MATTOCCIA LABS / ENGINEERING EVIDENCE

Embedded Software
Analysis Engine.

Experimental local prototype · v0.1.0

Study context

Problem addressed
Can a small controlled example verify that known findings are reported?
Contribution relative to existing methods
Injected defects make the expected findings explicit and traceable to the underlying analyzers.
Potential commercial use
Use the fixture to check the reporting pipeline during onboarding.

Market context and value assumptions on the engine page

ESAE · DEMO

Experiment conclusions

The analyzers detected all four seeded defects in the controlled case: an out-of-bounds access, a null dereference, an uninitialized value and a memory leak.

Study limits. The test covers the prepared cases only. It does not quantify detection on other programs or verify races, worst-case timing or target hardware behavior.

Scan dd545378-9458-4fe4-b8e7-3f25e41188bc

2026-11-05T22:04:05.210230+00:00 · demo · completed

10 captured source files · 106 physical lines · 1.315 s

{
  "static_findings": 11,
  "heuristic_indicators": 11,
  "ai_explanations": 1,
  "static_by_severity": {
    "high": 3,
    "medium": 4,
    "low": 4,
    "info": 0
  },
  "total_findings": 22
}

Tool-reported diagnostics require engineering review. Heuristics are risk indicators. AI text is an unverified hypothesis. No source modification, hardware execution or certification.

Executed tools and configuration

{
  "configuration": {
    "excludes": [
      ".git",
      ".venv",
      "node_modules",
      "build",
      "dist",
      "vendor",
      "third_party",
      "external",
      "generated",
      ".local",
      ".toolchain"
    ],
    "per_process_timeout_seconds": 30,
    "clang_checks": "-*,clang-analyzer-*,bugprone-sizeof-expression,bugprone-infinite-loop,bugprone-suspicious-memset-usage,bugprone-narrowing-conversions,cert-err34-c,portability-*",
    "source_mode": "private_readonly_snapshot",
    "network": "denied_to_analyzers",
    "platform": "Darwin",
    "os_sandbox": true,
    "ai": "optional_explicit_local_only",
    "host_system_headers": true,
    "database_used": true,
    "accepted_translation_units": 6,
    "ignored_compilation_arguments": []
  },
  "executed": [
    {
      "tool": "cppcheck",
      "translation_units": 6,
      "returncode": 0,
      "duration_seconds": 0.109,
      "version": "Cppcheck 2.22.0"
    },
    {
      "tool": "clang-tidy",
      "file": "src/comm.c",
      "returncode": 0,
      "duration_seconds": 0.331,
      "version": "LLVM (http://llvm.org/):\n  LLVM version 23.1.4\n  Optimized build."
    },
    {
      "tool": "clang-tidy",
      "file": "src/data.c",
      "returncode": 0,
      "duration_seconds": 0.113,
      "version": "LLVM (http://llvm.org/):\n  LLVM version 23.1.4\n  Optimized build."
    },
    {
      "tool": "clang-tidy",
      "file": "src/diagnostics.c",
      "returncode": 0,
      "duration_seconds": 0.112,
      "version": "LLVM (http://llvm.org/):\n  LLVM version 23.1.4\n  Optimized build."
    },
    {
      "tool": "clang-tidy",
      "file": "src/main.c",
      "returncode": 0,
      "duration_seconds": 0.112,
      "version": "LLVM (http://llvm.org/):\n  LLVM version 23.1.4\n  Optimized build."
    },
    {
      "tool": "clang-tidy",
      "file": "src/sensor.c",
      "returncode": 0,
      "duration_seconds": 0.113,
      "version": "LLVM (http://llvm.org/):\n  LLVM version 23.1.4\n  Optimized build."
    },
    {
      "tool": "clang-tidy",
      "file": "src/resource.cpp",
      "returncode": 0,
      "duration_seconds": 0.382,
      "version": "LLVM (http://llvm.org/):\n  LLVM version 23.1.4\n  Optimized build."
    }
  ]
}

Analysis errors and coverage limitations

Findings

heuristic_indicator / medium

include/sensor.h:5

Arithmetic assigned to a narrow integer: range/conversion risk candidate, not a proven overflow.

esae-heuristics · embedded.narrow-integer-arithmetic · requires_engineering_review

Evidence / all tool reports
[
  {
    "tool": "esae-heuristics",
    "rule_id": "embedded.narrow-integer-arithmetic",
    "message": "Arithmetic assigned to a narrow integer: range/conversion risk candidate, not a proven overflow.",
    "severity": "medium",
    "evidence": {
      "expression": "uint16_t sensor_average(const uint16_t *values, unsigned count);"
    }
  }
]

static_analysis / low

src/data.c:4

Variable 'values' can be declared as const array

cppcheck · constVariable · reported_by_tool_not_manually_verified

Evidence / all tool reports
[
  {
    "tool": "cppcheck",
    "rule_id": "constVariable",
    "message": "Variable 'values' can be declared as const array",
    "severity": "low",
    "evidence": {
      "analyzer_severity": "style",
      "inconclusive": false,
      "trace": [
        {
          "file": "src/data.c",
          "line": 4,
          "info": "Variable 'values' can be declared as const array"
        }
      ]
    }
  }
]

static_analysis / medium

src/data.c:5

Out of bound access to memory after the end of 'values'

clang-tidy · clang-analyzer-security.ArrayBound · reported_by_tool_not_manually_verified

Evidence / all tool reports
[
  {
    "tool": "clang-tidy",
    "rule_id": "clang-analyzer-security.ArrayBound",
    "message": "Out of bound access to memory after the end of 'values'",
    "severity": "medium",
    "evidence": {
      "analyzer_level": "Warning",
      "notes": [
        {
          "file": "src/data.c",
          "message": "Access of 'values' at index 4, while it holds only 4 'int' elements"
        }
      ],
      "suggested_replacements_not_applied": 0
    }
  }
]

static_analysis / high

src/data.c:5

Array 'values[4]' accessed at index 4, which is out of bounds.

cppcheck · arrayIndexOutOfBounds · reported_by_tool_not_manually_verified

Evidence / all tool reports
[
  {
    "tool": "cppcheck",
    "rule_id": "arrayIndexOutOfBounds",
    "message": "Array 'values[4]' accessed at index 4, which is out of bounds.",
    "severity": "high",
    "evidence": {
      "analyzer_severity": "error",
      "inconclusive": false,
      "trace": [
        {
          "file": "src/data.c",
          "line": 5,
          "info": "Array index out of bounds"
        }
      ]
    }
  }
]

static_analysis / low

src/data.c:8

Variable 'value' can be declared as pointer to const

cppcheck · constVariablePointer · reported_by_tool_not_manually_verified

Evidence / all tool reports
[
  {
    "tool": "cppcheck",
    "rule_id": "constVariablePointer",
    "message": "Variable 'value' can be declared as pointer to const",
    "severity": "low",
    "evidence": {
      "analyzer_severity": "style",
      "inconclusive": false,
      "trace": [
        {
          "file": "src/data.c",
          "line": 8,
          "info": "Variable 'value' can be declared as pointer to const"
        }
      ]
    }
  }
]

static_analysis / medium

src/data.c:9

Dereference of null pointer (loaded from variable 'value')

clang-tidy · clang-analyzer-core.NullDereference · reported_by_tool_not_manually_verified

Evidence / all tool reports
[
  {
    "tool": "clang-tidy",
    "rule_id": "clang-analyzer-core.NullDereference",
    "message": "Dereference of null pointer (loaded from variable 'value')",
    "severity": "medium",
    "evidence": {
      "analyzer_level": "Warning",
      "notes": [
        {
          "file": "src/data.c",
          "message": "'value' initialized to a null pointer value"
        },
        {
          "file": "src/data.c",
          "message": "Dereference of null pointer (loaded from variable 'value')"
        }
      ],
      "suggested_replacements_not_applied": 0
    }
  }
]

static_analysis / high

src/data.c:9

Null pointer dereference: value

cppcheck · nullPointer · reported_by_tool_not_manually_verified

Evidence / all tool reports
[
  {
    "tool": "cppcheck",
    "rule_id": "nullPointer",
    "message": "Null pointer dereference: value",
    "severity": "high",
    "evidence": {
      "analyzer_severity": "error",
      "inconclusive": false,
      "trace": [
        {
          "file": "src/data.c",
          "line": 9,
          "info": "Null pointer dereference"
        },
        {
          "file": "src/data.c",
          "line": 8,
          "info": "Assignment 'value=0', assigned value is 0"
        }
      ]
    }
  }
]

heuristic_indicator / medium

src/data.c:12

Dynamic allocation via malloc; review failure handling, lifetime and determinism.

esae-heuristics · embedded.dynamic-allocation · requires_engineering_review

Evidence / all tool reports
[
  {
    "tool": "esae-heuristics",
    "rule_id": "embedded.dynamic-allocation",
    "message": "Dynamic allocation via malloc; review failure handling, lifetime and determinism.",
    "severity": "medium",
    "evidence": {
      "function": "data_leak",
      "call": "malloc"
    }
  }
]

static_analysis / high

src/data.c:15

Memory leak: buffer

cppcheck · memleak · reported_by_tool_not_manually_verified

Evidence / all tool reports
[
  {
    "tool": "cppcheck",
    "rule_id": "memleak",
    "message": "Memory leak: buffer",
    "severity": "high",
    "evidence": {
      "analyzer_severity": "error",
      "inconclusive": false,
      "trace": [
        {
          "file": "src/data.c",
          "line": 15,
          "info": ""
        }
      ]
    }
  },
  {
    "tool": "clang-tidy",
    "rule_id": "clang-analyzer-unix.Malloc",
    "message": "Potential leak of memory pointed to by 'buffer'",
    "severity": "medium",
    "evidence": {
      "analyzer_level": "Warning",
      "notes": [
        {
          "file": "src/data.c",
          "message": "Memory is allocated"
        },
        {
          "file": "src/data.c",
          "message": "Assuming 'buffer' is not equal to null"
        },
        {
          "file": "src/data.c",
          "message": "'buffer' is not equal to null"
        },
        {
          "file": "src/data.c",
          "message": "Taking true branch"
        },
        {
          "file": "src/data.c",
          "message": "Potential leak of memory pointed to by 'buffer'"
        }
      ],
      "suggested_replacements_not_applied": 0
    }
  }
]

heuristic_indicator / medium

src/diagnostics.c:5

Global volatile object may be shared with interrupts/tasks. Volatile does not prove synchronization or a race.

esae-heuristics · embedded.shared-volatile-candidate · requires_engineering_review

Evidence / all tool reports
[
  {
    "tool": "esae-heuristics",
    "rule_id": "embedded.shared-volatile-candidate",
    "message": "Global volatile object may be shared with interrupts/tasks. Volatile does not prove synchronization or a race.",
    "severity": "medium",
    "evidence": {
      "symbol": "shared_samples",
      "scope": "lexically global",
      "race_condition_verified": false
    }
  }
]

heuristic_indicator / medium

src/diagnostics.c:6

File-local call-name cycle involving diagnostics_retry; review stack depth and termination.

esae-heuristics · embedded.recursion-candidate · requires_engineering_review

Evidence / all tool reports
[
  {
    "tool": "esae-heuristics",
    "rule_id": "embedded.recursion-candidate",
    "message": "File-local call-name cycle involving diagnostics_retry; review stack depth and termination.",
    "severity": "medium",
    "evidence": {
      "function": "diagnostics_retry",
      "resolution": "lexical names, not AST; macros/overloads can invalidate inference"
    }
  }
]

heuristic_indicator / medium

src/diagnostics.c:11

Dynamic allocation via malloc; review failure handling, lifetime and determinism.

esae-heuristics · embedded.dynamic-allocation · requires_engineering_review

Evidence / all tool reports
[
  {
    "tool": "esae-heuristics",
    "rule_id": "embedded.dynamic-allocation",
    "message": "Dynamic allocation via malloc; review failure handling, lifetime and determinism.",
    "severity": "medium",
    "evidence": {
      "function": "Sensor_IRQHandler",
      "call": "malloc"
    }
  }
]

heuristic_indicator / high

src/diagnostics.c:11

malloc in ISR-named function Sensor_IRQHandler; confirm ISR role and target constraints.

esae-heuristics · embedded.isr-suspicious-call · requires_engineering_review

Evidence / all tool reports
[
  {
    "tool": "esae-heuristics",
    "rule_id": "embedded.isr-suspicious-call",
    "message": "malloc in ISR-named function Sensor_IRQHandler; confirm ISR role and target constraints.",
    "severity": "high",
    "evidence": {
      "function": "Sensor_IRQHandler",
      "call": "malloc",
      "isr_evidence": "function naming convention only"
    }
  }
]

static_analysis / low

src/diagnostics.c:11

Variable 'scratch' is allocated memory that is never used.

cppcheck · unusedAllocatedMemory · reported_by_tool_not_manually_verified

Evidence / all tool reports
[
  {
    "tool": "cppcheck",
    "rule_id": "unusedAllocatedMemory",
    "message": "Variable 'scratch' is allocated memory that is never used.",
    "severity": "low",
    "evidence": {
      "analyzer_severity": "style",
      "inconclusive": false,
      "trace": [
        {
          "file": "src/diagnostics.c",
          "line": 11,
          "info": ""
        }
      ]
    }
  }
]

heuristic_indicator / high

src/diagnostics.c:12

usleep in ISR-named function Sensor_IRQHandler; confirm ISR role and target constraints.

esae-heuristics · embedded.isr-suspicious-call · requires_engineering_review

Evidence / all tool reports
[
  {
    "tool": "esae-heuristics",
    "rule_id": "embedded.isr-suspicious-call",
    "message": "usleep in ISR-named function Sensor_IRQHandler; confirm ISR role and target constraints.",
    "severity": "high",
    "evidence": {
      "function": "Sensor_IRQHandler",
      "call": "usleep",
      "isr_evidence": "function naming convention only"
    }
  }
]

heuristic_indicator / medium

src/diagnostics.c:12

usleep may block; timing depends on platform and arguments.

esae-heuristics · embedded.possibly-blocking-call · requires_engineering_review

Evidence / all tool reports
[
  {
    "tool": "esae-heuristics",
    "rule_id": "embedded.possibly-blocking-call",
    "message": "usleep may block; timing depends on platform and arguments.",
    "severity": "medium",
    "evidence": {
      "function": "Sensor_IRQHandler",
      "call": "usleep"
    }
  }
]

heuristic_indicator / high

src/diagnostics.c:14

free in ISR-named function Sensor_IRQHandler; confirm ISR role and target constraints.

esae-heuristics · embedded.isr-suspicious-call · requires_engineering_review

Evidence / all tool reports
[
  {
    "tool": "esae-heuristics",
    "rule_id": "embedded.isr-suspicious-call",
    "message": "free in ISR-named function Sensor_IRQHandler; confirm ISR role and target constraints.",
    "severity": "high",
    "evidence": {
      "function": "Sensor_IRQHandler",
      "call": "free",
      "isr_evidence": "function naming convention only"
    }
  }
]

heuristic_indicator / medium

src/diagnostics.c:20

Arithmetic assigned to a narrow integer: range/conversion risk candidate, not a proven overflow.

esae-heuristics · embedded.narrow-integer-arithmetic · requires_engineering_review

Evidence / all tool reports
[
  {
    "tool": "esae-heuristics",
    "rule_id": "embedded.narrow-integer-arithmetic",
    "message": "Arithmetic assigned to a narrow integer: range/conversion risk candidate, not a proven overflow.",
    "severity": "medium",
    "evidence": {
      "expression": "uint8_t result = a + b;"
    }
  }
]

static_analysis / low

src/main.c:6

Variable 'samples' can be declared as const array

cppcheck · constVariable · reported_by_tool_not_manually_verified

Evidence / all tool reports
[
  {
    "tool": "cppcheck",
    "rule_id": "constVariable",
    "message": "Variable 'samples' can be declared as const array",
    "severity": "low",
    "evidence": {
      "analyzer_severity": "style",
      "inconclusive": false,
      "trace": [
        {
          "file": "src/main.c",
          "line": 6,
          "info": "Variable 'samples' can be declared as const array"
        }
      ]
    }
  }
]

heuristic_indicator / medium

src/sensor.c:3

Arithmetic assigned to a narrow integer: range/conversion risk candidate, not a proven overflow.

esae-heuristics · embedded.narrow-integer-arithmetic · requires_engineering_review

Evidence / all tool reports
[
  {
    "tool": "esae-heuristics",
    "rule_id": "embedded.narrow-integer-arithmetic",
    "message": "Arithmetic assigned to a narrow integer: range/conversion risk candidate, not a proven overflow.",
    "severity": "medium",
    "evidence": {
      "expression": "uint16_t)(100U + (channel % 4U) * 10U);"
    }
  }
]

static_analysis / medium

src/sensor.c:14

Undefined or garbage value returned to caller

clang-tidy · clang-analyzer-core.uninitialized.UndefReturn · reported_by_tool_not_manually_verified

Evidence / all tool reports
[
  {
    "tool": "clang-tidy",
    "rule_id": "clang-analyzer-core.uninitialized.UndefReturn",
    "message": "Undefined or garbage value returned to caller",
    "severity": "medium",
    "evidence": {
      "analyzer_level": "Warning",
      "notes": [
        {
          "file": "src/sensor.c",
          "message": "'sample' declared without an initial value"
        },
        {
          "file": "src/sensor.c",
          "message": "Assuming 'ready' is 0"
        },
        {
          "file": "src/sensor.c",
          "message": "Taking false branch"
        },
        {
          "file": "src/sensor.c",
          "message": "Undefined or garbage value returned to caller"
        }
      ],
      "suggested_replacements_not_applied": 0
    }
  }
]

static_analysis / medium

src/sensor.c:14

Uninitialized variable: sample

cppcheck · uninitvar · reported_by_tool_not_manually_verified

Evidence / all tool reports
[
  {
    "tool": "cppcheck",
    "rule_id": "uninitvar",
    "message": "Uninitialized variable: sample",
    "severity": "medium",
    "evidence": {
      "analyzer_severity": "warning",
      "inconclusive": false,
      "trace": [
        {
          "file": "src/sensor.c",
          "line": 14,
          "info": ""
        },
        {
          "file": "src/sensor.c",
          "line": 13,
          "info": "Assuming condition is false"
        }
      ]
    }
  }
]

Not verified