endere\c{c}a a tem\'atica da qualidade do software atrav\'es de uma an\'alise comparativa da usabilidade e efic\'acia de quatro ferramentas de an\'alise est\'atica de programas em C/C++. Este estudo permitiu compreender o grande potencial e o elevado impacto que as ferramentas de an\'alise est\'atica podem ter na valida\c{c}\~ao e verifica\c{c}\~ao de software. Como resultado complementar, foram identificados novos erros em programas de c\'odigo aberto e com elevada popularidade, que foram reportados. --- English version Software bugs are frequently associated with accidents with serious economical and/or human consequences, being thus imperative the investment in the validation of software, namely of the critical one. This article addresses the topic of software quality by making a comparative analysis of the usability and efficiency of four static analysis tools for C/C++ programs. This study allow to understand the big potential and high impact that these tools may have in the validation and verification of software. As a complementary result, we identified new errors in very popular open source projects, which have been reported.