编程缺陷

与编程编码错误相关的缺陷，如赋值与相等运算符、类型不匹配、绕回问题、字符串数组等

这些缺陷是与编程语法相关的错误。这些缺陷包括：

赋值与相等运算符
变量限定符或声明不匹配
格式错误的字符串

Polyspace 结果

影响程度大的缺陷

`断言`	Failed assertion statement
`字符值被吸收转化为 EOF`	数据类型转换使有效的字符值与文件结尾 (EOF) 相同。
`声明不匹配`	Mismatch between function or variable declarations
`errno 未重置`	`errno` not reset before calling a function that sets `errno`
`不正确的值转发`	Forwarded object might be modified unexpectedly
`无效的迭代器用法`	Mismatched or uninitialized iterators are used in standard algorithm functions and comparison operations (自 R2022a 起)
`无效的 == (相等)运算符使用`	Equality operation in assignment statement
`无效的标准库例程使用`	Wrong arguments to standard library function
`无效的 va_list 参量`	Variable argument list used after invalidation with `va_end` or not initialized with `va_start` or `va_copy`
`误用 errno`	`errno` incorrectly checked for error conditions
`误用窄字符串或宽字符串`	Narrow (wide) character string passed to wide (narrow) string function
`误用不可重入标准函数的返回值`	Pointer to static buffer from previous call is used despite a subsequent call that modifies the buffer
`不符合 AUTOSAR 规范`	An RTE API function is used with arguments that violate the AUTOSAR standard specification (自 R2021a 起)
`指向销毁的临时对象的指针或引用`	Destruction of temporary object results in dangling pointer or reference (自 R2023b 起)
`可能的 sizeof 误用`	Use of `sizeof` operator can cause unintended results
`运算符优先级规则导致可能的非预期表达式计算`	Operator precedence rules cause unexpected evaluation order in arithmetic expression
`用悬空指针初始化 std::string_view`	An `std::string_view` object is initialized by using an unnamed temporary object (自 R2022b 起)
`Typedef 不匹配`	Mismatch between `typedef` statements
`大小不为正数的可变长度数组`	Size of variable-length array is zero or negative
`写入 const 限定对象`	Object declared with a `const` qualifier is modified
`在 sizeof 中使用了错误的类型`	`sizeof` argument does not match pointed type

影响程度中等的缺陷

`退出处理程序异常终止`	Exit handler function interrupts the normal execution of a program
`错误的文件访问模式或状态`	Access mode argument of function in `fopen` or `open` group is invalid
`通过非原型函数指针进行调用`	Function pointer declared without its type or number of parameters causes unexpected behavior
`内存重叠的复制`	Source and destination arguments of a copy function have overlapping memory
`环境指针因前面的运算而失效`	Call to `setenv` or `putenv` family function modifies environment pointed to by pointer
`使用相等运算符进行浮点比较`	Imprecise comparison of floating-point variables
`从信号处理程序调用的函数不是异步安全的`	Call to interrupted function causes undefined program behavior
`从信号处理程序调用的函数不是异步安全的(严格 ISO C)`	Call to interrupted function causes undefined program behavior
`不正确的数组初始化`	Incorrect array initialization when using initializers
`不正确的 erase-remove 惯用法`	Container's `erase()` is not called or called improperly following a call to `std::remove()` (自 R2022a 起)
`传递给 va_arg 的数据类型不正确`	Data type of variadic function argument does not match type in `va_arg` call
`不正确的指针缩放`	Implicit scaling in pointer arithmetic might be ignored
`向 va_start 传递不正确的类型数据`	Data type of second argument to `va_start` macro leads to undefined behavior
`在 C++ 中不正确地使用 offsetof`	Incorrect arguments to `offsetof` macro causes undefined behavior
`不正确地使用 va_start`	`va_start` is called in a non-variadic function or called with a second argument that is not the rightmost parameter of a variadic function
`未遵守内联约束`	Non-`const` static variable is modified in nonstatic inline function
`无效的内存组织假设`	Address is computed by adding or subtracting from address of a variable
`无效的文件位置`	`fsetpos()` is invoked with a file position argument not obtained from `fgetpos()`
`无效的 = 运算符使用`	Assignment in conditional statement
`比较填充数据内存`	`memcmp` compares data stored in structure padding
`比较字符串内存`	`memcmp` compares data stored in strings after the null terminator
`传输数据时未对字节重新排序`	Different endianness of host and network
`在信号处理程序中误用 errno`	You read `errno` after calling an `errno`-setting function in a signal handler
`在信号处理程序内访问共享数据`	Access or modification of shared data causes inconsistent state
`不安全的宏中带副作用的参量`	Macro contains arguments that can be evaluated multiple times or not evaluated
`从信号处理程序内部调用 signal`	Nonpersistent signal handler calling `signal()` in Windows system causes race condition
`用不正确的参量调用标准函数`	Argument to a standard function does not meet requirements for use in the function
`va_arg 调用次数相对当前参量列表太多`	Number of calls to `va_arg` exceeds number of arguments passed to variadic function
`va_arg 调用次数相对当前参量列表太多`	Number of calls to `va_arg` exceeds number of arguments passed to variadic function
`头文件中未命名的命名空间`	Header file contains unnamed namespace leading to multiple definitions
`指针和整数之间的不安全转换`	Misaligned or invalid results from conversions between pointer and integer types
`使用大小参量为零的 memset`	Size argument of function in `memset` family is zero
`使用不确定字符串`	Use of unvalidated buffer from fgets-family function
`移动后读取变量`	A variable in a moved-from state is used in an operation that has preconditions (自 R2025a 起)

影响程度小的缺陷

`访问具有临时存在时间的对象`	Read or write operations on the object are undefined behavior
`从文件流中交替执行输入和输出运算间未执行刷新和定位调用`	Undefined behavior for input or output stream operations
`使用非预期值调用 memset`	`memset` or `wmemset` used with possibly incorrect arguments
`格式字符串设定符和参量不匹配`	Format specifiers in `printf`-like functions do not match corresponding arguments
`比较浮点值内存`	Object representation of floating-point values can be different (same) for equal (not equal) floating-point values
`字符串数组中缺失 null`	String does not terminate with null character
`误用 FILE 对象`	Use of copy of FILE object
`误用符号扩展字符值`	Data type conversion with sign extension causes unexpected behavior
`误用具有灵活数组成员的结构体`	Memory allocation ignores flexible array member
`修改了从不可重入标准函数返回的内部缓冲区`	Function attempts to modify internal buffer returned from a nonreentrant standard function
`重叠赋值`	Memory overlap between left and right sides of an assignment
`可能发生复制粘贴错误`	A section of code is duplicated in other places with exactly one minor change (自 R2023a 起)
`预定义宏用作对象`	You use standard library macros such as `assert` and `errno` as objects
`在宏参量中使用预处理器指令`	You use a preprocessor directive in the argument to a function-like macro
`在转换中删除限定符`	Variable qualifier is lost during conversion
`将 string::c_str() 结果与另一个指针做比较`	The C string obtained from `std::string::c_str()` is compared to a pointer (or NULL) (自 R2021b 起)
`从计算异常信号处理程序返回结果`	Undefined behavior when signal handler returns normally from program error
`表达式的副作用被忽略`	`sizeof`, `_Alignof`, or `_Generic` operates on expression with side effect
`可能带非预期副作用的流参量`	Stream argument side effects occur more than once
`通过标记串联创建通用字符名称`	You create a universal character name by joining tokens with `##` operator
`从字符串到数值的不安全转换`	String to number conversion without validation checks

主题

Bug Finder 缺陷组
Bug Finder 的缺陷检查项分为数据流、并发、数值等分组。