Extend Bug Finder Checkers to Find Defects from Specific System Input Values

This topic shows how to find possible defects from specific values of system inputs. Unlike Code Prover, Bug Finder does not exhaustively check for run-time errors for all combinations of system inputs. However, you can extend some Bug Finder checkers and find if there are specific system input values that can lead to run-time errors.

Identify Need for Extending Checker

First identify if an existing checker is sufficient for your requirements.

For instance, the Bug Finder checker Integer division by zero detects if a division operation can have a zero denominator. Suppose, a library function has the possibility of a division by zero following several numerical operations. For instance, consider the function speed here:

#include <assert.h>

int speed(int k) {
    int i,j,v;
    i=2;
    j=k+5;
    while (i <10) {
            i++;
            j+=3;
    }

    v = 1 / (i-j); 
    return v+k;
}

Suppose you see a sporadic run-time error when your program execution enters this function and the default Bug Finder analysis does not detect the issue. To minimize false positives, the default analysis might suppress issues from specific values of an unknown input (what if this value did not occur in practice at run time?). See also Inputs in Polyspace Bug Finder. To find the root cause of the sporadic error, you can run a stricter Bug Finder analysis for just this function.

Note that even after extending the checkers, Bug Finder does not provide the sound and exhaustive analysis of Code Prover. For instance, if Bug Finder does not detect errors after extending the checkers, this absence of detected errors does not have the same guarantees as green checks in Code Prover.

Extend Checker

To extend the checker and detect the above issue, use these options:

• Run stricter checks considering all values of system inputs (-checks-using-system-input-values): Enable this option. Checkers that rely on numerical values can now consider all input values for functions with at least one callee. You can change which functions are considered with the next option.

• Consider inputs to these functions (-system-inputs-from): Use the value custom and enter the name of the function whose inputs must be considered, in this case, speed. At the command line, use the option argument custom=speed.

When you run a Bug Finder analysis, you see a possible integer division by zero on the division operation. The result shows an example of an input value to the function speed that eventually leads to the current defect (zero value of the denominator).

The tooltips on the defect show how the input value propagates through the code to eventually lead to one set of values that cause the defect.

Checkers That Can Be Extended

The following checkers are affected by numerical values of inputs and can be extended using the preceding options:

• Bug Finder defects:

  • Array access out of bounds

  • Assertion

  • Bitwise operation on negative value

  • Float conversion overflow

  • Float division by zero

  • Float overflow

  • Integer conversion overflow

  • Integer division by zero

  • Integer overflow

  • Invalid use of standard library floating point routine

  • Invalid use of standard library integer routine

  • Non-initialized pointer

  • Non-initialized variable

  • Pointer to non initialized value converted to const pointer

  • Right operand of shift operation outside allowed bounds

  • Shift of a negative value

  • Sign change integer conversion overflow

  • Unsigned integer conversion overflow

  • Unsigned integer overflow

  • Use of automatic variable as putenv-family function argument

  • Use of plain char type for numeric value

• AUTOSAR C++14 coding rule:

  • AUTOSAR C++14 Rule A0-4-4

  • AUTOSAR C++14 Rule A3-8-1

  • AUTOSAR C++14 Rule A4-7-1

  • AUTOSAR C++14 Rule A5-2-5

  • AUTOSAR C++14 Rule A5-6-1

  • AUTOSAR C++14 Rule A8-5-0

  • AUTOSAR C++14 Rule M5-0-16

• CERT C rules and recommendations:

  • CERT C: Rule ARR30-C

  • CERT C: Rule EXP33-C

  • CERT C: Rule FLP34-C

  • CERT C: Rule FLP32-C

  • CERT C: Rule INT30-C

  • CERT C: Rule INT31-C

  • CERT C: Rule INT32-C

  • CERT C: Rule INT33-C

  • CERT C: Rule INT34-C

  • CERT C: Rec. EXP08-C

  • CERT C: Rec. INT00-C

  • CERT C: Rec. INT02-C

  • CERT C: Rec. INT07-C

  • CERT C: Rec. INT08-C

  • CERT C: Rec. INT13-C

  • CERT C: Rec. INT18-C

  • CERT C: Rec. FLP03-C

  • CERT C: Rec. FLP06-C

• CERT C++ rules:

  • CERT C++: ARR30-C

  • CERT C++: CTR50-CPP

  • CERT C++: EXP53-CPP

  • CERT C++: EXP54-CPP

  • CERT C++: FLP32-C

  • CERT C++: FLP34-C

  • CERT C++: INT30-C

  • CERT C++: INT31-C

  • CERT C++: INT32-C

  • CERT C++: INT33-C

  • CERT C++: INT34-C

  • CERT C++: STR53-CPP

• MISRA C:2012 rules:

  • MISRA C:2012 Rule 9.1

  • MISRA C:2012 Rule 18.1

  • MISRA C:2012 Dir 4.1

• MISRA C++:2008 rules:

  • MISRA C++:2008 Rule 5-0-16

  • MISRA C++:2008 Rule 8-5-1

• MISRA C:2004 Coding Rule 9.1, 20.3, 21.1

• ISO/IEC TS 17961 rules:

  • ISO/IEC TS 17961 [addrescape]

  • ISO/IEC TS 17961 [chrsgnext]

  • ISO/IEC TS 17961 [diverr]

  • ISO/IEC TS 17961 [intoflow]

  • ISO/IEC TS 17961 [invptr]

  • ISO/IEC TS 17961 [nullref]

  • ISO/IEC TS 17961 [uninitref]

• JSF AV C++ coding rules: JSF AV C++ coding rule 142

• CWE rules:

  • CWE Rule 119

  • CWE Rule 125

  • CWE Rule 128

  • CWE Rule 131

  • CWE Rule 191

  • CWE Rule 192

  • CWE Rule 194

  • CWE Rule 195

  • CWE Rule 196

  • CWE Rule 197

  • CWE Rule 369

  • CWE Rule 457

  • CWE Rule 466

  • CWE Rule 468

  • CWE Rule 617

  • CWE Rule 704

  • CWE Rule 824

  • CWE Rule 825

  • CWE Rule 1335

Related Topics

• Modify Default Behavior of Bug Finder Checkers