Using Static Security Analysis

There are two distinct steps involved in using static security analysis:


  1. Modify your build process to create a new build configuration for static security analysis.

    A build configuration specifies compiler options and directs the object module output to a separate directory. Projects typically use a separate build configuration for release and debug builds. When you modify your build process to create a new build configuration for static security analysis, you simplify any future updating of your build process. For instance, if you need to add or delete a source file in your project or change a compiler option, you can simply make the corresponding changes in the list of project files or common options and the static security analysis build configurations will adjust accordingly.

    Note iconNote

    If it is difficult to modify your build process to create a new build configuration, you can perform static security analysis by creating a build specification . See Creating and Using Build Specification Files for more information.

  2. Specify the desired static security analysis options in the new build configuration.

The remainder of this topic describes how to perform these steps either from your IDE or from the command line.

Using Static Security Analysis from within your IDE

Follow these steps to create a new build configuration and specify static security analysis options from your IDE.

Note iconNote

If your program uses OpenMP*, be sure to enable OpenMP by supplying the /Qopenmp option in the Languages property page.

In the Eclipse* IDE:


  1. Open the property pages for the project and select C/C++ Build .

  2. Click the Manage… button.

  3. In the Manage dialog box, click the New… button to open the Create configuration dialog box.

  4. Supply a name for the new configuration in the Name box; for example, Static Security Analysis.

  5. Supply a Description for the configuration if you want (optional).

  6. Choose Copy settings from an existing configuration and click the appropriate radio button to select the Debug configuration from the corresponding drop down menu.

  7. Click OK to close the Create configuration dialog box.

  8. Click OK to close the Manage dialog box (with your new configuration name selected).

  9. Navigate to the Intel compiler's Compilation Diagnostics properties.

  10. Use the Level of Static Security Analysis and Analyze Include Files properties to enable static security analysis.

Using Static Security Analysis from the Command Line

If you are building from the command line, you need to create a new build configuration or target distinct from your existing build configuration or target. Once you do this, you can specify certain command line options to enable static security analysis. You must supply the options that request static security analysis on each compilation and link step. The following table summarizes the static security analysis options.

Option (Windows* and Linux* OS syntax)

Result

/Qdiag-enable:sc{[1|2|3]}

-diag-enable sc{[1|2|3]}

Enables static security analysis. The number specifies the severity level of diagnostics reported (1=only critical errors, 2=all errors, and 3=all errors and warnings)

/Qdiag-disable:sc

-diag-disable sc

Disables static security analysis

/Qdiag-enable:sc-include

-diag-enable sc-include

Analyzes include files as well as source files. By default apparent errors in include files are not reported.

/Qdiag-sc-dir:dir

-diag-sc-dir dir

Directs diagnostic results to the given directory. If this option is not specified, or if the option is specified without indicating a directory, results are directed to the current working directory. Each run creates results in a new subdirectory whose name has the form "r@@@sc", where "@@@" is replaced the next available sequence number (001, 002, ...).

This option requires that you also specify the compiler option to enable static security analysis.

/Qdiag-file[:filename]

-diag-file [=filename]

Directs diagnostic results to the given filename. If a file name is not specified, the diagnostics are sent to name-of-the-first-source-file.diag.

/Qdiag-file-append:[filename]

-diag-file-append [=filename]

Appends diagnostic results to file. If a file name is not specified, the current working directory is searched for a file with a .diag suffix. If no file is found, the results are sent to name-of-the-first-source-file.diag. If the target file does not exist, it is created.

To request analysis using static security analysis, specify the /Qdiag-enable:sc{[1|2|3]} (Windows* OS) or -diag-enable sc{[1|2|3]} (Linux* OS) option.

Note iconNote

Even if your project must build on the command line, it is still possible to integrate your project into Visual Studio. To do this, create a Visual Studio "makefile project," in which case, Visual Studio will build the project by invoking a command line of your choosing. If you plan to use a makefile project, you should add the /Qdiag-sc-dir:dir or -diag-sc-dir dir option on the link step to direct the output to the "My Inspector XE Results-<product name>" folder in the project root directory. This allows Intel® Inspector XE to find your results and display them in the Visual Studio Solution Explorer. If you do not want to use Visual Studio at all, you should use the stand-alone form of the Intel® Inspector XE GUI. If you do this, you can place your results wherever you like.

To report errors in include files, specify the /Qdiag-enable:sc-include (Windows* OS) or -diag-enable sc-include (Linux* OS) option. By default, errors in include files are not reported.

To enable OpenMP, specify the /Qopenmp (Windows* OS) or -openmp (Linux* OS) option. You must do this if your program uses OpenMP.


Submit feedback on this help topic

Copyright © 1996-2010, Intel Corporation. All rights reserved.