軟件檢測之缺陷模式庫

       此文內容是以LIST的形式，列出與軟件缺陷相關特徵及其描述。對不同類型的錯誤有較大粒度的分類，在每一個分類下有若干具體的錯誤形式的描述，這些描述包括但不限於：錯誤名稱(NAME)、錯誤描述(DESCRIPTION)、示例錯誤代碼(SAMPLE)、可能還會提供可行修改方案(PATCH，說可能是因爲如果我太懶就不想寫了)。

      *程序語法錯不在此列，因其與程序員編程能力、具體語言特徵以及編譯器所能支持的程序特性相關。

      *此LIST會持續不定期更新。

====================================

CATEGORY 1：subtle semantic errors(most of these are runtime errors)

[1] :

NAME: branches errors 

DESCRIPTION: redundant program ingredient after branches    

SAMPLE:  

if( ... );
  return;

PATCH: delete redundant program ingredient

[2]

NAME: undefined symbol

DESCRIPTION: binary can not find and correctly link to the specified symbol.

SAMPLE: Most of these errors are caused by you reference a symbol from a lib, but not correctly specify the path of the lib(either static lib or dynamic lib)

                 The other situation included but not limit to that such as you declared an "inline" function in a class while define it in the source file.

CATEGORY 2: general semantic errors

[1]

NAME: memory leak

DESCRIPTION: malloc new memory from heap and forget to release it; or does not release it in all control flow pathes.

SAMPLE:

pt=new xxx;
...... // no delete

PATCH: release related memory in all related control flow path

CATEGORY 3: concurrency bugs

[1]

NAME: data race

DESCRIPTION: two threads modify the same shared memory without synchronization, at least one of them are write operation

SAMPLE:

int glo;

thread 1
glo=1;

thread 2:
local=glo;

PATCH: add suitable synchronization between related threads.

TO BE CONTINUED ...