CodeSonar Release 2.0p1 Release Notes

JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

If you access the manual through the hub's Web GUI, the functionality will not be suppressed because the hub is a web server.
Alternatively, your browser may allow you to explicitly disable the security setting that suppresses functionality. See the CodeSonar FAQ for more information.

CodeSonar Release 2.0, patchlevel 1: Release Notes

Official release date: October 13, 2006.

This release of CodeSonar is based on CodeSurfer 2.0p1.

Features

This version differs from CodeSonar 1.0p3 in the following ways:

CodeSonar is now capable of scanning much larger code bases than previously possible. A fundamental limitation on code size has been removed, so as long as there is enough disk space and time, it should complete on all projects.

Reduced disk space consumption.

It is possible to start to review individual reports before the entire scan is finished. The index and summary pages are not available until the end however.

CodeSonar now has much better handling of C++ constructs.

There are several new checks:

Dangerous Function Cast: A function pointer is cast to another function pointer having an incompatible signature or return type.
Redundant Condition: Some condition is either always or never satisfied.
Missing Return Statement: At least one path through a non-void return-type function does not contain a return statement.
Useless Assignment: Some assignment always assigns the value that the variable being modified already has.
Varargs function cast: A varargs function pointer is cast to another function pointer having different parameters or return type.
Accept/Bind/Connect on socket in wrong state: A socket function was called on a socket descriptor that is in the wrong state.
Negative file descriptor: A call to a file or socket manipulation function was passed a negative value as a file descriptor.
Free/Delete/Delete[] Object created by malloc/new/new[]: Inconsistent use of memory and object allocators and deallocators.

The Leak checker has been completely re-engineered to improve its results. It is now much less likely to miss real issues.

The information that appears in the "Problem" column is more helpful.

A new mechanism for setting preferences is provided that does not require the use of the CodeSurfer GUI. More preferences have been added to allow finer control of the scan:

Verbosity level.
Maximum time to spend in any one procedure.
Caching behavior.
The sizes and alignment constraints of various primitive types, including bit fields.
The first address below which it is illegal to dereference.

A new way of specifying a different compiler model, making it easier to integrate with non-standard compilers.

Many bug fixes.