Introduction

This report summarizes results from two software quality assessment tools used to analyze the software in this product:

• Static Program Analysis: Coverity Static Analysis
• MISRA-C:2004 Rules: Texas Instruments C/C++ Compiler
• MISRA and Coverity analysis reports were run on the C674x ELF target only. Since the NDK stack source code is common to all targets, these reports should be considered generic and applicable to all other supported targets (such as the ARM Cortex-M3 and ARM Cortex-A8).

Unless noted below, all source code, both .c and .h files, for embedded target libraries was analyzed using these tools.

Static Program Analysis Summary

This report summarizes the Static Program Analysis results. For each library, a listing provides:

• The command-line invocation for the tool actually used for the analysis.
• Summary of lines-of-code (LoC) analyzed and defect types and counts (if any).
• Location of defects in the source code (file name and line number) (if any).

Justification for Not Addressing Coverity Static Analysis Violations

• Error: STRING_NULL: ti/ndk/nettools/http/httpclie.c: 227: string_null_argument: Function "httpParseRecv" does not terminate string "pMsg->request".


• False Positive: this string is null-terminated at line 72 of httpparse.c


• Error: TAINTED_SCALAR: ti/ndk/nettools/dhcps/dhcps.c: 299: tainted_data_argument: Calling function "recvfrom" taints argument "pDS->buf".


• False Positive: the upper bounds of the array pDS->buf are passed into the recvfrom() call at line 300 of dhcps.c; the lower bounds are checked on line 303


• Error: ARRAY_VS_SINGLETON: ti/ndk/tools/console/contest.c: 2042: address_of: Taking address with "&pipe1" yields a singleton pointer.


• False Positive: the Coverity tool appears to be confusing the NDK pipe() API with the Unix/Linux implementation, which takes an array as an argument.


• Note that the above errors are repeated in the report (resulting in a total of 14 defects). This is due to the same code base being used to build multiple libraries.

MISRA-C:2004 Summary

There are several rules in MISRA-C:2004 that are contrary to long-standing coding standards used in this product, and, hence will not be addressed in the product source code. These rules are listed in the table below. The corresponding checks were explicitly disabled in the tool when the source code was analyzed.