# CodeSonar

> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/CodeSonar
> Markdown URL: https://mediated.wiki/source/CodeSonar.md
> Source: https://en.wikipedia.org/wiki/CodeSonar
> Source revision: 1356057172
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)

**CodeSonar** is a [static code analysis](/source/Static_code_analysis) tool from AdaCore, formerly by CodeSecure and [GrammaTech](/source/GrammaTech). CodeSonar is used to find and fix [bugs](/source/Software_bug) and [security vulnerabilities](/source/Security_vulnerabilities)[1] in source and binary code.[2][3][4] It performs whole-program, inter-procedural analysis with [abstract interpretation](/source/Abstract_interpretation) on [C](/source/C_(programming_language)), [C++](/source/C%2B%2B), [C#](/source/C_Sharp_(programming_language)), [Java](/source/Java_(programming_language)), as well as [x86](/source/X86) and [ARM](/source/ARM_architecture) binary executables and libraries. CodeSonar is typically used by teams developing or assessing software to track their quality or security weaknesses. CodeSonar supports [Linux](/source/Linux), [BSD](/source/BSD), [FreeBSD](/source/FreeBSD), [NetBSD](/source/NetBSD), [MacOS](/source/MacOS) and [Windows](/source/Microsoft_Windows) hosts and embedded operating systems and compilers.

CodeSonar provides information for every weakness found, including the trace through the source code that would trigger the bug as well as a call-tree visualization that represents how the weakness is related to the wider application.

## Functional safety compliance

CodeSonar supports compliance with functional safety standards like [IEC 61508](/source/IEC_61508), [ISO 26262](/source/ISO_26262), [DO-178B/C](/source/DO-178C), or ISO/IEC TS 17961. CodeSonar's warning classes also support several coding standard initiatives,[5] including MITRE's [CWE](/source/Common_Weakness_Enumeration), JPL, Power of 10, [MISRA C/C++](/source/MISRA_C) and [SEI CERT C](/source/SEI_CERT_C).

## Applications

CodeSonar is used in the defense/aerospace, medical, industrial control, automotive, electronic, tele/datacommunications and transportation industries. Some well known use cases are [FDA Center for Devices and Radiological Health](/source/Center_for_devices_and_radiological_health) uses it to detect defects in fielded medical devices.[6][7] The [NHTSA](/source/NHTSA) and NASA used CodeSonar to study on [sudden unintended acceleration](/source/Sudden_unintended_acceleration) in the electronic throttle control systems of Toyota vehicles[8][9]

## Supported programming languages, host platforms and compilers

**Supported Programming Languages**: C, C++, C#, Java, [Python](/source/Python_(programming_language)), binary code analysis supports Intel [x86-32](/source/IA-32), [amd64](/source/X86-64) and [ARM](/source/ARM_architecture).

**Supported Platforms**: Microsoft Windows, Linux, FreeBSD, NetBSD, MacOS

**Supported Compilers**: [Apple Xcode](/source/Apple_Xcode), ARM RealView, [CodeWarrior](/source/CodeWarrior), [GNU C/C++](/source/GNU_Compiler_Collection), Green Hills Compiler, HI-TECH Compiler, IAR Compiler, [Intel C++ Compiler](/source/Intel_C%2B%2B_Compiler), [Microsoft Visual Studio](/source/Microsoft_Visual_Studio), Renesas Compiler, Sun C/C++, Texas Instruments CodeComposer, Wind River Compiler

## See also

- [List of tools for static code analysis](/source/List_of_tools_for_static_code_analysis)

## References

1. Vitek, D. (2016). "Auditing Code for Security Vulnerabilities with CodeSonar". *2016 IEEE Cybersecurity Development (SecDev)*. p. 154. [doi:10.1109/SecDev.2016.042](https://doi.org/10.1109/SecDev.2016.042). ISBN 978-1-5090-5589-0. [S2CID 33024752](https://api.semanticscholar.org/CorpusID:33024752)

1. Balakrishnan, Gogul; Gruian, Radu; Reps, Thomas; Teitelbaum, Tim (2005). "CodeSurfer/X86—A Platform for Analyzing x86 Executables". *Compiler Construction*. Vol. 3443. Lecture Notes in Computer Science. Springer. pp. 250–254. [doi:10.1007/978-3-540-31985-6_19](https://doi.org/10.1007/978-3-540-31985-6_19). ISBN 978-3-540-31985-6.

1. Gopan, Denis; Driscoll, Evan; Nguyen, Ducson; Naydich, Dimitri; Loginov, Alexey; Melski, David (2015). ["Data-delineation in Software Binaries and Its Application to Buffer-overrun Discovery"](http://dl.acm.org/citation.cfm?id=2818754.2818775). *Proceedings of the 37th International Conference on Software Engineering - Volume 1*. ICSE '15. Florence, Italy: IEEE Press. ISBN 978-1-4799-1934-5.

1. Lim, J. & Reps, T. (April 2008). [*A system for generating static analyzers for machine instructions*](http://www.cs.wisc.edu/wpis/papers/cc08.pdf). Proc. Int. Conf. on Compiler Construction. New York: Springer-Verlag.

1. Anderson, P. (2008). *Coding standards for high-confidence embedded systems*. MILCOM 2008 - IEEE Military Communications Conference. pp. 1–7. [doi:10.1109/MILCOM.2008.4753206](https://doi.org/10.1109/MILCOM.2008.4753206)

1. Quinnell, Richard A. (2008-03-06). ["Static analysis stomps on bugs"](http://www.eetimes.com/news/design/showArticle.jhtml?articleID=206902140). EETimes. Retrieved 2009-09-11.

1. Jetley, Raoul Praful; Jones, Paul L.; Anderson, Paul (2008). "Static analysis of medical device software using CodeSonar". *Proceedings of the 2008 workshop on Static analysis*. Tucson, Arizona: ACM. pp. 22–29. [doi:10.1145/1394504.1394507](https://doi.org/10.1145/1394504.1394507). ISBN 978-1-59593-924-1. [S2CID 18152934](https://api.semanticscholar.org/CorpusID:18152934)

1. Koopman, P. (2014-09-18). ["A Case Study of Toyota Unintended Acceleration and Software Safety"](http://course.ece.cmu.edu/~ece348/lectures/14_safety_case_study_handouts.pdf). Carnegie Mellon University. Retrieved 2019-09-12.

1. Barr, Michael (2011-03-01). ["Unintended Acceleration and Other Embedded Software Bugs"](https://embeddedgurus.com/barr-code/2011/03/unintended-acceleration-and-other-embedded-software-bugs/). Embedded Gurus. Retrieved 2019-09-11.

## External links

- [CodeSonar by AdaCore product page](https://www.adacore.com/codesonar)

---
Adapted from the Wikipedia article [CodeSonar](https://en.wikipedia.org/wiki/CodeSonar) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/CodeSonar?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.