1

So, I am switching back to C coding soon. I have previous experience of Gimpel Lint and Splint, but would like to check out a few others.

Does anyone know of some C code which is specifically designed to test the capabilities of C static code analyzers?

That is to say, some code which deliberately accesses freed memory, reads beyond the end of arrays, unreachable code, etc, etc.

I would like to use it to evaluate C static code analyzers, to help me chose one.

Gratis, please, preferably Windows, but I will also accept Linux.

That is my on topic question. I don't suppose I would complain if there were some off-topic comments comparing such analyzers, pointing to websites, comparisons, recommendations, ease of setup/use, etc ( wink ;-)

Improve this question
12
  • 1
    If it is any help I have had a co-worker or two who writes just the sort of thing that you are looking for - ALL of the time. If it was not for copyright issues I could send you megabytes of examples.
    – Steve Barnes
    Commented Jun 4, 2015 at 16:59
  • 2
    Lolx - (+1) I generally write my own - but not deliberately
    – Mawg
    Commented Jun 4, 2015 at 17:01
  • 2
    If you are coding Open Source projects you will find it hard to beat Coverity for static analysis, free Cppcheck is worth a look as well but the bees knees for embedded C code is LDRA - LDRA is anything but free though. One of the best of course is gcc -Wall -Werror then fix things!
    – Steve Barnes
    Commented Jun 4, 2015 at 17:03
  • 1
    @Mawg Just to give you some ideas... List of C/C++ tools for static code analysis
    – mguassa
    Commented Jun 4, 2015 at 17:08
  • 1
    I did think about that before posting, but I realized that, as you say, many people here ask for libraries (). What are they, but source code? This site is for Software Recommendations and I am asking the members to recommend some software. Maybe we should rename the site to Application Recommendations? ;-) If I want to be pedantic, I can say that I am not asking for a code snippet, but for a complete test suite. - where else can I ask? () there was a site for library recommendations proposed on Area 51 not long ago, but it seems to have disappeared :-(
    – Mawg
    Commented Jun 5, 2015 at 8:36

2 Answers 2

Reset to default
1

The Julia test set built by NSA, available from NIST, is intended to be a broad spectrum set of tests to enable comparing various analysis tools using a standardized descriptive vocabulary.

There is a set of tests for C/C++, and another set of tests for Java.

My company has used it to test our CheckPointer dynamic analysis tool for C. With tens of thousands of individual tests, it seemed pretty thorough.

The NIST site at the link contains a variety of other test sets contributed by a wide variety of authors. AFAIK, these are all available as downloads for no charge. Pick your poison :-}

Improve this answer
-1

This test suite from Toyota contains invalid memory access, overflows, etc. They are conveniently placed in separate files:

https://github.com/orbitcowboy/itc-benchmarks/tree/master/01.w_Defects

They were used to find out the false positive/negative rate of some static code analysis tools.

BSD License

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.