CodeSonar Release 4.4, patchlevel 0: Release Notes

• Notes on Upgrading
• What's New
• Details
• Customer Tickets Fixed

Notes on Upgrading

If you are upgrading from a CodeSonar release before 4.2p0, note that Role Based Access Control (RBAC) was introduced in that version, involving substantial changes cutting across almost all aspects of the product. See the CodeSonar 4.2p0 release notes for more information.

What's New

Details

Determinism

CodeSonar 4.4 contains changes that make analysis results change less from run to run. The configuration preset stable_results must be used to take advantage of these changes. The preset reduces jitter by making some sacrifices in the way of analysis result quality and performance. Empirically, on a large project, the jitter measurements were as follows:

The "taint+dp" warning class checks continue to exhibit some degree of nondeterminism. If result stability is important to you, you may wish to ensure that these classes are disabled (note that all but Tainted Buffer Access are disabled by default).

• Tainted Buffer Access
• Multiplication Overflow of Allocation Size
• Multiplication Overflow of Size
• Subtraction Underflow of Allocation Size
• Subtraction Underflow of Size
• Addition Overflow of Allocation Size
• Addition Overflow of Size
• Truncation of Allocation Size
• Truncation of Size

Warning Class Changes

Changes to the set of available warning classes originate from several enhancements to CodeSonar.

• FindBugs Upgrade. If you perform a CodeSonar build/analysis of Java code with FindBugs enabled, the version of FindBugs invoked will depend on your JRE version (must be at least 1.5.0).
  • JRE version 1.7 or 1.8 → FindBugs version 3.0.1.
  • JRE version 1.5 or 1.6 → FindBugs version 2.0.2.
  These two FindBugs versions have slightly different sets of warning classes: if some of your Java analyses are performed on machines with JRE 1.7 or 1.8 and some on machines with older JRE versions, you will need to take this into account in comparing results. Documentation links for warning classes that are present in FindBugs version 2.0.2 but not version 3.0.1 may not work correctly.

  The upgrade may be associated with memory consumption regressions.

• PMD Upgrade. If you perform a CodeSonar build/analysis of Java code with PMD enabled, the version of PMD invoked will depend on your JRE version (must be at least 1.5.0).
  • JRE version 1.7 or 1.8 → PMD version 5.4.2.
  • JRE version 1.5 or 1.6 → PMD version 5.0.4.
  These two PMD versions have slightly different sets of warning classes: if some of your Java analyses are performed on machines with JRE 1.7 or 1.8 and some on machines with older JRE versions, you will need to take this into account in comparing results. Documentation links for warning classes that are present in PMD version 5.0.4 but not version 5.4.2 may not work correctly.
• Expanded MISRA Coverage. There are several new C/C++ warning classes in support of MISRA guidelines. Additionally, warning categories now include mappings for MISRA C:2012 Amendment 1 Additional security guidelines for MISRA C:2012 (April 2016).

New Warning Classes

Warning Class Name Changes

Warning Class Mnemonic Changes

Deleted Warning Classes

Configuration Parameters

There are several new parameters, along with changes to factory settings and behavior for some existing parameters.

New configuration parameters

Modified configuration parameters

Custom Compiler Models

There have been some changes to the C++ API provided for authoring custom compiler models. If you have not previously authored any custom models with this API, you will not be affected by the change. If you have authored custom models with this API, make the following modifications to your compiler model source then rebuild and reinstall.

For example:

/* previously class MyModel : public CompilerModel */
class MyModel : public C_CompilerModel {

/* [...] */

/* previously 
 * CmdArgumentVector fe_cmds_c(CProcess::cso_and_edg_options(csl_c,bit_width,config));
 * CmdArgumentVector fe_cmds_cxx(CProcess::cso_and_edg_options(csl_cxx,bit_width,config)); 
 */ 
CmdArgumentVector fe_cmds_c(EDGFrontEnd::cs_and_fe_options(csl_c,bit_width,config));
CmdArgumentVector fe_cmds_cxx(EDGFrontEnd::cs_and_fe_options(csl_cxx,bit_width,config));

/* [...] */

/* previously 
 * const std::vector<CmdArgument>& fe_ffa = CProcess::first_options(sf.first,"object_file.o"); 
 */ 
const std::vector<CmdArgument>& fe_ffa = EDGFrontEnd::first_options(sf.first,"object_file.o");

/* [...] */

API Changes

Summary:

• There are new functions in the CodeSonar Plug-In API and new functions in the general-purpose API.
• Internal CodeSonar symbols are no longer exported for dynamic linking.
• See also the notes on the changes for custom compiler models.

Plug-In API

There are several new functions in the CodeSonar Plug-In API.

General Purpose API

There are a number of new functions in the general purpose API, many of them concerned with stable comparison and hashing.

Internal CodeSonar symbols no longer exported

Internal CodeSonar symbols are no longer exported for dynamic linking.

• This resolves some C++ ABI compatibility issues that could arise when using C++ API plug-ins.
• Plug-in using undocumented C APIs may be affected. Some new public API functions have been created, but some remain to be done. If you are relying on any undocumented C APIs, please notify CodeSecure.

AST changes

• One new unnormalized C/C++ AST class: cc:builtin-choose-expr.
• New fields in two unnormalized C/C++ AST classes: cc:expr and cc:array.
• New fields in two normalized C/C++ AST classes: c:class and c:struct.

Customer Tickets Fixed