Goanna 3.0 released
The Red Lizards team is delighted to announce the release of version 3.0 of the Goanna suite of static analysis tools across all product lines!
This release is a major step forward for Goanna, adding significant new features for ease-of-use and productivity in team environments. In addition, Goanna’s core C/C++ analysis is now more accurate, covers additional classes of defects, and provides more precise information on each warning. Goanna’s analysis engine has also undergone a major overhaul, laying the foundation for even more advanced static analysis capabilities in future updates on the 3.x line.
Among the new features in this release are:
- A built-in Goanna Dashboard that automatically tracks snapshots of your project over time, providing instant visualization of defect history and problem areas.
- A fully integrated Codehaus SonarTM-based open source Code Quality Management platform, providing graphical visualization tools, all the classic cyclomatic complexity and code coverage metrics, and additional static analysis capabilities via the open source CppCheck tool. (Goanna Central only)
- A new suite of command line tools (“goannamake”, “goannascons”, and others) to automate Goanna analysis of whole projects with common options in build server environments, including projects with complicated settings for cross-compilation to multiple targets. (Goanna Central only)
- Additional checks to catch common overrun bugs in arrays and C style strings.
- Refinements to the core Goanna analysis engine to eliminate false positive warnings, increase the precision of warnings and traces, and improve performance.
- Improved support for platforms such as IAR Embedded Workbench, Altium TASKING, and more.
The Goanna Dashboard is a powerful new feature in Goanna 3.0 that allows you to visualize the warnings in your projects at a single glance.
As you analyze your projects with Goanna, snapshots are taken automatically on every run, and all the warnings are summarized by severity, category, folder, and file. At any time, you can browse this summary via a Web-based interface, allowing you to instantly recognize issues and zero in on trouble spots as soon as they arise.
The Goanna Dashboard lets you browse warnings in your project:
- by Severity over time (Snapshot History chart),
- by Category in a particular snapshot (Warnings by Category pie chart),
- in a Top 10 bar chart,
- in a 2D tree map over the directory structure,
- in a table with powerful filtering, sorting, and searching (the Warnings Browser), and
- in a proportional bar chart by category for each directory (the Directory Browser).
In addition, warnings are hyperlinked to Goanna check descriptions, rule documentation from Coding Standards, and to external source code browsers (if available).
Integrated Sonar Platform
In addition to the built-in Goanna Dashboard, Goanna Central now bundles the popular open source Codehaus SonarTM-Code Quality Management platform. SonarTM provides not only C/C++ code analysis, advanced metrics, and defect hunting tools, but can be easily extended through a powerful plug-in mechanism. Plug-ins (both free and commercial) are available for over 20 languages.
Goanna Central fully automates the installation and configuration of the SonarTM server, so it is available as soon as you install Goanna. In addition, Goanna analysis results are fully integrated with SonarTM. Taking snapshots of your project in the SonarTM Dashboard is also fully automated with Goanna’s project-level commands. All you need to do is add the --sonar option when you run goannamake.
You can find out more about SonarTM at http://www.sonarsource.org/.
Also bundled with Goanna Central in 3.0 are the CppCheck and CppNcss open source tools, providing additional static analysis capabilities and cyclomatic complexity metrics. These tools are also fully automated in Goanna’s project-level commands, all you need to do is add the --cppcheck and --cppncss options. Results of these tools are also available seamlessly in the SonarTM Dashboard.
Goannamake suite of utilities
Goanna Central users have been asking us for some time for a utility to automate Goanna analysis over whole projects. Fortunately Goanna Central’s design — goannacc/goannac++ commands that transparently wrap your system’s cc/c++ compilers — is conceptually so simple that for most people this hasn’t been necessary until now. You can usually get instant analysis results from Goanna by just issuing a make CC=goannacc or similar command. Normally no complex build monitoring or command injection is required.
As Goanna’s analysis capabilities increase and projects become more complex, however, we have recognized the need for a suite of project-level utilities to manage Goanna analysis in both interactive and build server environments.
But in keeping with Goanna’s simple design philosophy, the new utilities are extremely straightforward to use. Goannamake is for Makefile projects, and can be used exactly as you would use your system make command. Just issue a goannamake, and your build will be run interposing goannacc and goannac++ for your system compiler, with all the right options for optimal interprocedural analysis and snapshot generation in the Goanna Dashboard. Options are also available for passing options to every goannacc and goannac++ invocation, and for passing different analysis settings for each target in cross-compilation projects.
Goannascons is for SCons projects, and performs a similar function to goannamake. Additional build automation commands are in development, if you would like to see one for your build environment, please contact us at firstname.lastname@example.org.
Goreporter allows you to take manual snapshots and other operations with analysis runs that have been captured in .goannadb database files.
Improved Platform Support
Several third-party compilers and IDE’s are now fully supported by Goanna Studio for Eclipse:
- Altium TASKING,
- IAR Embedded Workbench.
Goanna Studio is able to auto-detect your compiler toolchain, target processor, included libraries, and similar settings, so that in the majority of cases your code should just analyze correctly first time.
Toolchain auto-detection in Goanna Studio has also been improved generally, especially for vendor IDE’s that bundle some variant of a GCC toolchain. Additional profile examples are also provided, and you can also override the compiler location and command-line options manually, yet still auto-detect the remaining options without having to edit the configuration by hand.
Improvements to the Core
Goanna now includes a new technique based on Satisfiability Modulo Theories (SMT) to suppress false positives due to paths that are infeasible in any actual execution. For example,
if (b) p = malloc(...); if (b) free(p);
is neither a memory leak nor a free of an uninitialized pointer, as the if conditions must either both be true or both false, never a mixture. This is a simple example, but much more complex paths can occur in real programs that can never actually be executed at run time. The SMT-based technique in Goanna 3.0 uses the latest research, and can eliminate such paths even in extremely complex situations involving the values of many dependent variables. This technique is applied across all checks in Goanna, and is enabled by default so you don’t need to do anything special to benefit from it.
The accuracy of abstract data tracking has been greatly improved, reducing both false positives and false negatives across many checks. The situations that have been improved include:
- complex expressions involving %, &, |, and ^ operators,
- array pointers passed as function parameters and return values,
- static const variables with initializers,
- and many more.
The following new checks have been added to detect situations where Goanna can deduce that a C style string overrun is possible or definite:
These checks supersede the [LIB-buf-lit] check and most of the [LIB-fn-unsafe] check.
Traces have been improved to show more information about the decisions (if, for, while, and switch conditions) on the path leading to a warning, and less information that’s not relevant to it.
Timeouts during Goanna analysis now only interrupt a single function (except in a few cases), not the entire source file. This means it is still possible to get part results even in very large (e.g., auto-generated) source files, without costing an indefinite amount of CPU time in build server environments.
In addition, a host of smaller refinements to accuracy have been made across the Goanna check database. There are too many to go into in much detail, but all the improvements address clear-cut false positives and false negatives that have occurred in common projects in previous releases:
- [ARR-inv-index-ptr] and [ARR-inv-index-ptr-pos] now warn about more potential array overruns occurring interprocedurally and in more complex expressions.
- [PTR-null-assign-fun-pos] and [PTR-null-pos-assign] have been relaxed in some situations where code fails to check the return value of malloc, calloc, and realloc
- [MEM-malloc-arith] has been refined to ignore cases of trivial arithmetic when computing allocation sizes.
- The [*-non-bool] checks have been relaxed to consider more Boolean types as Boolean by enforcement according to MISRA C:2004.
- [SPC-uninit-arr-all] has been improved to suppress false positives when arrays are initialized via aliases.
- [MEM-double-free] and [MEM-double-free-some] have been improved to suppress false positives when pointer variables are both declared and freed in inner scopes.
- [MEM-lose-assign] has been improved to suppress false positives when using COM-style reference-counting methods such as QueryInterface, AddRef, and Release.
- [FUNC-unprototyped] (formerly FUNC-unprototyped-call) has been improved to warn only once per function.
- [PTR-cmp-str-lit], [RED-dead], [RED-local-hides-global], [RED-local-hides-local], [RED-local-hides-member], and [RED-local-hides-param] have been improved to exclude spurious warnings resulting from complex macro expansions.
In addition, the set of checks that are on by default has been refined to include just the highest-probability, highest-severity issues. Analysis of functions defined in header files is also off by default, and interprocedural analysis is on by default in all product lines.
Our C/C++ parser has also been upgraded to accept more non-standard language extensions and C++11 syntax.
Update 3.0.1, 15 February 2013
This update includes quite a few improvements to performance, usability, and compatibility with more environments. Here’s a list of the major changes:
- Performance has been improved generally, especially in the following situations:
- Source files with large numbers of functions.
- Optimized result generation of internal checks functions.
- Short circuit of internal checks results exploited when possible.
- Reduce internal data representation structure and complexity.
- Trace output has been improved to show the original syntax better in conditionals.
- The profile file supports new sections for command-line arguments to pass to every compiler invocation, and records the arguments it was configured with.
- The situations where Goanna produces issue report logs (and the information contained in them) has been improved.
- There are now –package=…, –package-dir=…, and –no-stdchecks options (replacing the previous –checks-pkg and –checks-dir options) to control which custom checks packages are loaded.
- The Goanna Dashboard now includes a source code browser in environments where direct display of the source code in an IDE is not available.
- (Windows only) Various issues with files with non-ASCII file names have been fixed.
- (Windows only) Issues running Goanna under a user account with non-ASCII characters have been fixed.
Goanna Studio For Eclipse
- Error reporting for toolchain auto-detection has been improved.
- Issues in auto-detecting the version of the QNX QCC and Texas Instruments compilers have been fixed.
Goanna Studio for Visual Studio and Atmel Studio 6
- An issue auto-detecting Atmel toolchain settings for projects with no C++ compiler options defined has been fixed. (#4602)
- A user friendly dialog is now available to send issue reports back to Red Lizard Software automatically on errors.
- The Activate License dialog has been vastly simplified, making it much easier to activate your license and to start a free evaluation via the Atmel Gallery.
- There is now a –trace-format=… option to allow finer control over the formatting of traces.
- The –configure option now looks for profile files in Goanna’s built-in profile folder.
- The IAR profile has been improved to handle more IAR extended syntax including __c99_generic, __C_task, __eeprom, __far, __farflash, __farfunc, __flash, __generic, __huge, __hugeflash, __interrupt, __io, __monitor, __near, __nearfunc, __regvar, __tiny, __tinyflash, and __version_1.
- An issue with the QNX and Texas Instruments profiles in Windows XP has been fixed. (#4595)
- The Windows installer has been updated to a new EXE format that includes all prerequisite libraries including the .NET framework.
- A compatibility issue with GLIBC 2.4 has been fixed. (#3913)
- The Linux install script is now compatible with older versions of “tar” and “cp”. (#4608)