14-Jun-05White Elephant GmbH1 Ada Bug Finder

14-Jun-05White Elephant GmbH2 Ada Bug Finder The Ada Bug Finder is a Windows application that searches Ada code for recognisable bug patterns

14-Jun-05White Elephant GmbH3 Presentation Bug Finders Ada Bug Finder v1.4 Ada Bug Patterns Results Free software for you to try out!

14-Jun-05White Elephant GmbH4 Inspiration “Finding Bugs is Easy” By David Hovemeyer and William Pugh Presented October 2004 at OOPSLA Specific to Java Bug Patterns

14-Jun-05White Elephant GmbH5 Bug Pattern - Definition A bug pattern is a code idiom that is likely to be an error. David Hovemeyer and William Pugh Syntactically correct but probably not what the author intended.

14-Jun-05White Elephant GmbH6 Concept Premise: Bugs exist in production code Search existing Ada code base for bug patterns.

14-Jun-05White Elephant GmbH7 Bugs in Production Code Why? In code that is rarely executed Symptoms hard to reproduce No access to development staff

14-Jun-05White Elephant GmbH8 A “Find bugs” Utility Should use simple patterns Need not be 100% correct False Positives are to be expected No guarantee that every situation covered Overnight background job – Speed not an issue

14-Jun-05White Elephant GmbH9 Trade-offs Compilers could do more –Increased compilation time Bug finder utility could do more or raise fewer false positives –Increased development costs

14-Jun-05White Elephant GmbH10 Ada Bug Finder v1.4 Result of a small 140 hour project As yet only detects 8 bug patterns Optionally checks 7 style rules

14-Jun-05White Elephant GmbH11 False Positives ABF doesn’t always get it right! –Implementation trade-off –Bad or over-complex style Exercise care when modifying code! Mark code with special comment to prevent ABF reporting

14-Jun-05White Elephant GmbH12 Code Marking - Example

14-Jun-05White Elephant GmbH13 Recognised Ada Bug Patterns 1. Illogical Operator Rename 2. Code Not Reachable 3. Exception Not Raised 4. Unused Unit 5. Unused Declaration 6. Null Pointer 7. Non Short Circuit 8. Wrong Granularity

14-Jun-05White Elephant GmbH14 1. Illogical Operator Rename In Ada83, where there is no use type clause, operators are often renamed to avoid the use of prefixed notation Clumsy cut & paste editing might result in renaming an operator to be something totally different. The compiler allows this although it is highly unlikely to be what the author intended

14-Jun-05White Elephant GmbH15 IOR - Example

14-Jun-05White Elephant GmbH16 2. Code Not Reachable Code placed after an unconditional Raise Return Exit Some compilers (Gnat) detect this.

14-Jun-05White Elephant GmbH17 CNR - Example

14-Jun-05White Elephant GmbH18 3. Exception Not Raised An exception is declared but never raised Exception handled but never raised

14-Jun-05White Elephant GmbH19 ENR – Example of False Positive

14-Jun-05White Elephant GmbH20 4. Unused Unit Package imported but never used Procedure, function or package defined but neither exported nor used locally False positives: Undetected default generic subprogram parameter Conditional compilation selected code destined for a different target

14-Jun-05White Elephant GmbH21 UU – Example of False Positive

14-Jun-05White Elephant GmbH22 5. Unused Declaration Type, Constant or Variable declared but never used Why? History Confusion – Similar names Overloading False positive: Required because controlled type or default initialisation has an effect

14-Jun-05White Elephant GmbH23 UD – Example of False Positive

14-Jun-05White Elephant GmbH24 6. Null Pointer Code explicitly checks for null then dereferences the pointer Unbelievable? Not a compiler requirement. Some make checks None do the job properly!

14-Jun-05White Elephant GmbH25 NP - Example

14-Jun-05White Elephant GmbH26 7. Non Short Circuit and used instead of and then or used instead of or else Typically Test if index in range then use it Test if pointer not null then dereference it

14-Jun-05White Elephant GmbH27 NSC - Example

14-Jun-05White Elephant GmbH28 8. Wrong Granularity Size attribute outside of an expression Unlikely usage because hardly anything requires the size of an object in bits! Typically An imported API (e.g. Windows) requires the address and size of a buffer in bytes. If this buffer size is supplied as bits, a buffer overrun may occur!

14-Jun-05White Elephant GmbH29 WG - Example

14-Jun-05White Elephant GmbH30 The Ada Bug Finder Utility Written in Ada95 Uses Ada Parser to detect patterns Reports Options Style

14-Jun-05White Elephant GmbH31 Screen Shot

14-Jun-05White Elephant GmbH32 ABF - Reports Text Comma Delimited

14-Jun-05White Elephant GmbH33 ABF - Options Gnat Extensions Preparation Phase (Second pass to reduce false positives at the expense of speed)

14-Jun-05White Elephant GmbH34 Style Rules Not bugs as such but coding practices that lead to bugs or make bugs harder to find. 1. Character Not Portable 2. Handle Task Exceptions 3. No Declaration Overloading 4. No Goto Statements 5. No Use Clause 6. No Variables in Specification 7. Superfluous Code Mark

14-Jun-05White Elephant GmbH35 Other recognised bug patterns 1. Division by Zero 2. Raise after Assignment 3. Redundant Comparison to Null 4. Symmetrical Comparison

14-Jun-05White Elephant GmbH36 1. Division by Zero Code explicitly checks for zero then uses it for division.

14-Jun-05White Elephant GmbH37 DBZ - Example

14-Jun-05White Elephant GmbH38 2.Raise after assignment Leaving a procedure abnormally nullifies assignment to in-out or out parameters

14-Jun-05White Elephant GmbH39 RAA - Example

14-Jun-05White Elephant GmbH40 3. Redundant Comparison to null Comparing a pointer to null after it has been dereferenced is redundant Indicates confusion. Either the check is truly redundant or the previous dereference should have been first checked.

14-Jun-05White Elephant GmbH41 RCN - Example

14-Jun-05White Elephant GmbH42 4. Symmetrical Comparison When both sides of a comparison are identical

14-Jun-05White Elephant GmbH43 SC - Example

14-Jun-05White Elephant GmbH44 Results SourcesFiles CnrEnrIorNscNpSeUdUuWgStyles UniControl ILTIS Aonix Gnat GCC 3.15p Gps AI

14-Jun-05White Elephant GmbH45 Results Bugs were found in all the code bases we searched. Most were in code that was seldom if ever executed (e.g. Error handling) Some were severe! Reluctance to change production code that been accepted and that appears to function correctly. Can be used as a development tool.

14-Jun-05White Elephant GmbH46 Results (Style Violations) SourcesTotalCnpHteNdoNgsNpucNvisScm UniControl Iltis Aonix Gnat GCC 3.15p Gps AI

14-Jun-05White Elephant GmbH47 Any other ideas? After you find a bug ask yourself whether it could have been found automatically by looking for a “Simple Pattern” If so then let’s include it into ABF and see if anyone else has made the same bug!

14-Jun-05White Elephant GmbH48 Where to get it Not open source but freely available for use Download from Feedback appreciated. –Results –Suggestions for new patterns –Excessive false positives.