Klocwork and other static analysis tools promise to find software bugs early in the development cycle. Such tools analyze source code without having to run it, and look for potential run-time problems or security vulnerabilities. Problems found by Klocwork include array out of bounds violations, memory leaks, null pointer dereference, freeing non-heap or unallocated memory, unvalidated inputs, uninitialized variables, and deadlock.
Input to Klocwork, said Ian Gordon, vice president of product management at Klocwork (Burlington, Mass.), is the C/C++ or Java source code and some information about how the code is constructed. Klocwork analyzes the code and produces a series of reports. In addition to static text reports, it provides a dynamic web server where users can query the results, and a tool that lets managers see trends that have developed over various software builds.
While C or C++ are the traditional languages for embedded systems, Java is becoming important too, Gordon said. "Some of the embedded folks are using Java for some of their user interface layers, and they will thus have a multi-language project. Having a single tool that can analyze all these layers is important to them," he said.
Klocwork 7.5 adds 66 new Java checkers — 17 security checkers, and 49 quality defect checkers. "We decided to find more quality run-time issues than in the past," Gordon said. "Embedded applications with no external connectivity may not be as concerned about security vulnerabilities."
The new release also adds a Java Server Page (JSP) conversion capability that detects errors in the JSPs used by many organizations. Klocwork also offers direct integration with Ant, a software build environment often used for Java.
New features aimed at both C/C++ and Java include expanded integration with Integrated Development Environments (IDEs). Klocwork 7.5 has plug-ins for Eclipse 3.1 and 3.2, Wind River Workbench 2.4 and 2.5, QNX Momentics 6.3, and IBM's Rational Application Developer 6.0. Klocwork has also expanded its support for Micrsoft Visual Studio 2005 with automated solution and project file parsing.
Two new concurrency checkers have been added. One finds conditions in which interactions between multiple threads can cause deadlock. Another checks for blocking functions such as "wait" or "sleep" within critical sections of code. Both checkers will help developers of multi-core systems who are dealing with shared resources, Gordon said.
The new Klocwork release also boasts a customizable extensibility API that lets users create and deploy custom rules to monitor quality and security in web applications, security applications, telecom/network modules, and mobile code.
Klocwork company recently completed an analysis of several open-source Java projects, and has posted results at www.g2zero.com, a new on-line community that addresses software quality. Klocwork 7.5 is available now starting at $2,995 per user.
