1. 什么是Prefast
Prefast是一種代碼分析工具，它能夠幫助你找到編譯器不能找到的錯誤或者缺陷。Prefast首次被微軟集成到Visual Studio 2005 Team Suite中去，使用起來非常方便。
2.怎么使用Prefast
在vs2005 Team Suite中，使用Prefast非常簡單。修改你的工程屬性，設置Enable Code Analysis For C/C++為Yes.
效果:
注意到有可能錯誤的地方以淺灰色顯示在編輯器中了。
3.Prefast能幫你找到哪些錯誤
1)沒有初始化
//
no?initial
void
?defect1()
{
????????
int
?a;
????????
int
?b;
????????b?
=
?a;
}
會報: d:\test\testcode\testcode.cpp(18) : warning C6001: Using uninitialized memory 'a': Lines: 15, 16, 18
2)空指針取值
//
one?path?dereference?NULL
void
?defect4(
int
?b,?
int
?c)
{
????????
int
?
*
p?
=
?NULL;
????????
int
?a?
=
?
1
;
????????
if
?(b?
==
?
1
)?{
????????????????
if
?(c?
==
?
1
)?{
????????????????????????p?
=
?
&
a;
????????????????}
????????????????
else
?{
????????????????????????????????????????????????
????????????????}
????????}
????????
else
?{
????????????????
if
?(c?
==
?
1
)?{
????????????????}
????????????????
else
?{
????????????????????????p?
=
?
&
a;
????????????????}
????????}
????????
*
p;
????????
return
;
}????
會報:d:\test\testcode\testcode.cpp(65) : warning C6011: Dereferencing NULL pointer 'p': Lines: 45, 46, 48, 57, 65
3)可能錯誤的運算符優先級
void
?defect5()
{
????????
int
?a?
=
?
1
;
????????
int
?b?
=
?
1
;
????????
int
?c?
=
?
1
;
????????
if
?(a?
&
?b?
==
?c)
????????????????
return
;
}
會報: d:\test\testcode\testcode.cpp(76) : warning C6281: Incorrect order of operations: relational operators have higher precedence than bitwise operators
4)可能的buffer overrun
void
?defect8()
{
????????
char
?buf[
100
];
????????
char
?buf2[
200
];
????????
int
?i?
=
?
100
;
????????sprintf(buf,?
"
hello?world?%d
"
,?i);
????????strcpy(buf,?buf2);
}
會報: d:\test\testcode\testcode.cpp(133) : warning C6202: Buffer overrun for 'buf', which is possibly stack allocated, in call to 'strcpy': length '200' exceeds buffer size '100'
5)可能的無窮循環
//
infinite?loop
void
?defect14()
{
????????signed?
char
?i;
????????
for
?(i?
=
?
100
;?i?
>=
?
0
;?i
++
)?{
????????????????;?
????????}
}
會報: d:\test\testcode\testcode.cpp(198) : warning C6292: Ill-defined for-loop: counts up from maximum
6)格式字符串錯誤
//
Format?string?mismatch
void
?defect21()
{
????????
char
?buff[
5
];
????????sprintf(buff,?
"
%s?%s
"
,?
"
a
"
);
}
會報: d:\test\testcode\testcode.cpp(277) : warning C6063: Missing string argument to 'sprintf' that corresponds to conversion specifier '2'
7)安全問題
void
?defect27()
{
????????CreateProcess(NULL,
???????????????
"
c:\\program?files\\Project.exe?arg1
"
,?
//
correct?"\"c:\\program?files\\Project.exe\"?arg1",
???????????????NULL,
???????????????NULL,
???????????????
false
,
???????????????
0
,
???????????????NULL,
???????????????NULL,
???????????????NULL,
???????????????NULL);???????????????
}
會報: d:\test\testcode\testcode.cpp(327) : warning C6277: NULL application name with an unquoted path in call to 'CreateProcessA': results in a security vulnerability if the path contains spaces
8)=和==誤用
void
?defect32()
{
????????
int
?a?
=
?
1
;
????????
if
?(a?
=
?
2
)
????????????????
return
;
}
會報: d:\test\testcode\testcode.cpp(405) : warning C6282: Incorrect operator: assignment of constant in Boolean context. Consider using '==' instead
9)邏輯運算問題
//
always?false
void
?defect45()
{
????????
int
?x;
????????
if
?(
0
?
&&
?x
++
)?{
????????????????;
????????}
}
會報: d:\test\testcode\testcode.cpp(564) : warning C6237: (<zero> && <expression>) is always zero. <expression> is never evaluated and might have side effects
10)其他