Project 2 - V&V SW Analysis II

1. What is the difference between static code and dynamic code analysis?

Ans: Static code analysis and dynamic code analysis are two approaches to examining and evaluating software. Here's a breakdown of their differences:

Static code analysis involves examining the code without executing it. The analysis is performed by reviewing the source code, bytecode, or binary code to detect errors, vulnerabilities, and quality issues. When it happens: Before the program is run (compile-time).

Tools used: Linting tools, compilers, or static analyzers (e.g., SonarQube, Clang Static Analyzer, Coverity)

Dynamic Code Analysis

Definition: This involves analyzing the code while it is being executed. The program is run in real or simulated environments to monitor its behavior, performance, and runtime issues.

When it happens: During runtime (after or during execution).

Tools used: Profilers, debuggers, dynamic analyzers (e.g., Valgrind, Purify, Dynatrace).

Focus:

Memory usage (e.g., leaks, corruption)

Execution path coverage

Thread synchronization issues (e.g., race conditions, deadlocks)

Performance bottlenecks

Advantages:

Detects runtime errors that static analysis can't catch (e.g., unexpected inputs, environmental factors).

Helps in finding real-world performance and security issues.

Limitations:

Requires the code to be executed in different environments.

Can miss issues that are in unexecuted paths (not all code is tested).