Polyspace BugFinder: Disabling Security Defects
4 views (last 30 days)
Hello Support Team,
I would like to get some information on what would be the impact if the "Polyspace BugFinder Security Defects" are disabled in our embedded C project.
According to the documentation, these defects highlight places in the code which are vulnerable to hacking or other security attacks. If our software does not need to satisfy any such security requirements, would it be ok to disable these defects from our project?
Anirban on 18 May 2021
Edited: Anirban on 18 May 2021
I will start with the difference between a security defect checker and another type of defect checker. A security defect shows a vulnerability in your code that by itself is not a problem, but has to be actively exploited by a hacker to cause a problem. A very simple example is the following: a Division by zero by itself is a problem. But the equivalent security defect is a Tainted division operand, which shows cases where the divisor is obtained from an untrusted external source and not checked for certain problem values. This by itself might not be a problem since the source has to actually pass those problem values to trigger an issue. In other words, your program is not robust against malicious data from sources.
If you do not have requirements for this kind of robustness against malicious data (or malicious code injection through data), you can disable the security defects. They should not have an impact on other types of defect checkers.
More Answers (0)
Code Verification Polyspace Bug Finder Configure and Run Analysis Complete List of Polyspace Bug Finder Analysis Engine Options Bug Finder Analysis