UNO Static Analysis With a Simple Twist. Richard Mancusi CSCI – 297

Essential Principles Uninitialized Variables Null Pointers Out-of-Bounds Array Indices There is a two-fold focus to this tool: Keep things simple and remove the noise associated with other static tools. Allow for a simple means to extend the analysis In particular, the author references the inability of lint tools to be very succinct in its output.

Mechanics Builds upon ctree, a public-domain compiler front-end with a few modifications Parse tree transformation into control flow graph, with interpretations for goto and return statements Statement attributes describing all object usage for use by the dataflow analysis module Global analysis mechanism implemented Extensibility using C-like syntax, …simple.

Example: ‘lint –p’ “lint –p” is a running of lint using its portability option. This is 16 lines of output, 67 words to describe two errors.

The Better Tool (here): The comments generated by this tool targets the possible issues with minimal verbiage. User has be sharper focus.

Example: Extensibility via Properties This property is used to identify any side effect or function call that occurs within a select statement.

References Gerard J. Holzmann, Uno: Static Source Code Checking for User-Defined Properties, 2002. http://spinroot.com/uno