6/25
bugs detected outright
MISRA C++ 2023 + FA Aggressive
MISRA C++ 2023 + FA Aggressive
▲ 4 more than Recommended Rules
3
flagged: right line, right hazard family
(cases 16, 20, 22)
(cases 16, 20, 22)
indirect but purposeful rules
12/25
fully invisible
no finding anywhere on the bug
no finding anywhere on the bug
▼ needs sanitizers / other tools
177
findings in the combined config
13 land on bug lines
13 land on bug lines
39 in Recommended Rules
Configuration comparison best-of per config
| Configuration | Findings | On bug line | Detected | Flagged | Incidental |
|---|---|---|---|---|---|
| Recommended Rules | 39 | 2 / 25 | 2 | — | — |
| Flow Analysis Standard | 8 | 5 / 25 | 4 | 1 | — |
| Flow Analysis Aggressive | 8 | 5 / 25 | 4 | 1 | — |
| MISRA C++ 2023 + Flow Analysis Aggressive (custom merged) | 177 | 13 / 25 | 6 | 3 | 3 |
Flow Analysis Aggressive alone added nothing over Standard on these 25 files. Merging a coding standard with aggressive flow analysis more than doubles real coverage: 9 of 25 bugs get a purposeful finding (6 detected + 3 flagged) versus 5 with flow analysis alone and 2 with Recommended Rules.
Verdict split 25 cases
Detected outright6 · 24%
Flagged (right line, right hazard family)3 · 12%
Incidental style hit on the bug line3 · 12%
Case is a puzzle, not a bug1 · 4%
Fully invisible12 · 48%
MISRA C++ 2023 + Flow Analysis Aggressive, line-level scoring against
cases.json ground truth.The 13 findings that land on a bug line MISRA C++ 2023 + Flow Analysis Aggressive
| Case | Line | Rule | Severity | Tier | Message |
|---|---|---|---|---|---|
| 11 Greetings From Who? | 13 | BD-CO-STRMOD | Sev 1 | detected | The invalidated "ptr" pointer to the "text" container is used |
| 12 Think You're a Bit Wise? | 13 | BD-PB-VALRANGE | Sev 4 | detected | The "this->ages" variable may be accessed out of bounds at index "person", which may be greater or equal to the container size |
| 12 | 13 | MISRACPP2023-7_0_4-a | Sev 2 | detected | The LHS/RHS operand of bitwise operator '&=' should be unsigned (bitwise AND on a bool, the exact construct) |
| 13 An Offer You Can't Refuse | 12 | MISRACPP2023-8_0_1-b | Sev 4 | detected | The condition of the '?:' operator should be in parentheses, plus BD-PB-CC and 0_0_2-a: condition "price + (int)isMember" always evaluates to true |
| 15 Works In Production | 15 | BD-PB-VCTOR MISRACPP2023-15_1_1-a | Sev 2 | detected | Virtual method "getSpecialty" called on the "CppDoctor" object ("specialist") which is under construction |
| 19 A Wrong Move | 22 | MISRACPP2023-4_6_1-b | Sev 2 | detected | The code depends on the order of evaluation of 'getBody' function arguments — the exact use-after-move bug; clang-tidy is the only other tool that catches it |
| 24 No Strings Attached | 34 | MISRACPP2023-7_0_2-a | Sev 2 | detected | Do not convert type 'const char [4]' to type 'bool' — the exact overload-resolution bug (plus 8_2_7-c / 8_2_8-b) |
| 16 Have You Tried Upgrading? | 23 | MISRACPP2023-9_5_2-a | Sev 2 | flagged | The for-range-initializer contains 2 function calls — a rule built precisely for the range-for temporary trap |
| 20 Is Anybody Playing? | 11 | MISRACPP2023-7_0_3-a | Sev 2 | flagged | The numerical value of a character shall not be used — fires on the char-promotion comparison the bug needs |
| 22 Running in Circles | 29 | MISRACPP2023-0_3_1-d BD-PB-ZERO | Sev 4 Sev 1 | flagged | Infinity or NaN may be returned as a result of division by zero constant, plus 0_3_1-b on the float '!=' — the NaN entrance is flagged; the mutual recursion is not |
| 18 A Short Stack | 23 | MISRACPP2023-6_9_2-a | Sev 4 | incidental | Do not use the 'int' standard integer type — on the line, wrong reason |
| 21 What Comes First? | 16 | MISRACPP2023-9_3_1-b | Sev 2 | incidental | 'if' should be followed by a block — style, coincidental |
| 25 The Uninvited Temporary | 28 | MISRACPP2023-8_1_2-a | Sev 4 | incidental | Implicitly captured variables in a non-transient lambda — style, coincidental |
| 6 255 + 1 | 10 | MISRACPP2023-7_0_5-a | Sev 2 | no bug | Integral promotion shall not change signedness 'uint8_t' to 'int' — flags the puzzle construct; case 6 is not a defect |
Severity is the Parasoft severity level C++test reports per finding (1 = highest, 4 = lowest), taken from the
sev attribute of each violation in report.xml. Every rule pill links to the Parasoft documentation search for that rule ID: docs.parasoft.com does not host per-rule pages for C++test, the full rule documentation ships inside the product (Help → rule docs, or manuals/cpptest_rules.pdf). Hover a rule pill for its official title.Per-case verdicts MISRA C++ 2023 + Flow Analysis Aggressive · 177 findings
| # | Case | Root cause | Findings | Verdict | What C++test says (or why silent) |
|---|---|---|---|---|---|
| 1 | The Eternal Button | shared_ptr reference cycle | 6 | missed | Ownership-cycle reasoning absent; LeakSanitizer catches it |
| 2 | Timing Is Everything | member order vs thread lifetime | 4 | missed | thread start in ctor / join in dtor not modeled; TSan catches it |
| 3 | Self Destruction | use-after-free via callback | 5 | missed | std::function re-entry not traced; ASan catches it |
| 4 | Self Destruction II | lambda destroys own captures | 5 | missed | lambda-object capture model absent; ASan catches it |
| 5 | Calling Into the Void | pure virtual call during destruction | 8 | missed | join-in-destructor vs running thread not modeled; aborts at runtime on GCC |
| 6 | 255 + 1 | integral promotion (puzzle) | 4 | no bug | MISRA 7_0_5-a flags the promotion twice, on the exact line |
| 7 | Starting From Zero | accumulate initial-value type | 2 | missed | conversion hidden in std headers; GCC -Wconversion catches it |
| 8 | Hello World | ofstream recreation ordering | 2 | missed | assignment sequencing semantics; no rule |
| 9 | Did It Even Count? | thread copies arguments | 6 | missed | std::thread value semantics not modeled |
| 10 | G4rb&g# | static destruction order fiasco | 10 | missed | whole-program static destruction ordering not modeled |
| 11 | Greetings From Who? | dangling data() pointer | 3 | detected | BD-CO-STRMOD on the use line |
| 12 | Think You're a Bit Wise? | &= without short-circuit, OOB | 7 | detected | BD-PB-VALRANGE + MISRA 7_0_1-a, 7_0_4-a |
| 13 | An Offer You Can't Refuse | ternary precedence | 12 | detected | MISRA 8_0_1-b + BD-PB-CC + MISRA 0_0_2-a |
| 14 | A Wrong Status Report | dangling string_view from ternary | 8 | missed | ternary common-type temporary lifetime not modeled |
| 15 | Works In Production | virtual call on sibling base in ctor | 10 | detected | BD-PB-VCTOR + MISRA 15_1_1-a |
| 16 | Have You Tried Upgrading? | dangling range-for temporary | 7 | flagged | MISRA 9_5_2-a: 2 function calls in for-range-initializer |
| 17 | A Changing Reference | aliasing reference mutated in loop | 4 | missed | aliasing logic, not lifetime or bounds |
| 18 | A Short Stack | initializer-list ctor trap | 9 | incidental | 6_9_2-a on the line for an unrelated reason; constructor selection legal |
| 19 | A Wrong Move | unspecified evaluation order / use-after-move | 7 | detected | MISRA 4_6_1-b: code depends on argument evaluation order |
| 20 | Is Anybody Playing? | char signedness portability | 11 | flagged | MISRA 7_0_3-a on the char promotion comparison |
| 21 | What Comes First? | comparator breaks strict weak ordering | 9 | incidental | 9_3_1-b style hit; semantic contract not checked |
| 22 | Running in Circles | NaN + mutual recursion stack overflow | 9 | flagged | 0_3_1-d NaN may result + BD-PB-ZERO + 0_3_1-b float != |
| 23 | A Lock You Can't See | static-init mutex in real-time code | 4 | missed | needs Clang RealtimeSanitizer |
| 24 | No Strings Attached | string literal converts to bool | 14 | detected | MISRA 7_0_2-a + 8_2_7-c + 8_2_8-b on the call line |
| 25 | The Uninvited Temporary | implicit conversion mutates vector mid-iteration | 11 | incidental | 8_1_2-a style hit; invalidation path not modeled |
Rule mix 177 findings, top rules
Sev 4 6_0_3-a global namespace shall only contain main/namespaces30
Sev 4 18_3_1-a at least one catch-all exception handler25
Sev 2 6_2_3-a external linkage, one external definition25
Sev 4 6_9_2-a do not use standard signed/unsigned integer types16
Sev 4 6_5_1-a external-linkage objects declared in headers11
Sev 2 15_0_1-a special member functions provided appropriately8
Sev 2 7_0_3-a numerical value of a character shall not be used6
everything else (34 rules)56
The 13 bug-line findings come from 11 distinct rules. The violet structural rules dominate the noise floor: in 25 single-file demo programs they fire on every translation unit by design.
Why the 12 invisible bugs stay invisible
Dynamic behavior (9)1, 2, 3, 4, 5, 9, 10, 17, 25: refcount cycles, thread join in destructor, callback re-entry, thread argument copies, static destruction order, aliasing. Flow analysis is path/value based; it has no model of std::function dispatch, std::thread copies or jthread joins.
Temporary semantics (3)7, 8, 14: truncation hidden in std headers, ofstream recreation ordering, ternary common-type temporaries. String invalidation is modeled (case 11 was caught); these siblings are not.
Contracts (2)21 strict weak ordering and 23 real-time no-locking live outside the type system: they need libc++ hardening and RealtimeSanitizer.
What C++test cannot replaceSanitizers catch 1, 2, 3, 4, 5, 14, 25; Clang warnings catch 13, 24 (also caught here); clang-tidy catches 19 (also caught here); GCC -Wconversion catches 7. Cases 6, 17, 18, 20 are the book's true "understand the language" territory.
Recommended Rules found 2/25. Flow Analysis alone 5/25. MISRA C++ 2023 + Flow Analysis Aggressive: 9/25 purposeful (6 detected + 3 flagged) plus 3 incidental style hits. The delta over flow analysis alone comes almost entirely from MISRA semantic rules: 4_6_1-b (19), 7_0_2-a (24), 8_0_1-b (13), 15_1_1-a (15), 9_5_2-a (16), 7_0_3-a (20).
Method
| Item | Value |
|---|---|
| Tool | Parasoft C++test Professional 2025.2.0 (10.7.3.20251120B2939), cpptestcli |
| Cases | 25 standalone programs transcribed verbatim from "25 C++ Cases That Will Humble You" (Jelle Bakker, C++ Doctor, 2026) |
| Compiler import | GCC 13.3.0, C++23, pthreads; custom <print> shim for libstdc++ 13 |
| Configurations | builtin Recommended Rules / Flow Analysis Standard / Flow Analysis Aggressive; custom merged config: 277 MISRA C++ 2023 rules + 147 aggressive flow checkers (reportUnvalidatedViolations + aggressiveMode on) |
| Scoring | A case is "hit" only if a finding's line equals a ground-truth bug line in cases.json. Tiers: detected = finding expresses the bug; flagged = right line and hazard family, indirect rule; incidental = style rule coincidentally on the line |
| Repository | C:\Projects\CPPdoctor\cppdoctor-25-cases · reproduce with ./run_cpptest.sh + python3 parse_findings.py |
| Severity & rule docs | Severity levels come from the sev attribute of each violation in report.xml (Parasoft scale: 1 highest, 4 lowest here). Rule titles come from the rule documentation bundled with C++test (rules/docs.zip). Parasoft does not publish per-rule pages on docs.parasoft.com, so each rule pill opens the documentation search for that rule ID; the documentation space lives at docs.parasoft.com/display/CPPTEST20261 |