I've recently been looking at C++ static analysis tools. One thing that confuses me is the terminology used with these tools:

Some tools are simply called "static analysis tools" (e.g. CppCheck), others are called "sanitizers" (e.g. ASan, TSan, MSan, UBSan) and others are called "linters" (e.g. PC-Lint).

Is there an actual distinction that can be made between these three terms, or are they simply different words for the same thing?

  • "Sanitizers" aren't part of static analysis, but injected code to detect runtime bugs. – πάντα ῥεῖ Mar 18 '18 at 3:51
  • @ πάντα - So, when compile using clang++ -fsanitize=address it's not only compiling but then also executing the code in attempts to find issues? – Terence D Mar 18 '18 at 4:13
  • No. There's additional code injected by the compiler that is able to check for e.g. stack overflow errors at runtime. – πάντα ῥεῖ Mar 18 '18 at 8:17
  • @πάντα - Ah, got it, thx. In the example I was looking at I failed to notice they executed a.out on the same line after compiling by using ; ./a.out - Example: clang++ -O1 -fsanitize=address foo.cpp; ./a.out – Terence D Mar 18 '18 at 14:26

Sanitizers modify data to make it safe and/or usable by a program. For instance, escaping characters that may allow SQL injections, etc.

Linters analyze code to search for stylistic issues, bugs, possible memory leaks...

Static code analysis tools are any tool that analyzes source code without the need to run it. Linters are often static code analysis tools but may be other types. For instance, looking for dependencies or calculating metrics.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.