1

So, I am switching back to C coding soon. I have previous experience of Gimpel Lint and Splint, but would like to check out a few others.

Does anyone know of some C code which is specifically designed to test the capabilities of C static code analyzers?

That is to say, some code which deliberately accesses freed memory, reads beyond the end of arrays, unreachable code, etc, etc.

I would like to use it to evaluate C static code analyzers, to help me chose one.

Gratis, please, preferably Windows, but I will also accept Linux.


That is my on topic question. I don't suppose I would complain if there were some off-topic comments comparing such analyzers, pointing to websites, comparisons, recommendations, ease of setup/use, etc ( wink ;-)

  • 1
    If it is any help I have had a co-worker or two who writes just the sort of thing that you are looking for - ALL of the time. If it was not for copyright issues I could send you megabytes of examples. – Steve Barnes Jun 4 '15 at 16:59
  • 2
    Lolx - (+1) I generally write my own - but not deliberately – Mawg Jun 4 '15 at 17:01
  • 2
    If you are coding Open Source projects you will find it hard to beat Coverity for static analysis, free Cppcheck is worth a look as well but the bees knees for embedded C code is LDRA - LDRA is anything but free though. One of the best of course is gcc -Wall -Werror then fix things! – Steve Barnes Jun 4 '15 at 17:03
  • 1
    @Mawg Just to give you some ideas... List of C/C++ tools for static code analysis – mguassa Jun 4 '15 at 17:08
  • 1
    I did think about that before posting, but I realized that, as you say, many people here ask for libraries (). What are they, but source code? This site is for Software Recommendations and I am asking the members to recommend some software. Maybe we should rename the site to Application Recommendations? ;-) If I want to be pedantic, I can say that I am not asking for a code snippet, but for a complete test suite. - where else can I ask? () there was a site for library recommendations proposed on Area 51 not long ago, but it seems to have disappeared :-( – Mawg Jun 5 '15 at 8:36
1

The Julia test set built by NSA, available from NIST, is intended to be a broad spectrum set of tests to enable comparing various analysis tools using a standardized descriptive vocabulary.

There is a set of tests for C/C++, and another set of tests for Java.

My company has used it to test our CheckPointer dynamic analysis tool for C. With tens of thousands of individual tests, it seemed pretty thorough.

The NIST site at the link contains a variety of other test sets contributed by a wide variety of authors. AFAIK, these are all available as downloads for no charge. Pick your poison :-}

-1

This test suite from Toyota contains invalid memory access, overflows, etc. They are conveniently placed in separate files:

https://github.com/orbitcowboy/itc-benchmarks/tree/master/01.w_Defects

They were used to find out the false positive/negative rate of some static code analysis tools.

BSD License

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.