The Most Comprehensive Static Analysis Toolsuite for Ada
CodePeer helps developers gain a deep understanding of their code and build more reliable and secure software systems.
CodePeer is an Ada source code analyzer that detects run-time and logic errors. It assesses potential bugs before program execution, serving as an automated peer reviewer, helping to find errors easily at any stage of the development life-cycle. CodePeer helps you improve the quality of your code and makes it easier for you to perform safety and/or security analysis.
CodePeer is a stand-alone tool that runs on Windows and Linux platforms; it may be used with any standard Ada compiler or fully integrated into the GNAT Pro development environment. It can detect several of the “Top 25 Most Dangerous Software Errors” in the Common Weakness Enumeration. CodePeer supports all versions of Ada (83, 95, 2005, 2012).
CodePeer has been qualified as a Verification Tool under the DO-178B and EN 50128 software standards.
See CodePeer in Action
Watch a series of demos providing a high-level overview and the latest features of CodePeer. CodePeer Demos »
CodePeer’s advanced static error detection finds bugs before programs are run. By mathematically analyzing every line of code and considering every possible input and every path through the program, CodePeer can be used very early in the development life-cycle to identify problems when they are much less costly to repair. The tool can also be used retrospectively on existing code bases, to detect latent vulnerabilities.
CodePeer uses a unique “bottom-up” approach where each subprogram is analyzed separately, with its effects summarized / propagated for caller analysis. This enables CodePeer to scale up to very large applications, and also allows partial analysis (e.g., a library or even a specific unit without the enclosing context) with no need for a driver or stubs. In addition, CodePeer can take advantage of multicore architectures to significantly speed up its running time.
A CWE Compatible Tool
CodePeer has been designated as CWE-Compatible by the MITRE Corporation's Common Weakness Enumeration (CWE) Compatibility and Effectiveness Program. It detects a variety of code weaknesses, including several that are among the CWE’s Top 25 Most Dangerous Software Errors.
CodePeer’s advanced static error detection finds bugs before programs are run. By mathematically analyzing every line of code, and considering every possible input and every path through the program, CodePeer can be used very early in the development life-cycle to identify problems when they are much less costly to repair. The tool can also be used retrospectively on existing code bases, to detect latent vulnerabilities.
CWE-120 (Classic Buffer Overflow)
“The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.”
CWE-131 (Incorrect Calculation of Buffer Size)
“The software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.”
CWE-190 (Integer Overflow or Wraparound)
“The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.”
CodePeer will also detect the following CWE weaknesses:
| CWE weakness | Description |
|---|---|
| CWE 120, 123, 124, 125, 126, 127, 129, 130, 131 | Buffer overflow/underflow |
| CWE 136, 137 | Variant record field violation, Use of incorrect type in inheritance hierarchy |
| CWE 190, 191 | Numeric overflow/underflow |
| CWE 197 | Numeric truncation error |
| CWE 252, 253 | Unchecked or incorrectly checked return value |
| CWE 362, 366 | Race condition |
| CWE 369 | Division by zero |
| CWE 456, 457 | Use of uninitialized variable |
| CWE 476 | Null pointer dereference |
| CWE 561 | Dead (unreachable) code |
| CWE 563 | Unused or redundant assignement |
| CWE 570 | Expression is always false |
| CWE 571 | Expression is always true |
| CWE 682 | Range constraint violation |
| CWE 820 | Missing synchronization |
| CWE 821 | Incorrect synchronization |
| CWE 835 | Infinite loop |
Qualified For DO-178B and EN 50128
CodePeer has been qualified as a Verification Tool under the DO-178B software standard for commercial airborne systems, automating a number of activities associated with that standard’s objectives for software accuracy and consistency. CodePeer has also been qualified for EN 50128, the highest international safety integrity standard for software in railway control and protection systems. The EN 50128 qualification material addresses boundary value analysis (detecting errors such as buffer overflow), control flow analysis (detecting errors such as unreachable code), and data flow analysis (detecting errors such as references to uninitialized variables).
Customer Projects: CodePeer
-
UTC Aerospace Systems
Digital Terrain System Requiring DO-178B Certification
CodePeer has been selected by Atlantic Inertial Systems Limited, a UTC Aerospace Systems company in the U.K., for usage on its TERPROM® digital terrain system for military transport aircraft.
-
Saab
Land and Naval Surveillance and Defense Systems
Saab Electronic Defence Systems (Sweden) has adopted the CodePeer static analyzer tool for use on the GIRAFFE project. The GIRAFFE project is a family of land and naval radar-based surveillance and air defense command and control systems.
-
Siemens
Railway Control System
The Mobility Division of Siemens Switzerland Ltd., has selected GNAT Pro, along with the CodePeer static analysis tool, to develop the next generation of its railway control and information system.
Expert Support
Integral to every one of our products are the consulting and support services we provide to our customers. While every company says they offer excellent support, for us it‘s a critical part of our business model and something we take very seriously.