What is static code analysis?

Static analysis tools are today an important part of the CI/CD tool-chain and are required by regulatory standards. Furthermore, to combat the increasing threat from cyber security attacks, Static Application Security Testing (SAST) has been identified as one of the key tools.

Specifically, according to CEWT 25, any commercial code will not be either Safe or Secure if you can’t find all of the Undefined Behavior bugs.

Using several static analysis tools can be a good idea. There are unique features in each tool. This has been established in many studies.

Static code analysis for safety critical software

Static analysis is an integral part of developing safety-critical software, particularly in adhering to stringent safety-related ISO standards such as ISO 62304 (medical devices), IEC 61508 (general safety-related systems), ISO 26262 (automotive), and EN 50128 (railway applications).

These standards mandate rigorous development processes to ensure the highest levels of safety and reliability. Static analysis tools scrutinize source code for potential errors and compliance with these standards, facilitating early detection of issues that could compromise safety. This not only streamlines the development process but also plays a pivotal role in certifying that the software meets the exacting safety standards required in these critical industries.

Static code analysis for cyber security compliance

Static code analysis is a pivotal cybersecurity tool that scrutinizes source code for potential vulnerabilities, coding flaws, and compliance with security standards, without executing the program. Its role in cybersecurity compliance is increasingly vital given the expanding landscape of cybersecurity threats and regulatory requirements.

Reference to Common Vulnerabilities and Exposures (CVEs) is a key aspect of static code analysis in cybersecurity. By identifying known vulnerabilities that match entries in the CVE database, static code analysis helps developers remediate security issues before they can be exploited. This proactive approach is crucial for maintaining the integrity and security of software systems, reducing the risk of cyber incidents that could have severe repercussions.

In the context of automotive cybersecurity, ISO 21434 is a recent standard that outlines requirements for cybersecurity risk management regarding the lifecycle of automotive products. Static code analysis plays a critical role in this process by ensuring that automotive software is scrutinized for vulnerabilities and compliance issues, thereby supporting manufacturers in adhering to this standard and enhancing the cybersecurity posture of automotive products.

The upcoming Network and Information Systems Directive 2 (NIS2), Radio Equipment Directive (RED), and Cyber Resilience Act (CRA) in the European Union represent significant legislative efforts to strengthen cybersecurity across various sectors. These legislations will impose more stringent cybersecurity requirements, emphasizing the importance of secure software development practices.

Static code analysis will be instrumental in ensuring compliance with these new regulations. By identifying and addressing security issues during the software development phase, organizations can demonstrate their commitment to cybersecurity, reduce the risk of regulatory penalties, and protect themselves against the reputational damage associated with cyber breaches.

What is TÜV SÜD?

Cppcheck Premium is TÜV SÜD-certified!

TÜV stands for “Technischer Überwachungsverein,” which translates to “Technical Inspection Association” in English. TÜV SÜD is committed to protecting people and the environment through comprehensive testing, certification, auditing, and advisory services. The company ensures that new and updated technologies comply with regulations, with a strong focus on automotive innovation and development. Additionally, it acts as a notified body for medical devices in Europe.

Cppcheck Premium has received TÜV SÜD certification, signifying that it meets stringent safety and quality standards. TÜV SÜD has evaluated Cppcheck Premium to ensure its reliability and compliance with industry regulations. This certification underscores Cppcheck Premium's commitment to delivering high-quality static code analysis tools, particularly for applications in safety-critical industries.

So what's unique about Cppcheck?

Cppcheck uses unsound flow sensitive analysis. Several other analyzers use path sensitive analysis based on abstract interpretation, that is also great however that has both advantages and disadvantages. In theory by definition, it is better with path sensitive analysis than flow sensitive analysis.

But in practice, it means Cppcheck will detect bugs that the other tools do not detect. In Cppcheck the data flow analysis is not only "forward" but "bi-directional". Most analyzers will diagnose this:

void foo(int x)
{
int buf[10];
if (x == 1000)
buf[x] = 0; // <- ERROR
}
Most tools can determine that the array index will be 1000 and there will be overflow.
Cppcheck will also diagnose this:
void foo(int x)
{
int buf[10];
buf[x] = 0; // <- ERROR
if (x == 1000) {}
}

What is undefined behavior?

A program that has undefined behavior is broken according to the C and C++ specifications. The result of undefined behavior can be any of: crash, hang, security vulnerability, safety issues, bug, unreachable code can be executed, works exactly as you want, etc. Undefined behavior allows the compiler to generate arbitrary code for instance it can freely remove code that has undefined behavior.

Examples of what may generate undefined behavior are listed below:

Dead pointers
Division by zero
Integer overflows
Invalid bit shift operands
Invalid conversions
Invalid usage of STL
Memory management
Null pointer dereferences
Out of bounds checking
Uninitialized variables
Writing const data