Parasoft C++test vs "25 C++ Cases That Will Humble You": Findings Report
2026-11-04 · Parasoft C++test Professional 2025.2.0 · GCC 13.3.0 / C++23 · one translation unit per case
Interactive dashboard version (severity pills, linked rule docs): index.html
Headline
Across four configurations the best result is the custom merged MISRA C++ 2023 + Flow Analysis Aggressive config: 9 of 25 bugs get a purposeful finding (6 detected outright, 3 flagged on the right line for the right hazard family), plus 3 incidental style hits on bug lines. 12 of 25 cases produce no finding anywhere near the bug. Recommended Rules alone finds 2 of 25; Flow Analysis alone 5.
Configurations and totals
| Configuration | Findings | On a bug line | Detected | Flagged | Incidental |
|---|---|---|---|---|---|
| Recommended Rules | 39 | 2 (cases 13, 22) | 2 | - | - |
| Flow Analysis Standard | 8 | 5 (cases 11, 12, 13, 15, 22) | 4 | 1 | - |
| Flow Analysis Aggressive | 8 | 5 | 4 | 1 | - |
| MISRA C++ 2023 + Flow Analysis Aggressive (custom merged, 277 rules + 147 checkers) | 177 | 13 | 6 | 3 | 3 + 1 no-bug |
Flow Analysis Aggressive added nothing over Standard on these files. The merged config's gain comes almost entirely from MISRA semantic rules: MISRACPP2023-4_6_1-b (case 19), 7_0_2-a (case 24), 8_0_1-b (case 13), 15_1_1-a (case 15), 9_5_2-a (case 16), 7_0_3-a (case 20).
The findings that hit a bug line (merged config)
| Case | Line | Rule | Severity | Tier | Message |
|---|---|---|---|---|---|
| 11 Greetings From Who? | 13 | BD-CO-STRMOD | 1 (highest) | detected | The invalidated "ptr" pointer to the "text" container is used |
| 12 Think You're a Bit Wise? | 13 | BD-PB-VALRANGE | 4 | detected | The "this->ages" variable may be accessed out of bounds at index "person", which may be greater or equal to the container size |
| 12 | 13 | MISRACPP2023-7_0_4-a | 2 | detected | The LHS/RHS operand of bitwise operator '&=' should be unsigned (bitwise AND on a bool, the exact construct) |
| 13 An Offer You Can't Refuse | 12 | MISRACPP2023-8_0_1-b | 4 | detected | The condition of the '?:' operator should be in parentheses; plus BD-PB-CC and 0_0_2-a: condition "price + (int)isMember" always evaluates to true |
| 15 Works In Production | 15 | BD-PB-VCTOR + MISRACPP2023-15_1_1-a | 2 | detected | Virtual method "getSpecialty" called on the "CppDoctor" object ("specialist") which is under construction |
| 19 A Wrong Move | 22 | MISRACPP2023-4_6_1-b | 2 | detected | The code depends on the order of evaluation of 'getBody' function arguments: the exact use-after-move bug; clang-tidy is the only other tool that catches it |
| 24 No Strings Attached | 34 | MISRACPP2023-7_0_2-a | 2 | detected | Do not convert type 'const char [4]' to type 'bool' (plus 8_2_7-c / 8_2_8-b) |
| 16 Have You Tried Upgrading? | 23 | MISRACPP2023-9_5_2-a | 2 | flagged | The for-range-initializer contains 2 function calls: a rule built precisely for the range-for temporary trap |
| 20 Is Anybody Playing? | 11 | MISRACPP2023-7_0_3-a | 2 | flagged | The numerical value of a character shall not be used: fires on the char-promotion comparison the bug needs |
| 22 Running in Circles | 29 | MISRACPP2023-0_3_1-d + BD-PB-ZERO | 4 + 1 | flagged | Infinity or NaN may be returned as a result of division by zero constant; plus 0_3_1-b on the float '!=': the NaN entrance is flagged, the mutual recursion is not |
| 18 A Short Stack | 23 | MISRACPP2023-6_9_2-a | 4 | incidental | Do not use the 'int' standard integer type: on the line, wrong reason |
| 21 What Comes First? | 16 | MISRACPP2023-9_3_1-b | 2 | incidental | 'if' should be followed by a block: style, coincidental |
| 25 The Uninvited Temporary | 28 | MISRACPP2023-8_1_2-a | 4 | incidental | Implicitly captured variables in a non-transient lambda: style, coincidental |
| 6 255 + 1 | 10 | MISRACPP2023-7_0_5-a | 2 | no bug | Integral promotion shall not change signedness 'uint8_t' to 'int': flags the puzzle construct; case 6 is not a defect |
Severity is the Parasoft severity level C++test reports per finding (scale 1 highest to 5 lowest; levels 1-4 occur here), taken from the sev attribute of each violation in report.xml. Each rule links to the Parasoft documentation search for that rule ID: docs.parasoft.com does not host per-rule pages for C++test, the full rule documentation ships inside the product (rules/docs.zip, manuals/cpptest_rules.pdf); the C++test 2026.1 documentation space is at https://docs.parasoft.com/display/CPPTEST20261
The other findings (wrong line, wrong bug, or noise)
| Config | Finding | Assessment |
|---|---|---|
| FA Std/Aggr | case18:20 BD-PB-VALRANGE | False positive: flags pop(), which the index == 0 guard protects; the real bug is the buffer{Size} trap |
| FA Std/Aggr | case24:17 BD-PB-INTDL | Wrong bug: flags the intended uint16-to-byte truncation |
| FA Std/Aggr | case13:9 BD-PB-VOVR | Consequence finding, downstream of the precedence bug |
| Merged | 30x MISRACPP2023-6_0_3-a, 25x 18_3_1-a, 25x 6_2_3-a, 16x 6_9_2-a, 11x 6_5_1-a | Structural rules that fire on every single-file demo program by design; they are the noise floor |
Recommended Rules inventory (39): 25x MISRA2004-16_8 on main, 5x OPT-14, 4x OOP-23, 2x CODSTA-CPP-04, plus the BD-PB-CC (13) and BD-PB-ZERO (22) hits.
Per-case verdicts (merged config)
| # | Case | Verdict | Why |
|---|---|---|---|
| 1 | The Eternal Button | missed | shared_ptr ownership-cycle reasoning absent (LeakSanitizer catches it) |
| 2 | Timing Is Everything | missed | thread start in ctor / join in dtor / cross-thread access not modeled (TSan) |
| 3 | Self Destruction | missed | std::function re-entry not traced (ASan) |
| 4 | Self Destruction II | missed | lambda-object capture model absent (ASan) |
| 5 | Calling Into the Void | missed | join-in-destructor vs running thread not modeled; aborts at runtime on GCC |
| 6 | 255 + 1 | no bug | puzzle; MISRA 7_0_5-a flags the promotion itself |
| 7 | Starting From Zero | missed | conversion hidden in std headers (GCC -Wconversion catches it) |
| 8 | Hello World | missed | assignment sequencing semantics; no rule |
| 9 | Did It Even Count? | missed | std::thread value semantics not modeled |
| 10 | G4rb&g# | missed | whole-program static destruction order not modeled |
| 11 | Greetings From Who? | detected | BD-CO-STRMOD |
| 12 | Think You're a Bit Wise? | detected | BD-PB-VALRANGE + MISRA 7_0_1-a / 7_0_4-a |
| 13 | An Offer You Can't Refuse | detected | MISRA 8_0_1-b + BD-PB-CC + 0_0_2-a |
| 14 | A Wrong Status Report | missed | ternary common-type temporary lifetime not modeled (ASan) |
| 15 | Works In Production | detected | BD-PB-VCTOR + MISRA 15_1_1-a |
| 16 | Have You Tried Upgrading? | flagged | MISRA 9_5_2-a, the rule built for this trap |
| 17 | A Changing Reference | missed | aliasing logic, not lifetime or bounds |
| 18 | A Short Stack | incidental | 6_9_2-a on the line, unrelated reason |
| 19 | A Wrong Move | detected | MISRA 4_6_1-b argument evaluation order |
| 20 | Is Anybody Playing? | flagged | MISRA 7_0_3-a on the char promotion |
| 21 | What Comes First? | incidental | 9_3_1-b style hit; strict weak ordering not checked (libc++ hardening asserts it) |
| 22 | Running in Circles | flagged | 0_3_1-d + BD-PB-ZERO + 0_3_1-b; recursion not modeled |
| 23 | A Lock You Can't See | missed | needs Clang RealtimeSanitizer |
| 24 | No Strings Attached | detected | MISRA 7_0_2-a + 8_2_7-c + 8_2_8-b |
| 25 | The Uninvited Temporary | incidental | 8_1_2-a style hit; invalidation path not modeled (ASan) |
Why the 12 invisible bugs stay invisible
- Dynamic behavior absent (cases 1, 2, 3, 4, 5, 9, 10, 17, 25): refcount cycles, thread joins, callback re-entry, thread argument copies, static destruction order, aliasing. Flow analysis is path/value based and has no model of std::function dispatch, std::thread copies, or jthread join-in-destructor.
- Temporary semantics (7, 8, 14): truncation hidden in std headers, ofstream recreation ordering, ternary common-type temporaries. String invalidation is modeled (case 11); these siblings are not.
- Contracts outside the type system (21, 23): strict weak ordering and real-time no-locking need libc++ hardening and RealtimeSanitizer.
Method and reproduction
Repository: C:\Projects\CPPdoctor\cppdoctor-25-cases (25 case files verbatim from the book, the book's fixes, ground-truth bug lines in cases.json, merged config in MISRA-CPP-2023-FA-Aggressive.properties). Scans: ./run_cpptest.sh (builtin Recommended Rules / Flow Analysis Standard / Flow Analysis Aggressive + the custom merged config), GCC 13.3 import (bdf.import.compiler.family=gcc_13-64), reports parsed from report.xml with parse_findings.py. A finding counts as a hit only if its line equals a ground-truth bug line for that case; tiers: detected (finding expresses the bug), flagged (right line and hazard family), incidental (style rule coincidentally on the line).