What's new in Klocwork 2019.1
Here are the highlights for Klocwork 2019.1. If you're upgrading, also see the Limitations for items that affect how you use Klocwork.
Improvements to security vulnerability detection
Our improved security checkers catch vulnerabilities related to the tracking of tainted data used in structures, after offsets, and when casting.
OWASP 2017 Top 10 Security Risks taxonomy
We've added a new Java taxonomy that covers the OWASP Top 10 Security Risks for 2017. For more information, see OWASP Top 10 Security Risks for 2017 mapped to Klocwork Java checkers.
Analysis engine enhancement
Our Linux platform now leverages 64-bit architecture to generate build specifications, allowing Klocwork to handle larger and more complex code bases and projects.
MISRA C 2012 new and improved
We've enhanced coverage for MISRA C 2012 by adding a checker to support Rule 18.1 and improved the checker that supports Rule 19.1.
Clearer build analysis reporting
We’ve made improvements to the way Klocwork reports a successful clean build by providing clearer information to users on the quality of analysis and if it requires review. We've also added a new option so that you can optimize and reduce the size of your build.log file.
Improved support for Microsoft Visual Studio
Our Visual Studio Extension now supports a broader range of Visual Studio 2017 update versions and includes general improvements to stability and performance.
Licensing
2018 licenses are not compatible with Klocwork 2019.1. You need a new license to use the latest version of the product. Contact license@roguewave.com to obtain a new license.
Improvements to supported compilers
We've improved support for the following compilers:
- ARM Optimizing C/C++ compiler (formerly TI tms470 C/C++ compiler)
- Clang
- GNU
- Green Hills
- Microsoft Visual C++
- Mono Headset SDK
- Nvidia CUDA
- Plan 9 C
- WinAVR
For the full list of supported C/C++ compilers, see C/C++ compilers supported for build integration.
Checker improvements
From release to release, we improve issue detection to bring state-of-the-art capabilities to our customers. As a result, expect your analysis results to change as accuracy and coverage improve.
New checkers
| Checker | Description |
|---|---|
| MISRA.PTR.ARITH.NOT_SAME.2012 | Implements MISRA C 2012 Rule 18.1: A pointer resulting from arithmetic on a pointer operand shall address an element of the same array as that pointer operand |
Modified checkers
| Checker | Description |
|---|---|
| MISRA.ASSIGN.OVERLAP | New defects detected. |
| RLK.SQLOBJ | Fewer false positives are expected. |
| SV.TAINTED.ALLOC_SIZE | New defects detected. |
| SV.TAINTED.BINOP | New defects detected. |
| SV.TAINTED.CALL.BINOP | New defects detected. |
| SV.TAINTED.CALL.DEREF | New defects detected. |
| SV.TAINTED.CALL.INDEX_ACCESS | New defects detected. |
| SV.TAINTED.CALL.LOOP_BOUND | New defects detected. |
| SV.TAINTED.DEREF | New defects detected. |
| SV.TAINTED.INDEX | New defects detected. |
| SV.TAINTED.INDEX_ACCESS | New defects detected. |
Enabled or disabled checkers
No changes were made to the default enabled field of the checker configuration files for this release.
Taxonomy improvements
As part of our installation, we offer several custom taxonomy files that map our checkers to standards such as MISRA, CWE, OWASP and DISA STIG.
| Taxonomy | Updates |
|---|---|
| misra_c_2012_c90.tconf and misra_c_2012_c90_ja.tconf |
We added references to the following checker: MISRA C 2012 Rule 18.1: A pointer resulting from arithmetic on a pointer operand shall address an element of the same array as that pointer operand
|
| misra_c_2012_c99.tconf and misra_c_2012_c99_ja.tconf |
We added references to the following checker: MISRA C 2012 Rule 18.1: A pointer resulting from arithmetic on a pointer operand shall address an element of the same array as that pointer operand
|
| misra_c_2012_with_amd1_c90.tconf and misra_c_2012_with_amd1_c90_ja.tconf |
We added references to the following checker: MISRA C 2012 Rule 18.1: A pointer resulting from arithmetic on a pointer operand shall address an element of the same array as that pointer operand
|
| misra_c_2012_with_amd1_c99.tconf and misra_c_2012_with_amd1_c99_ja.tconf |
We added references to the following checker: Implements MISRA C 2012 Rule 18.1: A pointer resulting from arithmetic on a pointer operand shall address an element of the same array as that pointer operand
|
| owasp_2017_10_java.tconf and owasp_2017_10_java_ja.tconf | These are new taxonomies that map Klocwork Java checkers to the OWASP 2017 Top 10 Security Risks. |
End of support announcement
Klocwork 2018.3 was the last supported release of the Klocwork Portal and License Server on the following platforms: AIX, Mac, and Solaris. Rogue Wave is also here to help! If you need help moving your Klocwork Portal or License Server to Linux or Windows, you can contact Rogue Wave Professional Services to discuss assistance via a services engagement.
Changes to system requirements
- Debian 9.x to 9.8
- Red Hat Enterprise Linux 7.6
- Ubuntu 16.04.5 LTS and 18.10
- Windows 10 1709 to 1809
- Windows Server 2019
- IBM AIX 7.2 TL1 to TL3
- Eclipse 3.4 to 4.11
- Microsoft Visual Studio 2017 up to version 15.9.9
- Android Studio 1.0 to 3.3 (3.3.1)
- JetBrains IntelliJ IDEA 11.x to 2018.x (2018.3.3)
- Jenkins 1.58 to 2.165
- TeamCity 9.1.3 to 2018.2.3
- Google Chrome 54.x to 72.x
- Mozilla Firefox 65.x.x.
- Microsoft Edge 44.x to 44.17763
- Microsoft Internet Explorer 11.0.x to 11.0.105
Changes to commands, tools, and options
In Klocwork Desktop, we modified the description of the check box that you can select if you want to leave Klocwork Desktop running in background when the window is closed.
We modified the kwbuildproject command. We added a --short-log option that produces a stripped down version of the build.log file.
We also modified the --strict option so that when --strict is specified, extra warning information will be printed to the parse_errors.log and build_integration.log files. If kwbuildproject skips one or more functions during analysis, additional information will be printed to the function_information.log file.
For more information about Klocwork commands, see Command Reference.