AjayV

I really liked the new features of CA in VC11, specially the new annotation _Guarded_by_

The new-view, detailed explanation and filtering feature is also excellent improvement!

And the greatest thing MS is doing - giving CA to everyone for the software eco-system. Kudos!

Now, few of my concerns, which I can think of now:

• Functions like EnterCriticalSection, WriteFile, do depend on some handle. There should be feature to detect if relevant "open/create" is called successfully or not. Some annotation may be given to link these "open" and "use" functions, which would also facilitate developers who develop modules.
• Checked headers, but couldn't get how ECS and LCS are related, and CA is issuing Race condition warning against them. But there should be another annotation, for other developers, to link them - so that two functions like Begin--End may be analyzed.
• There is no feature to detect dead-code - for global functions and for unused members of class. This is, I believe, much easier. The linker optimization would (may) generally remove unreferenced code. It would be great if CA also does to same to let developer know.
• It goes for unused classes, enums etc. also.
• If a class method is not modifying the data or calling other non-const method, but it is currently a non-const method - then CA should mention it may be marked as 'const'
• Most compilers are having "uninitialized variable" warning, but no static-analysis tool seem to have using uninitialized member-variable - if not initialized in constructor. If constructor (or some initializer called from constructor(s)) doesn't initialize some variable, CA warning should be popped if other method tried to "read" from member variable.
• Code Analysis detects most of memory-function bugs, but it allows non-POD objects to be initialized/copied using these functions. Let's have CString object(s) in some class, and initialize this class object using memset/memcpy! You got me, right?!
• Contract between caller and callee is made - but contract between prototype and the implementation is not made!! Consider following code:
  

  void Copy(_In_ char*);
  
  void Copy(_In_opt_ char* p)
  {
  *p=0;
  }

  Here, compiler sees first prototype, and records it. There is a warning of nullptr is passed, but no warning in function implementation, where pointer is used without null check!