Webinar: Tit for Tat: How (not) to bully a Static Analysis Tool
Modern static analysis tools are able to spot a large number of critical runtime defects such as null pointer dereferences, overflows, uses of uninitialized memory and divisions by zero, by using advanced techniques like Abstract Interpretation. Since the applied analyses necessarily overapproximate the behaviour of a program, they also might report false positives, i.e. program locations at which a reported defect never occurs during runtime of the program, but the analysis cannot exclude a defect at this location for sure. As issue reports usually induce manual review or rework of the code, it is highly desirable to keep the number of false positives small.
In this webinar we show examples of coding patterns that make the life of a static analysis tool complicated and might cause an increase of false positives. We investigate examples of numerical computations and usages of memory-related constructs that are difficult to analyze and investigate challenging control flow constructs. As an example from practice we take a look at the implementation of a message-passing primitive and check how well it can be analyzed. Vice versa, we also point out ways to avoid the painful patterns and to make life easier for the analysis tool (and consequently, its users).
Author: Dr. Andreas Gaiser is Senior Research and Development Engineer and Dr. Daniel Simon is Head of Professional Services at Axivion.
More information on the Axivion tools can be found here. Please do not hesitate to contact us if you would like to get a free demo or have any questions regarding our products.
Oh, here is more
Webinar: The Cyber Resilience Act: What Waiting is Costing US Software Teams
Starting September 11, 2026, the EU Cyber Resilience Act (CRA) requires companies to report actively...
Watch Video
Webinar: Architecture-Guided Migration to Rust
Rust promises memory safety and modern tooling — but migrating a large, safety-critical C or C++ cod...
Watch Video
On-Demand Webinar: CI/CD and Continuous Compliance of Embedded Software for Aerospace and Defense
Today, CI/CD for pure software products is well understood. But hardware dependencies and embedded d...
Watch Video
De-Risking AI Playbooks: How to Build Visual UI Tests That Remain 100% Deterministic
Pixel-by-pixel UI testing is too brittle for modern release cycles, yet LLMs introduce a dangerous l...
Watch Video