AdaCore’s CodePeer Officially Registered as CWE-Compatible

NEW YORK, PARIS, SAN JOSE, Calif., December 6, 2016 – Embedded Systems Conference – AdaCore today announced that itsCodePeer advanced static analysis tool for Ada has been formally designated as “CWE-Compatible” by the MITRE Corporation’s Common Weakness Enumeration (CWE) Compatibility and Effectiveness Program. This program is a web-based initiative that consolidates and organizes information about cyber-security products and services.

“It’s a great achievement to have CodePeer officially recognized as CWE compatible, which confirms that the tool can detect the most frequent types of software vulnerability,” said Arnaud Charlet, AdaCore Technical Director and CodePeer Product Manager. “CodePeer’s deep analysis of Ada code supports a wide range of uses including coding standard checking, automated code review, and exhaustive detection of certain CWE weaknesses as well as other kinds of error.”

CodePeer was recognized as CWE-Compatible based on its ability to detect the following code weaknesses, which are among the CWE’s Top 25 Most Dangerous Software Errors:

CWE-120 (Classic Buffer Overflow)
“The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.”
CWE-131 (Incorrect Calculation of Buffer Size)
“The software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.”
CWE-190 (Integer Overflow or Wraparound)
“The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.”

A number of other CWE weaknesses are also detected by CodePeer:

Check	CWE weakness
Array index out of bounds	CWE 124, 125-125, 129, 130-131, 135, 170, 193
Division by zero	CWE 189
Dereferencing a null pointer	CWE 252-253, 476
Numeric overflow	CWE 128, 190-192, 197
Range constraint violation	CWE 118
Variant record field violation	CWE 136-137
Use of incorrect type in inheritance hierarchy	CWE 136-137
Dead (unreachable) code	CWE 561
Reference to uninitialized variable	CWE 232, 236, 475
Test predetermined (redundant conditional)	CWE 561
Loop runs forever or fails to complete normally	CWE 835
Unused (redundant) or useless assignment, or unused “out” parameter	CWE 563
Unprotected access to shared variable	CWE 362, 366-367, 374, 820

About CodePeer

CodePeer is an Ada source code analyzer that detects run-time and logic errors. It assesses potential bugs before program execution, serving as an automated peer reviewer, helping to find errors efficiently and early in the development life-cycle. It can also be used to perform impact analysis when introducing changes to the existing code, as well as helping vulnerability analysis for legacy systems. Using control-flow, data-flow, and other advanced static analysis techniques, CodePeer detects errors that would otherwise only be found through labor-intensive debugging.

The tool’s deep analysis can directly support formal certification against industry-specific safety standards. For avionics applications CodePeer has been qualified as a Software Verification Tool under DO-178B, automating a number of verification activities defined in paragraph 6.3.4f (“Accuracy and consistency”). These activities include detecting errors such as values outside the bounds of an Ada type or subtype, buffer overflows, integer overflow or wraparound, division by zero, use of uninitialized variables, and floating point underflow.

CodePeer has also been qualified for EN 50128, the highest international standard for safety integrity concerning software for railway control and protection, including communications, signaling and processing systems. The EN 50128 qualification material addresses the following:

Boundary value analysis to detect attempts to dereference a pointer that could be null, values outside the bounds of an Ada type or subtype, buffer overflows, integer overflow or wraparound, and division by zero.
Control flow analysis to detect suspicious and potentially incorrect control flows, such as unreachable code, redundant conditionals, loops that either run forever or fail to terminate normally, and subprograms that never return.
Data flow analysis to detect suspicious and potentially incorrect data flows, such as variables that are read before they are written (uninitialized variables), variables written more than once without being read (redundant assignments), variables that are written but never read, and parameters with an incorrect mode (unread “in” parameter, unassigned “out” parameter).

Qualification materials for DO-178B and EN 50128 are available as an option with CodePeer.

CodePeer is fully integrated into Adacore’s GNAT Pro development environment and comes with a number of complementary static analysis tools common to the technology – a coding standard verification tool (GNATcheck), a source code metric generator (GNATmetric) and a document generator.

About AdaCore

Founded in 1994, AdaCore supplies software development and verification tools for mission-critical, safety-critical and security-critical systems. Four flagship products highlight the company’s offerings:

The GNAT Pro development environment for Ada, a complete toolset for designing, implementing, and managing applications that demand high reliability and maintainability,
The CodePeer advanced static analysis tool, an automatic Ada code reviewer and validator that can detect and eliminate errors both during development and retrospectively on existing software,
The SPARK Pro verification environment, a toolset based on formal methods and oriented toward high-assurance systems, and
The QGen model-based development tool, a qualifiable and customizable code generator and verifier for Simulink^® and Stateflow^® models, intended for safety-critical control systems.

Over the years customers have used AdaCore products to field and maintain a wide range of critical applications in domains such as space systems, commercial avionics, military systems, air traffic management/control, railway systems, medical devices and financial services. AdaCore has an extensive and growing worldwide customer base; see www.adacore.com/customers/ for further information.

AdaCore products are open source and come with expert online support provided by the developers themselves. The company has North American headquarters in New York and European headquarters in Paris. www.adacore.com

Pricing and Availability

CodePeer is available now. Please contact AdaCore (info@adacore.com) for information on product pricing and supported configurations.