今天看到一篇文章 - “Firebird, MySQL 与 PostgreSQL 代码质量对比”-  关于三个开源 RDBMS 的静态分析比较。

主要内容

A few words about the projects

Firebird

MySQL

PostgreSQL

PVS-Studio

Comparison criteria

Why "head-on" comparison is not a good idea

An alternative way

Review of bugs

Total analysis results

Troubles with clearing private data

No check for the pointer returned by malloc and other similar functions

The use of a potential null pointer

Potentially unsafe use of formatted-output functions

Other warnings mentioned in the article on vulnerabilities

Suspicious use of enumeration elements

Incorrect determination of memory-block size

Missing 'throw' keyword

Calling the wrong memory-deallocation operator

Summing it all up

最终比较结果

Summing up the demerit points, we get the following:

Firebird: 1 + 1 + 2 = 4 points.

MySQL: 3 + 1 + 2 + 2 + 2 + 2 = 12 points.

PostgreSQL: 3 points.

Remember: the fewer points, the better.And if you ask me (a person with a wicked taste), I'd prefer... MySQL! It has the most interesting bugs and it's the leader, which makes it a perfect choice for analysis!

Firebird and PostgreSQL are trickier. On the one hand, even a one-point margin counts; on the other hand, it's quite a small difference, especially because that point was given for a V768 warning of the medium-certainty level... But then again, the codebase of PostgreSQL is way larger, yet it issued four hundred warnings at its automatically generated code...

Anyway, to figure out which of the two projects, Firebird or PostgreSQL, is better, we'd have to do a more thorough comparison. For now, I put them on one podium place so no one is offended. Maybe one day we'll compare them again more carefully, but it will be quite a different story...

So, the code-quality rankings are as follows:

1 place - Firebird and PostgreSQL.

2 place - MySQL.

Please remember that any review or comparison, including this one, is subjective. Different approaches may produce different results (though it is mostly true for Firebird and PostgreSQL, but not for MySQL).

So what about static analysis? I hope you are convinced now that it is useful for detecting defects of various types. Want to find out if your codebase has any of those bugs? Then it's the right time to try PVS-Studio! You write perfectly clean code? Then why not check your colleagues' code? ;)