Static analyzer Svace for finding of defects in program source code

Abstract

This paper describes Svace, a tool for static program analysis developed in ISP RAS. This tool allows to find defects and potential vulnerabilities in source code of programs written in C/C++ languages. Main features of the tool are simplicity of usage, wide variety of supported warning types, scalability up to programs of millions lines of code and acceptable quality of analysis (30-80% of true positive warnings).

Keywords

• статический анализ
• анализ потока данных
• уязвимости
• межпроцедурный анализ
• анализ на основе аннотаций