Analysis Setup
In R2023a, you can explicitly check for violations of Common Weakness Enumeration (CWE) rules by selecting the CWE rules that you want to enable during your analysis. To check for CWE rule violations, choose from these predefined subsets or create a custom subset that meets your requirements:
all— All supported CWE rules.cwe-658-659— CWE rules for weaknesses that are specific to C and C++ Software.from-file— Custom selection of CWE rules that you configure with the Checkers selection interface. See Customize Checker Subsets.
See also:
In previous releases, you checked for violations of CWE rules by enabling
defect checkers that were mapped to CWE rules (-checkers
CWE). In R2023a, to check for violations of CWE rules,
use the option Check CWE (-cwe).
The desktop interface automatically updates your project configuration by
replacing the option -checkers CWE with the option and
-cwe all.
To update your scripts, replace all instances of -checkers
CWE with -cwe all. Alternatively, you
can enable only a subset of CWE rule checkers instead of all CWE
checkers.
In R2023a, Polyspace® supports Clang compiler version 13.x natively. If you build your source code by using this Clang compiler version, you can specify the compiler name for your Polyspace analysis.
You can now set up a Polyspace project without knowing the internal workings of this Clang compiler version. The analysis can interpret macros that are implicitly defined by the compiler and compiler-specific language extensions, such as keywords and pragmas.
At the command line, specify a compiler by using the option -compiler.
For
instance:
polyspace-bug-finder-server -sources file.c -compiler clang13.x ...
Compiler
(-compiler).In R2023a, Polyspace supports GCC compiler versions 11.x and 12.x natively. If you build your source code by using these GCC compiler versions, you can specify the compiler name for your Polyspace analysis.
You can now set up a Polyspace project without knowing the internal workings of these compiler versions. The analysis can interpret macros that are implicitly defined by the compiler and compiler-specific language extensions, such as keywords and pragmas.
At the command line, specify a compiler by using the option -compiler.
For
instance:
polyspace-bug-finder-server -sources file.c -compiler gnu12.x ...
Compiler
(-compiler).In R2023a, polyspace-access has these new options and commands behaviors that simplify
the management of the Polyspace
Access™ software and results.
New option
-verDisplay the release version and license number of a Polyspace Access instance at the command line. Use option
-hostto specify the hostname of the Polyspace Access server. For example:The command returns:polyspace-access -ver -host myAccessServer $LOGIN Connecting to https://myAccessServer:9443 Connecting as jsmith ------------------------------------------------------------------ polyspace-access command version: R2023a Polyspace Access Server version: R2023a Polyspace Access license number: 12345678 ------------------------------------------------------------------ Command Completed
The Polyspace Access server version and license number.
The version of the
polyspace-accessbinary.
Here,
$LOGINis a variable that stores the login credentials and other connection information. See Encrypt Password and Store Login Options in a VariablePreviously, you could not display this information at the command line. To view the version and license number you logged into Polyspace Access and clicked
> About Polyspace.Improved
-uploadcommandYou can now specify the path of a results file when you upload results to Polyspace Access, for example
-upload "C:\Polyspace_Workspace\My Example Project\Module1\ps_results.psbf"Previously, you could specify only the path of a folder containing a results file, or the path of a zipped file containing a results file.
View URL of update results — You can now view the Polyspace Access URL for the results that you upload with the command
polyspace-access -upload. The URL is available in the command output, for example:Use the URL to open the uploaded results in Polyspace Access.polyspace-access %login% -upload C:\myProject\resultsDir\ps_results.psbf -parent-project public/myExample Zipping results Connecting to https://myAccessServer:9443 Connecting as jsmith Upload C:\myProject\resultsDir\ps_results.psbf in public/myExample/PolyspaceProject (Bug Finder) Upload with IMPORT_ID 1673331466966_6517d659-769c-4233-9e13-c505781c962c.zip Uploading RunId: 1241 Progress: 10% Uploading RunId: 1241 Progress: 95% Upload successful for RUN_ID 1241 and PROJECT_ID 483 You can now view the results via your web browser at ACCESS_URL https://myAccessServer:9443/metrics/index.html?a=metrics&p=483&r=1241 Upload completed for 1 / 1 runs Command Completed
See also polyspace-access.
Analysis Results
Reviewing Results
In R2023a, when you check for violations of the CWE rules, Polyspace reports violations of these rules as explicit findings in the Results List and in reports.
In the results list you see the rule number and you can filter the results by CWE rule for a more focused review.
See also:
In previous releases, when reviewing violations of CWE rules, you reviewed the Bug Finder defects that were mapped to the rules. When you reviewed results in the results list, CWE rules that corresponded to a defect were listed in a CWE column. In R2023a, you can check for violations of CWE rules directly and review findings by CWE rule ID.
If you open results generated with a Polyspace product version R2022b or earlier, the CWE column is still available in the Results List. Starting with R2023a results, the CWE column is no longer available.
You can now fix some common defects or coding rule violations, such as not declaring an
unmodified variable const, with a single click. You can apply the fix to
one finding or to all instances of that finding in the currently active file.
To apply a fix, select a finding in the editor or the Problems panel, and then click the appropriate option in the light bulb menu. Polyspace inserts the fix in your code and removes the corresponding finding from the list of findings in the Problems panel.
See also Apply Suggested Fix for Common Defects or Coding Rule Violations.
In R2023a, Polyspace Access shows aggregate software quality objectives (SQO) statistics when you select a project folder. To view aggregate SQO statistics, click on a folder in the Project Explorer pane. A Quality Objectives card shows in the Project Overview dashboard. To view detailed SQO information for all items in the selected folder, click on the title of the Quality Objectives card to open the Quality Objectives dashboard.
Note these differences between viewing SQO information at the folder level and the project level.
For folders, the Progress and Details sections do not contain links to filtered results in the tables.
You cannot assign quality objective levels to all projects in the folder at once.
The Quality Objectives card for folders does not show Pass, In progress, or Incomplete labels.
Polyspace Access aggregates SQO statistics even if the quality objectives configuration levels are not homogeneous. While individual projects might contain separate definitions of each SQO level, Polyspace Access does not separate the statistics by level details when aggregating the statistics. All SQO1 level projects are aggregated together, as are SQO2 and so forth.
For more information about the Quality Objectives dashboard, see Quality Objectives Dashboard in Polyspace Access.
If you use the Checkers selection interface to enable coding rule checkers and you enter text in the Comment column for these rules, Polyspace now displays that text in the Result Details pane and in the Detail column of the Results List. You can then filter your results based on the text that you entered.
You can add custom comments, if, for instance, you want to customize the categorization of a coding standard. For example, if you want to treat a MISRA C™:2012 advisory rule as required.
If a pointer in your code is initialized only for certain system input values, in R2023a, a Bug Finder analysis can report the defect along with one possible combination of input values causing the defect. Bug Finder shows problematic input values for these defects:
For instance, in this example, the if statement has a missing else branch. As a result, the pointer backup can be non-initialized for certain values of the input
size.
void checkIfLowCount(int*, int);
void removeFirstElement(int *arr, int size)
{
int *backup;
if(size > 2)
{
backup = arr;
for(int i = 0; i < size - 1; i++, arr++)
{
*(arr+1) = *arr;
}
*arr = 0;
}
checkIfLowCount(backup, size);
}Run stricter checks considering all values of system inputs (-checks-using-system-input-values), the event list below the Non-initialized pointer defect shows a possible value of the input size that leads to the defect.
For the full list of defects that Bug Finder can report along with input values, see Extend Bug Finder Checkers to Find Defects from Specific System Input Values.