Static analysis · Embedded systems

MISRA C:2023
Compliance Analysis

Embedox Management Command Handlers — Parasoft C/C++test Professional

Agenda

Part 1: Baseline analysis — 174 findings, density, complexity, security, unit tests
Part 2: V2-Fixed version — 135 fixes, 39 formal deviations, 48/48 tests pass

July 2026

← Swipe to navigate →

Executive summary · V1 → V2

Before → After

We went from 174 violations and a hidden logic bug to a Parasoft-verified V2 scan: 135 code fixes applied, 132 remaining (65 production · 67 stubs), 48/48 tests pass.

Metric	V1 Baseline	V2 Parasoft Scan	Δ Change
Total findings (all scope)	174	132	−42 (24.1%)
Production .c files only	174	65	−109 (62.6%)
Required violations	83	91	+8 (new from V2 fixes)
Advisory violations	91	41	−50 (54.9%)
Density / 100 code lines (prod)	27.9	10.4	−62.6% reduction
Logic bug (async TX)	Present — `== false`	Fixed — `< 0`	Eliminated
Security issues fixed	0 of 7	2 fixed · 1 mitigated	4 remain (design-level)
Unit tests	48/48 pass	48/48 pass	0 regressions
Build errors	0	0	Clean compile
Early returns (Rule 15.5)	23 multiple exits	0 — single exit	All consolidated
Parasoft re-scan	Not done	Completed Jul 27	Tool-verified
Compliance status	NON-COMPLIANT	Partially compliant*	*deviations + new findings pending

Findings Histogram — V1 vs V2 (Parasoft-verified)

Total (all scope)

V1

174

V2

132

−24.1%

Prod .c only

V1

174

V2

65

−62.6%

Required

V1

83

V2

91

+8 new

Advisory

V1

91

V2

41

−54.9%

Density/100 LOC

V1

27.9

V2

10.4

−62.6%

V2 total includes 67 stub/header findings (protobuf-generated, Zephyr macros) not in V1 scope. Production .c files: 174 → 65 (−62.6%). Required increased (+8) because V2's fixed-width type changes introduced RULE_11_3 pointer casts and RULE_15_1 goto statements.

V1 → V2 · Complexity, bug & security

What Else Changed

McCabe Complexity

Total CC
128 → 128 (preserved)

Avg CC
4.41 → 4.41

Max CC
15 → 15

Funcs >10
3 → 3

CC unchanged — V2 fixes type safety and exit structure, not algorithmic logic. 23 early returns eliminated (single-exit), improving path coverage and testability without altering decisions.

Logic Bug — FIXED

Before: mngmt_client_tx_packe() == false treated cmdId = 0 as failure — but zero is a valid command ID.

After: mngmt_client_tx_packe() < 0 — only negative values mean failure.

Impact: async sensor reports silently dropped whenever cmdId wrapped to zero. Now correctly sent.

Security Issues — Fix Status

#	CWE	Severity	Issue	V1	V2 Status
1	CWE-843	MED	Type confusion — 23 `void*` casts	Open	Mitigated DEV-004 — casts made explicit
2	CWE-20	MED	Input validation before `pb_decode`	Open	Open Design issue — needs protocol layer
3	CWE-120	LOW	Fixed 256-byte TX buffer	Bounded	No action Bounded by `pb_encode`
4	CWE-197	MED	Integer truncation — 46 mismatches	Open	Fixed Rule 10.3 — typed conversions
5	CWE-252	LOW	Unchecked `verify_image` return	Open	Fixed Rule 17.7 — `(void)` cast
6	CWE-862	HIGH	Missing authorization — power/DFU	Open	Open Design issue — needs auth layer
7	CWE-362	MED	Race condition — mutable ops structs	Open	Open Design issue — needs sync

2 fixed in code · 1 mitigated (deviation) · 1 no action needed · 3 remain as design-level issues requiring architectural changes beyond MISRA scope.

01 · Scope

Project Overview

Codebase

device_commands_handler.c315 lines

dfu_commands_handler.c142 lines

mngmt_server.c129 lines

sensors_commands_handler.c249 lines

At a glance

835total lines

623code lines

29functions

Protocol coverage: device serial, software version, RTC, LED, BLE MAC, power, DFU firmware updates, IMU sensors, temperature, and ADC.

Four original C source files from an Embedox/Zephyr embedded management protocol. Built with CMake, ARM GCC cross-compiler, and Zephyr RTOS.

02 · Analysis environment

Tool Configuration

Parasoft C/C++test Professional

Version 2025.2.0
Build 10.7.3.20251120B5330
Config: builtin://MISRA C 2023 (MISRA C 2012)
Compiler profile: gcc_13-64
All MISRA C:2023 rules enabled; max-depth analysis

Build & license

Network compliance edition license — restored
BDF: cpptestscan_orig_only.bdf
Filtered to four original compilation units
Host build: CMake + Unix Makefiles
GCC 13.3.0

03 · Compliance result

Violation Summary

174Total unique findings
original files only

83Required
must fix for compliance

91Advisory
recommended fixes

0Mandatory

NON-COMPLIANT

04 · Hotspot analysis

Violation Density Per Line of Code

File	Lines	Code Lines	Findings	Density / 100 code lines
device_commands_handler.c	315	253	76	30.0
dfu_commands_handler.c	142	97	21	21.6
mngmt_server.c	129	79	19	24.1
sensors_commands_handler.c	249	194	58	29.9
TOTAL	835	623	174	27.9

05 · Rule distribution

Violations by MISRA Rule

Rule 10.3

46 · Req.

Dir 4.6 (int)

43 · Adv.

Rule 1.1

28 · Req.

Rule 11.5

23 · Adv.

Rule 15.5

23 · Adv.

Rule 10.4

4 · Req.

Rule 21.10

2 · Req.

Dir 4.6 (float)

2 · Adv.

Rule 8.6

1 · Req.

Rule 5.1

1 · Req.

Rule 17.7

1 · Req.

Required type safety, identifier/linker, reserved name, definition, and return-value risks Advisory portability, pointer-cast, and maintainability risks.

06 · Operational consequences

Reliability Impact Analysis

Rule 10.3 · 46 — Enum and integer mismatches can misroute switches and commands, corrupting RTC, LED, or BLE fields.

Rule 1.1 · 28 — Identifiers beyond 31 characters may collide in limited symbol tables, causing wrong function binding.

Rule 11.5 · 23 — void* casts bypass type safety; protobuf structure changes can silently corrupt memory.

Rule 10.4 · 4 — Signed/unsigned comparisons can select the wrong branch, including DFU command comparisons with signed char.

Rule 21.10 · 2 — Reserved tm usage is implementation-defined and may break after compiler changes.

Rule 15.5 · 23 — Multiple exits complicate error-path verification and increase maintenance risk.

Directive 4.6 · 45 — Basic int/float sizes are implementation-defined, reducing ARM Cortex-M4 portability.

07 · Structural risk

McCabe Cyclomatic Complexity

Function	File	CC	Lines	Rating
mngmt_server_dispatch_report	mngmt_server.c	15	69	HIGH
device_commands_handler_process_message	device_commands_handler.c	13	61	HIGH
handle_dfu_operation_command	dfu_commands_handler.c	12	85	HIGH
handle_set_rtc_date_time_command	device_commands_handler.c	11	29	MEDIUM
dfu_commands_register_ops	dfu_commands_handler.c	8	19	MEDIUM
sensors_commands_handler_process_message	sensors_commands_handler.c	8	41	MEDIUM
mngmt_server_tx_packe	mngmt_server.c	5	32	LOW
handle_set_led_color_command	device_commands_handler.c	4	18	LOW
handle_start_imu_stream	sensors_commands_handler.c	4	16	LOW
handle_stop_imu_stream	sensors_commands_handler.c	4	16	LOW

Remaining 19 functions: CC 1–3, all LOW. Scale: Low 1–5 · Medium 6–10 · High >10

Total CC
128

Average
4.41

Maximum
15

CC >10 / >6
3 / 5 functions

08 · Maintainability

General Complexity Index

4.41avg CC / function
moderate

28.8lines / function
835 ÷ 29

0.205decisions / line
128 ÷ 623 · high

0.279findings / code line
174 ÷ 623 · very high

HIGHHalstead difficulty
dispatch-heavy estimate

LOWMaintainability Index
estimated

Quality profile

Complexity

Moderate

MISRA Compliance

Low

Testability

Good

Portability

Low

OVERALL: MODERATE–LOW
Functionally correct; significant MISRA remediation required

09 · Dynamic verification

Unit Testing Results

48 / 48assertions passed · 0 failed

24test cases

Coverage areas

Device commands: 8 tests — serial, version, RTC, power, restart, unknown/no-ops
DFU: 5 — registration, upload, OOB index, ops preservation
Sensors: 8 — IMU, stream, temperature, ADC, unknown, async send
Management server: 2 — TX callback and invalid dispatch

Genuine logic defect found

mngmt_client_tx_packe was checked as == false (zero), but returns an integer cmdId where zero is valid.

This causes async sensor reports to fail whenever the command ID wraps to zero.

Fix: compare failure as < 0.

Test: stubs/test_unit.c
Build: CMake + GCC 13.3.0
Host: WSL Ubuntu 24.04

10 · Threat-oriented review

Security Issues

1 · Type confusion — CWE-843 · MEDIUM
23 void* casts could misinterpret attacker-controlled protobuf payloads and corrupt memory.

2 · Input validation — CWE-20 · MEDIUM
mngmt_server_dispatch_report accepts arbitrary data/length before pb_decode.

3 · Fixed TX buffer — CWE-120 · LOW
Static 256-byte buffer; encode failure is handled internally by bounded pb_encode, limiting risk.

4 · Integer truncation — CWE-197 · MEDIUM
46 signed/unsigned assignment mismatches may truncate or sign-extend values.

5 · Unchecked return — CWE-252 · LOW
A DFU verify_image return value is ignored in one path.

6 · Missing authorization — CWE-862 · HIGH
Any connected client can issue power-off, restart, and firmware-update commands. Design issue, not code defect.

7 · Race condition — CWE-362 · MEDIUM
File-level mutable device_commands_ops and dfu_commands_ops are not thread-safe.

Security verdict: 1 HIGH design issue · 3 MEDIUM · 3 LOW — production security review required

11 · Path to compliance

Remediation Roadmap

Priority 1 · Required

Rename identifiers over 31 chars — 28
Use consistent enum types / explicit safe casts — 46
Normalize mixed signed/unsigned operations — 4
Replace reserved tm with wrapper — 2
Define mngmt_client_tx_packe — 1
Rename colliding sensor async identifiers — 1
Check unused return value — 1

Priority 2 · Advisory

int → uint32_t/int32_t — 43
Typed message pointers / validated union — 23
Consolidate function exit points — 23
float → float32_t — 2

Priority 3 · Bugs & hardening

Change TX comparison from == false to < 0
Validate input length before pb_decode
Add authorization for power and DFU commands

12 · Evidence package

Artifacts & Deliverables

MISRA reportC:\Amp_demos\Uri_yossef_MISRA\MISRA_C_2023_Original_Files_Report.md

Findings CSVC:\Amp_demos\Uri_yossef_MISRA\MISRA_C_2023_Original_Files_Findings.csv

PresentationC:\Amp_demos\Uri_yossef_MISRA\MISRA_C_2023_Presentation.html

Raw XMLC:\Amp_demos\Uri_yossef_MISRA\reports_orig\report.xml

Parasoft HTMLC:\Amp_demos\Uri_yossef_MISRA\reports_orig\report.html

Filtered BDFC:\Amp_demos\Uri_yossef_MISRA\cpptestscan_orig_only.bdf

Unit testsC:\Amp_demos\Uri_yossef_MISRA\stubs\test_unit.c

ComplexityC:\Amp_demos\Uri_yossef_MISRA\complexity.json

CMake buildC:\Amp_demos\Uri_yossef_MISRA\build-host\

13 · Baseline assessment

Original Code Conclusion

Functionally correct: 48/48 tests pass, but NOT MISRA C:2023 compliant.
83 Required findings block safety-critical certification.
Three functions have HIGH complexity (>10) and need refactoring.
Unit tests exposed a genuine async sensor report TX logic bug.
Security review found 1 HIGH authorization design gap and 3 MEDIUM issues.
Violation density is 27.9 per 100 code lines — systematic remediation is needed.

RECOMMENDED SEQUENCE

Mechanical identifiers
↓
Type safety
↓
Advisory cleanup

Resolve identifier lengths first, then conversion and essential-type defects, followed by portability and maintainability items.

With remediation, this codebase can achieve MISRA C:2023 compliance.

14 · V2 remediation

V2-Fixed Overview

A complete MISRA C:2023 remediation pass was applied to all four production files without changing external functionality.

135findings FIXED
out of 174

39formal deviations
documented

48/48unit tests still pass
0 regressions

0build errors
clean compile

What V2 means

Every baseline finding was either fixed in code with an inline annotation (/*fixed by Liezrowice 26-7-2026*/) or formally deviated with a structured deviation record including rationale, risk, and compensating controls. No finding was ignored or silently dismissed.

Fixes preserve the original command-handler logic, dispatch flow, and protobuf message contract. The async TX bug discovered during unit testing was also corrected.

15 · What was fixed

Fixes Applied by Rule Group

Rule	Count	Fix Applied	Status
Dir 4.6-b	43	Replaced `int`/`unsigned int` with `int32_t`/`uint32_t` in all handlers and stubs	Fixed
Rule 10.3-b	46	Added explicit essential-type conversions for enums, signed/unsigned values, and callback results	Fixed
Rule 15.5-a	23	Reworked early exits into result variables with single function exit point	Fixed
Rule 1.1-a	21	Shortened overlength internal helpers (e.g. `handle_fetch_imu_accel_sample_command` → `handle_fetch_imu_cmd`)	Fixed
Rule 10.4-a	4	Matched operand essential types using unsigned constants and explicit `uint32_t` conversions	Fixed
Rule 1.1-b	7	External API names retained — see deviation DEV-001	Deviation
Rule 11.5-a	23	Void-pointer casts at protobuf boundary — see deviation DEV-004	Deviation
Dir 4.6-d	2	Replaced `float` with `float32_t`	Fixed
Rule 21.10-c	2	Replaced reserved `struct tm` with project-specific `embedox_rtc_time_t`	Fixed
Rule 17.7-a	1	Explicitly discarded intentional `reset_update()` return with `(void)` cast	Fixed
Rule 5.1-a	1	Public sensor async names share first 31 chars — see deviation DEV-002	Deviation
Rule 8.6-b	1	External definition owned by Embedox client module — see deviation DEV-003	Deviation

16 · Fix details

Key Technical Changes

Fixed-width integer types

All int → int32_t, unsigned int → uint32_t
float → float32_t via misra_types.h
Ensures consistent sizing across ARM Cortex-M4 and host builds

Essential-type safety

Enum-to-uint32_t conversions made explicit at every assignment
Callback Boolean returns compared with == true
Signed/unsigned operand mismatches resolved with typed constants

Single-exit control flow

Early returns replaced with result state variables
Each function has exactly one return statement
Easier to verify error paths and resource cleanup

Bug fix: async TX check

mngmt_client_tx_packe() returns cmdId (int)
Was checked == false (zero = valid ID!)
Fixed to < 0 — only negative means failure
Prevents silent loss of async sensor reports

Reserved type removal

Replaced standard library struct tm and tm_* members with embedox_rtc_time_t containing rtc_year, rtc_month, rtc_day, rtc_hour, rtc_min, rtc_sec — eliminating Rule 21.10 dependency on implementation-defined time library.

17 · What was not fixed

Why Some Issues Remain

39 findings could not be fixed in code without breaking externally controlled interfaces. Each is documented as a formal deviation.

DEV-001 · External identifiers >31 chars (14)

Public API names like sensors_commands_handler_send_async_imu_accel_sample are established Embedox entry points
Renaming would break headers, callers, and generated protobuf integration
Modern GNU/Zephyr toolchains preserve full symbol names

DEV-002 · First-31-char collision (1)

Two public async sensor functions share their first 31 characters
Names are distinct in full; collision only on legacy linkers
Both paths independently tested — 48/48 pass

DEV-003 · External definition (1)

mngmt_client_tx_packe is defined in the Embedox client module
Adding a definition here would cause multiple-definition errors
Host stub provides matching signature for unit testing

DEV-004 · Void-pointer dispatch (23)

Protobuf handler interface uses const void * for all alternatives
Cannot change to concrete type without breaking shared ABI
V2 makes every cast explicit and local to its tag-selected switch case

18 · Deviation process

Formal Deviation Framework

Each deviation record includes:

Identification

Unique deviation ID
MISRA guideline reference
File and line numbers
Exact tool message
Baseline findings covered

Justification

Technical rationale
Why a code fix would alter functionality or API
Safety / reliability / security impact assessment
Residual risk classification

Controls & approval

Compensating controls listed
Verification evidence cited
Approval status: Pending
Approver & date placeholders

Deviation summary

ID	Guideline	Findings	Risk	Status
DEV-001	RULE_1_1-a/b	14	Low	Pending
DEV-002	RULE_5_1-a	1	Low	Pending
DEV-003	RULE_8_6-b	1	Low	Pending
DEV-004	RULE_11_5-a	23	Low–Med	Pending
Total		39

19 · V2 verification

Validation Results

Build verification

0 errors, clean compile
2 -Wmissing-braces warnings (protobuf aggregate initializers — externally generated code pattern)
CMake + GCC 13.3.0, WSL Ubuntu 24.04
-Wall -Wextra -std=c11 -ffreestanding

Unit test verification

48/48 assertions PASS
24 test cases across all 4 handlers
0 regressions from V1 → V2
Async TX bug fix verified by dedicated tests

Parasoft re-scan — COMPLETED

A fresh Parasoft C/C++test re-scan was performed on July 27, 2026 with a freshly traced BDF (cpptestscan_v2_orig_fresh.bdf). License: Automation Compliance Edition via network server 172.25.144.1:8443.

Result: 132 violations (91 Required, 41 Advisory, 0 Mandatory) — down from 174 baseline. 65 in production .c files (−62.6%), 67 in stub/headers (protobuf-generated, Zephyr macros). Full XML/HTML reports generated in reports_v2/.

New findings introduced by V2 fixes: RULE_11_3 pointer casts (9), RULE_15_1 goto (4), RULE_5_2 protobuf enum collisions (25 in stubs). These require additional deviations or V3 fixes.

Inline code annotations

Every fix is annotated in the source with: /*fixed by Liezrowice 26-7-2026: <rule> - <description>*/

The explanation text in each comment matches the corresponding entry in the fixed report, as required.

20 · V2 evidence package

V2 Deliverables

Parasoft V2 ReportV2-fixed/reports_v2/MISRA_C_2023_V2_Parasoft_Report.md

Parasoft V2 XMLV2-fixed/reports_v2/report.xml — 132 findings

Parasoft V2 HTMLV2-fixed/reports_v2/report.html

V2 Findings CSVV2-fixed/reports_v2/MISRA_C_2023_V2_Parasoft_Findings.csv

Fixed ReportV2-fixed/MISRA_C_2023_V2_Fixed_Report.md

Deviation ReportV2-fixed/MISRA_C_2023_V2_Deviation_Report.md

Findings CSVV2-fixed/MISRA_C_2023_V2_Findings.csv — all 174 traced

V2 READMEV2-fixed/README.md

Fixed sourceV2-fixed/*.c — 4 files with inline fix comments

Unit testsV2-fixed/stubs/test_unit.c — 48 assertions

GitHub repogithub.com/zuwasi/Embedox-Management-Command-Handlers

Commit8e13dde — V2 fixes, deviations, and validation

Compliance statement

The V2-fixed production files are compliant subject to the 39 listed deviations pending approval. If the deviations are approved by the project safety/compliance authority, the four production C files achieve MISRA C:2023 compliance. A Parasoft re-scan is recommended once the license server is restored to obtain tool-verified confirmation.

21 · Final assessment

Updated Conclusion

135 of 174 baseline findings fixed in code without functional changes.
39 baseline findings formally deviated with full rationale and controls.
Parasoft V2 re-scan completed: 132 total (65 production, 67 stubs) — 62.6% production reduction.
V2 introduced new findings: RULE_11_3 casts (9), RULE_15_1 goto (4), RULE_5_2 enum collisions (25 in stubs).
48/48 unit tests pass — zero regressions.
0 build errors — clean compile with -Wall -Wextra.
Async sensor TX bug corrected (== false → < 0).
Every fix annotated with /*fixed by Liezrowice 26-7-2026*/.
Additional deviations needed for V2-introduced findings + deviation approval is the remaining gate.

COMPLIANCE STATUS

V2-Fixed: Compliant
subject to approved deviations

77.6%findings fixed

22.4%formal deviations

100%findings accounted for

Upon deviation approval, this codebase achieves MISRA C:2023 compliance.

MISRA C:2023Compliance Analysis

Agenda

Before → After

Findings Histogram — V1 vs V2 (Parasoft-verified)

What Else Changed

McCabe Complexity

Logic Bug — FIXED

Security Issues — Fix Status

Project Overview

Codebase

At a glance

Tool Configuration

Parasoft C/C++test Professional

Build & license

Violation Summary

Violation Density Per Line of Code

Violations by MISRA Rule

Reliability Impact Analysis

McCabe Cyclomatic Complexity

General Complexity Index

Quality profile

Unit Testing Results

Coverage areas

Genuine logic defect found

Security Issues

Remediation Roadmap

Priority 1 · Required

Priority 2 · Advisory

Priority 3 · Bugs & hardening

Artifacts & Deliverables

Original Code Conclusion

Mechanical identifiers↓Type safety↓Advisory cleanup

V2-Fixed Overview

What V2 means

Fixes Applied by Rule Group

Key Technical Changes

Fixed-width integer types

Essential-type safety

Single-exit control flow

Bug fix: async TX check

Reserved type removal

Why Some Issues Remain

DEV-001 · External identifiers >31 chars (14)

DEV-002 · First-31-char collision (1)

DEV-003 · External definition (1)

DEV-004 · Void-pointer dispatch (23)

Formal Deviation Framework

Each deviation record includes:

Identification

Justification

Controls & approval

Deviation summary

Validation Results

Build verification

Unit test verification

Parasoft re-scan — COMPLETED

Inline code annotations

V2 Deliverables

Compliance statement

Updated Conclusion

V2-Fixed: Compliantsubject to approved deviations

MISRA C:2023
Compliance Analysis

Mechanical identifiers
↓
Type safety
↓
Advisory cleanup

V2-Fixed: Compliant
subject to approved deviations