This release builds on the capabilities of Goanna 3.0, making huge leaps forward in terms of performance, support for C/C++ development environments, warning accuracy and detail, and Web Dashboard functionality.  Goanna’s core C/C++ analysis engine is now more streamlined and accurate than ever before, providing more precise and targeted warnings for code requiring complex control and data flow analysis, and performing much better in many common situations such as very large functions and source files.  In addition, for each warning there is now much more detailed trace information and a greatly improved Web interface including a full source code browser to help you pinpoint the root causes of bugs in your code.

Highlights

• Configurable Parallel Analysis: Goanna 3.1 is now fully parallelized, and can take advantage of modern multi-core processors to deliver several times faster analysis than earlier versions.
• Enhanced Incremental Analysis: Goanna 3.1 includes a host of other performance optimizations, including greatly enhanced incremental analysis of a project with only small changes since the last run.  Such analysis can be up to 20 times faster than re-analyzing the whole project from scratch.
• Build Specifications: Goanna Central 3.1 now lets you analyze whole projects from a build specification that captures all the analysis commands required to do a complete run of your project.  Build specifications can be written and edited manually, or generated automatically with a suite of new and improved tools: goannamake for Makefile projects, goannascons for SCons projects, and goannaiarbuild for IAR Embedded Workbench projects.
• Auto-detection of C/C++ Dialect: Goanna 3.1 has vastly improved support for different C/C++ dialects including more C++11 constructs, GNU extensions, and Microsoft C++ language features than ever before. In most cases, you won’t even need to know precisely which dialect options to use, as the “goanna” suite of utilities can auto-detect all this information directly from your compiler.
• Interprocedural Traces: Traces for most warnings in Goanna 3.1 now show much more detailed information, including across interprocedural (function) boundaries where Goanna has detected that an issue spans multiple functions and files. On Goanna Studio traces are now displayed in a tree-like format for easier navigation.
• Dashboard Improvements: The Goanna Dashboard has a greatly enhanced Web interface, including a complete history of historical warnings and a full code browser with interactive trace highlighting and hyperlinks.
• New and Improved Platform Support: Goanna 3.1 adds support for more IDE’s and Toolchains including Atmel Studio 6.1, IAR 8051, IAR MSP430, ARM CC, Renesas H8, TI Code Composer 3.3, and the Wind River Diab Compiler.

Configurable Parallel Analysis

Goanna analysis is now fully parallelized.  This means that Goanna 3.1 can now take advantage of unused cores on modern multi-core CPUs that would be otherwise idle.  If your CPU has several cores available, then parallel analysis in Goanna 3.1 can yield 6 or more times speedup over earlier releases of Goanna.

By default, Goanna runs as many parallel processes as you have CPU cores.  But you can change the number of parallel processes to any number you like by setting Parallel jobs to any number you like in Preferences for Goanna Studio, or by using the –jobs option in Goanna Central.

This gives you complete control over the amount of resources used by Goanna on your machine.

Enhanced Incremental Analysis

Goanna 3.1 not only parallelizes analysis into multiple threads, but has significantly optimized the performance of each individual thread.  The optimizations are too numerous to go into detail here, but address common bottlenecks such as very large source files, functions with very many variables, and very complex expressions.

In particular, the common case where you have only made a few changes in your project since the last analysis run has been significantly optimized.  Goanna 3.1 caches analysis information on all the source files in your project in the project database, and only re-analyzes the portions of your project that are actually affected by the change.  This provides a performance boost for both individual developers and for build servers that are repeatedly analyzing the same project.  Incremental analysis of a project can be up to 20 times faster than re-analyzing the whole project from scratch.

Enhanced incremental analysis is on by default and completely transparent, so you don’t need to do anything to enable it.  Underneath, it works by hashing the content of your source files, and does not depend on file timestamps in any way.  This means you should never need to force a “clean” analysis run as you sometimes do in build environments that only look at file timestamps.

If you want to experience how much performance improvement is due to Incremental Analysis in Goanna 3.1, try manually turning it off with the –force-analysis flag and experiencing the difference.  You’ll never want to go back!

Build Specifications

Goanna Central 3.1 now lets you analyze whole projects from a build specification that captures all the analysis commands required to do a complete run of your project.

Build specifications can be created in a variety of ways.  They can be automatically generated for a project with the following new and improved tools:

• goannamake, which now also auto-detects the C/C++ compiler(s) used in your Makefiles, and transparently configures Goanna for them without any manual intervention.
• goannascons, which can now record build specifications for SCons-based projects.
• goannaiarbuild, a new utility for IAR Embedded Workbench projects.
• In addition, Goanna build specifications have a very simple, plain text format, so they are easy to edit manually or even write from scratch with an ordinary text editor.

Bringing it all together in Goanna 3.1 is a new, project-level utility called goanna.  The goanna command is the one that now drives all the goannacc and goannac++ commands to analyze a whole project, and provides access to all the new features in this release.  It provides all the configurable options and features including:

• Analyzing projects from a build specification,
• Configurable parallel analysis,
• Enhanced incremental analysis,
• Auto-detection of C/C++ dialect,
• Automatic publishing of results to the Goanna Dashboard and third-party integrations,
• Running goannacc and goannac++ with optimal analysis settings.

The goanna command is in fact common across all product lines, Goanna Central and Goanna Studio.  So all the new features provided in Goanna Central are equally available in Goanna Studio, and you can expect goanna to provide even more powerful analysis capabilities in future releases.

Auto-detection of C/C++ Dialect

Goanna 3.1 has vastly improved support for different C/C++ dialects including more C++11 constructs, GNU extensions, and Microsoft C++ language features than ever before.  The number of C/C++ toolchains supported has doubled, with the addition of ARM CC, more IAR targets, Renesas H8, TASKING C166, and Wind River DIAB among others.  In addition the existing GNU and Microsoft dialect support has been improved to include the language features in the most up-to-date versions of these toolchains.

Goanna 3.1 also makes configuration and setup much easier than ever before with C/C++ dialect auto-detection.  This means that whether you are using Goanna Studio or Goanna Central, and whether you have projects using multiple compilers, the same compiler with different target options, or even projects with any mixture of the above, Goanna 3.1 should auto-detect all your dialect and compiler-specific settings, and automatically configure itself for each target transparently.

This completely eliminates the manual “–configure” commands that were required in previous releases, and all the PARSE errors that resulted from incomplete information when configuring Goanna for each target compiler.  The new auto-detection features in Goanna 3.1 greatly simplify the process of setting up Goanna in complex projects, for example, those that must cross compile for several target architectures.

In Goanna Central, the new C/C++ dialect auto-detection support is completely integrated with the “goanna” suite of utilities.  So when using the tools to record build specifications and analyze whole projects, dialect auto-detection is enabled transparently.  The new C/C++ dialect auto-detection support gives you complete control, so you can manually override the target dialect or tweak it in any way you like.  It is also extensible, so that support for new dialects and compiler variants are now much easier to add in.  Complete documentation on how Goanna 3.1′s dialect auto-detection works is provided in the User Guide.  If you would like help in adding support for a new compiler variant, then please contact us.

Improved Traces

Traces in Goanna 3.1 now contain interprocedural information when issues span function boundaries.  This gives more detail when trying to track down exactly which execution path in your program causes the issue raised by Goanna and may help in isolating and fixing the issue.

The Trace dialog in Goanna Studio has been updated to show the new interprocedural information provided by Goanna.  Traces are now displayed in a tree structure, with collapsible nodes on each function call boundary.  This gives the ability to expand out each function and get the details of a trace, or collapse them all and just get an overview of how the trace works.  As always, you can step through the trace side-by-side with your code, allowing you to replay the trace like a debugger.

The Goanna Dashboard also gives trace information through its new Source Code Browser. Just like in an IDE, you can step through trace of a warning via the Web interface, even when the trace spans many functions and source files.

In addition to interprocedural traces, we have gone to extensive effort to make the information presented in a trace clearer. When viewing a Goanna trace, each step will now give more details about how it was reached or what is happening at that line of code. This, in conjunction with interprocedural traces, allows you to gain much more insight into issues that Goanna finds.

Goanna Dashboard

The Goanna Dashboard has had numerous new features added, including:
Source Code Browser: The Goanna Dashboard now has a fully integrated source code browser across all product lines. The browser shows warning information side-by-side to your source code allowing you to visualize analysis results as easily as if they were in your IDEs. Trace information is also shown when available, so you can step through your code to see how the warning is found.

Historical Warning Data: The Goanna Dashboard now stores the full history of your warnings in past analysis runs, not just a summary.  This allows you to track warnings through your development cycle to see when bugs appeared and disappeared.

Bug Statuses and Notes: It is now possible to classify all your warnings in Goanna Dashboard. You can classify your bugs as one of; Unclassified (default), Ignore, Analyse, Fix or Not A Problem. In addition to this, you can also write a note for each of your warnings. This status information will stay attached to your warning for all time.

New and Improved Platform Support

Goanna 3.1 now fully supports the Atmel Studio 6.1 IDE.  All the new features of Goanna 3.1 including C/C++ dialect auto-detection are now available in all versions of Atmel Studio 6. Vendor toolchain plug-ins to Atmel Studio are also supported, provided the target dialect is on our supported dialects list.

In addition, IAR Embedded Workbench users can now integrate Goanna into the Workbench IDE much more easily using the new goannaiarbuild project-level utility.  This command supports analysis of IAR Embedded Workbench project (.ewp) files natively, eliminating the need to create batch files or manual scripts.  Goannaiarbuild also supports recording of build specifications and all the other features of the “goanna” suite of utilities, so you can also automate the analysis of IAR projects in a build server or command line environment.  The IAR 8051 and MSP430 targets are now fully supported.  Support for the other IAR targets is coming soon, so please contact us for more information.

Wind River Workbench support is greatly improved, including support for the DIAB toolchain and auto-detection of settings for projects using the Wind River Build System instead of the native Eclipse CDT builder.

In addition, toolchain support for the ARM CC, Renesas H8, TASKING C166, and TI Code Composer 3.3 has been added and/or improved.  These C/C++ dialects should be auto-detected from Goanna Central and Goanna Studio Eclipse.  If you would like to see support for a new platform not on this list, please contact us.

Release Notes

A whole host of other fixes and improvements have gone into Goanna 3.1.  Here is a detailed summary:

• Check accuracy improvements: the following checks have had their accuracy improved:
  • [MEM-lose-assign] now catches more memory leaks interprocedurally.
  • [COP-dtor] no longer warns about certain kinds of class destructors leading to false warnings.
  • [COP-dealloc-dtor] has an increased search depth. Freeing the member through other function calls within the same class can be detected.
  • [ATH-shift-neg] no longer reporters false positives from complex macros.
  • [RED-cond-const-expr] no longer reports false positives for dereference of a constant address declared as volatile.
  • [PTR-array-indexing] no longer reporters false positive for class member dereferences in C++.
  • [INT-octal] eliminates false positives on compiler synthesized enumeration constants.
• Resolved [PARSE] issues: 
  • Added support for __int128 type.
  • Added support for c++11 final keyword.
  • Added support for c++11 range based for loops.
  • Added support for MSVC for each loops.
  • Added support for GNU binary literals extension.
  • Added support for the IAR extended C anonymous union.
  • Fixed parsing of <type_traits>  with use of __float128 in GNU C++ 4.6+
  • Improved parsing of STL.
  • Unusual values in the __aligned__() GCC extension are now supported.
  • Unusual values in the #pragma pack directive are now supported.
  • An illegal redeclaration of std::string::npos that’s accepted by the Microsoft compiler is now also accepted by Goanna.
• Dashboard improvements: 
  • Substantial improvement has been made to Goanna Dashboard server’s performance.
  • Exporting now produces a CSV instead of a tab separated file.
  • There is now the ability to log server activity to a file.
  • Files analysed that contain no warnings now appear in the directory browser.
  • UI has been made more compact.
  • Bulk editing for changing bug status and deleting projects and snapshots is now available in the respective tables.
• Goanna Studio for Eclipse:
  • A user friendly dialog is now available to send issue reports back to Red Lizards Software.
• Goanna Studio for Visual Studio:
  • $(Configure) macro is now expanded correctly.
  • Fixed parsing issues with size_t and va_list on x64 targets.
  • Rare error dialogs that would occasionally pop up from Microsoft internal software components have been eliminated.
• Goanna Studio for Atmel Studio 6:
  • More options are now auto-detected from a project’s toolchain settings.
• All Platforms:
  • Template functions that have been automatically instantiated are now fully analyzed.
  • A new diagnostic preference is available. This includes internal diagnostic information in issue reports to Red Lizards Software to debug difficult issues.
  • Signals that occur due to external causes (such as an overly strict SELinux security policy) no longer cause goannacc to stop.
  • Improved false positive elimination algorithm to improve accuracy in [COP-copy-ctor] and [COP-assign-op].
  • Improved robustness of Goanna database transactions.
  • Dashboard is now fully compatible with Internet Explorer 10.
  • Goanna Dashboard’s database is now more resilient in the presence of system failures.

Existing customers can download the new 3.1 release here, and anyone can request a free trial of Goanna 3.1 here.

SI specialises in the QNX and SMX realtime OS products with Goanna integration,
and various supporting products with the goal of assisting engineers develop efficient
and reliable systems.  Specific assistive expertise includes system architecture, software
design, coding, QA, testing, and training.

You can contact Symmetry innvations at:
Unit 1, 6 Dance Street,
Mitchell, ACT 2911
Australia
Phone: +61 2 6248 6611
Email:  info@symmetry.com.au 

or visit them this May at CeBIT Australia, stand S21!

See Goanna Studio and Goanna Central in action, meet the team and learn about static code analysis for embedded systems. Our team will be present at the Embedded World Exhibition & Conference 2013 in Nuremberg, Germany.

You find us at: Hall 4 – 616

Feel also free to join the presentation by co-founder Dr Ralf Huuck on

Source Code Security for Embedded Devices

on Thursday 28 (Session 21, 16:00-16:30). If you like to arrange a personal meeting please contact us directly at ew13@redlizards.com.

This release is a major step forward for Goanna, adding significant new features for ease-of-use and productivity in team environments.  In addition, Goanna’s core C/C++ analysis is now more accurate, covers additional classes of defects, and provides more precise information on each warning.  Goanna’s analysis engine has also undergone a major overhaul, laying the foundation for even more advanced static analysis capabilities in future updates on the 3.x line.

Among the new features in this release are:

• A built-in Goanna Dashboard that automatically tracks snapshots of your project over time, providing instant visualization of defect history and problem areas.
• A fully integrated Codehaus Sonar^TM-based open source Code Quality Management platform,  providing graphical visualization tools, all the classic cyclomatic complexity and code coverage metrics, and additional static analysis capabilities via the open source CppCheck tool.  (Goanna Central only)
• A new suite of command line tools (“goannamake”, “goannascons”, and others) to automate Goanna analysis of whole projects with common options in build server environments, including projects with complicated settings for cross-compilation to multiple targets.  (Goanna Central only)
• Additional checks to catch common overrun bugs in arrays and C style strings.
• Refinements to the core Goanna analysis engine to eliminate false positive warnings, increase the precision of warnings and traces, and improve performance.
• Improved support for platforms such as IAR Embedded Workbench, Altium TASKING, and more.

Goanna Dashboard

The Goanna Dashboard is a powerful new feature in Goanna 3.0 that allows you to visualize the warnings in your projects at a single glance.

As you analyze your projects with Goanna, snapshots are taken automatically on every run, and all the warnings are summarized by severity, category, folder, and file.  At any time, you can browse this summary via a Web-based interface, allowing you to instantly recognize issues and zero in on trouble spots as soon as they arise.

The Goanna Dashboard lets you browse warnings in your project:

• by Severity over time (Snapshot History chart),
• by Category in a particular snapshot (Warnings by Category pie chart),
• in a Top 10 bar chart,
• in a 2D tree map over the directory structure,
• in a table with powerful filtering, sorting, and searching (the Warnings Browser), and
• in a proportional bar chart by category for each directory (the Directory Browser).

In addition, warnings are hyperlinked to Goanna check descriptions, rule documentation from Coding Standards, and to external source code browsers (if available).

Integrated Sonar Platform

In addition to the built-in Goanna Dashboard, Goanna Central now bundles the popular open source Codehaus Sonar^TM-Code Quality Management platform.  Sonar^TM provides not only C/C++ code analysis, advanced metrics, and defect hunting tools, but can be easily extended through a powerful plug-in mechanism.  Plug-ins (both free and commercial) are available for over 20 languages.

Goanna Central fully automates the installation and configuration of the Sonar^TM server, so it is available as soon as you install Goanna.  In addition, Goanna analysis results are fully integrated with Sonar^TM.  Taking snapshots of your project in the Sonar^TM Dashboard is also fully automated with Goanna’s project-level commands.  All you need to do is add the --sonar option when you run goannamake.

You can find out more about Sonar^TM at http://www.sonarsource.org/.

Also bundled with Goanna Central in 3.0 are the CppCheck and CppNcss open source tools, providing additional static analysis capabilities and cyclomatic complexity metrics.  These tools are also fully automated in Goanna’s project-level commands, all you need to do is add the --cppcheck and --cppncss options.  Results of these tools are also available seamlessly in the Sonar^TM Dashboard.

Goannamake suite of utilities

Goanna Central users have been asking us for some time for a utility to automate Goanna analysis over whole projects.  Fortunately Goanna Central’s design – goannacc/goannac++ commands that transparently wrap your system’s cc/c++ compilers — is conceptually so simple that for most people this hasn’t been necessary until now.  You can usually get instant analysis results from Goanna by just issuing a make CC=goannacc or similar command.  Normally no complex build monitoring or command injection is required.

As Goanna’s analysis capabilities increase and projects become more complex, however, we have recognized the need for a suite of project-level utilities to manage Goanna analysis in both interactive and build server environments.

But in keeping with Goanna’s simple design philosophy, the new utilities are extremely straightforward to use.  Goannamake is for Makefile projects, and can be used exactly as you would use your system make command.  Just issue a goannamake, and your build will be run interposing goannacc and goannac++ for your system compiler, with all the right options for optimal interprocedural analysis and snapshot generation in the Goanna Dashboard.  Options are also available for passing options to every goannacc and goannac++ invocation, and for passing different analysis settings for each target in cross-compilation projects.

Goannascons is for SCons projects, and performs a similar function to goannamake.  Additional build automation commands are in development, if you would like to see one for your build environment, please contact us at info@redlizards.com.

Goreporter allows you to take manual snapshots and other operations with analysis runs that have been captured in .goannadb database files.

Improved Platform Support

Several third-party compilers and IDE’s are now fully supported by Goanna Studio for Eclipse:

• Altium TASKING,
• IAR Embedded Workbench.

Goanna Studio is able to auto-detect your compiler toolchain, target processor, included libraries, and similar settings, so that in the majority of cases your code should just analyze correctly first time.

Toolchain auto-detection in Goanna Studio has also been improved generally, especially for vendor IDE’s that bundle some variant of a GCC toolchain.  Additional profile examples are also provided, and you can also override the compiler location and command-line options manually, yet still auto-detect the remaining options without having to edit the configuration by hand.

Improvements to the Core

Goanna now includes a new technique based on Satisfiability Modulo Theories (SMT) to suppress false positives due to paths that are infeasible in any actual execution.  For example,

if (b)
    p = malloc(...);
if (b)
    free(p);

is neither a memory leak nor a free of an uninitialized pointer, as the if conditions must either both be true or both false, never a mixture.  This is a simple example, but much more complex paths can occur in real programs that can never actually be executed at run time.  The SMT-based technique in Goanna 3.0 uses the latest research, and can eliminate such paths even in extremely complex situations involving the values of many dependent variables.  This technique is applied across all checks in Goanna, and is enabled by default so you don’t need to do anything special to benefit from it.

The accuracy of abstract data tracking has been greatly improved, reducing both false positives and false negatives across many checks.  The situations that have been improved include:

• complex expressions involving %, &, |, and ^ operators,
• array pointers passed as function parameters and return values,
• static const variables with initializers,
• and many more.

The following new checks have been added to detect situations where Goanna can deduce that a C style string overrun is possible or definite:

• [LIB-strcpy-overrun]
• [LIB-strcpy-overrun-pos]
• [LIB-strcat-overrun]
• [LIB-strcat-overrun-pos]
• [LIB-sprintf-overrun]

These checks supersede the [LIB-buf-lit] check and most of the [LIB-fn-unsafe] check.

Traces have been improved to show more information about the decisions (if, for, while, and switch conditions) on the path leading to a warning, and less information that’s not relevant to it.

Timeouts during Goanna analysis now only interrupt a single function (except in a few cases), not the entire source file.  This means it is still possible to get part results even in very large (e.g., auto-generated) source files, without costing an indefinite amount of CPU time in build server environments.

In addition, a host of smaller refinements to accuracy have been made across the Goanna check database.  There are too many to go into in much detail, but all the improvements address clear-cut false positives and false negatives that have occurred in common projects in previous releases:

• [ARR-inv-index-ptr] and [ARR-inv-index-ptr-pos] now warn about more potential array overruns occurring interprocedurally and in more complex expressions.
• [PTR-null-assign-fun-pos] and [PTR-null-pos-assign] have been relaxed in some situations where code fails to check the return value of malloc, calloc, and realloc
• [MEM-malloc-arith] has been refined to ignore cases of trivial arithmetic when computing allocation sizes.
• The [*-non-bool] checks have been relaxed to consider more Boolean types as Boolean by enforcement according to MISRA C:2004.
• [SPC-uninit-arr-all] has been improved to suppress false positives when arrays are initialized via aliases.
• [MEM-double-free] and [MEM-double-free-some] have been improved to suppress false positives when pointer variables are both declared and freed in inner scopes.
• [MEM-lose-assign] has been improved to suppress false positives when using COM-style reference-counting methods such as QueryInterface, AddRef, and Release.
• [FUNC-unprototyped] (formerly FUNC-unprototyped-call) has been improved to warn only once per function.
• [PTR-cmp-str-lit], [RED-dead], [RED-local-hides-global], [RED-local-hides-local], [RED-local-hides-member], and [RED-local-hides-param] have been improved to exclude spurious warnings resulting from complex macro expansions.

In addition, the set of checks that are on by default has been refined to include just the highest-probability, highest-severity issues.  Analysis of functions defined in header files is also off by default, and interprocedural analysis is on by default in all product lines.

Our C/C++ parser has also been upgraded to accept more non-standard language extensions and C++11 syntax.

Existing customers can download the new 3.0 release here, and anyone can request a free trial of Goanna 3.0 here.

Update 3.0.1, 15 February 2013

Update 3.0.1 is now available from the Download page and the Free Evaluation page!

This update includes quite a few improvements to performance, usability, and compatibility with more environments. Here’s a list of the major changes:

All versions

• Performance has been improved generally, especially in the following situations:
  • Source files with large numbers of functions.
  • Optimized result generation of internal checks functions.
  • Short circuit of internal checks results exploited when possible.
  • Reduce internal data representation structure and complexity.
• Trace output has been improved to show the original syntax better in conditionals.
• The profile file supports new sections for command-line arguments to pass to every compiler invocation, and records the arguments it was configured with.
• The situations where Goanna produces issue report logs (and the information contained in them) has been improved.
• There are now –package=…, –package-dir=…, and –no-stdchecks options (replacing the previous –checks-pkg and –checks-dir options) to control which custom checks packages are loaded.
• The Goanna Dashboard now includes a source code browser in environments where direct display of the source code in an IDE is not available.
• (Windows only) Various issues with files with non-ASCII file names have been fixed.
• (Windows only) Issues running Goanna under a user account with non-ASCII characters have been fixed.

Goanna Studio For Eclipse

• Error reporting for toolchain auto-detection has been improved.
• Issues in auto-detecting the version of the QNX QCC and Texas Instruments compilers have been fixed.

Goanna Studio for Visual Studio and Atmel Studio 6

• An issue auto-detecting Atmel toolchain settings for projects with no C++ compiler options defined has been fixed. (#4602)
• A user friendly dialog is now available to send issue reports back to Red Lizard Software automatically on errors.
• The Activate License dialog has been vastly simplified, making it much easier to activate your license and to start a free evaluation via the Atmel Gallery.

Goanna Central

• There is now a –trace-format=… option to allow finer control over the formatting of traces.
• The –configure option now looks for profile files in Goanna’s built-in profile folder.
• The IAR profile has been improved to handle more IAR extended syntax including __c99_generic, __C_task, __eeprom, __far, __farflash, __farfunc, __flash, __generic, __huge, __hugeflash, __interrupt, __io, __monitor, __near, __nearfunc, __regvar, __tiny, __tinyflash, and __version_1.
• An issue with the QNX and Texas Instruments profiles in Windows XP has been fixed. (#4595)
• The Windows installer has been updated to a new EXE format that includes all prerequisite libraries including the .NET framework.
• A compatibility issue with GLIBC 2.4 has been fixed.  (#3913)
• The Linux install script is now compatible with older versions of “tar” and “cp”. (#4608)

Goanna Studio is a static verification tool that analyzes C/C++ programs for difficult-to-find bugs including access violations, overruns, memory leaks, security flaws, and arithmetic errors. Goanna Studio also verifies compliance with industry safety and security standards such as CERT C/C++, CWE, MISRA C:2004, and MISRA C++:2008.

“With Red Lizard’s Goanna Studio static code analysis tools, embedded developers can easily extend Atmel Studio to check their MCU applications against crashes and security vulnerabilities,” said Ralf Huuck, CEO and Co-Founder of Red Lizard Software. “Atmel Gallery is a first of its kind to easily provide all the tools a developer needs. We are excited to be included in this app store to help bring additional value to the embedded industry.”

Atmel Corporation (NASDAQ: ATML), a leader in microcontroller (MCU) and touch technology solutions, has simplified the software design process for embedded MCU designers with the introduction of Atmel Gallery, which evolves Atmel Studio 6 into a comprehensive integrated development platform (IDP).

The availability of Goanna Studio in the Atmel Gallery allows developers of products based around the Atmel AVR® and SAM ARM® -based Cortex™-M MCU’s to rapidly detect and eliminate software defects before release, greatly reducing development costs and time to market. Goanna Studio integrates seamlessly with the Atmel Studio 6 IDE, and natively supports code written for AVR and ARM toolchains.

To shorten the design cycles for their differentiated products, designers today need a comprehensive IDP that provides easy access to all the necessary tools and embedded software they require, such as compilers, advanced debugging and analysis tools, real-time-operating systems and communication stacks.

“Embedded designers require a new type of development platform that helps meet the exploding software requirements in their MCU designs, including an effective way to protect their apps from bugs and crashes. Goanna Studio does just that by enabling designers to meet their challenging project timelines,” said Joerg Bertholdt, director of marketing, MCU tools and software, Atmel Corporation. “Atmel Gallery provides the convenience of an app store to add an integrated code analysis solution into Studio 6.”

You can download Goanna Studio for Atmel Studio 6 here.

You can also read the full press release here:

Red Lizard Software joins Atmel Gallery

As a Microsoft Partner we have been working hard to keep  Goanna up to date so that
you get the full power of deep semantic code analysis, interprocedural checking, flexible
configurations and reporting directly in the Visual Studio IDE.

To get some impressions on how Goanna is working with Visual Studio 2012 have a
look at our short video below. If you are interested in more details or prefer a personal
demonstration, please contact us.

This release is a major step forward in terms of:

• coverage of coding standards such as MISRA C:2004, MISRA C++:2008, and CERT;
• support for third-party IDE’s such as Atollic TrueSTUDIO, Mentor Code Sourcery, QNX Momentics, and Texas Instruments Code Composer Studio;
• improvements to the core to increase the coverage of checks, refine accuracy, and eliminate false positives.

Coding Standards

Over 60 new checks have been added in Goanna 2.9, improving Goanna’s coverage of a number of industry coding standards:

• the Common Weakness Enumeration (CWE),
• the Computer Emergency Response Team (CERT) Secure Coding Standard,
• Motor Industry Software Reliability Association (MISRA) C:2004 and MISRA C++:2008.

Many of the new checks are enabled by default as they detect common flaws that are of general interest to everybody.  But if you want to maximize your coverage of these standards, you need to explicitly enable some of the new checks in your project’s settings.

Fortunately, Goanna makes this very easy.  In Goanna Studio (both Eclipse and Visual Studio versions), just go to your Project Properties, select the Checks tab, click Coding Standards, and select your coding standard(s) (e.g., misrac2004).  You can also click Custom and turn on or off each specific check individually.

In Goanna Central, you can accomplish the same thing with a single command line option: ––checks=misrac2004.

There is considerable overlap between all the different standards, so it is not uncommon for one Goanna check to cover several rules.  Data sheets detailing precisely how the rules of each Coding Standard are checked are available on the Red Lizards website here.

Goanna’s internal architecture for defining checks has undergone a considerable overhaul in version 2.9.  This paves the way for later releases of Goanna to improve the coverage of these and other coding standards in the very near future.

Support for third-party IDE’s

Several third-party IDE’s are now fully supported by Goanna Studio for Eclipse:

• Atollic TrueSTUDIO,
• Mentor Code Sourcery,
• QNX Momentics,
• Texas Instruments Code Composer Studio.

Support for these environments is tightly integrated with the IDE.  Goanna Studio is able to auto-detect your compiler toolchain, target processor, included libraries, and similar settings, so that in the majority of cases your code should analyze correctly first time.  Moreover, whenever you set up a new project or change any of your project’s options, Goanna will auto-detect these settings and reconfigure itself to analyze your project and all of its dependencies correctly.

To enable all this, just go to your Project Properties and check Auto-Detect.

Quick Start Guides for each of the supported vendor IDE’s are available from the Red Lizards website here.

Users of native Eclipse haven’t been forgotten!  Compiler auto-detection works for the built-in GCC, Cygwin, and MinGW compiler profiles as well as vendor toolchains.  In addition Goanna Studio for Eclipse has also undergone numerous other improvements.  Goanna analysis output is now sorted by severity in the Problems view, making navigation and filtering of Warnings a breeze.  Goanna analysis also now runs in the background, allowing you to continue working while Goanna analyses your code.

Improvements to the Core

In our improvements to the Goanna Core for version 2.9, we listened to a lot of customer feedback and took all of it on board.  We sat down and analysed hundreds of thousands of lines of code from many large projects, and came up with a list of major bugs that were missed not only by the compiler but also in countless hours of manual inspection and testing. These we flagged as new, high-value checks. We also flagged a list of situations where previous versions of Goanna issued too many low-probability warnings, and refined these checks to eliminate the false positives.

Many of the new checks relate to common abuses of C++:

• Violations of encapsulation by returning handles to private class data (CPU-return-ref-to-class-data and CONST-member-ret). This is not only bad practice, but can even lead to badly compiled code as compilers may silently optimize away repeated calls to const member functions if they are unaware of subtle side effects between calls.
• Exceptions that are thrown but not caught on any path through your code (THROW-unhandled). This one should be enabled together with interprocedural analysis for greatest effect.
• Unintended type conversions due to constructors declared with a single argument (CPU-ctor-implicit). This one is difficult to detect as the conversion is silent, and can change the behaviour of your code depending on which class declarations are in scope (i.e., in your #include list) when an expression is evaluated.
• Classes with virtual methods that define a public, non-virtual destructor (CPU-nonvirt-dtor). This can lead to nasty memory corruption if derived classes are ever destroyed via a pointer-to-base, and is easy to miss as the compiler will silently supply a default destructor if you forget to explicitly define one.

Some new checks, common to both C and C++, relate to common coding mistakes such as side effects in the right hand side of short-circuit operators and sizeof (LOGIC-side-effect and SIZEOF-side-effect), and mix-ups of expressions, boolean conditions, and assignments (BOOL-assign, BOOL-arith, IF-non-bool, and others).  These mistakes are easy to make even for experienced C/C++ programmers, and are not always detected by the compiler.

A few checks (like ATH-overflow-cast and ATH-shift-bounds) have been completely re-written to detect issues only where there is a high likelihood of a real problem.  In addition, all Goanna checks now take into account volatile qualifiers, noreturn attributes, and short-circuit evaluation in complex Boolean expressions much more accurately.  This eliminates a large number of false positives about dead code and uninitialized variables in many projects, greatly improving the quality of warnings that remain.  The common practice of writing do … while(0) in macros is also tolerated now as not defining a real loop, greatly reducing unwanted noise in certain projects.

If you have ideas or experiences where Goanna analysis could analyze your projects more accurately, we’re always interested to hear them.

Update 2.9.1, 20 September 2012

Update 2.9.1 is now available from the Download page and the Free Evaluation page.

This update resolves a number of issues, and adds another 70+ new checks on top of the 60+ checks that were added in Goanna 2.9.0. Goanna 2.9.1 now covers the vast majority of MISRA C:2004 rules that are statically verifiable. A majority of MISRA C++:2008 rules are also covered.

Here is a detailed list of the improvements in this update:

• Over 70 new checks have been added.
• The following checks have been improved to refine accuracy: CHAR-arith, COP-alloc-ctor, FLOAT-implicit-conv, FUNC-implicit-addr, FUNC-varargs, INT-missing-u, ITR-invalidated, ITR-store, ITR-uninit, MEM-lose-assign, PTR-array-indexing, PTR-triple.
• The following checks have been removed or superseded: DECL-implicit-int, EXPRESSION-bitwise-signed-operand, LANG-asm-mixed-with-code, MEM-free-some, PTR-array-indexing, TYPE-invalid-implicit-integer-cast.
  
• About 30 checks have been renamed for conciseness and readability. The old names continue to work at the command line level.
• For each warning, a list of matching rules from coding standards is now included in the default output.
• Parse errors due to the TI C6000 compiler’s __cregister keyword are now fixed when using the TI profile.
• Eclipse 4.2 (Juno) is now supported.
• Compiler toolchain auto-detection in Eclipse has been improved. On the Compiler tab, the auto-detected predefined macros and include paths are displayed, and it is possible to manually repeat auto-detection after editing the compiler path and/or arguments.
• Integration with PC Lint in Eclipse has been fixed.
• Goanna Studio for Visual Studio has better detection and support of project settings in additional props and vsprops files.
• All checks that apply to particular standard can now be selected in the settings screen in a drop-down menu.
• In Goanna Central, the --silent-profile option now suppresses the “Opening profile …” output.
• In Goanna Central, --output-format="... %RULES% ..." now prints a list of matching rules from coding standards.

Update 2.9.2, 31 October 2012

Update 2.9.2 is now available from the Download page and the Free Trial page.

This update is expected to be the final release in the 2.9.x branch, and is focused only on

• resolving a few critical issues that were the cause of parse errors and failures in some situations, and
• refining the accuracy of many checks to reduce false positives.

Development on the 2.9.x branch has been occurring in parallel with major work on the Goanna core, which is targeted towards a major release later this year. This release will include some major new capabilities in Goanna, so stay tuned for further announcements in the near future.

Here is a detailed list of the improvements in this update:

All versions

• Goanna’s C/C++ front-end has been upgraded, supporting many more C++11 features, Microsoft extensions, and GNU extensions.
• Compiler auto-detection has been improved for GCC and Microsoft Visual C/C++. The expected dialect is now automatically set from the actual version of the compiler installed. (#4138, #4151)
• An issue parsing classes with a projection of operator delete from a base class (as found in the open source SENF library) has been fixed. (#4168)
• An issue parsing declarations containing multiple inline specifiers has been fixed.
• An issue parsing GCC register names and asm constraints when cross compiling has been fixed.
• False positives due to use of GCC’s __builtin_expect() function have been eliminated.
• The following checks have been added:
  • [ASM-mixed]
  • [DECL-implicit-int]
  • [FUNC-unprototyped-call]
  • [PTR-array-indexing]
  • [RED-unused-assign]
• The following check has been greatly improved to catch more cases of array overrun, both within a function and interprocedurally:
  • [ARR-inv-index-ptr]
  • [ARR-inv-index-ptr-pos]
• The accuracy of the following checks has been improved to suppress false positives resulting from literal addresses in low level embedded code:
  • [PTR-null-literal-pos]
• The accuracy of the following checks has been improved to suppress false positives resulting from volatile variables and throw statements:
  • [RED-no-effect]
  • [RED-func-no-effect]
• The accuracy of the following checks has been improved to suppress false positives resulting from complex macro expansions and sizeof expressions:
  • [RED-cmp-always]
  • [RED-cmp-never]
  • [RED-cond-const]
  • [RED-cond-const-expr]
  • [RED-no-effect]
• The accuracy of the following checks has been improved to suppress false positives resulting from floating-point expressions that cannot be zero:
  • [ATH-div-0-unchk-global]
  • [ATH-div-0-unchk-local]
  • [ATH-div-0-unchk-param]
• The accuracy of the following check has been improved to suppress false positives resulting from iterators passed in parameters:
  • [ITR-uninit]
• The accuracy of the following checks have been improved to suppress false positives resulting from assignment to nested class or structure members:
  • [MEM-lose-assign]
  • [RED-no-effect]
  • [RED-func-no-effect]
• The accuracy of the following check has been improved by handling some simple aliasing:
  • [RED-func-no-effect]
• The following check has been improved by accounting for various levels of casting:
  • [MEM-lose-assign]
• The accuracy of the following checks have been improved to correctly interpret the MISRA C:2004 and MISRA C++:2008 standards:
  • [CAST-widening-int-expr]
  • [PTR-arithmetic]
  • [RED-func-no-effect]
  • [RED-unused-param]
  • [RED-unused-val]
  • [SWITCH-fall-through-misra] (previously [SWITCH-fall-through])
• The following checks have been relaxed to ignore break and return statements
  immediately following a function call that is known never to return:
  • [RED-dead]
• The accuracy of the following check has been improved to suppress false
  positives resulting from static variables:
  • [LIB-putenv]
• The accuracy of the following check has been improved by correctly handling
  extern declarations:
  • [RED-local-hides-global]
• The following checks have been relaxed to ignore zero length arrays in structures (the “struct hack”):
  • [ARR-inv-index]
  • [ARR-inv-index-pos]
• The following check has been improved to ignore spurious synthesized cases:
  • [COP-member-uninit]
• The check [SWITCH-fall-through] has been added to handle comments that indicate fall through is desired behaviour.
• The following checks have been turned off by default:
  • [FUNC-no-prototype]
• The following checks have been superseded:
  • [RED-unused-val-ptr]

Goanna Studio for Visual Studio

• Internal error dialogs no longer appear for solutions containing InstallShieldLE projects. (#4181)
• Extra arguments entered into your Project or Solution Settings appear later on Goanna’s command line, allowing them to override options such as --parse-error-log. (#4133)
• Goanna[PARSE] errors are no longer reported on the right line number of the wrong source file. (#4188)
• The preprocessor symbols _IX86_, _M_IX86, _M_IX86_FP, _M_X64, _M_AMD64, _M_IA64, _IX86_, and _AMD64_ are now defined correctly for the project’s Active configuration. (#4188)
• Suppression Manager is now out of Beta.
• The old “Warning Summary” feature is no longer available; this has now been
  superseded by the Suppression Manager.
• The Suppression Manager now displays Severity and Rules from coding standards,
  allowing more powerful sorting and searching.

Goanna Studio for Eclipse

• Suppression Manager is now out of Beta.
• The old “Warning Summary” feature is no longer available; this has now been superseded by the Suppression Manager.
• The Suppression Manager now displays Severity and Rules from coding standards, allowing more powerful sorting and searching.

We have made some major improvements to the core of Goanna in this release, particularly in the areas of reducing false positives and improved checks.  Goanna’s support for the C++11 standards, embedded compilers, and different locales has been improved. And we have also added several improvements to Goanna Studio interfaces and compatibility with other IDEs. It is now much easier to integrate Goanna Central or Studio with other IDEs.

Most noteworthy in this release is a new false positive elimination module, that is able to deduce with greater accuracy whether each potential defect is a real one or cannot happen on any path through your code.

In addition, this release also includes more checks for potential division-by-zero and double-free errors, and improvements to existing checks such as null pointer dereferences.

All Versions

• Goanna now includes a false positive elimination module that checks the feasibility of warnings to ensure they are possible. This rules out many previous false positives and improves Goanna’s precision.
• Goanna has an upgraded parser that now handles more of the C++11 standards, as well as better support for embedded compilers.
• The installation and configuration of Goanna now handles different character sets and locales better.
• Variable comparisons are now used more intelligently to better detect when variables cannot be null or zero.
• Goanna now makes more use of information for Linux/Mingw assert functions.
• Fixed a bug in the COP-member-uninit warning by now handling operator overloading better.
• Added two new ATH-div-0-unchk warnings for local and global variables being checked against zero before being used as a divisor.
• Added a new MEM-double-free-some check that detects when memory is freed twice along some paths of execution.

Goanna Studio Eclipse

• Improved the trace viewer to react to the user input and provide more information on the trace path.
• General improvements to the interface.
• Compatibility with earlier versions of Java to support more environments and integration.

Goanna Visual Studio

• Increased configuration compatibility by gathering more information from various configuration files, in particular user specific configurations.
• Add in functionality to specify Ignore Paths; a list of files, directories, or regular expressions that Goanna should not analyze. This allows users to better control analysis of generated files, included files, and libraries provided by third parties.
• Improved integration of the Suppression Manager so that clicking on a warning now jumps to the corresponding location in the code.

There are some major improvements and a bunch of new features in the new release.
Most noteworthy, we completely redesigned the  way we handle different compilers
and environments in Goanna Studio for Eclipse. It is now straightforward to support
different embedded compilers and cross-compilation settings.

In this release we also provide some early support for Visual Studio 11. As one
of the leaders in Visual Studio support we provide a beta for public download and
exploration.

As usual there has been a lot of improvements to the underlying analysis engine often times
significantly reducing the overall runtime. There are improved checks and reduced false positives
as well as a re-worked interprocedural analysis that finds more issues in a single run.

Goanna Studio Eclipse & Visual Studio

• The IDE versions now come with preconfigured setting for different needs:  ”Quick Check”
  and “Deep Check” . The “Quick Check” performs most checks that  can be run quickly to allow fast results. The “Deep Check” option does thorough analysis and includes all possible checks. These are simple alternatives to the default/customised configuration.
• There is a free beta version of a new “Suppression Manager” included to view sort, filter, and manage the warnings from a project.
• Goanna has early support for Visual Studio 11 (beta).

All Versions

• Goanna has changed from a custom configuration file format to use JSON. By moving to the new format it is much easier to support different compilers and environments.
• There is a new user guide as well as a separate reference guide with more introductions, check examples and explanations.

• The Goanna interprocedural analysis has been improved to give stable results between runs.
• Reduced false positive reporting for many cases including the RED-unusued-var-all  check.
• Better handling of random numbers (from the “rand()” function).
• Support for the “-isystem” argument by default.
• Improved  overall Goanna performance including avoiding some pathological examples.
• Greater support of the C++11 standard and future options to support other languages.

As recently announced, Visual Studio 11 beta is now available for download. The new IDE comes with a simplified design and a much streamlined user experience. At this point in time MSDN subscribers can download and trial the beta release: 

Goanna Studio, previously already available for Visual Studio 2005,  Visual Studio 2008, and Visual Studio 2010, will be available in time for the upcoming Visual Studio 11 to seamlessly support our innovative and trend defining users. A big thanks also goes to our development team for working with the guys at Microsoft to make Goanna Studio even better in the upcoming release. As a sneak peak we give you a first screenshot below, but if you want to try Goanna Studio for Visual Studio yourself, send us an email at vs11@redlizards.com.

Goanna Studio in Visual Studio 11 beta

About

Red Lizard Software is the leading provider of code confidence tools for C/C++ developers, bringing advanced static analysis closer to the developer by providing solutions for flexible build integration on the server and deep IDE embedding on the desktop across platforms.

Goanna is a fast, scalable, and precise software solution that detects software bugs and security vulnerabilities automatically during the development process, helping to keep product launch timetables on track and to reduce life cycle costs.