10

I've recently been looking at C++ static analysis tools. One thing that confuses me is the terminology used with these tools:

Some tools are simply called "static analysis tools" (e.g. CppCheck), others are called "sanitizers" (e.g. ASan, TSan, MSan, UBSan) and others are called "linters" (e.g. PC-Lint).

Is there an actual distinction that can be made between these three terms, or are they simply different words for the same thing?

4
  • "Sanitizers" aren't part of static analysis, but injected code to detect runtime bugs. Mar 18, 2018 at 3:51
  • @ πάντα - So, when compile using clang++ -fsanitize=address it's not only compiling but then also executing the code in attempts to find issues?
    – Terence D
    Mar 18, 2018 at 4:13
  • No. There's additional code injected by the compiler that is able to check for e.g. stack overflow errors at runtime. Mar 18, 2018 at 8:17
  • @πάντα - Ah, got it, thx. In the example I was looking at I failed to notice they executed a.out on the same line after compiling by using ; ./a.out - Example: clang++ -O1 -fsanitize=address foo.cpp; ./a.out
    – Terence D
    Mar 18, 2018 at 14:26

1 Answer 1

13

Sanitizers modify data to make it safe and/or usable by a program. For instance, escaping characters that may allow SQL injections, etc.

Linters analyze code to search for stylistic issues, bugs, possible memory leaks...

Static code analysis tools are any tool that analyzes source code without the need to run it. Linters are often static code analysis tools but may be other types. For instance, looking for dependencies or calculating metrics.

1
  • 2
    The specific clang sanitizers mentioned in the question are different to what is described in this answer. Those sanitizers modify the code at compilation and work at runtime, sometimes with help from runtime libraries. Therefore they are dynamic analyzers - the "opposite" to static analyzers. Now, it'd be interesting to know why they were called "sanitizers" at all. Mar 7, 2021 at 0:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.