MISRA-C:2004  Rule  21.1:  (Required)			Minimisation of run-time failures shall be ensured by the use of at least one of (a) static analysis tools/techniques; (b) dynamic analysis tools/techniques; (c) explicit coding of checks to handle run-time faults

Where expressions consist only of values within a well-defined range, a run-time check may not be necessary, provided it can be demonstrated that for all values within the defined range the exception cannot occur. Such a demonstration, if used, should be documented along with the assumptions on which it depends. However if adopting this approach, be very careful about subsequent modifications of the code which may invalidate the assumptions, or of the assumptions changing for any other reason.

Example Code:

/* PRQA S 2982,3203,3112 ++ */

#include "misra.h"
#include "m2cmex.h"
#include <string.h>

extern S16 test_2101( void )
{
    S16 ia[10];

    if (s16a >= 30767)
    {
        s16r = s16a + 3000;                      /* MISRA Violation */
    }

    s16r = s16a + 4000;                          /* MISRA Violation */


    if (s16a < 0)
    {
        u16r = (U16)s16a;                        /* MISRA Violation */
    }

    u16r = (U16)s16a;                            /* MISRA Violation */

    if (s16c == 0)
    {
        s16r = s16r / s16c;                      /* MISRA Violation */
    }

    s16r = s16r / s16c;                          /* MISRA Violation */


    if (u16a >= 0x1FFFU)
    {
        u16r = u16a * 16U;                       /* MISRA Violation */
    }

    u16r = 10U - u16a;                           /* MISRA Violation */

    if (s16b > 9)
    {
        ia [s16b] = 1;                           /* MISRA Violation */
    }

    ia[s16b] = 1;                                /* MISRA Violation */

    {
        PC a[10];
        PC b[11];

        strncpy(a, b, sizeof(b));                /* MISRA Violation */
    }

    {
        PC a[10];
        PC b[11];

        if (s16a > sizeof(a))
        {
            strncpy(a, b, s16a);                 /* MISRA Violation */
        }
    }

    {
        PC a[10];
        PC b[11];

        if (s16a > sizeof(a))
        {
        }

        strncpy(a, b, s16a);                     /* MISRA Violation */
    }

    {
        if (u16a < 10)
        {
            if (u16b >= 10)
            {
                u16c = u16a / u16b;              /* MISRA Violation */
            }
        }
    }

    {
        if (u16b > u16a)
        {
            u16a % u16b;                         /* MISRA Violation */
        }

        u16a << 0;                               /* MISRA Violation */
        u16b | 0;                                /* MISRA Violation */
    }

    {
        0 | u16a;                                /* MISRA Violation */
        0xFFFFFFFFu & u16a;                      /* MISRA Violation */
        s16a = 1;
        s16a * u16a;                             /* MISRA Violation */
    }

    {
        S16 i;

        for (i = 0; i < 1; ++i)                  /* MISRA Violation */
        {
        }


        i = 10;

        while (i <= 10)                          /* MISRA Violation */
        {
            ++i;
        }
    }

    return s16r;
}

QAC messages that encompass this guideline:

2791	Definite: Right hand operand of shift operator is negative or too large.
2792	Apparent: Right hand operand of shift operator is negative or too large.
2801	Definite: Overflow in signed arithmetic operation.
2802	Apparent: Overflow in signed arithmetic operation.
2811	Definite: Dereference of NULL pointer.
2812	Apparent: Dereference of NULL pointer.
2821	Definite: Arithmetic operation on NULL pointer.
2822	Apparent: Arithmetic operation on NULL pointer.
2831	Definite: Division by zero.
2832	Apparent: Division by zero.
2841	Definite: Dereference of an invalid pointer value.
2842	Apparent: Dereference of an invalid pointer value.
2845	Constant: Maximum number of characters to be written is larger than the target buffer size.
2846	Definite: Maximum number of characters to be written is larger than the target buffer size.
2847	Apparent: Maximum number of characters to be written is larger than the target buffer size.
2871	Infinite loop identified.
2872	This loop, if entered, will never terminate.
2877	This loop will never be executed more than once.
2891	Definite: Negative value implicitly converted to an unsigned type.
2892	Apparent: Negative value implicitly converted to an unsigned type.
2896	Definite: Negative value cast to an unsigned type.
2897	Apparent: Negative value cast to an unsigned type.
2901	Definite: Positive integer value truncated by implicit conversion to a smaller unsigned type.
2902	Apparent: Positive integer value truncated by implicit conversion to a smaller unsigned type.
2911	Definite: Wraparound in unsigned arithmetic operation.
2912	Apparent: Wraparound in unsigned arithmetic operation.
2980	The value of this function parameter is never used before being modified.
2981	This initialization is redundant. The value of this object is never used before being modified.
2982	This assignment is redundant. The value of this object is never used before being modified.
2983	This assignment is redundant. The value of this object is never subsequently used.
2984	This operation is redundant. The value of the result is always '%1s'.
2985	This operation is redundant. The value of the result is always that of the left-hand operand.
2986	This operation is redundant. The value of the result is always that of the right-hand operand.

Related rules:

Rule  20.3

The validity of values passed to library functions shall be checked.

(c) The Motor Industry Research Association, 2004

QA C Source Code Analyser 8.1.2 MISRA-C:2004 Compliance Module 3.2 © 2013 Programming Research www.programmingresearch.com

Personality Groups | Glossary | Message Index | MISRA-C:2004 Rule Index

Contents