Code Analysis: Empowering developers to write performant, reliable, and safe C++
summary
Shows concrete tooling and results: Microsoft adds static analysis into Visual Studio to flag path‑sensitive bugs (lifetime, expensive copies, mutex suspension) and flips one compiler switch to enable AddressSanitizer for zero‑false‑positive runtime finds. Integration produces ASAN dump files (asan_save_dumps) that Visual Studio rehydrates, tight debugger links, and CI fuzzing. Findings include bugs in Azure SDK, Boost, OpenSSL, EA STL, several Windows zero‑days and one startup bug each in Word/PowerPoint/Excel, demonstrating build‑time + run‑time “defense in depth.”
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:55Overview
- 2:15Static Analysis
- 7:00Preventing concurrency errors
- 8:08Preventing lifetimes
- 9:18Under the hood
- 11:20Join the fun
- 11:46Whats next
- 14:05Resources
- 15:35Demo
- 17:40Address Sanitizer
- 24:37Static Analysis Overview
- 25:47Conceptual Cycle
- 26:45Secure by Coincidence
- 27:41Platform Runtime Dependent
- 28:09Thank you Google
- 28:39Memory Safety
- 30:31Results
- 32:11Questions
related talks
43mEverything I learned about static analysis and program safety in C++
50mC++ Sanitizers & Fuzzing for the Windows Platform Using New Compilers...
01h 00m2020: The Year of Sanitizers?
01h 00mStatic Analysis and Program Safety in C++: Making it Real
01h 29mAddressSanitizer on Windows
01h 02mSanitize your C++ code
09mModern Static Code Analysis the Example of PVS-Studio
29m“The Current State of (free) Static Analysis"