|
Data Reference Errors
1. Does a referenced variable have a value that is unset or unini-
tialized? This probably is the most frequent programming
error; it occurs in a wide variety of circumstances. For each
reference to a data item (variable, array element, field in a
structure), attempt to “prove” informally that the item has a
value at that point.
2. For all array references, is each subscript value within the
defined bounds of the corresponding dimension?
3. For all array references, does each subscript have an integer
value? This is not necessarily an error in all languages, but it
is a dangerous practice.
4. For all references through pointer or reference variables, is
the referenced memory currently allocated? This is known as
the “dangling reference” problem. It occurs in situations
where the lifetime of a pointer is greater than the lifetime of
the referenced memory. One situation occurs where a
pointer references a local variable within a procedure, the
pointer value is assigned to an output parameter or a global
variable, the procedure returns (freeing the referenced loca-
tion), and later the program attempts to use the pointer
value. In a manner similar to checking for the prior errors,
try to prove informally that, in each reference using a pointer
variable, the reference memory exists.
5. When a memory area has alias names with differing attributes,
does the data value in this area have the correct attributes
when referenced via one of these names? Situations to look
for are the use of the EQUIVALENCE statement in FORTRAN,
and the REDEFINES clause in COBOL. As an example, a
FORTRAN program contains a real variable A and an integer
variable B;both are made aliases for the same memory area by
using an EQUIVALENCE statement. If the program stores a value
into A and then references variable B, an error is likely present
since the machine would use the floating-point bit representa-
tion in the memory area as an integer.
6. Does a variable’s value have a type or attribute other than
what the compiler expects? This situation might occur where
a C, C++, or COBOL program reads a record into memory
and references it by using a structure, but the physical repre-
sentation of the record differs from the structure definition.
7. Are there any explicit or implicit addressing problems if, on
the machine being used, the units of memory allocation are
smaller than the units of memory addressability? For instance,
in some environments, fixed-length bit strings do not neces-
sarily begin on byte boundaries, but addresses only point to
byte boundaries. If a program computes the address of a bit
string and later refers to the string through this address, the
wrong memory location may be referenced. This situation
also could occur when passing a bit-string argument to a
subroutine.
8. If pointer or reference variables are used, does the referenced
memory location have the attributes the compiler expects?
An example of such an error is where a C++ pointer upon
which a data structure is based is assigned the address of a dif-
ferent data structure.
9. If a data structure is referenced in multiple procedures or
subroutines, is the structure defined identically in each proce-
dure?
10. When indexing into a string, are the limits of the string off-
by-one errors in indexing operations or in subscript refer-
ences to arrays?
11. For object-oriented languages, are all inheritance require-
ments met in the implementing class?
[ Last edited by ylximu on 2005-7-21 at 08:34 ] |
|