From fb4643f7f121519da6194b4db5c5ce84369b6bf7 Mon Sep 17 00:00:00 2001 From: Matt Jones <47545907+SoundMatt@users.noreply.github.com> Date: Tue, 28 Jul 2026 14:52:03 -0700 Subject: [PATCH] =?UTF-8?q?feat:=20v0.5.47=20=E2=80=94=20x-FuSa=20spec=20v?= =?UTF-8?q?1.15.0=20adoption=20+=20deep-audit=20bug-fix=20sprint?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes issues #73-80 filed by a deep-audit pass that ran c-FuSa against its own codebase and diffed real output against the x-FuSa master spec. - HARA006 check rule + hara --format json completeness.asilMismatches: risk.asil is now cross-checked against the ISO 26262-3 Table 4 S x E x C derivation as a gating Finding, not just a hara-show text warning (#74). - hara --format json is now a verbatim passthrough of hazards[].source/ situations/safetyGoals, safetyGoals[].hazards/safeState, and the document attestation (#73). - fmea/tara/sci file/location.file are project-relative (including subdirectory) instead of a bare basename or a leaked absolute path, regardless of whether --dir is given relative or absolute (#77). - fmea/tara content generators no longer pick up standard-library calls or string-literal text as project components/assets — 18% of this repo's own previously-committed fmea.json was stdlib noise (#78). - fmea/tara 'standard' now emits the canonical lowercase id (iso26262/ iso21434) instead of a citation string (#75). - tara impact.* uses the v1.14.1 closed enum (critical/major/moderate/ negligible); risk is derived from the spec's combination table instead of an ad hoc score (#76). - cfusa fmea --output — previously undefined, so getopt_long's prefix matching silently treated it as an abbreviation of --output-dir (#79). - summary.coveragePct defensive clamp on fmea/tara, with regression tests using a non-trivial test-source tree (#80 point 3). - Shared cfusa_is_test_source_file()/cfusa_extract_call_name()/ cfusa_is_stdlib_call()/cfusa_relativize_path() utilities, replacing near-duplicate per-command scanners (#80 point 2's reuse guidance). - cfusa_walk_sources() now skips any build/build-*/build_* directory (matching this repo's own .gitignore), not just a fixed name enum — found while dogfooding the fmea/tara fix against this repo's own local build trees, which were being scanned as project source. Regenerated fmea.json/fmea.csv/tara.json/tara.md/safety-case.json/ safety-case.md against the fixes above. Attestation carry-forward (spec v1.15.0 point 1) was already conformant for fmea/tara/safety-case/sas before this PR; only hara's own JSON passthrough had a gap, closed above. Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com> --- .fusa-reqs.json | 11 + CHANGELOG.md | 85 + CMakeLists.txt | 3 +- cmd/cfusa/cmd_fmea.c | 99 +- cmd/cfusa/cmd_hara.c | 116 +- cmd/cfusa/cmd_safety_rules.c | 72 +- cmd/cfusa/cmd_sci.c | 20 +- cmd/cfusa/cmd_tara.c | 129 +- fmea.csv | 528 ++-- fmea.json | 4734 ++++++---------------------------- include/cfusa/asil.h | 20 + include/cfusa/utils.h | 51 + include/cfusa/version.h | 34 +- safety-case.json | 8 +- safety-case.md | 6 +- src/asil.c | 35 + src/utils.c | 171 +- tara.json | 128 +- tara.md | 27 +- tests/test_safety_rules.c | 64 +- tests/test_xfusa_v114.c | 377 ++- 21 files changed, 2165 insertions(+), 4553 deletions(-) create mode 100644 include/cfusa/asil.h create mode 100644 src/asil.c diff --git a/.fusa-reqs.json b/.fusa-reqs.json index 518e82c..94fe13d 100644 --- a/.fusa-reqs.json +++ b/.fusa-reqs.json @@ -31,6 +31,7 @@ {"id":"REQ-HARA007","title":"cfusa hara show displays hazard entries","standard":"ISO 26262-3","level":"ASIL-A"}, {"id":"REQ-HARA008","title":"cfusa hara asil computes ASIL from S/E/C","standard":"ISO 26262-3","level":"ASIL-A"}, {"id":"REQ-HARA009","title":"ASIL table follows ISO 26262-3:2018 Table 4","standard":"ISO 26262-3","level":"ASIL-D"}, + {"id":"REQ-HARA010","title":"check gates on stored hazard ASIL matching the S x E x C table","standard":"ISO 26262-3","level":"ASIL-D"}, {"id":"REQ-ENG001","title":"Engine registers rules up to CFUSA_MAX_RULES","standard":"ISO 26262","level":"ASIL-A"}, {"id":"REQ-ENG002","title":"Engine runs all registered rules","standard":"ISO 26262","level":"ASIL-A"}, {"id":"REQ-ENG003","title":"Engine can run rules by category","standard":"ISO 26262","level":"ASIL-A"}, @@ -338,14 +339,23 @@ {"id":"REQ-HARA-SCHEMA001","title":"cfusa hara init scaffolds empty operationalSituations/hazards/safetyGoals collections, never dummy rows","standard":"x-FuSa spec §1.2.5","level":"ASIL-D"}, {"id":"REQ-HARA-SCHEMA002","title":"cfusa hara show --format json reports completeness including safetyGoalsWithFssrRefs and danglingReferences","standard":"x-FuSa spec §1.2.5","level":"ASIL-B"}, {"id":"REQ-HARA-SCHEMA003","title":"cfusa hara show detects and gates on FUSA-STUB001 placeholder text in hazard/safety-goal descriptions","standard":"x-FuSa spec §1.6.1","level":"ASIL-D"}, + {"id":"REQ-HARA-SCHEMA004","title":"cfusa hara show --format json is a verbatim passthrough of hazards[].source/situations/safetyGoals, safetyGoals[].hazards/safeState, and the document attestation","standard":"x-FuSa spec §9.2","level":"ASIL-B"}, {"id":"REQ-FMEA-SCHEMA001","title":"cfusa fmea --format json emits ratingScale, failureMode/effect/cause, actionPriority, and summary.componentsInProject/coveragePct","standard":"x-FuSa spec §9.2","level":"ASIL-B"}, {"id":"REQ-FMEA-SCHEMA002","title":"cfusa fmea failureMode/effect/cause text varies per function rather than one fixed string for every entry","standard":"x-FuSa spec §1.6.1","level":"ASIL-B"}, + {"id":"REQ-FMEA-SCHEMA003","title":"cfusa fmea.json standard field is the canonical lowercase id (iso26262), not a display string","standard":"x-FuSa spec §2.4.1","level":"ASIL-B"}, + {"id":"REQ-FMEA-SCHEMA004","title":"cfusa fmea.json entries[].file is project-relative regardless of whether --dir is relative or absolute","standard":"x-FuSa spec §4","level":"ASIL-B"}, + {"id":"REQ-FMEA-SCHEMA005","title":"cfusa fmea excludes standard-library calls and string-literal text from componentsInProject/entries","standard":"x-FuSa spec §1.6 rule 4","level":"ASIL-B"}, {"id":"REQ-FMEA-COV001","title":"cfusa fmea --min-coverage N exits 1 when summary.coveragePct < N (N=0 disables the gate)","standard":"x-FuSa spec §9.2","level":"ASIL-B"}, + {"id":"REQ-FMEA-COV002","title":"cfusa fmea.json summary.coveragePct never exceeds 100 even with a non-trivial test-source tree","standard":"x-FuSa spec §9.2","level":"ASIL-B"}, {"id":"REQ-FMEA-ATTEST001","title":"cfusa fmea --attest stamps a valid §1.6.2 attestation that suppresses FUSA-STUB002","standard":"x-FuSa spec §1.6.2","level":"ASIL-B"}, + {"id":"REQ-FMEA-OUTPUT001","title":"cfusa fmea --output writes exactly that path, distinct from --output-dir","standard":"x-FuSa spec §9.2","level":"ASIL-B"}, {"id":"REQ-TARA-SCHEMA001","title":"cfusa tara --format json emits threats[].impact as an SFOP object and summary.assetInventoryMethod","standard":"x-FuSa spec §9.2","level":"ASIL-B"}, + {"id":"REQ-TARA-SCHEMA002","title":"cfusa tara.json standard field is the canonical lowercase id (iso21434), impact.* uses the critical/major/moderate/negligible closed enum, and risk is derived from the spec's combination table","standard":"x-FuSa spec §9.2","level":"ASIL-B"}, + {"id":"REQ-TARA-SCHEMA003","title":"cfusa tara.json threats[].location.file is project-relative and excludes standard-library calls/string-literal text","standard":"x-FuSa spec §4","level":"ASIL-B"}, {"id":"REQ-TARA006","title":"cfusa tara summary rolls up assetsAnalyzed/assetsInProject/coveragePct/assetInventoryMethod","standard":"ISO 21434","level":"ASIL-B"}, + {"id":"REQ-TARA-COV001","title":"cfusa tara.json summary.coveragePct never exceeds 100 even with a non-trivial test-source tree","standard":"x-FuSa spec §9.2","level":"ASIL-B"}, {"id":"REQ-SC002","title":"cfusa safety-case --format json emits nodes[]/edges[]/completeness using the six GSN node types","standard":"x-FuSa spec §9.2","level":"ASIL-B"}, {"id":"REQ-SC003","title":"cfusa safety-case solution nodes cite evidence only for files that actually exist in the project","standard":"x-FuSa spec §9.2","level":"ASIL-B"}, @@ -354,6 +364,7 @@ {"id":"REQ-SAS-SCHEMA001","title":"cfusa sas --format json emits checklist[]/summary and always writes the sas.md companion","standard":"x-FuSa spec §9.3","level":"ASIL-A"}, {"id":"REQ-SCI-SCHEMA001","title":"cfusa sci --format json emits artifacts[].hash as sha256:-prefixed per x-FuSa spec §2.7","standard":"x-FuSa spec §2.7","level":"ASIL-A"}, + {"id":"REQ-SCI-SCHEMA002","title":"cfusa sci.json artifacts[].file is project-relative even when --dir is given as an absolute path","standard":"x-FuSa spec §4","level":"ASIL-A"}, {"id":"REQ-FSR-CHECK001","title":"cfusa check/lint shall not suppress or omit any finding for which the rule engine is configured to detect (functional safety requirement decomposing .fusa-hara.json SG-001)","standard":"ISO 26262-3","level":"ASIL-C"}, {"id":"REQ-FSR-CHECK002","title":"cfusa check shall keep its false-positive rate low enough, via the disposition system, that it does not cause systematic check-disabling (functional safety requirement decomposing .fusa-hara.json SG-002)","standard":"ISO 26262-3","level":"ASIL-C"} diff --git a/CHANGELOG.md b/CHANGELOG.md index 8033b0d..031b7bf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,91 @@ and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0. ## [Unreleased] +## v0.5.47 — 2026-07-28 + +x-FuSa spec v1.15.0 adoption + deep-audit bug-fix sprint (issues #73-80): +`hara`/`fmea`/`tara`/`sci` schema-conformance fixes found by running the +tool against its own codebase and diffing real output against the spec. + +### Added +- **HARA006 `check` engine rule.** `risk.asil` is now cross-checked against + the ISO 26262-3 Table 4 S x E x C derivation both as a `check`-gating + `Finding` (HARA006) and in `hara --format json`'s new + `completeness.asilMismatches` count — previously the mismatch only + surfaced as a `hara show` (text) warning line that never affected any + exit code or machine-readable output (#74). The S x E x C table itself is + now `src/asil.c`'s shared `cfusa_compute_asil()`, used by both call sites + instead of a copy local to `cmd_hara.c`. +- **`hara --format json` verbatim passthrough.** `hazards[].source`/ + `situations`/`safetyGoals` and `safetyGoals[].hazards`/`safeState` are no + longer silently dropped, and a document-level `attestation` (when present + in `.fusa-hara.json`) is now passed through — closing the gap between + what `hara show` (text) already displayed and what a consumer of the + JSON contract could actually see (#73). +- **`cfusa fmea --output `.** `fmea` previously defined only + `--output-dir `, so GNU `getopt_long`'s unambiguous-prefix matching + silently treated `--output ` (the exact form the CLI synopsis in + §9.2 documents) as an abbreviation of `--output-dir`, writing a bogus + `/fmea.json` and failing with a confusing error instead of either + working or rejecting cleanly (#79). +- Shared `src/utils.c` helpers: `cfusa_relativize_path()` (the one + canonical project-relative-path implementation, replacing ad hoc copies + in `cfusa_report_add()`/`cmd_trace.c`), `cfusa_is_test_source_file()`, + `cfusa_is_stdlib_call()`, and `cfusa_extract_call_name()` — the last two + centralise the "does this line look like a real call/definition site" + heuristic previously duplicated (and independently under-guarded) in + `cmd_fmea.c`'s `fmea_line()` and `cmd_tara.c`'s `asset_line()`, per the + x-FuSa spec §1.6 rule 4 implementation note. +- Regenerated this repo's own `fmea.json`/`fmea.csv`, `tara.json`/`tara.md`, + and `safety-case.json`/`safety-case.md` against the fixes below — + dogfooding, same convention as v0.5.46. + +### Fixed +- **`fmea.json`/`tara.json` picked up standard-library calls and + string-literal text as project components/assets (#78).** The scanner's + naive paren-based heuristic found the first `(` on a line without regard + to whether it sat inside a quoted string (misreading a qualification + test-case description like `"strcpy() triggers CY001"` as a call to a + function named `"strcpy`, leading-quote included), and never excluded + well-known libc calls (`fprintf`/`snprintf`/`printf`/`malloc`/`memcpy`/... + — 67 of 370 entries, 18%, in this repo's own previously-committed + `fmea.json`). `cfusa_extract_call_name()` now requires the `(` to be + outside a string literal and excludes standard-library identifiers + outright. `cfusa_walk_sources()` also skipped only a fixed directory-name + enum (`build`/`vendor`/`build-cov`/`node_modules`); a local working tree + with other build-type variants side by side (`build-asan`, + `build_fortify`, ...) had every one of them scanned as project source + too, picking up CMake's own generated `CompilerIdC` probe. Both are §1.6 + rule 4 "real referents only" violations; `cfusa_walk_sources()` now skips + any `build`/`build-*`/`build_*` directory, matching this project's own + `.gitignore` convention. +- **`fmea.json`/`tara.json` truncated `file` to a bare basename; `sci.json` + emitted an absolute path when `--dir` was given absolute (#77).** + `cfusa_relativize_path()` now relativizes against the literal `--dir` + value used to build each scanned path (deliberately *not* + `realpath(dir)` — see its doc comment: `path` is always built by + concatenating the literal `--dir`, and resolving symlinks first can + silently break the prefix match, e.g. macOS aliases `/tmp` to + `/private/tmp`), applied to `fmea`/`tara`'s entry `file` and `sci`'s + `artifacts[].file`. +- **`fmea.json`/`tara.json` `standard` was a citation string, not the + canonical id (#75).** `"IEC 60812:2018 / ISO 26262-5"` -> `"iso26262"`; + `"ISO/SAE 21434:2021 Clause 15"` -> `"iso21434"`, matching + `safety-case.json`'s existing (correct) convention and x-FuSa spec + §2.4.1's "never a display string" rule. +- **`tara.json` `impact.*` used `high|medium|low`, and `risk` was an ad hoc + score (#76).** The four category profiles now emit the v1.14.1 closed + enum (`critical|major|moderate|negligible`), and `risk` is a literal + lookup against the x-FuSa spec §9.2 combination table (highest-ranked + SFOP impact x `attackFeasibility`) instead of an independently-invented + `feasibility_rank x impact_rank` numeric threshold that didn't correspond + to the table's cells. +- **`summary.coveragePct` defensive clamp (fmea/tara, #80).** Added + `if (coveragePct > 100) coveragePct = 100;` to both commands per the + x-FuSa spec §9.2 MUST, plus a regression test with a non-trivial + test-source tree on each (a fixture with no `test_*.c`-equivalent + directory can't exercise the bug this clamp guards against). + ## v0.5.46 — 2026-07-28 x-FuSa spec v1.13.0/v1.14.0 conformance sprint (issue #71): `hara`/`fmea`/ diff --git a/CMakeLists.txt b/CMakeLists.txt index ff6bf23..cd27470 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -1,6 +1,6 @@ cmake_minimum_required(VERSION 3.16) project(cfusa - VERSION 0.5.46 + VERSION 0.5.47 DESCRIPTION "C functional safety toolkit" LANGUAGES C ) @@ -38,6 +38,7 @@ add_library(cfusa_core STATIC src/utils.c src/cfusa_runtime.c src/qualitybar.c + src/asil.c ) target_include_directories(cfusa_core PUBLIC include) set_target_properties(cfusa_core PROPERTIES diff --git a/cmd/cfusa/cmd_fmea.c b/cmd/cfusa/cmd_fmea.c index fbebce7..1391e08 100644 --- a/cmd/cfusa/cmd_fmea.c +++ b/cmd/cfusa/cmd_fmea.c @@ -23,6 +23,11 @@ #define MAX_FUNS 1024 #define FMEA_RATING_SCALE "cfusa-heuristic-1-10" +/* Resolved absolute --dir, for project-relative `file` fields (x-FuSa spec + * §4) regardless of whether --dir itself was given relative or absolute — + * same pattern as cmd_trace.c's g_dir_abs. */ +static char g_dir_abs[512]; + typedef struct { char name[128]; char file[256]; @@ -104,30 +109,14 @@ static void render_cause(char *out, size_t sz, const fn_entry_t *fn) static void fmea_line(const char *path, int lineno, const char *line, void *vctx) { (void)vctx; - const char *p = line; - while (*p == ' ' || *p == '\t') p++; - if (!*p || *p == '/' || *p == '#' || *p == '*' || *p == '}') return; - static const char * const skip_kw[] = { - "if ","for ","while ","switch ","return ","else ","case ", - "typedef ","struct ","enum ","union ","static ","extern ","inline ",NULL - }; - for (int i = 0; skip_kw[i]; i++) - if (strncmp(p, skip_kw[i], strlen(skip_kw[i])) == 0) return; - if (!strstr(line,"(") || !strstr(line,")")) return; - const char *end = line + strlen(line); - while (end > line && (end[-1]==' '||end[-1]=='\t'||end[-1]=='\n'||end[-1]=='\r')) end--; - if (end > line && end[-1] == ';') return; - - char *paren = strchr((char*)p, '('); - if (!paren) return; - char before[128] = ""; - size_t bl = (size_t)(paren - p); - if (bl == 0 || bl >= 128) return; - strncpy(before, p, bl); before[bl] = '\0'; - char *sp = strrchr(before, ' '); - char *fn_name = sp ? sp + 1 : before; - while (*fn_name == '*') fn_name++; - if (!*fn_name || strlen(fn_name) < 2) return; + /* cfusa_extract_call_name() (src/utils.c) centralises the match + * heuristic that used to live here: skip control-flow/storage-class + * keywords (word-boundary aware, so "if(" and "if " are both caught), + * require the "(" to be outside a string literal (a test-fixture + * description string is not a call site), and exclude standard-library + * calls outright — x-FuSa spec §1.6 rule 4 ("real referents only"). */ + char fn_name[128]; + if (!cfusa_extract_call_name(line, fn_name, sizeof(fn_name))) return; /* Counted for componentsInProject regardless of the per-run table cap, * so coveragePct honestly reflects truncation on very large projects @@ -136,24 +125,23 @@ static void fmea_line(const char *path, int lineno, const char *line, void *vctx if (g_fn_count >= MAX_FUNS) return; strncpy(g_fns[g_fn_count].name, fn_name, 127); - strncpy(g_fns[g_fn_count].file, path, 255); + /* Project-relative (x-FuSa spec §4), regardless of whether --dir was + * given relative or absolute. */ + cfusa_relativize_path(g_dir_abs, path, g_fns[g_fn_count].file, + sizeof(g_fns[g_fn_count].file)); g_fns[g_fn_count].line = lineno; infer_profile(fn_name, &g_fns[g_fn_count]); g_fn_count++; } -/* Mirrors cmd_trace.c's is_test_file(): a design FMEA is over the +/* Mirrors trace --func-coverage's is_test_file(): a design FMEA is over the * project's own safety-relevant public functions, not its test scaffolding * — same exclusion used by trace --func-coverage's componentsInProject- * equivalent denominator (x-FuSa spec §1.4.1/§5), which this command's * summary.componentsInProject is intentionally aligned with. */ static int fmea_is_test_file(const char *path) { - const char *b = strrchr(path, '/'); - b = b ? b + 1 : path; - if (strncmp(b, "test_", 5) == 0) return 1; - size_t n = strlen(b); - return n > 7 && strcmp(b + n - 7, "_test.c") == 0; + return cfusa_is_test_source_file(path); } static int fmea_file(const char *path, void *v) @@ -184,7 +172,7 @@ static size_t fmea_canonical_content(char *buf, size_t bufsz) "\"effect\":\"%s\",\"failureMode\":\"%s\",\"file\":\"%s\",\"id\":\"FM-%03d\"," "\"item\":\"%s\",\"occurrence\":%d,\"severity\":%d}", i ? "," : "", g_fns[i].action_priority, esc_ca, g_fns[i].detection, esc_ef, esc_fm, - cfusa_basename(g_fns[i].file), i + 1, esc_item, g_fns[i].occurrence, + g_fns[i].file, i + 1, esc_item, g_fns[i].occurrence, g_fns[i].severity); } off += (size_t)snprintf(buf + off, off < bufsz ? bufsz - off : 0, "]}"); @@ -264,7 +252,7 @@ static void write_entry_json(FILE *f, const fn_entry_t *fn, int idx, int last, i " \"mitigations\": [],\n" " \"requirementIds\": []%s\n" " }%s\n", - idx + 1, esc_item, cfusa_basename(fn->file), fn->line, + idx + 1, esc_item, fn->file, fn->line, esc_fm, esc_ef, esc_ca, fn->severity, fn->occurrence, fn->detection, fn->action_priority, with_cyber ? ",\n \"cyberFailureMode\": \"\"" : "", @@ -275,6 +263,7 @@ int cmd_fmea(int argc, char **argv) { const char *dir = "."; const char *out_dir = NULL; /* --output-dir (go-FuSa style) */ + const char *output = NULL; /* --output — exact path, distinct from --output-dir */ const char *fmt_s = NULL; /* NULL → both json+csv; "md"/"json"/"csv" → single */ const char *attest = NULL; /* --attest convenience flag */ int with_cyber = 0; @@ -285,6 +274,7 @@ int cmd_fmea(int argc, char **argv) static const struct option lo[] = { {"dir", required_argument, NULL, 'd'}, {"output-dir", required_argument, NULL, 'D'}, + {"output", required_argument, NULL, 'o'}, {"format", required_argument, NULL, 'f'}, {"cyber", no_argument, NULL, 'c'}, {"strict", no_argument, NULL, 'S'}, @@ -296,10 +286,11 @@ int cmd_fmea(int argc, char **argv) }; int ch; optind = 1; - while ((ch = getopt_long(argc, argv, "d:D:f:cSAT:m:h", lo, NULL)) != -1) { + while ((ch = getopt_long(argc, argv, "d:D:o:f:cSAT:m:h", lo, NULL)) != -1) { switch (ch) { case 'd': dir = optarg; break; case 'D': out_dir = optarg; break; + case 'o': output = optarg; break; case 'f': fmt_s = optarg; break; case 'c': with_cyber = 1; break; case 'S': strict = 1; break; @@ -307,14 +298,16 @@ int cmd_fmea(int argc, char **argv) case 'T': attest = optarg; break; case 'm': min_coverage = atoi(optarg); break; case 'h': - printf("Usage: cfusa fmea [--dir ] [--output-dir ]\n" + printf("Usage: cfusa fmea [--dir ] [--output-dir ] [--output ]\n" " [--format md|json|csv] [--cyber]\n" " [--strict] [--require-attestation] [--attest ]\n" " [--min-coverage N]\n\n" "Generates a design FMEA from public function signatures\n" "(IEC 60812 / ISO 26262-5 / AIAG-VDA FMEA Handbook).\n" "Default: generates both fmea.json and fmea.csv.\n" - "--format md generates fmea.md instead.\n" + "--format md|json|csv generates a single file of that format instead.\n" + "--output writes exactly that path (implies --format json\n" + " unless --format is also given).\n" "--cyber enriches entries with cybersecurity failure modes.\n" "--strict implies --require-attestation.\n" "--require-attestation escalates an unsuppressed FUSA-STUB002 to exit 1.\n" @@ -330,6 +323,10 @@ int cmd_fmea(int argc, char **argv) cfusa_config_load(dir, &cfg); g_fn_count = 0; g_total_found = 0; + /* Deliberately the literal --dir value, not realpath(dir) — see + * cfusa_relativize_path()'s doc comment for why. */ + strncpy(g_dir_abs, dir, sizeof(g_dir_abs) - 1); + g_dir_abs[sizeof(g_dir_abs) - 1] = '\0'; static const char * const exts[] = {".c"}; cfusa_walk_sources(dir, exts, 1, fmea_file, NULL); @@ -338,6 +335,13 @@ int cmd_fmea(int argc, char **argv) char ts[32]; cfusa_timestamp_now(ts); int coverage_pct = (g_total_found == 0) ? 100 : (g_fn_count * 100 / g_total_found); + /* x-FuSa spec §9.2: coveragePct MUST NOT exceed 100. Structurally + * g_fn_count <= g_total_found already (every match increments + * g_total_found; g_fn_count only when under the MAX_FUNS cap), so this + * is defense-in-depth against a future accounting change rather than a + * currently-reachable path — the spec's rollout audit found this + * exceeded in other tools precisely when that invariant silently broke. */ + if (coverage_pct > 100) coverage_pct = 100; int high = 0; for (int i = 0; i < g_fn_count; i++) if (strcmp(g_fns[i].action_priority, "high") == 0) high++; @@ -402,7 +406,7 @@ int cmd_fmea(int argc, char **argv) printf("FMEA written to %s (%d functions)\n", _p, g_fn_count); \ } while(0) - if (!fmt_s) { + if (!fmt_s && !output) { /* Default: generate both fmea.json and fmea.csv (go-FuSa style) */ FILE *jf, *cf; OPEN_OUT("fmea.json", jf); @@ -418,7 +422,7 @@ int cmd_fmea(int argc, char **argv) " \"generatedAt\": \"%s\",\n" " \"project\": \"%s\",\n" " \"version\": \"%s\",\n" - " \"standard\": \"IEC 60812:2018 / ISO 26262-5\",\n" + " \"standard\": \"iso26262\",\n" " \"ratingScale\": \"" FMEA_RATING_SCALE "\",\n" " \"entries\": [\n", ts, cfg.project, cfg.version); @@ -457,11 +461,20 @@ int cmd_fmea(int argc, char **argv) return qb_gate || cov_gate; } - cfusa_format_t fmt = cfusa_format_parse(fmt_s); - const char *def_name = (fmt == FMT_JSON) ? "fmea.json" : - (fmt == FMT_CSV) ? "fmea.csv" : "fmea.md"; + /* --output with no --format defaults to JSON — the canonical, + * schema-formalized shape (x-FuSa spec §9.2) and the format anyone + * scripting a specific --output path is most likely after. */ + cfusa_format_t fmt = cfusa_format_parse(fmt_s ? fmt_s : "json"); FILE *f; - OPEN_OUT(def_name, f); + if (output) { + f = cfusa_fopen_write(output); + if (!f) { perror(output); return 3; } + printf("FMEA written to %s (%d functions)\n", output, g_fn_count); + } else { + const char *def_name = (fmt == FMT_JSON) ? "fmea.json" : + (fmt == FMT_CSV) ? "fmea.csv" : "fmea.md"; + OPEN_OUT(def_name, f); + } if (fmt == FMT_JSON) { fprintf(f, @@ -474,7 +487,7 @@ int cmd_fmea(int argc, char **argv) " \"generatedAt\": \"%s\",\n" " \"project\": \"%s\",\n" " \"version\": \"%s\",\n" - " \"standard\": \"IEC 60812:2018 / ISO 26262-5\",\n" + " \"standard\": \"iso26262\",\n" " \"ratingScale\": \"" FMEA_RATING_SCALE "\",\n" " \"entries\": [\n", ts, cfg.project, cfg.version); diff --git a/cmd/cfusa/cmd_hara.c b/cmd/cfusa/cmd_hara.c index d66c5a5..06e76d9 100644 --- a/cmd/cfusa/cmd_hara.c +++ b/cmd/cfusa/cmd_hara.c @@ -7,6 +7,7 @@ #include #include #include +#include "cfusa/asil.h" #include "cfusa/config.h" #include "cfusa/qualitybar.h" #include "cfusa/utils.h" @@ -39,40 +40,11 @@ #define REF_LEN 32 /* - * ISO 26262-3:2018 Table 4 ASIL determination with C0 extension. - * Indices: [S1-S3][E1-E4][C0-C3] — parity with go-FuSa DetermineASIL. + * ISO 26262-3:2018 Table 4 ASIL determination with C0 extension is now the + * shared cfusa_compute_asil() (src/asil.c) — also used by check's HARA006 + * rule (cmd_safety_rules.c) so both call sites are provably consistent. */ //cfusa:req REQ-HARA001 REQ-HARA002 REQ-HARA003 REQ-HARA004 REQ-HARA005 REQ-HARA006 REQ-HARA007 REQ-HARA008 REQ-HARA009 -static const char *asil_table[3][4][4] = { - /* S1: slight to moderate injuries */ - { - {"QM","QM","QM","QM"}, /* E1: C0,C1,C2,C3 */ - {"QM","QM","QM","QM"}, /* E2 */ - {"QM","QM","QM","ASIL-A"}, /* E3 */ - {"QM","QM","ASIL-A","ASIL-B"} /* E4 */ - }, - /* S2: severe/life-threatening injuries, survival probable */ - { - {"QM","QM","QM","QM"}, /* E1 */ - {"QM","QM","ASIL-A","ASIL-B"}, /* E2 */ - {"QM","ASIL-A","ASIL-B","ASIL-C"}, /* E3 */ - {"ASIL-A","ASIL-B","ASIL-C","ASIL-D"} /* E4 */ - }, - /* S3: life-threatening injuries, survival uncertain / fatal */ - { - {"QM","ASIL-A","ASIL-B","ASIL-C"}, /* E1 */ - {"ASIL-A","ASIL-B","ASIL-C","ASIL-D"}, /* E2 */ - {"ASIL-B","ASIL-C","ASIL-D","ASIL-D"}, /* E3 */ - {"ASIL-C","ASIL-D","ASIL-D","ASIL-D"} /* E4 */ - } -}; - -static const char *compute_asil(int s, int e, int c) -{ - /* s: 1-3 (S1-S3), e: 1-4 (E1-E4), c: 0-3 (C0-C3) */ - if (s < 1 || s > 3 || e < 1 || e > 4 || c < 0 || c > 3) return "QM"; - return asil_table[s - 1][e - 1][c]; -} static void do_asil(int s, int e, int c) { @@ -80,7 +52,7 @@ static void do_asil(int s, int e, int c) printf(" Severity S%d\n", s); printf(" Exposure E%d\n", e); printf(" Controllability C%d\n", c); - printf(" Result %s\n", compute_asil(s, e, c)); + printf(" Result %s\n", cfusa_compute_asil(s, e, c)); } /* Parse a "Sx"/"Ex"/"Cx" (or bare "x") code into an integer. */ @@ -649,7 +621,7 @@ static int do_show(const char *dir, FILE *out, int require_attestation) hazard_entry_t *h = &doc.hazards[i]; int s = parse_sec_code(h->severity), e = parse_sec_code(h->exposure), c = parse_sec_code(h->controllability); - const char *computed = compute_asil(s, e, c); + const char *computed = cfusa_compute_asil(s, e, c); fprintf(out, "\n%s [%s]\n", h->id, h->asil[0] ? h->asil : "(no asil)"); fprintf(out, " Description: %s\n", h->description); fprintf(out, " %s/%s/%s\n", h->severity, h->exposure, h->controllability); @@ -691,10 +663,21 @@ static int do_show_json(const char *dir, FILE *out, int require_attestation) parse_hara_doc(content, len, &doc); int total_hazards = doc.hazards_count, hazards_with_asil = 0, hazards_with_sg = 0; - int goals_with_fssr = 0, dangling = 0; + int goals_with_fssr = 0, dangling = 0, asil_mismatches = 0; for (int i = 0; i < total_hazards; i++) { - if (doc.hazards[i].asil[0]) hazards_with_asil++; - if (doc.hazards[i].safety_goals_count > 0) hazards_with_sg++; + hazard_entry_t *h = &doc.hazards[i]; + if (h->asil[0]) hazards_with_asil++; + if (h->safety_goals_count > 0) hazards_with_sg++; + /* x-FuSa spec §1.2.5: risk.asil MUST derive from S×E×C (ISO 26262-3 + * Table 4) — cross-check the stored value the same way `hara show` + * (text) already warns about, but surface it in the JSON + * completeness block too so it's machine-checkable, not just a + * human-readable warning line. */ + if (h->asil[0] && h->severity[0] && h->exposure[0] && h->controllability[0]) { + int s = parse_sec_code(h->severity), e = parse_sec_code(h->exposure), + c = parse_sec_code(h->controllability); + if (strcmp(cfusa_compute_asil(s, e, c), h->asil) != 0) asil_mismatches++; + } } char req_ids[MAX_REQ_IDS][REF_LEN]; int req_count = load_req_ids(dir, req_ids); @@ -726,15 +709,27 @@ static int do_show_json(const char *dir, FILE *out, int require_attestation) } fprintf(out, " ],\n"); + /* x-FuSa spec §9.2: `hara --format json` MUST be a verbatim passthrough + * of .fusa-hara.json's own §1.2.5 shape — source/situations/safetyGoals + * on each hazard, and hazards/safeState on each safety goal, not just + * the id/description/risk subset. */ fprintf(out, " \"hazards\": [\n"); for (int i = 0; i < doc.hazards_count; i++) { hazard_entry_t *h = &doc.hazards[i]; char esc[256]; cfusa_str_escape_json(h->description, esc, sizeof(esc)); - fprintf(out, " {\"id\": \"%s\", \"description\": \"%s\", \"risk\": " + char esc_src[128]; cfusa_str_escape_json(h->source, esc_src, sizeof(esc_src)); + fprintf(out, " {\"id\": \"%s\", \"description\": \"%s\", \"source\": \"%s\", " + "\"situations\": [", + h->id, esc, esc_src); + for (int k = 0; k < h->situations_count; k++) + fprintf(out, "%s\"%s\"", k ? ", " : "", h->situations[k]); + fprintf(out, "], \"risk\": " "{\"severity\": \"%s\", \"exposure\": \"%s\", \"controllability\": \"%s\", " - "\"asil\": \"%s\"}}%s\n", - h->id, esc, h->severity, h->exposure, h->controllability, h->asil, - (i < doc.hazards_count - 1) ? "," : ""); + "\"asil\": \"%s\"}, \"safetyGoals\": [", + h->severity, h->exposure, h->controllability, h->asil); + for (int k = 0; k < h->safety_goals_count; k++) + fprintf(out, "%s\"%s\"", k ? ", " : "", h->safety_goals[k]); + fprintf(out, "]}%s\n", (i < doc.hazards_count - 1) ? "," : ""); } fprintf(out, " ],\n"); @@ -742,8 +737,13 @@ static int do_show_json(const char *dir, FILE *out, int require_attestation) for (int i = 0; i < doc.goals_count; i++) { safety_goal_entry_t *g = &doc.goals[i]; char esc[256]; cfusa_str_escape_json(g->description, esc, sizeof(esc)); - fprintf(out, " {\"id\": \"%s\", \"description\": \"%s\", \"asil\": \"%s\", \"fssrRefs\": [", - g->id, esc, g->asil); + char esc_safe[128]; cfusa_str_escape_json(g->safe_state, esc_safe, sizeof(esc_safe)); + fprintf(out, " {\"id\": \"%s\", \"description\": \"%s\", \"hazards\": [", + g->id, esc); + for (int k = 0; k < g->hazards_count; k++) + fprintf(out, "%s\"%s\"", k ? ", " : "", g->hazards[k]); + fprintf(out, "], \"asil\": \"%s\", \"safeState\": \"%s\", \"fssrRefs\": [", + g->asil, esc_safe); for (int k = 0; k < g->fssr_refs_count; k++) fprintf(out, "%s\"%s\"", k ? ", " : "", g->fssr_refs[k]); fprintf(out, "]}%s\n", (i < doc.goals_count - 1) ? "," : ""); @@ -753,10 +753,32 @@ static int do_show_json(const char *dir, FILE *out, int require_attestation) fprintf(out, " \"completeness\": {\n" " \"totalHazards\": %d, \"hazardsWithAsil\": %d, \"hazardsWithSafetyGoal\": %d,\n" - " \"safetyGoalsWithFssrRefs\": %d, \"danglingReferences\": %d\n" - " }\n" - "}\n", - total_hazards, hazards_with_asil, hazards_with_sg, goals_with_fssr, dangling); + " \"safetyGoalsWithFssrRefs\": %d, \"danglingReferences\": %d, " + "\"asilMismatches\": %d\n" + " }", + total_hazards, hazards_with_asil, hazards_with_sg, goals_with_fssr, dangling, + asil_mismatches); + + /* x-FuSa spec §1.6.2: an attestation on the input file is a passthrough + * into the report, not something `hara` re-derives (it has no --attest + * flag of its own — the attestation is authored alongside the rest of + * .fusa-hara.json). */ + if (doc.attestation.present) { + fprintf(out, + ",\n \"attestation\": {\n" + " \"status\": \"%s\",\n" + " \"implementationAuthor\": \"%s\",\n" + " \"independentReviewer\": \"%s\",\n" + " \"reviewedAt\": \"%s\",\n" + " \"contentHash\": \"%s\"\n" + " }\n", + doc.attestation.status[0] ? doc.attestation.status : "heuristic", + doc.attestation.implementation_author, doc.attestation.independent_reviewer, + doc.attestation.reviewed_at, doc.attestation.content_hash); + } else { + fprintf(out, "\n"); + } + fprintf(out, "}\n"); /* Quality-bar scan drives the exit code but is not re-printed as JSON * members here (this document mirrors the x-FuSa spec §9.2 shape diff --git a/cmd/cfusa/cmd_safety_rules.c b/cmd/cfusa/cmd_safety_rules.c index b975aa5..6272d29 100644 --- a/cmd/cfusa/cmd_safety_rules.c +++ b/cmd/cfusa/cmd_safety_rules.c @@ -2,7 +2,7 @@ * cmd_safety_rules.c — Project-level safety engine rules. * * Registers rules that run during `cfusa check`: - * HARA001-005 — HARA file and content validation (ISO 26262-3) + * HARA001-006 — HARA file and content validation (ISO 26262-3) * ISO26262001-3 — ISO 26262 evidence and qualification checks * COUP001-003 — Data/control coupling (DO-178C §6.4.4.3) * DISP001 — Undispositioned ERROR findings @@ -16,12 +16,13 @@ #include #include #include +#include "cfusa/asil.h" #include "cfusa/engine.h" #include "cfusa/report.h" #include "cfusa/config.h" #include "cfusa/utils.h" -//cfusa:req REQ-HARA001 REQ-HARA002 REQ-HARA003 REQ-HARA004 REQ-HARA005 +//cfusa:req REQ-HARA001 REQ-HARA002 REQ-HARA003 REQ-HARA004 REQ-HARA005 REQ-HARA010 //cfusa:req REQ-COUPLING001 REQ-COUPLING002 REQ-COUPLING003 //cfusa:req REQ-DISP001 REQ-COMP001 @@ -381,6 +382,69 @@ static int rule_hara005(const char *dir, const cfusa_config_t *cfg, return 0; } +/* ── HARA006 — stored ASIL must match the S×E×C table (x-FuSa spec §1.2.5) ── */ + +/* `hara show` (text mode) has long printed a "stored ASIL differs from + * computed" warning line, but that never became a `Finding` and never + * gated `check`'s exit code — a hazard could carry a self-consistent- + * looking but wrong ASIL and pass every machine-readable gate. This rule + * recomputes ISO 26262-3 Table 4 from each hazard's own S/E/C and compares + * it to the stored risk.asil, the same way cmd_hara.c's do_show()/ + * do_show_json() now do (via the shared cfusa_compute_asil()), so the + * mismatch also surfaces here where it can fail `check`. */ +static int rule_hara006(const char *dir, const cfusa_config_t *cfg, + cfusa_report_t *rpt) +{ + (void)cfg; + size_t len; char *json = read_file_at(dir, ".fusa-hara.json", &len); + if (!json) json = read_file_at(dir, ".cfusa-hara.json", &len); + if (!json) return 0; /* HARA001 already fired */ + + const char *hz_end = NULL; + const char *hz_start = json_bracket(json, "hazards", '[', ']', &hz_end); + + int findings = 0; + if (hz_start) { + const char *p = hz_start; + while ((p = strstr(p, "\"id\"")) != NULL && p < hz_end) { + char id[64] = ""; + const char *blk = p; + const char *blk_end = strstr(blk + 1, "\"id\""); + if (!blk_end || blk_end > hz_end) blk_end = hz_end; + + json_str_field(blk, blk_end, "id", id, sizeof(id)); + + const char *risk_end = NULL; + const char *risk = json_bracket(blk, "risk", '{', '}', &risk_end); + char sevs[8] = "", exps[8] = "", ctls[8] = "", asils[16] = ""; + if (risk && risk < blk_end) { + json_str_field(risk, risk_end, "severity", sevs, sizeof(sevs)); + json_str_field(risk, risk_end, "exposure", exps, sizeof(exps)); + json_str_field(risk, risk_end, "controllability", ctls, sizeof(ctls)); + json_str_field(risk, risk_end, "asil", asils, sizeof(asils)); + } + + if (id[0] && sevs[0] && exps[0] && ctls[0] && asils[0]) { + int sev = json_sec_code(sevs), exp = json_sec_code(exps), + ctl = json_sec_code(ctls); + const char *computed = cfusa_compute_asil(sev, exp, ctl); + if (strcmp(computed, asils) != 0) { + cfusa_report_add(rpt, "HARA006", "safety", SEV_ERROR, + ".fusa-hara.json", 0, + "hazard '%s' has stored ASIL %s but S%d/E%d/C%d derives to %s " + "per ISO 26262-3 Table 4 (x-FuSa spec §1.2.5 — risk.asil MUST " + "derive from severity x exposure x controllability)", + id, asils, sev, exp, ctl, computed); + findings++; + } + } + p = blk_end; + } + } + free(json); + return findings; +} + /* ── ISO26262001 — iso26262-gap-report.json should be present ─────────── */ static int rule_iso26262001(const char *dir, const cfusa_config_t *cfg, @@ -886,6 +950,10 @@ static const cfusa_rule_t SAFETY_RULES[] = { {"HARA005", "safety", "HARA max ASIL within project ASIL", "Hazard ASIL must not exceed project ASIL in .fusa.json", "ISO 26262-3", rule_hara005}, + {"HARA006", "safety", "HARA stored ASIL matches S x E x C table", + "risk.asil MUST derive from severity x exposure x controllability " + "(ISO 26262-3 Table 4, x-FuSa spec §1.2.5)", + "ISO 26262-3", rule_hara006}, /* ISO 26262 */ {"ISO26262001", "safety", "ISO 26262 gap report present", "iso26262-gap-report.json should be generated and committed", diff --git a/cmd/cfusa/cmd_sci.c b/cmd/cfusa/cmd_sci.c index dcf1f0a..7eb4515 100644 --- a/cmd/cfusa/cmd_sci.c +++ b/cmd/cfusa/cmd_sci.c @@ -18,6 +18,7 @@ typedef struct { FILE *out; const char *fmt; /* "text" or "md" or "json" */ const char *version; + char dir_abs[512]; /* resolved --dir, for §4 project-relative paths */ int count; int first; } sci_ctx_t; @@ -28,14 +29,20 @@ static int sci_file(const char *path, void *vctx) char hex[65]; cfusa_sha256_file(path, hex); + /* x-FuSa spec §4: location.file (here, artifacts[].file) MUST be + * project-relative, never absolute — even when --dir itself was given + * as an absolute path. */ + char rel[512]; + cfusa_relativize_path(ctx->dir_abs, path, rel, sizeof(rel)); + if (!strcmp(ctx->fmt,"json")) { fprintf(ctx->out, "%s\n {\"file\": \"%s\", \"hash\": \"sha256:%s\", \"version\": \"%s\"}", - ctx->first ? "" : ",", path, hex, ctx->version); + ctx->first ? "" : ",", rel, hex, ctx->version); ctx->first = 0; } else if (!strcmp(ctx->fmt,"md")) { - fprintf(ctx->out, "| %s | `sha256:%s` |\n", path, hex); + fprintf(ctx->out, "| %s | `sha256:%s` |\n", rel, hex); } else { - fprintf(ctx->out, "%-60s sha256:%s\n", path, hex); + fprintf(ctx->out, "%-60s sha256:%s\n", rel, hex); } ctx->count++; return 0; @@ -109,7 +116,12 @@ int cmd_sci(int argc, char **argv) "----------------------------------------------------------------"); } - sci_ctx_t ctx = {out, fmt_s, cfg.version, 0, 1}; + sci_ctx_t ctx; + memset(&ctx, 0, sizeof(ctx)); + ctx.out = out; ctx.fmt = fmt_s; ctx.version = cfg.version; ctx.first = 1; + /* Deliberately the literal --dir value, not realpath(dir) — see + * cfusa_relativize_path()'s doc comment for why. */ + strncpy(ctx.dir_abs, dir, sizeof(ctx.dir_abs) - 1); static const char * const exts[] = {".c",".h"}; cfusa_walk_sources(dir, exts, 2, sci_file, &ctx); diff --git a/cmd/cfusa/cmd_tara.c b/cmd/cfusa/cmd_tara.c index 3d6f456..37cb87a 100644 --- a/cmd/cfusa/cmd_tara.c +++ b/cmd/cfusa/cmd_tara.c @@ -25,31 +25,43 @@ #define MAX_THREATS 512 +/* Resolved absolute --dir, for project-relative `location.file` fields + * (x-FuSa spec §4) regardless of whether --dir itself was given relative or + * absolute — same pattern as cmd_trace.c's g_dir_abs / cmd_fmea.c's. */ +static char g_dir_abs[512]; + typedef struct { const char *category; /* "network" | "file" | "auth" | "memory" */ const char *attack_vector; /* "network" | "local" | "physical" */ const char *feasibility; /* high|medium|low|very-low */ - const char *safety, *financial, *operational, *privacy; /* SFOP: high|medium|low */ + /* SFOP impact axes — x-FuSa spec §9.2 v1.14.1 closed enum: + * critical|major|moderate|negligible (NOT high|medium|low, which is a + * distinct scale used only for `feasibility` above). The four profiles + * below mechanically remap this heuristic's original 3-level + * high/medium/low scale onto the top three enum values + * (high->critical, medium->major, low->moderate), preserving each + * profile's relative severity ordering. */ + const char *safety, *financial, *operational, *privacy; const char *mitigations[3]; } category_profile_t; static const category_profile_t PROFILE_NETWORK = { - "network", "network", "medium", "medium", "low", "medium", "medium", + "network", "network", "medium", "major", "moderate", "major", "major", {"Validate and bound-check all network input before use", "Add fuzz/negative testing for this entry point", NULL} }; static const category_profile_t PROFILE_FILE = { - "file", "local", "medium", "low", "low", "medium", "low", + "file", "local", "medium", "moderate", "moderate", "major", "moderate", {"Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths", NULL} }; static const category_profile_t PROFILE_AUTH = { - "auth", "local", "medium", "low", "medium", "medium", "high", + "auth", "local", "medium", "moderate", "major", "major", "critical", {"Store credentials/keys only in vetted secret storage", "Add independent review of authentication/authorization logic", NULL} }; static const category_profile_t PROFILE_MEMORY = { - "memory", "local", "medium", "high", "low", "medium", "low", + "memory", "local", "medium", "critical", "moderate", "major", "moderate", {"Use bounds-checked copy/allocation APIs", "Add static analysis (cfusa analyze/lint) to the CI gate for this file", NULL} }; @@ -79,21 +91,17 @@ static const category_profile_t *classify(const char *name) return NULL; } -/* ---- feasibility x max(SFOP) -> risk (documented heuristic, not a claim - * of the full ISO 21434 risk-value table — see summary.assetInventoryMethod) ---- */ +/* ---- feasibility x max(SFOP) -> risk, via the x-FuSa spec §9.2 canonical + * risk combination table (v1.14.1) — the same table implemented (and + * tested) in FuSaOps' own `tara` package; not an ad hoc score. ---- */ -static int feasibility_rank(const char *f) -{ - if (!strcmp(f, "high")) return 4; - if (!strcmp(f, "medium")) return 3; - if (!strcmp(f, "low")) return 2; - return 1; /* very-low */ -} +/* Highest-ranked first: critical > major > moderate > negligible. */ static int impact_rank(const char *v) { - if (!strcmp(v, "high")) return 3; - if (!strcmp(v, "medium")) return 2; - return 1; /* low */ + if (!strcmp(v, "critical")) return 3; + if (!strcmp(v, "major")) return 2; + if (!strcmp(v, "moderate")) return 1; + return 0; /* negligible */ } static const char *max_sfop(const category_profile_t *p) { @@ -105,13 +113,28 @@ static const char *max_sfop(const category_profile_t *p) } return best; } +/* feasibility column: high | medium | low | very-low */ +static int feasibility_col(const char *f) +{ + if (!strcmp(f, "high")) return 0; + if (!strcmp(f, "medium")) return 1; + if (!strcmp(f, "low")) return 2; + return 3; /* very-low */ +} static const char *derive_risk(const category_profile_t *p) { - int score = feasibility_rank(p->feasibility) * impact_rank(max_sfop(p)); - if (score <= 2) return "low"; - if (score <= 6) return "medium"; - if (score <= 9) return "high"; - return "critical"; + /* Row order matches impact_rank(): critical, major, moderate, negligible. + * Column order matches feasibility_col(): high, medium, low, very-low. + * Verbatim transcription of the x-FuSa spec §9.2 combination table. */ + static const char * const table[4][4] = { + /* critical */ {"critical", "critical", "high", "medium"}, + /* major */ {"high", "high", "medium", "medium"}, + /* moderate */ {"medium", "medium", "low", "low"}, + /* negligible*/ {"low", "low", "low", "low"}, + }; + int row = 3 - impact_rank(max_sfop(p)); + int col = feasibility_col(p->feasibility); + return table[row][col]; } static const char *derive_treatment(const char *risk) { @@ -134,30 +157,15 @@ static void render_threat(char *out, size_t sz, const asset_entry_t *a) static void asset_line(const char *path, int lineno, const char *line, void *vctx) { (void)vctx; - const char *p = line; - while (*p == ' ' || *p == '\t') p++; - if (!*p || *p == '/' || *p == '#' || *p == '*' || *p == '}') return; - static const char * const skip_kw[] = { - "if ","for ","while ","switch ","return ","else ","case ", - "typedef ","struct ","enum ","union ","static ","extern ","inline ",NULL - }; - for (int i = 0; skip_kw[i]; i++) - if (strncmp(p, skip_kw[i], strlen(skip_kw[i])) == 0) return; - if (!strstr(line,"(") || !strstr(line,")")) return; - const char *end = line + strlen(line); - while (end > line && (end[-1]==' '||end[-1]=='\t'||end[-1]=='\n'||end[-1]=='\r')) end--; - if (end > line && end[-1] == ';') return; - - char *paren = strchr((char*)p, '('); - if (!paren) return; - char before[128] = ""; - size_t bl = (size_t)(paren - p); - if (bl == 0 || bl >= 128) return; - strncpy(before, p, bl); before[bl] = '\0'; - char *sp = strrchr(before, ' '); - char *fn_name = sp ? sp + 1 : before; - while (*fn_name == '*') fn_name++; - if (!*fn_name || strlen(fn_name) < 2) return; + /* cfusa_extract_call_name() (src/utils.c, shared with cmd_fmea.c) + * centralises the match heuristic: skip control-flow/storage-class + * keywords, require the "(" to be outside a string literal, and + * exclude standard-library calls outright — x-FuSa spec §1.6 rule 4 + * ("real referents only"). A stdlib call like strcpy()/memcpy() is + * excluded here even though `classify()` below would otherwise treat + * its name as a memory-category asset keyword match. */ + char fn_name[128]; + if (!cfusa_extract_call_name(line, fn_name, sizeof(fn_name))) return; const category_profile_t *prof = classify(fn_name); if (!prof) return; /* not asset-relevant by this heuristic */ @@ -166,22 +174,22 @@ static void asset_line(const char *path, int lineno, const char *line, void *vct if (g_asset_count >= MAX_THREATS) return; strncpy(g_assets[g_asset_count].name, fn_name, 127); - strncpy(g_assets[g_asset_count].file, path, 255); + /* Project-relative (x-FuSa spec §4), regardless of whether --dir was + * given relative or absolute. */ + cfusa_relativize_path(g_dir_abs, path, g_assets[g_asset_count].file, + sizeof(g_assets[g_asset_count].file)); g_assets[g_asset_count].line = lineno; g_assets[g_asset_count].profile = prof; g_asset_count++; } -/* Mirrors cmd_trace.c's is_test_file() / cmd_fmea.c's fmea_is_test_file(): - * a TARA is over the project's own attack surface, not its test - * scaffolding (a test helper calling e.g. strcpy() is not an asset). */ +/* Mirrors trace --func-coverage's is_test_file() / cmd_fmea.c's + * fmea_is_test_file(): a TARA is over the project's own attack surface, not + * its test scaffolding (a test helper calling e.g. strcpy() is not an + * asset). */ static int tara_is_test_file(const char *path) { - const char *b = strrchr(path, '/'); - b = b ? b + 1 : path; - if (strncmp(b, "test_", 5) == 0) return 1; - size_t n = strlen(b); - return n > 7 && strcmp(b + n - 7, "_test.c") == 0; + return cfusa_is_test_source_file(path); } static int asset_file(const char *path, void *v) @@ -289,7 +297,7 @@ static void write_threat_json(FILE *f, const asset_entry_t *a, int idx, int last fprintf(f, "],\n" " \"location\": {\"file\": \"%s\", \"line\": %d}\n" " }%s\n", - cfusa_basename(a->file), a->line, last ? "" : ","); + a->file, a->line, last ? "" : ","); } static void render_markdown(FILE *f, const char *project, const char *version, const char *ts, @@ -383,10 +391,17 @@ int cmd_tara(int argc, char **argv) g_asset_count = 0; g_total_found = 0; + /* Deliberately the literal --dir value, not realpath(dir) — see + * cfusa_relativize_path()'s doc comment for why. */ + strncpy(g_dir_abs, dir, sizeof(g_dir_abs) - 1); + g_dir_abs[sizeof(g_dir_abs) - 1] = '\0'; static const char * const exts[] = {".c"}; cfusa_walk_sources(dir, exts, 1, asset_file, NULL); int coverage_pct = (g_total_found == 0) ? 100 : (g_asset_count * 100 / g_total_found); + /* x-FuSa spec §9.2: coveragePct MUST NOT exceed 100 — see cmd_fmea.c's + * equivalent clamp for the rationale (defense-in-depth). */ + if (coverage_pct > 100) coverage_pct = 100; const char *base = output_dir ? output_dir : dir; char existing_path[512]; @@ -432,7 +447,7 @@ int cmd_tara(int argc, char **argv) " \"generatedAt\": \"%s\",\n" \ " \"project\": \"%s\",\n" \ " \"version\": \"%s\",\n" \ - " \"standard\": \"ISO/SAE 21434:2021 Clause 15\",\n" \ + " \"standard\": \"iso21434\",\n" \ " \"threats\": [\n", \ ts, cfg.project, cfg.version); \ for (int i = 0; i < g_asset_count; i++) \ diff --git a/fmea.csv b/fmea.csv index 47c35e5..22a6eb8 100644 --- a/fmea.csv +++ b/fmea.csv @@ -2,370 +2,164 @@ ID,Function,File,Line,Failure Mode,Effect,Cause,Severity,O,D,ActionPriority FM-001,"cmd_pr","cmd_pr.c",146,"cmd_pr (general function) does not perform its intended action","Failure of cmd_pr could propagate undetected to callers in cmd_pr.c","Logic error or untested edge case in cmd_pr",3,2,3,"low" FM-002,"cmd_version","cmd_version.c",7,"cmd_version (general function) does not perform its intended action","Failure of cmd_version could propagate undetected to callers in cmd_version.c","Logic error or untested edge case in cmd_version",3,2,3,"low" FM-003,"cmd_help","cmd_dispatch.c",66,"cmd_help (general function) does not perform its intended action","Failure of cmd_help could propagate undetected to callers in cmd_dispatch.c","Logic error or untested edge case in cmd_help",3,2,3,"low" -FM-004,"snprintf","cmd_coupling.c",56,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_coupling.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-005,"snprintf","cmd_coupling.c",65,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_coupling.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-006,"cmd_coupling","cmd_coupling.c",121,"cmd_coupling (general function) does not perform its intended action","Failure of cmd_coupling could propagate undetected to callers in cmd_coupling.c","Logic error or untested edge case in cmd_coupling",3,2,3,"low" -FM-007,"printf","cmd_coupling.c",177,"printf (general function) does not perform its intended action","Failure of printf could propagate undetected to callers in cmd_coupling.c","Logic error or untested edge case in printf",3,2,3,"low" -FM-008,"fn","cmd_qualify.c",347,"fn (general function) does not perform its intended action","Failure of fn could propagate undetected to callers in cmd_qualify.c","Logic error or untested edge case in fn",3,2,3,"low" -FM-009,"fn","cmd_qualify.c",375,"fn (general function) does not perform its intended action","Failure of fn could propagate undetected to callers in cmd_qualify.c","Logic error or untested edge case in fn",3,2,3,"low" -FM-010,"fn","cmd_qualify.c",398,"fn (general function) does not perform its intended action","Failure of fn could propagate undetected to callers in cmd_qualify.c","Logic error or untested edge case in fn",3,2,3,"low" -FM-011,"fn","cmd_qualify.c",408,"fn (general function) does not perform its intended action","Failure of fn could propagate undetected to callers in cmd_qualify.c","Logic error or untested edge case in fn",3,2,3,"low" -FM-012,"""strcpy","cmd_qualify.c",427,"""strcpy (general function) does not perform its intended action","Failure of ""strcpy could propagate undetected to callers in cmd_qualify.c","Logic error or untested edge case in ""strcpy",3,2,3,"low" -FM-013,"""snprintf","cmd_qualify.c",428,"""snprintf (general function) does not perform its intended action","Failure of ""snprintf could propagate undetected to callers in cmd_qualify.c","Logic error or untested edge case in ""snprintf",3,2,3,"low" -FM-014,"""MD5_Init","cmd_qualify.c",429,"""MD5_Init (general function) does not perform its intended action","Failure of ""MD5_Init could propagate undetected to callers in cmd_qualify.c","Logic error or untested edge case in ""MD5_Init",3,2,3,"low" -FM-015,"""SHA256_Init","cmd_qualify.c",430,"""SHA256_Init (general function) does not perform its intended action","Failure of ""SHA256_Init could propagate undetected to callers in cmd_qualify.c","Logic error or untested edge case in ""SHA256_Init",3,2,3,"low" -FM-016,"cmd_qualify","cmd_qualify.c",472,"cmd_qualify (general function) does not perform its intended action","Failure of cmd_qualify could propagate undetected to callers in cmd_qualify.c","Logic error or untested edge case in cmd_qualify",3,2,3,"low" -FM-017,"qualification_badge","cmd_qualify.c",579,"qualification_badge (general function) does not perform its intended action","Failure of qualification_badge could propagate undetected to callers in cmd_qualify.c","Logic error or untested edge case in qualification_badge",3,2,3,"low" -FM-018,"independence_status","cmd_qualify.c",580,"independence_status (general function) does not perform its intended action","Failure of independence_status could propagate undetected to callers in cmd_qualify.c","Logic error or untested edge case in independence_status",3,2,3,"low" -FM-019,"cmd_misra","cmd_misra.c",60,"cmd_misra (general function) does not perform its intended action","Failure of cmd_misra could propagate undetected to callers in cmd_misra.c","Logic error or untested edge case in cmd_misra",3,2,3,"low" -FM-020,"!path_exists","cmd_safety_rules.c",119,"!path_exists (general function) does not perform its intended action","Failure of !path_exists could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in !path_exists",3,2,3,"low" -FM-021,"strcmp","cmd_safety_rules.c",278,"strcmp (general function) does not perform its intended action","Failure of strcmp could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in strcmp",3,2,3,"low" -FM-022,"!path_exists","cmd_safety_rules.c",391,"!path_exists (general function) does not perform its intended action","Failure of !path_exists could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in !path_exists",3,2,3,"low" -FM-023,"sscanf","cmd_safety_rules.c",422,"sscanf (general function) does not perform its intended action","Failure of sscanf could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in sscanf",3,2,3,"low" -FM-024,"failure","cmd_safety_rules.c",483,"failure (general function) does not perform its intended action","Failure of failure could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in failure",3,2,3,"low" -FM-025,"!strchr","cmd_safety_rules.c",506,"!strchr (general function) does not perform its intended action","Failure of !strchr could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in !strchr",3,2,3,"low" -FM-026,"!strstr","cmd_safety_rules.c",507,"!strstr (general function) does not perform its intended action","Failure of !strstr could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in !strstr",3,2,3,"low" -FM-027,"strchr","cmd_safety_rules.c",544,"strchr (general function) does not perform its intended action","Failure of strchr could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in strchr",3,2,3,"low" -FM-028,"sscanf","cmd_safety_rules.c",614,"sscanf (general function) does not perform its intended action","Failure of sscanf could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in sscanf",3,2,3,"low" -FM-029,"strstr","cmd_safety_rules.c",724,"strstr (general function) does not perform its intended action","Failure of strstr could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in strstr",3,2,3,"low" -FM-030,"!path_exists","cmd_safety_rules.c",804,"!path_exists (general function) does not perform its intended action","Failure of !path_exists could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in !path_exists",3,2,3,"low" -FM-031,"!path_exists","cmd_safety_rules.c",818,"!path_exists (general function) does not perform its intended action","Failure of !path_exists could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in !path_exists",3,2,3,"low" -FM-032,"!path_exists","cmd_safety_rules.c",831,"!path_exists (general function) does not perform its intended action","Failure of !path_exists could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in !path_exists",3,2,3,"low" -FM-033,"""V","cmd_safety_rules.c",915,"""V (general function) does not perform its intended action","Failure of ""V could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in ""V",3,2,3,"low" -FM-034,"cfusa_safety_register_rules","cmd_safety_rules.c",919,"cfusa_safety_register_rules (safety-critical function) does not perform its intended action","Failure of cfusa_safety_register_rules could propagate undetected to callers in cmd_safety_rules.c","Unhandled fault or invalid input condition within cfusa_safety_register_rules",9,4,6,"high" -FM-035,"cfusa_safety_rule_count","cmd_safety_rules.c",927,"cfusa_safety_rule_count (safety-critical function) does not perform its intended action","Failure of cfusa_safety_rule_count could propagate undetected to callers in cmd_safety_rules.c","Unhandled fault or invalid input condition within cfusa_safety_rule_count",9,4,6,"high" -FM-036,"cmd_iso26262","cmd_iso26262.c",84,"cmd_iso26262 (general function) does not perform its intended action","Failure of cmd_iso26262 could propagate undetected to callers in cmd_iso26262.c","Logic error or untested edge case in cmd_iso26262",3,2,3,"low" -FM-037,"fprintf","cmd_iso26262.c",183,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_iso26262.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-038,"fprintf","cmd_iso26262.c",206,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_iso26262.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-039,"cfusa_scan_lines","cmd_req.c",135,"cfusa_scan_lines (general function) does not perform its intended action","Failure of cfusa_scan_lines could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in cfusa_scan_lines",3,2,3,"low" -FM-040,"xml_escape","cmd_req.c",172,"xml_escape (general function) does not perform its intended action","Failure of xml_escape could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in xml_escape",3,2,3,"low" -FM-041,"xml_escape","cmd_req.c",176,"xml_escape (general function) does not perform its intended action","Failure of xml_escape could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in xml_escape",3,2,3,"low" -FM-042,"xml_escape","cmd_req.c",180,"xml_escape (general function) does not perform its intended action","Failure of xml_escape could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in xml_escape",3,2,3,"low" -FM-043,"fprintf","cmd_req.c",193,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-044,"fprintf","cmd_req.c",209,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-045,"fprintf","cmd_req.c",225,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-046,"snprintf","cmd_req.c",257,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-047,"!strcmp","cmd_req.c",520,"!strcmp (general function) does not perform its intended action","Failure of !strcmp could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in !strcmp",3,2,3,"low" -FM-048,"import_reqif","cmd_req.c",646,"import_reqif (general function) does not perform its intended action","Failure of import_reqif could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in import_reqif",3,2,3,"low" -FM-049,"import_polarion_xml","cmd_req.c",652,"import_polarion_xml (general function) does not perform its intended action","Failure of import_polarion_xml could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in import_polarion_xml",3,2,3,"low" -FM-050,"import_reqif","cmd_req.c",655,"import_reqif (general function) does not perform its intended action","Failure of import_reqif could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in import_reqif",3,2,3,"low" -FM-051,"import_codebeamer_xml","cmd_req.c",660,"import_codebeamer_xml (general function) does not perform its intended action","Failure of import_codebeamer_xml could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in import_codebeamer_xml",3,2,3,"low" -FM-052,"import_jama_xml","cmd_req.c",671,"import_jama_xml (general function) does not perform its intended action","Failure of import_jama_xml could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in import_jama_xml",3,2,3,"low" -FM-053,"sizeof","cmd_req.c",695,"sizeof (general function) does not perform its intended action","Failure of sizeof could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in sizeof",3,2,3,"low" -FM-054,"append_entry","cmd_req.c",713,"append_entry (general function) does not perform its intended action","Failure of append_entry could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in append_entry",3,2,3,"low" -FM-055,"printf","cmd_req.c",755,"printf (general function) does not perform its intended action","Failure of printf could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in printf",3,2,3,"low" -FM-056,"cmd_req","cmd_req.c",760,"cmd_req (general function) does not perform its intended action","Failure of cmd_req could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in cmd_req",3,2,3,"low" -FM-057,"cmd_release","cmd_release.c",100,"cmd_release (general function) does not perform its intended action","Failure of cmd_release could propagate undetected to callers in cmd_release.c","Logic error or untested edge case in cmd_release",3,2,3,"low" -FM-058,"snprintf","cmd_release.c",174,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_release.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-059,"cmd_check","cmd_check.c",14,"cmd_check (monitoring/control function) does not perform its intended action","Failure of cmd_check could propagate undetected to callers in cmd_check.c","Configuration or state inconsistency affecting cmd_check",5,3,4,"medium" -FM-060,"cfusa_template_generate_all","cmd_template.c",84,"cfusa_template_generate_all (general function) does not perform its intended action","Failure of cfusa_template_generate_all could propagate undetected to callers in cmd_template.c","Logic error or untested edge case in cfusa_template_generate_all",3,2,3,"low" -FM-061,"cmd_template","cmd_template.c",106,"cmd_template (general function) does not perform its intended action","Failure of cmd_template could propagate undetected to callers in cmd_template.c","Logic error or untested edge case in cmd_template",3,2,3,"low" -FM-062,"fprintf","cmd_tara.c",326,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_tara.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-063,"cmd_tara","cmd_tara.c",330,"cmd_tara (general function) does not perform its intended action","Failure of cmd_tara could propagate undetected to callers in cmd_tara.c","Logic error or untested edge case in cmd_tara",3,2,3,"low" -FM-064,"fprintf","cmd_tara.c",426,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_tara.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-065,"write_threat_json","cmd_tara.c",439,"write_threat_json (general function) does not perform its intended action","Failure of write_threat_json could propagate undetected to callers in cmd_tara.c","Logic error or untested edge case in write_threat_json",3,2,3,"low" -FM-066,"fprintf","cmd_tara.c",440,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_tara.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-067,"fprintf","cmd_tara.c",449,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_tara.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-068,"fprintf","cmd_tara.c",459,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_tara.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-069,"fprintf","cmd_tara.c",461,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_tara.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-070,"cfusa_scan_lines","cmd_trace.c",184,"cfusa_scan_lines (general function) does not perform its intended action","Failure of cfusa_scan_lines could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in cfusa_scan_lines",3,2,3,"low" -FM-071,"cmd_trace","cmd_trace.c",336,"cmd_trace (general function) does not perform its intended action","Failure of cmd_trace could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in cmd_trace",3,2,3,"low" -FM-072,"compute_hlr_llr","cmd_trace.c",436,"compute_hlr_llr (general function) does not perform its intended action","Failure of compute_hlr_llr could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in compute_hlr_llr",3,2,3,"low" -FM-073,"printf","cmd_trace.c",453,"printf (general function) does not perform its intended action","Failure of printf could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in printf",3,2,3,"low" -FM-074,"LLR","cmd_trace.c",460,"LLR (general function) does not perform its intended action","Failure of LLR could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in LLR",3,2,3,"low" -FM-075,"printf","cmd_trace.c",478,"printf (general function) does not perform its intended action","Failure of printf could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in printf",3,2,3,"low" -FM-076,"printf","cmd_trace.c",497,"printf (general function) does not perform its intended action","Failure of printf could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in printf",3,2,3,"low" -FM-077,"printf","cmd_trace.c",530,"printf (general function) does not perform its intended action","Failure of printf could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in printf",3,2,3,"low" -FM-078,"printf","cmd_trace.c",558,"printf (general function) does not perform its intended action","Failure of printf could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in printf",3,2,3,"low" -FM-079,"snprintf","cmd_trace.c",696,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-080,"snprintf","cmd_trace.c",700,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-081,"cfusa_basename","cmd_trace.c",716,"cfusa_basename (general function) does not perform its intended action","Failure of cfusa_basename could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in cfusa_basename",3,2,3,"low" -FM-082,"snprintf","cmd_trace.c",763,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-083,"snprintf","cmd_trace.c",767,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-084,"fprintf","cmd_trace.c",790,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-085,"for","cmd_analyze.c",25,"for (general function) does not perform its intended action","Failure of for could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in for",3,2,3,"low" -FM-086,"if","cmd_analyze.c",67,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in if",3,2,3,"low" -FM-087,"!strstr","cmd_analyze.c",68,"!strstr (general function) does not perform its intended action","Failure of !strstr could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in !strstr",3,2,3,"low" -FM-088,"strstr","cmd_analyze.c",102,"strstr (general function) does not perform its intended action","Failure of strstr could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in strstr",3,2,3,"low" -FM-089,"strstr","cmd_analyze.c",103,"strstr (general function) does not perform its intended action","Failure of strstr could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in strstr",3,2,3,"low" -FM-090,"!strstr","cmd_analyze.c",104,"!strstr (general function) does not perform its intended action","Failure of !strstr could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in !strstr",3,2,3,"low" -FM-091,"if","cmd_analyze.c",135,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in if",3,2,3,"low" -FM-092,"!strstr","cmd_analyze.c",136,"!strstr (general function) does not perform its intended action","Failure of !strstr could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in !strstr",3,2,3,"low" -FM-093,"if","cmd_analyze.c",167,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in if",3,2,3,"low" -FM-094,"""assert","cmd_analyze.c",171,"""assert (general function) does not perform its intended action","Failure of ""assert could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in ""assert",3,2,3,"low" -FM-095,"if","cmd_analyze.c",199,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in if",3,2,3,"low" -FM-096,"strstr","cmd_analyze.c",200,"strstr (general function) does not perform its intended action","Failure of strstr could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in strstr",3,2,3,"low" -FM-097,"strstr","cmd_analyze.c",201,"strstr (general function) does not perform its intended action","Failure of strstr could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in strstr",3,2,3,"low" -FM-098,"for","cmd_analyze.c",238,"for (general function) does not perform its intended action","Failure of for could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in for",3,2,3,"low" -FM-099,"""assert","cmd_analyze.c",284,"""assert (general function) does not perform its intended action","Failure of ""assert could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in ""assert",3,2,3,"low" -FM-100,"cfusa_analyze_register_rules","cmd_analyze.c",292,"cfusa_analyze_register_rules (general function) does not perform its intended action","Failure of cfusa_analyze_register_rules could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in cfusa_analyze_register_rules",3,2,3,"low" -FM-101,"cmd_analyze","cmd_analyze.c",298,"cmd_analyze (general function) does not perform its intended action","Failure of cmd_analyze could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in cmd_analyze",3,2,3,"low" -FM-102,"cmd_report","cmd_report.c",14,"cmd_report (general function) does not perform its intended action","Failure of cmd_report could propagate undetected to callers in cmd_report.c","Logic error or untested edge case in cmd_report",3,2,3,"low" -FM-103,"cmd_init","cmd_init.c",15,"cmd_init (monitoring/control function) does not perform its intended action","Failure of cmd_init could propagate undetected to callers in cmd_init.c","Configuration or state inconsistency affecting cmd_init",5,3,4,"medium" -FM-104,"fprintf","cmd_init.c",99,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_init.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-105,"fprintf","cmd_init.c",116,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_init.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-106,"cmd_iec62443","cmd_iec62443.c",85,"cmd_iec62443 (general function) does not perform its intended action","Failure of cmd_iec62443 could propagate undetected to callers in cmd_iec62443.c","Logic error or untested edge case in cmd_iec62443",3,2,3,"low" -FM-107,"fprintf","cmd_iec62443.c",223,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_iec62443.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-108,"cfusa_basename","cmd_fmea.c",187,"cfusa_basename (general function) does not perform its intended action","Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in cfusa_basename",3,2,3,"low" -FM-109,"cfusa_basename","cmd_fmea.c",267,"cfusa_basename (general function) does not perform its intended action","Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in cfusa_basename",3,2,3,"low" -FM-110,"cmd_fmea","cmd_fmea.c",274,"cmd_fmea (general function) does not perform its intended action","Failure of cmd_fmea could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in cmd_fmea",3,2,3,"low" -FM-111,"fprintf","cmd_fmea.c",383,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-112,"fprintf","cmd_fmea.c",393,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-113,"cfusa_path_join","cmd_fmea.c",399,"cfusa_path_join (general function) does not perform its intended action","Failure of cfusa_path_join could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in cfusa_path_join",3,2,3,"low" -FM-114,"printf","cmd_fmea.c",402,"printf (general function) does not perform its intended action","Failure of printf could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in printf",3,2,3,"low" -FM-115,"cfusa_basename","cmd_fmea.c",442,"cfusa_basename (general function) does not perform its intended action","Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in cfusa_basename",3,2,3,"low" -FM-116,"cfusa_basename","cmd_fmea.c",506,"cfusa_basename (general function) does not perform its intended action","Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in cfusa_basename",3,2,3,"low" -FM-117,"cfusa_basename","cmd_fmea.c",534,"cfusa_basename (general function) does not perform its intended action","Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in cfusa_basename",3,2,3,"low" -FM-118,"strtol","cmd_fix.c",50,"strtol (general function) does not perform its intended action","Failure of strtol could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in strtol",3,2,3,"low" -FM-119,"fgets","cmd_fix.c",57,"fgets (general function) does not perform its intended action","Failure of fgets could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in fgets",3,2,3,"low" -FM-120,"strncpy","cmd_fix.c",58,"strncpy (general function) does not perform its intended action","Failure of strncpy could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in strncpy",3,2,3,"low" -FM-121,"snprintf","cmd_fix.c",59,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-122,"malloc","cmd_fix.c",63,"malloc (general function) does not perform its intended action","Failure of malloc could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in malloc",3,2,3,"low" -FM-123,"assert","cmd_fix.c",73,"assert (general function) does not perform its intended action","Failure of assert could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in assert",3,2,3,"low" -FM-124,"strncpy","cmd_fix.c",80,"strncpy (general function) does not perform its intended action","Failure of strncpy could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in strncpy",3,2,3,"low" -FM-125,"dst[sizeof","cmd_fix.c",81,"dst[sizeof (general function) does not perform its intended action","Failure of dst[sizeof could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in dst[sizeof",3,2,3,"low" -FM-126,"printf","cmd_fix.c",85,"printf (general function) does not perform its intended action","Failure of printf could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in printf",3,2,3,"low" -FM-127,"printf","cmd_fix.c",86,"printf (general function) does not perform its intended action","Failure of printf could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in printf",3,2,3,"low" -FM-128,"execve","cmd_fix.c",90,"execve (general function) does not perform its intended action","Failure of execve could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in execve",3,2,3,"low" -FM-129,"sizeof","cmd_fix.c",97,"sizeof (general function) does not perform its intended action","Failure of sizeof could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in sizeof",3,2,3,"low" -FM-130,"malloc","cmd_fix.c",99,"malloc (general function) does not perform its intended action","Failure of malloc could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in malloc",3,2,3,"low" -FM-131,"free","cmd_fix.c",103,"free (general function) does not perform its intended action","Failure of free could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in free",3,2,3,"low" -FM-132,"cmd_fix","cmd_fix.c",125,"cmd_fix (general function) does not perform its intended action","Failure of cmd_fix could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in cmd_fix",3,2,3,"low" -FM-133,"printf","cmd_fix.c",175,"printf (general function) does not perform its intended action","Failure of printf could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in printf",3,2,3,"low" -FM-134,"printf","cmd_fix.c",195,"printf (general function) does not perform its intended action","Failure of printf could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in printf",3,2,3,"low" -FM-135,"main","main.c",14,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in main.c","Logic error or untested edge case in main",3,2,3,"low" -FM-136,"cmd_boundary","cmd_boundary.c",72,"cmd_boundary (general function) does not perform its intended action","Failure of cmd_boundary could propagate undetected to callers in cmd_boundary.c","Logic error or untested edge case in cmd_boundary",3,2,3,"low" -FM-137,"cmd_impact","cmd_impact.c",106,"cmd_impact (general function) does not perform its intended action","Failure of cmd_impact could propagate undetected to callers in cmd_impact.c","Logic error or untested edge case in cmd_impact",3,2,3,"low" -FM-138,"printf","cmd_impact.c",194,"printf (general function) does not perform its intended action","Failure of printf could propagate undetected to callers in cmd_impact.c","Logic error or untested edge case in printf",3,2,3,"low" -FM-139,"cmd_sci","cmd_sci.c",44,"cmd_sci (general function) does not perform its intended action","Failure of cmd_sci could propagate undetected to callers in cmd_sci.c","Logic error or untested edge case in cmd_sci",3,2,3,"low" -FM-140,"cmd_iec61508","cmd_iec61508.c",78,"cmd_iec61508 (general function) does not perform its intended action","Failure of cmd_iec61508 could propagate undetected to callers in cmd_iec61508.c","Logic error or untested edge case in cmd_iec61508",3,2,3,"low" -FM-141,"fprintf","cmd_iec61508.c",204,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_iec61508.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-142,"cmd_badge","cmd_badge.c",9,"cmd_badge (general function) does not perform its intended action","Failure of cmd_badge could propagate undetected to callers in cmd_badge.c","Logic error or untested edge case in cmd_badge",3,2,3,"low" -FM-143,"fill=\""url","cmd_badge.c",87,"fill=\""url (general function) does not perform its intended action","Failure of fill=\""url could propagate undetected to callers in cmd_badge.c","Logic error or untested edge case in fill=\""url",3,2,3,"low" -FM-144,"cmd_unece","cmd_unece.c",57,"cmd_unece (general function) does not perform its intended action","Failure of cmd_unece could propagate undetected to callers in cmd_unece.c","Logic error or untested edge case in cmd_unece",3,2,3,"low" -FM-145,"cmd_sign","cmd_sign.c",43,"cmd_sign (general function) does not perform its intended action","Failure of cmd_sign could propagate undetected to callers in cmd_sign.c","Logic error or untested edge case in cmd_sign",3,2,3,"low" -FM-146,"cfusa_hmac_sha256","cmd_sign.c",120,"cfusa_hmac_sha256 (general function) does not perform its intended action","Failure of cfusa_hmac_sha256 could propagate undetected to callers in cmd_sign.c","Logic error or untested edge case in cfusa_hmac_sha256",3,2,3,"low" -FM-147,"cmd_iso21434","cmd_iso21434.c",77,"cmd_iso21434 (general function) does not perform its intended action","Failure of cmd_iso21434 could propagate undetected to callers in cmd_iso21434.c","Logic error or untested edge case in cmd_iso21434",3,2,3,"low" -FM-148,"fprintf","cmd_iso21434.c",212,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_iso21434.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-149,"""gets","cmd_vuln.c",26,"""gets (general function) does not perform its intended action","Failure of ""gets could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in ""gets",3,2,3,"low" -FM-150,"fgets","cmd_vuln.c",27,"fgets (general function) does not perform its intended action","Failure of fgets could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in fgets",3,2,3,"low" -FM-151,"""sprintf","cmd_vuln.c",29,"""sprintf (general function) does not perform its intended action","Failure of ""sprintf could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in ""sprintf",3,2,3,"low" -FM-152,"snprintf","cmd_vuln.c",30,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-153,"""strcpy","cmd_vuln.c",32,"""strcpy (general function) does not perform its intended action","Failure of ""strcpy could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in ""strcpy",3,2,3,"low" -FM-154,"strlcpy","cmd_vuln.c",33,"strlcpy (general function) does not perform its intended action","Failure of strlcpy could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in strlcpy",3,2,3,"low" -FM-155,"""strcat","cmd_vuln.c",35,"""strcat (general function) does not perform its intended action","Failure of ""strcat could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in ""strcat",3,2,3,"low" -FM-156,"strlcat","cmd_vuln.c",36,"strlcat (general function) does not perform its intended action","Failure of strlcat could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in strlcat",3,2,3,"low" -FM-157,"scanf","cmd_vuln.c",39,"scanf (general function) does not perform its intended action","Failure of scanf could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in scanf",3,2,3,"low" -FM-158,"""tmpnam","cmd_vuln.c",41,"""tmpnam (general function) does not perform its intended action","Failure of ""tmpnam could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in ""tmpnam",3,2,3,"low" -FM-159,"mkstemp","cmd_vuln.c",42,"mkstemp (general function) does not perform its intended action","Failure of mkstemp could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in mkstemp",3,2,3,"low" -FM-160,"""system","cmd_vuln.c",44,"""system (general function) does not perform its intended action","Failure of ""system could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in ""system",3,2,3,"low" -FM-161,"system","cmd_vuln.c",45,"system (general function) does not perform its intended action","Failure of system could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in system",3,2,3,"low" -FM-162,"""rand","cmd_vuln.c",47,"""rand (general function) does not perform its intended action","Failure of ""rand could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in ""rand",3,2,3,"low" -FM-163,"""mktemp","cmd_vuln.c",50,"""mktemp (general function) does not perform its intended action","Failure of ""mktemp could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in ""mktemp",3,2,3,"low" -FM-164,"mkstemp","cmd_vuln.c",51,"mkstemp (general function) does not perform its intended action","Failure of mkstemp could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in mkstemp",3,2,3,"low" -FM-165,"""popen","cmd_vuln.c",53,"""popen (general function) does not perform its intended action","Failure of ""popen could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in ""popen",3,2,3,"low" -FM-166,"execv","cmd_vuln.c",54,"execv (general function) does not perform its intended action","Failure of execv could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in execv",3,2,3,"low" -FM-167,"cfusa_scan_lines","cmd_vuln.c",107,"cfusa_scan_lines (general function) does not perform its intended action","Failure of cfusa_scan_lines could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in cfusa_scan_lines",3,2,3,"low" -FM-168,"cmd_vuln","cmd_vuln.c",109,"cmd_vuln (general function) does not perform its intended action","Failure of cmd_vuln could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in cmd_vuln",3,2,3,"low" -FM-169,"printf","cmd_vuln.c",181,"printf (general function) does not perform its intended action","Failure of printf could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in printf",3,2,3,"low" -FM-170,"strstr","cmd_comp.c",102,"strstr (general function) does not perform its intended action","Failure of strstr could propagate undetected to callers in cmd_comp.c","Logic error or untested edge case in strstr",3,2,3,"low" -FM-171,"fprintf","cmd_comp.c",184,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_comp.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-172,"cmd_comp","cmd_comp.c",222,"cmd_comp (general function) does not perform its intended action","Failure of cmd_comp could propagate undetected to callers in cmd_comp.c","Logic error or untested edge case in cmd_comp",3,2,3,"low" -FM-173,"cmd_audit_pack","cmd_audit_pack.c",21,"cmd_audit_pack (general function) does not perform its intended action","Failure of cmd_audit_pack could propagate undetected to callers in cmd_audit_pack.c","Logic error or untested edge case in cmd_audit_pack",3,2,3,"low" -FM-174,"snprintf","cmd_audit_pack.c",149,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_audit_pack.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-175,"snprintf","cmd_audit_pack.c",162,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_audit_pack.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-176,"snprintf","cmd_audit_pack.c",187,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_audit_pack.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-177,"cmd_hooks","cmd_hooks.c",20,"cmd_hooks (general function) does not perform its intended action","Failure of cmd_hooks could propagate undetected to callers in cmd_hooks.c","Logic error or untested edge case in cmd_hooks",3,2,3,"low" -FM-178,"cmd_disposition","cmd_disposition.c",184,"cmd_disposition (general function) does not perform its intended action","Failure of cmd_disposition could propagate undetected to callers in cmd_disposition.c","Logic error or untested edge case in cmd_disposition",3,2,3,"low" -FM-179,"strcmp","cmd_disposition.c",261,"strcmp (general function) does not perform its intended action","Failure of strcmp could propagate undetected to callers in cmd_disposition.c","Logic error or untested edge case in strcmp",3,2,3,"low" -FM-180,"snprintf","cmd_coverage.c",42,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_coverage.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-181,"snprintf","cmd_coverage.c",81,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_coverage.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-182,"snprintf","cmd_coverage.c",93,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_coverage.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-183,"cmd_coverage","cmd_coverage.c",174,"cmd_coverage (general function) does not perform its intended action","Failure of cmd_coverage could propagate undetected to callers in cmd_coverage.c","Logic error or untested edge case in cmd_coverage",3,2,3,"low" -FM-184,"strcmp","cmd_coverage.c",258,"strcmp (general function) does not perform its intended action","Failure of strcmp could propagate undetected to callers in cmd_coverage.c","Logic error or untested edge case in strcmp",3,2,3,"low" -FM-185,"fprintf","cmd_coverage.c",408,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_coverage.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-186,"fprintf","cmd_coverage.c",411,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_coverage.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-187,"fprintf","cmd_coverage.c",413,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_coverage.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-188,"fprintf","cmd_coverage.c",425,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_coverage.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-189,"cmd_diff","cmd_diff.c",66,"cmd_diff (general function) does not perform its intended action","Failure of cmd_diff could propagate undetected to callers in cmd_diff.c","Logic error or untested edge case in cmd_diff",3,2,3,"low" -FM-190,"fprintf","cmd_hara.c",622,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_hara.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-191,"parse_sec_code","cmd_hara.c",650,"parse_sec_code (general function) does not perform its intended action","Failure of parse_sec_code could propagate undetected to callers in cmd_hara.c","Logic error or untested edge case in parse_sec_code",3,2,3,"low" -FM-192,"cmd_hara","cmd_hara.c",770,"cmd_hara (general function) does not perform its intended action","Failure of cmd_hara could propagate undetected to callers in cmd_hara.c","Logic error or untested edge case in cmd_hara",3,2,3,"low" -FM-193,"cmd_slsa","cmd_slsa.c",71,"cmd_slsa (general function) does not perform its intended action","Failure of cmd_slsa could propagate undetected to callers in cmd_slsa.c","Logic error or untested edge case in cmd_slsa",3,2,3,"low" -FM-194,"slsa_file_exists","cmd_slsa.c",123,"slsa_file_exists (general function) does not perform its intended action","Failure of slsa_file_exists could propagate undetected to callers in cmd_slsa.c","Logic error or untested edge case in slsa_file_exists",3,2,3,"low" -FM-195,"cmd_do178","cmd_do178.c",113,"cmd_do178 (general function) does not perform its intended action","Failure of cmd_do178 could propagate undetected to callers in cmd_do178.c","Logic error or untested edge case in cmd_do178",3,2,3,"low" -FM-196,"cmd_verify","cmd_verify.c",14,"cmd_verify (general function) does not perform its intended action","Failure of cmd_verify could propagate undetected to callers in cmd_verify.c","Logic error or untested edge case in cmd_verify",3,2,3,"low" -FM-197,"fprintf","cmd_sas.c",61,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_sas.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-198,"cmd_sas","cmd_sas.c",90,"cmd_sas (general function) does not perform its intended action","Failure of cmd_sas could propagate undetected to callers in cmd_sas.c","Logic error or untested edge case in cmd_sas",3,2,3,"low" -FM-199,"fprintf","cmd_sas.c",178,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_sas.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-200,"fprintf","cmd_sas.c",255,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_sas.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-201,"for","cmd_cyber.c",19,"for (general function) does not perform its intended action","Failure of for could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in for",3,2,3,"low" -FM-202,"if","cmd_cyber.c",22,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in if",3,2,3,"low" -FM-203,"||","cmd_cyber.c",23,"|| (general function) does not perform its intended action","Failure of || could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in ||",3,2,3,"low" -FM-204,"for","cmd_cyber.c",51,"for (general function) does not perform its intended action","Failure of for could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in for",3,2,3,"low" -FM-205,"if","cmd_cyber.c",55,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in if",3,2,3,"low" -FM-206,"if","cmd_cyber.c",63,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in if",3,2,3,"low" -FM-207,"if","cmd_cyber.c",71,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in if",3,2,3,"low" -FM-208,"strncmp","cmd_cyber.c",72,"strncmp (general function) does not perform its intended action","Failure of strncmp could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in strncmp",3,2,3,"low" -FM-209,"for","cmd_cyber.c",96,"for (general function) does not perform its intended action","Failure of for could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in for",3,2,3,"low" -FM-210,"if","cmd_cyber.c",103,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in if",3,2,3,"low" -FM-211,"if","cmd_cyber.c",155,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in if",3,2,3,"low" -FM-212,"strstr","cmd_cyber.c",156,"strstr (general function) does not perform its intended action","Failure of strstr could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in strstr",3,2,3,"low" -FM-213,"if","cmd_cyber.c",179,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in if",3,2,3,"low" -FM-214,"free","cmd_cyber.c",182,"free (general function) does not perform its intended action","Failure of free could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in free",3,2,3,"low" -FM-215,"if","cmd_cyber.c",204,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in if",3,2,3,"low" -FM-216,"if","cmd_cyber.c",223,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in if",3,2,3,"low" -FM-217,"cfusa_match_outside_string","cmd_cyber.c",224,"cfusa_match_outside_string (general function) does not perform its intended action","Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cfusa_match_outside_string",3,2,3,"low" -FM-218,"mkstemp","cmd_cyber.c",227,"mkstemp (general function) does not perform its intended action","Failure of mkstemp could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in mkstemp",3,2,3,"low" -FM-219,"for","cmd_cyber.c",246,"for (general function) does not perform its intended action","Failure of for could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in for",3,2,3,"low" -FM-220,"if","cmd_cyber.c",247,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in if",3,2,3,"low" -FM-221,"for","cmd_cyber.c",270,"for (general function) does not perform its intended action","Failure of for could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in for",3,2,3,"low" -FM-222,"if","cmd_cyber.c",274,"if (general function) does not perform its intended action","Failure of if could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in if",3,2,3,"low" -FM-223,"cfusa_match_outside_string","cmd_cyber.c",329,"cfusa_match_outside_string (general function) does not perform its intended action","Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cfusa_match_outside_string",3,2,3,"low" -FM-224,"cfusa_match_outside_string","cmd_cyber.c",349,"cfusa_match_outside_string (general function) does not perform its intended action","Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cfusa_match_outside_string",3,2,3,"low" -FM-225,"cfusa_match_outside_string","cmd_cyber.c",350,"cfusa_match_outside_string (general function) does not perform its intended action","Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cfusa_match_outside_string",3,2,3,"low" -FM-226,"realpath","cmd_cyber.c",352,"realpath (general function) does not perform its intended action","Failure of realpath could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in realpath",3,2,3,"low" -FM-227,"TLS_method","cmd_cyber.c",378,"TLS_method (general function) does not perform its intended action","Failure of TLS_method could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in TLS_method",3,2,3,"low" -FM-228,"cfusa_match_outside_string","cmd_cyber.c",445,"cfusa_match_outside_string (general function) does not perform its intended action","Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cfusa_match_outside_string",3,2,3,"low" -FM-229,"cfusa_match_outside_string","cmd_cyber.c",479,"cfusa_match_outside_string (general function) does not perform its intended action","Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cfusa_match_outside_string",3,2,3,"low" -FM-230,"access","cmd_cyber.c",503,"access (general function) does not perform its intended action","Failure of access could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in access",3,2,3,"low" -FM-231,"cfusa_cyber_register_rules","cmd_cyber.c",564,"cfusa_cyber_register_rules (general function) does not perform its intended action","Failure of cfusa_cyber_register_rules could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cfusa_cyber_register_rules",3,2,3,"low" -FM-232,"for","cmd_cyber.c",566,"for (general function) does not perform its intended action","Failure of for could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in for",3,2,3,"low" -FM-233,"cmd_cyber","cmd_cyber.c",570,"cmd_cyber (general function) does not perform its intended action","Failure of cmd_cyber could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cmd_cyber",3,2,3,"low" -FM-234,"cmd_safety_case","cmd_safety_case.c",35,"cmd_safety_case (safety-critical function) does not perform its intended action","Failure of cmd_safety_case could propagate undetected to callers in cmd_safety_case.c","Unhandled fault or invalid input condition within cmd_safety_case",9,4,6,"high" -FM-235,"snprintf","cmd_safety_case.c",106,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_safety_case.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-236,"snprintf","cmd_safety_case.c",110,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_safety_case.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-237,"snprintf","cmd_safety_case.c",113,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_safety_case.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-238,"snprintf","cmd_safety_case.c",116,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_safety_case.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-239,"snprintf","cmd_safety_case.c",119,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in cmd_safety_case.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-240,"fprintf","cmd_safety_case.c",223,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_safety_case.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-241,"fprintf","cmd_safety_case.c",317,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_safety_case.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-242,"cmd_metrics","cmd_metrics.c",288,"cmd_metrics (general function) does not perform its intended action","Failure of cmd_metrics could propagate undetected to callers in cmd_metrics.c","Logic error or untested edge case in cmd_metrics",3,2,3,"low" -FM-243,"cmd_capabilities","cmd_capabilities.c",15,"cmd_capabilities (general function) does not perform its intended action","Failure of cmd_capabilities could propagate undetected to callers in cmd_capabilities.c","Logic error or untested edge case in cmd_capabilities",3,2,3,"low" -FM-244,"fprintf","cmd_capabilities.c",86,"fprintf (general function) does not perform its intended action","Failure of fprintf could propagate undetected to callers in cmd_capabilities.c","Logic error or untested edge case in fprintf",3,2,3,"low" -FM-245,"strstr","cmd_lint.c",42,"strstr (general function) does not perform its intended action","Failure of strstr could propagate undetected to callers in cmd_lint.c","Logic error or untested edge case in strstr",3,2,3,"low" -FM-246,"fgets","cmd_lint.c",186,"fgets (general function) does not perform its intended action","Failure of fgets could propagate undetected to callers in cmd_lint.c","Logic error or untested edge case in fgets",3,2,3,"low" -FM-247,"strstr","cmd_lint.c",220,"strstr (general function) does not perform its intended action","Failure of strstr could propagate undetected to callers in cmd_lint.c","Logic error or untested edge case in strstr",3,2,3,"low" -FM-248,"!strstr","cmd_lint.c",222,"!strstr (general function) does not perform its intended action","Failure of !strstr could propagate undetected to callers in cmd_lint.c","Logic error or untested edge case in !strstr",3,2,3,"low" -FM-249,"!strstr","cmd_lint.c",384,"!strstr (general function) does not perform its intended action","Failure of !strstr could propagate undetected to callers in cmd_lint.c","Logic error or untested edge case in !strstr",3,2,3,"low" -FM-250,"cfusa_lint_register_rules","cmd_lint.c",527,"cfusa_lint_register_rules (general function) does not perform its intended action","Failure of cfusa_lint_register_rules could propagate undetected to callers in cmd_lint.c","Logic error or untested edge case in cfusa_lint_register_rules",3,2,3,"low" -FM-251,"cmd_lint","cmd_lint.c",535,"cmd_lint (general function) does not perform its intended action","Failure of cmd_lint could propagate undetected to callers in cmd_lint.c","Logic error or untested edge case in cmd_lint",3,2,3,"low" -FM-252,"defined","CMakeCCompilerId.c",891,"defined (general function) does not perform its intended action","Failure of defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in defined",3,2,3,"low" -FM-253,"!defined","CMakeCCompilerId.c",892,"!defined (general function) does not perform its intended action","Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in !defined",3,2,3,"low" -FM-254,"main","CMakeCCompilerId.c",902,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-255,"main","CMakeCCompilerId.c",907,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-256,"defined","CMakeCCompilerId.c",891,"defined (general function) does not perform its intended action","Failure of defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in defined",3,2,3,"low" -FM-257,"!defined","CMakeCCompilerId.c",892,"!defined (general function) does not perform its intended action","Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in !defined",3,2,3,"low" -FM-258,"main","CMakeCCompilerId.c",902,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-259,"main","CMakeCCompilerId.c",907,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-260,"defined","CMakeCCompilerId.c",891,"defined (general function) does not perform its intended action","Failure of defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in defined",3,2,3,"low" -FM-261,"!defined","CMakeCCompilerId.c",892,"!defined (general function) does not perform its intended action","Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in !defined",3,2,3,"low" -FM-262,"main","CMakeCCompilerId.c",902,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-263,"main","CMakeCCompilerId.c",907,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-264,"defined","CMakeCCompilerId.c",891,"defined (general function) does not perform its intended action","Failure of defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in defined",3,2,3,"low" -FM-265,"!defined","CMakeCCompilerId.c",892,"!defined (general function) does not perform its intended action","Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in !defined",3,2,3,"low" -FM-266,"main","CMakeCCompilerId.c",902,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-267,"main","CMakeCCompilerId.c",907,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-268,"defined","CMakeCCompilerId.c",891,"defined (general function) does not perform its intended action","Failure of defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in defined",3,2,3,"low" -FM-269,"!defined","CMakeCCompilerId.c",892,"!defined (general function) does not perform its intended action","Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in !defined",3,2,3,"low" -FM-270,"main","CMakeCCompilerId.c",902,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-271,"main","CMakeCCompilerId.c",907,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-272,"defined","CMakeCCompilerId.c",891,"defined (general function) does not perform its intended action","Failure of defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in defined",3,2,3,"low" -FM-273,"!defined","CMakeCCompilerId.c",892,"!defined (general function) does not perform its intended action","Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in !defined",3,2,3,"low" -FM-274,"main","CMakeCCompilerId.c",902,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-275,"main","CMakeCCompilerId.c",907,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-276,"defined","CMakeCCompilerId.c",891,"defined (general function) does not perform its intended action","Failure of defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in defined",3,2,3,"low" -FM-277,"!defined","CMakeCCompilerId.c",892,"!defined (general function) does not perform its intended action","Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in !defined",3,2,3,"low" -FM-278,"main","CMakeCCompilerId.c",902,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-279,"main","CMakeCCompilerId.c",907,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-280,"defined","CMakeCCompilerId.c",891,"defined (general function) does not perform its intended action","Failure of defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in defined",3,2,3,"low" -FM-281,"!defined","CMakeCCompilerId.c",892,"!defined (general function) does not perform its intended action","Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in !defined",3,2,3,"low" -FM-282,"main","CMakeCCompilerId.c",902,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-283,"main","CMakeCCompilerId.c",907,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-284,"defined","CMakeCCompilerId.c",891,"defined (general function) does not perform its intended action","Failure of defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in defined",3,2,3,"low" -FM-285,"!defined","CMakeCCompilerId.c",892,"!defined (general function) does not perform its intended action","Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in !defined",3,2,3,"low" -FM-286,"main","CMakeCCompilerId.c",902,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-287,"main","CMakeCCompilerId.c",907,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-288,"defined","CMakeCCompilerId.c",891,"defined (general function) does not perform its intended action","Failure of defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in defined",3,2,3,"low" -FM-289,"!defined","CMakeCCompilerId.c",892,"!defined (general function) does not perform its intended action","Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in !defined",3,2,3,"low" -FM-290,"main","CMakeCCompilerId.c",902,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-291,"main","CMakeCCompilerId.c",907,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in CMakeCCompilerId.c","Logic error or untested edge case in main",3,2,3,"low" -FM-292,"cfusa_watchdog_kick","cfusa_runtime.c",26,"cfusa_watchdog_kick (safety-critical function) does not perform its intended action","Failure of cfusa_watchdog_kick could propagate undetected to callers in cfusa_runtime.c","Unhandled fault or invalid input condition within cfusa_watchdog_kick",9,4,6,"high" -FM-293,"cfusa_watchdog_check","cfusa_runtime.c",33,"cfusa_watchdog_check (safety-critical function) does not perform its intended action","Failure of cfusa_watchdog_check could propagate undetected to callers in cfusa_runtime.c","Unhandled fault or invalid input condition within cfusa_watchdog_check",9,4,6,"high" -FM-294,"cfusa_watchdog_stop","cfusa_runtime.c",43,"cfusa_watchdog_stop (safety-critical function) does not perform its intended action","Failure of cfusa_watchdog_stop could propagate undetected to callers in cfusa_runtime.c","Unhandled fault or invalid input condition within cfusa_watchdog_stop",9,4,6,"high" -FM-295,"cfusa_watchdog_fired","cfusa_runtime.c",48,"cfusa_watchdog_fired (safety-critical function) does not perform its intended action","Failure of cfusa_watchdog_fired could propagate undetected to callers in cfusa_runtime.c","Unhandled fault or invalid input condition within cfusa_watchdog_fired",9,4,6,"high" -FM-296,"cfusa_heartbeat_beat","cfusa_runtime.c",67,"cfusa_heartbeat_beat (general function) does not perform its intended action","Failure of cfusa_heartbeat_beat could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_heartbeat_beat",3,2,3,"low" -FM-297,"cfusa_heartbeat_check","cfusa_runtime.c",74,"cfusa_heartbeat_check (monitoring/control function) does not perform its intended action","Failure of cfusa_heartbeat_check could propagate undetected to callers in cfusa_runtime.c","Configuration or state inconsistency affecting cfusa_heartbeat_check",5,3,4,"medium" -FM-298,"cfusa_heartbeat_stop","cfusa_runtime.c",85,"cfusa_heartbeat_stop (general function) does not perform its intended action","Failure of cfusa_heartbeat_stop could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_heartbeat_stop",3,2,3,"low" -FM-299,"cfusa_heartbeat_missed","cfusa_runtime.c",90,"cfusa_heartbeat_missed (general function) does not perform its intended action","Failure of cfusa_heartbeat_missed could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_heartbeat_missed",3,2,3,"low" -FM-300,"cfusa_state_get","cfusa_runtime.c",107,"cfusa_state_get (general function) does not perform its intended action","Failure of cfusa_state_get could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_state_get",3,2,3,"low" -FM-301,"cfusa_state_transition","cfusa_runtime.c",112,"cfusa_state_transition (general function) does not perform its intended action","Failure of cfusa_state_transition could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_state_transition",3,2,3,"low" -FM-302,"cfusa_state_name","cfusa_runtime.c",123,"cfusa_state_name (general function) does not perform its intended action","Failure of cfusa_state_name could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_state_name",3,2,3,"low" -FM-303,"cfusa_diag_init","cfusa_runtime.c",137,"cfusa_diag_init (monitoring/control function) does not perform its intended action","Failure of cfusa_diag_init could propagate undetected to callers in cfusa_runtime.c","Configuration or state inconsistency affecting cfusa_diag_init",5,3,4,"medium" -FM-304,"cfusa_diag_count","cfusa_runtime.c",160,"cfusa_diag_count (general function) does not perform its intended action","Failure of cfusa_diag_count could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_diag_count",3,2,3,"low" -FM-305,"cfusa_diag_get","cfusa_runtime.c",165,"cfusa_diag_get (general function) does not perform its intended action","Failure of cfusa_diag_get could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_diag_get",3,2,3,"low" -FM-306,"cfusa_diag_clear","cfusa_runtime.c",174,"cfusa_diag_clear (general function) does not perform its intended action","Failure of cfusa_diag_clear could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_diag_clear",3,2,3,"low" -FM-307,"cfusa_diag_level_name","cfusa_runtime.c",179,"cfusa_diag_level_name (general function) does not perform its intended action","Failure of cfusa_diag_level_name could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_diag_level_name",3,2,3,"low" -FM-308,"cfusa_fault_record","cfusa_runtime.c",223,"cfusa_fault_record (safety-critical function) does not perform its intended action","Failure of cfusa_fault_record could propagate undetected to callers in cfusa_runtime.c","Unhandled fault or invalid input condition within cfusa_fault_record",9,4,6,"high" -FM-309,"cfusa_fault_reset","cfusa_runtime.c",233,"cfusa_fault_reset (safety-critical function) does not perform its intended action","Failure of cfusa_fault_reset could propagate undetected to callers in cfusa_runtime.c","Unhandled fault or invalid input condition within cfusa_fault_reset",9,4,6,"high" -FM-310,"cfusa_fault_count","cfusa_runtime.c",240,"cfusa_fault_count (safety-critical function) does not perform its intended action","Failure of cfusa_fault_count could propagate undetected to callers in cfusa_runtime.c","Unhandled fault or invalid input condition within cfusa_fault_count",9,4,6,"high" -FM-311,"cfusa_report_init","report.c",14,"cfusa_report_init (monitoring/control function) does not perform its intended action","Failure of cfusa_report_init could propagate undetected to callers in report.c","Configuration or state inconsistency affecting cfusa_report_init",5,3,4,"medium" -FM-312,"cfusa_report_free","report.c",27,"cfusa_report_free (general function) does not perform its intended action","Failure of cfusa_report_free could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_report_free",3,2,3,"low" -FM-313,"snprintf","report.c",117,"snprintf (general function) does not perform its intended action","Failure of snprintf could propagate undetected to callers in report.c","Logic error or untested edge case in snprintf",3,2,3,"low" -FM-314,"cfusa_severity_str","report.c",127,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" -FM-315,"cfusa_format_parse","report.c",137,"cfusa_format_parse (general function) does not perform its intended action","Failure of cfusa_format_parse could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_format_parse",3,2,3,"low" -FM-316,"cfusa_report_score","report.c",148,"cfusa_report_score (general function) does not perform its intended action","Failure of cfusa_report_score could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_report_score",3,2,3,"low" -FM-317,"cfusa_report_score","report.c",256,"cfusa_report_score (general function) does not perform its intended action","Failure of cfusa_report_score could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_report_score",3,2,3,"low" -FM-318,"cfusa_severity_str","report.c",262,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" -FM-319,"cfusa_report_score","report.c",307,"cfusa_report_score (general function) does not perform its intended action","Failure of cfusa_report_score could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_report_score",3,2,3,"low" -FM-320,"cfusa_severity_str","report.c",344,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" -FM-321,"cfusa_severity_str","report.c",360,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" -FM-322,"cfusa_severity_str","report.c",375,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" -FM-323,"cfusa_report_score","report.c",508,"cfusa_report_score (general function) does not perform its intended action","Failure of cfusa_report_score could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_report_score",3,2,3,"low" -FM-324,"cfusa_severity_str","report.c",523,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" -FM-325,"cfusa_severity_str","report.c",524,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" -FM-326,"cfusa_report_score","report.c",550,"cfusa_report_score (general function) does not perform its intended action","Failure of cfusa_report_score could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_report_score",3,2,3,"low" -FM-327,"cfusa_severity_str","report.c",564,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" -FM-328,"cfusa_report_print","report.c",571,"cfusa_report_print (general function) does not perform its intended action","Failure of cfusa_report_print could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_report_print",3,2,3,"low" -FM-329,"cfusa_qb_is_stub_text","qualitybar.c",44,"cfusa_qb_is_stub_text (general function) does not perform its intended action","Failure of cfusa_qb_is_stub_text could propagate undetected to callers in qualitybar.c","Logic error or untested edge case in cfusa_qb_is_stub_text",3,2,3,"low" -FM-330,"cfusa_qb_rule_b_flagged","qualitybar.c",59,"cfusa_qb_rule_b_flagged (general function) does not perform its intended action","Failure of cfusa_qb_rule_b_flagged could propagate undetected to callers in qualitybar.c","Logic error or untested edge case in cfusa_qb_rule_b_flagged",3,2,3,"low" -FM-331,"cfusa_qb_attestation_read","qualitybar.c",100,"cfusa_qb_attestation_read (general function) does not perform its intended action","Failure of cfusa_qb_attestation_read could propagate undetected to callers in qualitybar.c","Logic error or untested edge case in cfusa_qb_attestation_read",3,2,3,"low" -FM-332,"cfusa_qb_attestation_valid","qualitybar.c",161,"cfusa_qb_attestation_valid (general function) does not perform its intended action","Failure of cfusa_qb_attestation_valid could propagate undetected to callers in qualitybar.c","Logic error or untested edge case in cfusa_qb_attestation_valid",3,2,3,"low" -FM-333,"cfusa_qb_rule_disposed","qualitybar.c",180,"cfusa_qb_rule_disposed (general function) does not perform its intended action","Failure of cfusa_qb_rule_disposed could propagate undetected to callers in qualitybar.c","Logic error or untested edge case in cfusa_qb_rule_disposed",3,2,3,"low" -FM-334,"cfusa_qb_content_hash","qualitybar.c",206,"cfusa_qb_content_hash (general function) does not perform its intended action","Failure of cfusa_qb_content_hash could propagate undetected to callers in qualitybar.c","Logic error or untested edge case in cfusa_qb_content_hash",3,2,3,"low" -FM-335,"cfusa_engine_reset","engine.c",9,"cfusa_engine_reset (general function) does not perform its intended action","Failure of cfusa_engine_reset could propagate undetected to callers in engine.c","Logic error or untested edge case in cfusa_engine_reset",3,2,3,"low" -FM-336,"cfusa_engine_register","engine.c",14,"cfusa_engine_register (general function) does not perform its intended action","Failure of cfusa_engine_register could propagate undetected to callers in engine.c","Logic error or untested edge case in cfusa_engine_register",3,2,3,"low" -FM-337,"cfusa_engine_rule_count","engine.c",23,"cfusa_engine_rule_count (general function) does not perform its intended action","Failure of cfusa_engine_rule_count could propagate undetected to callers in engine.c","Logic error or untested edge case in cfusa_engine_rule_count",3,2,3,"low" -FM-338,"cfusa_engine_get_rule","engine.c",28,"cfusa_engine_get_rule (general function) does not perform its intended action","Failure of cfusa_engine_get_rule could propagate undetected to callers in engine.c","Logic error or untested edge case in cfusa_engine_get_rule",3,2,3,"low" -FM-339,"cfusa_engine_list_rules","engine.c",34,"cfusa_engine_list_rules (general function) does not perform its intended action","Failure of cfusa_engine_list_rules could propagate undetected to callers in engine.c","Logic error or untested edge case in cfusa_engine_list_rules",3,2,3,"low" -FM-340,"!cfusa_config_is_rule_disabled","engine.c",65,"!cfusa_config_is_rule_disabled (monitoring/control function) does not perform its intended action","Failure of !cfusa_config_is_rule_disabled could propagate undetected to callers in engine.c","Configuration or state inconsistency affecting !cfusa_config_is_rule_disabled",5,3,4,"medium" -FM-341,"strcmp","utils.c",46,"strcmp (general function) does not perform its intended action","Failure of strcmp could propagate undetected to callers in utils.c","Logic error or untested edge case in strcmp",3,2,3,"low" -FM-342,"cfusa_read_file","utils.c",60,"cfusa_read_file (general function) does not perform its intended action","Failure of cfusa_read_file could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_read_file",3,2,3,"low" -FM-343,"cfusa_fopen_write","utils.c",78,"cfusa_fopen_write (general function) does not perform its intended action","Failure of cfusa_fopen_write could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_fopen_write",3,2,3,"low" -FM-344,"cfusa_file_exists","utils.c",87,"cfusa_file_exists (general function) does not perform its intended action","Failure of cfusa_file_exists could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_file_exists",3,2,3,"low" -FM-345,"cfusa_dir_exists","utils.c",93,"cfusa_dir_exists (general function) does not perform its intended action","Failure of cfusa_dir_exists could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_dir_exists",3,2,3,"low" -FM-346,"cfusa_mkdir_p","utils.c",99,"cfusa_mkdir_p (general function) does not perform its intended action","Failure of cfusa_mkdir_p could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_mkdir_p",3,2,3,"low" -FM-347,"cfusa_scan_lines","utils.c",115,"cfusa_scan_lines (general function) does not perform its intended action","Failure of cfusa_scan_lines could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_scan_lines",3,2,3,"low" -FM-348,"cfusa_basename","utils.c",134,"cfusa_basename (general function) does not perform its intended action","Failure of cfusa_basename could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_basename",3,2,3,"low" -FM-349,"cfusa_extension","utils.c",140,"cfusa_extension (general function) does not perform its intended action","Failure of cfusa_extension could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_extension",3,2,3,"low" -FM-350,"cfusa_str_contains","utils.c",147,"cfusa_str_contains (general function) does not perform its intended action","Failure of cfusa_str_contains could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_str_contains",3,2,3,"low" -FM-351,"cfusa_str_starts_with","utils.c",152,"cfusa_str_starts_with (general function) does not perform its intended action","Failure of cfusa_str_starts_with could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_str_starts_with",3,2,3,"low" -FM-352,"cfusa_str_trim","utils.c",157,"cfusa_str_trim (general function) does not perform its intended action","Failure of cfusa_str_trim could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_str_trim",3,2,3,"low" -FM-353,"cfusa_str_escape_json","utils.c",168,"cfusa_str_escape_json (general function) does not perform its intended action","Failure of cfusa_str_escape_json could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_str_escape_json",3,2,3,"low" -FM-354,"cfusa_path_join","utils.c",188,"cfusa_path_join (general function) does not perform its intended action","Failure of cfusa_path_join could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_path_join",3,2,3,"low" -FM-355,"cfusa_sha256_buf","utils.c",311,"cfusa_sha256_buf (general function) does not perform its intended action","Failure of cfusa_sha256_buf could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_sha256_buf",3,2,3,"low" -FM-356,"cfusa_sha256_file","utils.c",323,"cfusa_sha256_file (general function) does not perform its intended action","Failure of cfusa_sha256_file could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_sha256_file",3,2,3,"low" -FM-357,"cfusa_sha256_buf","utils.c",352,"cfusa_sha256_buf (general function) does not perform its intended action","Failure of cfusa_sha256_buf could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_sha256_buf",3,2,3,"low" -FM-358,"cfusa_timestamp_now","utils.c",383,"cfusa_timestamp_now (general function) does not perform its intended action","Failure of cfusa_timestamp_now could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_timestamp_now",3,2,3,"low" -FM-359,"cfusa_count_c_files","utils.c",400,"cfusa_count_c_files (general function) does not perform its intended action","Failure of cfusa_count_c_files could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_count_c_files",3,2,3,"low" -FM-360,"cfusa_count_lines_in_file","utils.c",408,"cfusa_count_lines_in_file (general function) does not perform its intended action","Failure of cfusa_count_lines_in_file could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_count_lines_in_file",3,2,3,"low" -FM-361,"cfusa_match_outside_string","utils.c",421,"cfusa_match_outside_string (general function) does not perform its intended action","Failure of cfusa_match_outside_string could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_match_outside_string",3,2,3,"low" -FM-362,"cfusa_config_defaults","config.c",8,"cfusa_config_defaults (safety-critical function) does not perform its intended action","Failure of cfusa_config_defaults could propagate undetected to callers in config.c","Unhandled fault or invalid input condition within cfusa_config_defaults",9,4,6,"high" -FM-363,"cfusa_config_load","config.c",92,"cfusa_config_load (monitoring/control function) does not perform its intended action","Failure of cfusa_config_load could propagate undetected to callers in config.c","Configuration or state inconsistency affecting cfusa_config_load",5,3,4,"medium" -FM-364,"extract_str_array_n","config.c",150,"extract_str_array_n (general function) does not perform its intended action","Failure of extract_str_array_n could propagate undetected to callers in config.c","Logic error or untested edge case in extract_str_array_n",3,2,3,"low" -FM-365,"extract_str_array_n","config.c",160,"extract_str_array_n (general function) does not perform its intended action","Failure of extract_str_array_n could propagate undetected to callers in config.c","Logic error or untested edge case in extract_str_array_n",3,2,3,"low" -FM-366,"extract_str_array_n","config.c",170,"extract_str_array_n (general function) does not perform its intended action","Failure of extract_str_array_n could propagate undetected to callers in config.c","Logic error or untested edge case in extract_str_array_n",3,2,3,"low" -FM-367,"extract_str_array_n","config.c",177,"extract_str_array_n (general function) does not perform its intended action","Failure of extract_str_array_n could propagate undetected to callers in config.c","Logic error or untested edge case in extract_str_array_n",3,2,3,"low" -FM-368,"cfusa_config_is_rule_disabled","config.c",186,"cfusa_config_is_rule_disabled (monitoring/control function) does not perform its intended action","Failure of cfusa_config_is_rule_disabled could propagate undetected to callers in config.c","Configuration or state inconsistency affecting cfusa_config_is_rule_disabled",5,3,4,"medium" -FM-369,"cfusa_config_save","config.c",193,"cfusa_config_save (monitoring/control function) does not perform its intended action","Failure of cfusa_config_save could propagate undetected to callers in config.c","Configuration or state inconsistency affecting cfusa_config_save",5,3,4,"medium" -FM-370,"cfusa_config_is_excluded","config.c",225,"cfusa_config_is_excluded (monitoring/control function) does not perform its intended action","Failure of cfusa_config_is_excluded could propagate undetected to callers in config.c","Configuration or state inconsistency affecting cfusa_config_is_excluded",5,3,4,"medium" +FM-004,"cmd_coupling","cmd_coupling.c",121,"cmd_coupling (general function) does not perform its intended action","Failure of cmd_coupling could propagate undetected to callers in cmd_coupling.c","Logic error or untested edge case in cmd_coupling",3,2,3,"low" +FM-005,"cmd_qualify","cmd_qualify.c",472,"cmd_qualify (general function) does not perform its intended action","Failure of cmd_qualify could propagate undetected to callers in cmd_qualify.c","Logic error or untested edge case in cmd_qualify",3,2,3,"low" +FM-006,"cmd_misra","cmd_misra.c",60,"cmd_misra (general function) does not perform its intended action","Failure of cmd_misra could propagate undetected to callers in cmd_misra.c","Logic error or untested edge case in cmd_misra",3,2,3,"low" +FM-007,"path_exists","cmd_safety_rules.c",120,"path_exists (general function) does not perform its intended action","Failure of path_exists could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in path_exists",3,2,3,"low" +FM-008,"json_sec_code","cmd_safety_rules.c",428,"json_sec_code (general function) does not perform its intended action","Failure of json_sec_code could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in json_sec_code",3,2,3,"low" +FM-009,"path_exists","cmd_safety_rules.c",455,"path_exists (general function) does not perform its intended action","Failure of path_exists could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in path_exists",3,2,3,"low" +FM-010,"path_exists","cmd_safety_rules.c",868,"path_exists (general function) does not perform its intended action","Failure of path_exists could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in path_exists",3,2,3,"low" +FM-011,"path_exists","cmd_safety_rules.c",882,"path_exists (general function) does not perform its intended action","Failure of path_exists could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in path_exists",3,2,3,"low" +FM-012,"path_exists","cmd_safety_rules.c",895,"path_exists (general function) does not perform its intended action","Failure of path_exists could propagate undetected to callers in cmd_safety_rules.c","Logic error or untested edge case in path_exists",3,2,3,"low" +FM-013,"cfusa_safety_register_rules","cmd_safety_rules.c",987,"cfusa_safety_register_rules (safety-critical function) does not perform its intended action","Failure of cfusa_safety_register_rules could propagate undetected to callers in cmd_safety_rules.c","Unhandled fault or invalid input condition within cfusa_safety_register_rules",9,4,6,"high" +FM-014,"cfusa_safety_rule_count","cmd_safety_rules.c",995,"cfusa_safety_rule_count (safety-critical function) does not perform its intended action","Failure of cfusa_safety_rule_count could propagate undetected to callers in cmd_safety_rules.c","Unhandled fault or invalid input condition within cfusa_safety_rule_count",9,4,6,"high" +FM-015,"cmd_iso26262","cmd_iso26262.c",84,"cmd_iso26262 (general function) does not perform its intended action","Failure of cmd_iso26262 could propagate undetected to callers in cmd_iso26262.c","Logic error or untested edge case in cmd_iso26262",3,2,3,"low" +FM-016,"cfusa_scan_lines","cmd_req.c",135,"cfusa_scan_lines (general function) does not perform its intended action","Failure of cfusa_scan_lines could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in cfusa_scan_lines",3,2,3,"low" +FM-017,"xml_escape","cmd_req.c",172,"xml_escape (general function) does not perform its intended action","Failure of xml_escape could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in xml_escape",3,2,3,"low" +FM-018,"xml_escape","cmd_req.c",176,"xml_escape (general function) does not perform its intended action","Failure of xml_escape could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in xml_escape",3,2,3,"low" +FM-019,"xml_escape","cmd_req.c",180,"xml_escape (general function) does not perform its intended action","Failure of xml_escape could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in xml_escape",3,2,3,"low" +FM-020,"import_reqif","cmd_req.c",646,"import_reqif (general function) does not perform its intended action","Failure of import_reqif could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in import_reqif",3,2,3,"low" +FM-021,"import_polarion_xml","cmd_req.c",652,"import_polarion_xml (general function) does not perform its intended action","Failure of import_polarion_xml could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in import_polarion_xml",3,2,3,"low" +FM-022,"import_reqif","cmd_req.c",655,"import_reqif (general function) does not perform its intended action","Failure of import_reqif could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in import_reqif",3,2,3,"low" +FM-023,"import_codebeamer_xml","cmd_req.c",660,"import_codebeamer_xml (general function) does not perform its intended action","Failure of import_codebeamer_xml could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in import_codebeamer_xml",3,2,3,"low" +FM-024,"import_jama_xml","cmd_req.c",671,"import_jama_xml (general function) does not perform its intended action","Failure of import_jama_xml could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in import_jama_xml",3,2,3,"low" +FM-025,"sizeof","cmd_req.c",695,"sizeof (general function) does not perform its intended action","Failure of sizeof could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in sizeof",3,2,3,"low" +FM-026,"append_entry","cmd_req.c",713,"append_entry (general function) does not perform its intended action","Failure of append_entry could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in append_entry",3,2,3,"low" +FM-027,"cmd_req","cmd_req.c",760,"cmd_req (general function) does not perform its intended action","Failure of cmd_req could propagate undetected to callers in cmd_req.c","Logic error or untested edge case in cmd_req",3,2,3,"low" +FM-028,"cmd_release","cmd_release.c",100,"cmd_release (general function) does not perform its intended action","Failure of cmd_release could propagate undetected to callers in cmd_release.c","Logic error or untested edge case in cmd_release",3,2,3,"low" +FM-029,"cmd_check","cmd_check.c",14,"cmd_check (monitoring/control function) does not perform its intended action","Failure of cmd_check could propagate undetected to callers in cmd_check.c","Configuration or state inconsistency affecting cmd_check",5,3,4,"medium" +FM-030,"cfusa_template_generate_all","cmd_template.c",84,"cfusa_template_generate_all (general function) does not perform its intended action","Failure of cfusa_template_generate_all could propagate undetected to callers in cmd_template.c","Logic error or untested edge case in cfusa_template_generate_all",3,2,3,"low" +FM-031,"cmd_template","cmd_template.c",106,"cmd_template (general function) does not perform its intended action","Failure of cmd_template could propagate undetected to callers in cmd_template.c","Logic error or untested edge case in cmd_template",3,2,3,"low" +FM-032,"cmd_tara","cmd_tara.c",338,"cmd_tara (general function) does not perform its intended action","Failure of cmd_tara could propagate undetected to callers in cmd_tara.c","Logic error or untested edge case in cmd_tara",3,2,3,"low" +FM-033,"write_threat_json","cmd_tara.c",454,"write_threat_json (general function) does not perform its intended action","Failure of write_threat_json could propagate undetected to callers in cmd_tara.c","Logic error or untested edge case in write_threat_json",3,2,3,"low" +FM-034,"link","cmd_trace.c",35,"link (general function) does not perform its intended action","Failure of link could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in link",3,2,3,"low" +FM-035,"cfusa_scan_lines","cmd_trace.c",184,"cfusa_scan_lines (general function) does not perform its intended action","Failure of cfusa_scan_lines could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in cfusa_scan_lines",3,2,3,"low" +FM-036,"cmd_trace","cmd_trace.c",336,"cmd_trace (general function) does not perform its intended action","Failure of cmd_trace could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in cmd_trace",3,2,3,"low" +FM-037,"compute_hlr_llr","cmd_trace.c",436,"compute_hlr_llr (general function) does not perform its intended action","Failure of compute_hlr_llr could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in compute_hlr_llr",3,2,3,"low" +FM-038,"cfusa_basename","cmd_trace.c",716,"cfusa_basename (general function) does not perform its intended action","Failure of cfusa_basename could propagate undetected to callers in cmd_trace.c","Logic error or untested edge case in cfusa_basename",3,2,3,"low" +FM-039,"cfusa_analyze_register_rules","cmd_analyze.c",292,"cfusa_analyze_register_rules (general function) does not perform its intended action","Failure of cfusa_analyze_register_rules could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in cfusa_analyze_register_rules",3,2,3,"low" +FM-040,"cmd_analyze","cmd_analyze.c",298,"cmd_analyze (general function) does not perform its intended action","Failure of cmd_analyze could propagate undetected to callers in cmd_analyze.c","Logic error or untested edge case in cmd_analyze",3,2,3,"low" +FM-041,"cmd_report","cmd_report.c",14,"cmd_report (general function) does not perform its intended action","Failure of cmd_report could propagate undetected to callers in cmd_report.c","Logic error or untested edge case in cmd_report",3,2,3,"low" +FM-042,"cmd_init","cmd_init.c",15,"cmd_init (monitoring/control function) does not perform its intended action","Failure of cmd_init could propagate undetected to callers in cmd_init.c","Configuration or state inconsistency affecting cmd_init",5,3,4,"medium" +FM-043,"required","cmd_iec62443.c",24,"required (general function) does not perform its intended action","Failure of required could propagate undetected to callers in cmd_iec62443.c","Logic error or untested edge case in required",3,2,3,"low" +FM-044,"cmd_iec62443","cmd_iec62443.c",85,"cmd_iec62443 (general function) does not perform its intended action","Failure of cmd_iec62443 could propagate undetected to callers in cmd_iec62443.c","Logic error or untested edge case in cmd_iec62443",3,2,3,"low" +FM-045,"cmd_fmea","cmd_fmea.c",262,"cmd_fmea (general function) does not perform its intended action","Failure of cmd_fmea could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in cmd_fmea",3,2,3,"low" +FM-046,"cfusa_path_join","cmd_fmea.c",403,"cfusa_path_join (general function) does not perform its intended action","Failure of cfusa_path_join could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in cfusa_path_join",3,2,3,"low" +FM-047,"cfusa_basename","cmd_fmea.c",446,"cfusa_basename (general function) does not perform its intended action","Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in cfusa_basename",3,2,3,"low" +FM-048,"cfusa_basename","cmd_fmea.c",519,"cfusa_basename (general function) does not perform its intended action","Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in cfusa_basename",3,2,3,"low" +FM-049,"cfusa_basename","cmd_fmea.c",547,"cfusa_basename (general function) does not perform its intended action","Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c","Logic error or untested edge case in cfusa_basename",3,2,3,"low" +FM-050,"cmd_fix","cmd_fix.c",125,"cmd_fix (general function) does not perform its intended action","Failure of cmd_fix could propagate undetected to callers in cmd_fix.c","Logic error or untested edge case in cmd_fix",3,2,3,"low" +FM-051,"main","main.c",14,"main (general function) does not perform its intended action","Failure of main could propagate undetected to callers in main.c","Logic error or untested edge case in main",3,2,3,"low" +FM-052,"cmd_boundary","cmd_boundary.c",72,"cmd_boundary (general function) does not perform its intended action","Failure of cmd_boundary could propagate undetected to callers in cmd_boundary.c","Logic error or untested edge case in cmd_boundary",3,2,3,"low" +FM-053,"cmd_impact","cmd_impact.c",106,"cmd_impact (general function) does not perform its intended action","Failure of cmd_impact could propagate undetected to callers in cmd_impact.c","Logic error or untested edge case in cmd_impact",3,2,3,"low" +FM-054,"cmd_sci","cmd_sci.c",51,"cmd_sci (general function) does not perform its intended action","Failure of cmd_sci could propagate undetected to callers in cmd_sci.c","Logic error or untested edge case in cmd_sci",3,2,3,"low" +FM-055,"cmd_iec61508","cmd_iec61508.c",78,"cmd_iec61508 (general function) does not perform its intended action","Failure of cmd_iec61508 could propagate undetected to callers in cmd_iec61508.c","Logic error or untested edge case in cmd_iec61508",3,2,3,"low" +FM-056,"cmd_badge","cmd_badge.c",9,"cmd_badge (general function) does not perform its intended action","Failure of cmd_badge could propagate undetected to callers in cmd_badge.c","Logic error or untested edge case in cmd_badge",3,2,3,"low" +FM-057,"cmd_unece","cmd_unece.c",57,"cmd_unece (general function) does not perform its intended action","Failure of cmd_unece could propagate undetected to callers in cmd_unece.c","Logic error or untested edge case in cmd_unece",3,2,3,"low" +FM-058,"cmd_sign","cmd_sign.c",43,"cmd_sign (general function) does not perform its intended action","Failure of cmd_sign could propagate undetected to callers in cmd_sign.c","Logic error or untested edge case in cmd_sign",3,2,3,"low" +FM-059,"cfusa_hmac_sha256","cmd_sign.c",120,"cfusa_hmac_sha256 (general function) does not perform its intended action","Failure of cfusa_hmac_sha256 could propagate undetected to callers in cmd_sign.c","Logic error or untested edge case in cfusa_hmac_sha256",3,2,3,"low" +FM-060,"cmd_iso21434","cmd_iso21434.c",77,"cmd_iso21434 (general function) does not perform its intended action","Failure of cmd_iso21434 could propagate undetected to callers in cmd_iso21434.c","Logic error or untested edge case in cmd_iso21434",3,2,3,"low" +FM-061,"cfusa_scan_lines","cmd_vuln.c",107,"cfusa_scan_lines (general function) does not perform its intended action","Failure of cfusa_scan_lines could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in cfusa_scan_lines",3,2,3,"low" +FM-062,"cmd_vuln","cmd_vuln.c",109,"cmd_vuln (general function) does not perform its intended action","Failure of cmd_vuln could propagate undetected to callers in cmd_vuln.c","Logic error or untested edge case in cmd_vuln",3,2,3,"low" +FM-063,"cmd_comp","cmd_comp.c",222,"cmd_comp (general function) does not perform its intended action","Failure of cmd_comp could propagate undetected to callers in cmd_comp.c","Logic error or untested edge case in cmd_comp",3,2,3,"low" +FM-064,"cmd_audit_pack","cmd_audit_pack.c",21,"cmd_audit_pack (general function) does not perform its intended action","Failure of cmd_audit_pack could propagate undetected to callers in cmd_audit_pack.c","Logic error or untested edge case in cmd_audit_pack",3,2,3,"low" +FM-065,"cmd_hooks","cmd_hooks.c",20,"cmd_hooks (general function) does not perform its intended action","Failure of cmd_hooks could propagate undetected to callers in cmd_hooks.c","Logic error or untested edge case in cmd_hooks",3,2,3,"low" +FM-066,"cmd_disposition","cmd_disposition.c",184,"cmd_disposition (general function) does not perform its intended action","Failure of cmd_disposition could propagate undetected to callers in cmd_disposition.c","Logic error or untested edge case in cmd_disposition",3,2,3,"low" +FM-067,"cmd_coverage","cmd_coverage.c",174,"cmd_coverage (general function) does not perform its intended action","Failure of cmd_coverage could propagate undetected to callers in cmd_coverage.c","Logic error or untested edge case in cmd_coverage",3,2,3,"low" +FM-068,"cmd_diff","cmd_diff.c",66,"cmd_diff (general function) does not perform its intended action","Failure of cmd_diff could propagate undetected to callers in cmd_diff.c","Logic error or untested edge case in cmd_diff",3,2,3,"low" +FM-069,"parse_sec_code","cmd_hara.c",622,"parse_sec_code (general function) does not perform its intended action","Failure of parse_sec_code could propagate undetected to callers in cmd_hara.c","Logic error or untested edge case in parse_sec_code",3,2,3,"low" +FM-070,"parse_sec_code","cmd_hara.c",677,"parse_sec_code (general function) does not perform its intended action","Failure of parse_sec_code could propagate undetected to callers in cmd_hara.c","Logic error or untested edge case in parse_sec_code",3,2,3,"low" +FM-071,"cmd_hara","cmd_hara.c",792,"cmd_hara (general function) does not perform its intended action","Failure of cmd_hara could propagate undetected to callers in cmd_hara.c","Logic error or untested edge case in cmd_hara",3,2,3,"low" +FM-072,"cmd_slsa","cmd_slsa.c",71,"cmd_slsa (general function) does not perform its intended action","Failure of cmd_slsa could propagate undetected to callers in cmd_slsa.c","Logic error or untested edge case in cmd_slsa",3,2,3,"low" +FM-073,"slsa_file_exists","cmd_slsa.c",123,"slsa_file_exists (general function) does not perform its intended action","Failure of slsa_file_exists could propagate undetected to callers in cmd_slsa.c","Logic error or untested edge case in slsa_file_exists",3,2,3,"low" +FM-074,"cmd_do178","cmd_do178.c",113,"cmd_do178 (general function) does not perform its intended action","Failure of cmd_do178 could propagate undetected to callers in cmd_do178.c","Logic error or untested edge case in cmd_do178",3,2,3,"low" +FM-075,"cmd_verify","cmd_verify.c",14,"cmd_verify (general function) does not perform its intended action","Failure of cmd_verify could propagate undetected to callers in cmd_verify.c","Logic error or untested edge case in cmd_verify",3,2,3,"low" +FM-076,"cmd_sas","cmd_sas.c",90,"cmd_sas (general function) does not perform its intended action","Failure of cmd_sas could propagate undetected to callers in cmd_sas.c","Logic error or untested edge case in cmd_sas",3,2,3,"low" +FM-077,"cfusa_match_outside_string","cmd_cyber.c",224,"cfusa_match_outside_string (general function) does not perform its intended action","Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cfusa_match_outside_string",3,2,3,"low" +FM-078,"cfusa_match_outside_string","cmd_cyber.c",329,"cfusa_match_outside_string (general function) does not perform its intended action","Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cfusa_match_outside_string",3,2,3,"low" +FM-079,"cfusa_match_outside_string","cmd_cyber.c",349,"cfusa_match_outside_string (general function) does not perform its intended action","Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cfusa_match_outside_string",3,2,3,"low" +FM-080,"cfusa_match_outside_string","cmd_cyber.c",350,"cfusa_match_outside_string (general function) does not perform its intended action","Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cfusa_match_outside_string",3,2,3,"low" +FM-081,"cfusa_match_outside_string","cmd_cyber.c",445,"cfusa_match_outside_string (general function) does not perform its intended action","Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cfusa_match_outside_string",3,2,3,"low" +FM-082,"cfusa_match_outside_string","cmd_cyber.c",479,"cfusa_match_outside_string (general function) does not perform its intended action","Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cfusa_match_outside_string",3,2,3,"low" +FM-083,"cfusa_cyber_register_rules","cmd_cyber.c",564,"cfusa_cyber_register_rules (general function) does not perform its intended action","Failure of cfusa_cyber_register_rules could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cfusa_cyber_register_rules",3,2,3,"low" +FM-084,"cmd_cyber","cmd_cyber.c",570,"cmd_cyber (general function) does not perform its intended action","Failure of cmd_cyber could propagate undetected to callers in cmd_cyber.c","Logic error or untested edge case in cmd_cyber",3,2,3,"low" +FM-085,"cmd_safety_case","cmd_safety_case.c",35,"cmd_safety_case (safety-critical function) does not perform its intended action","Failure of cmd_safety_case could propagate undetected to callers in cmd_safety_case.c","Unhandled fault or invalid input condition within cmd_safety_case",9,4,6,"high" +FM-086,"cmd_metrics","cmd_metrics.c",288,"cmd_metrics (general function) does not perform its intended action","Failure of cmd_metrics could propagate undetected to callers in cmd_metrics.c","Logic error or untested edge case in cmd_metrics",3,2,3,"low" +FM-087,"cmd_capabilities","cmd_capabilities.c",15,"cmd_capabilities (general function) does not perform its intended action","Failure of cmd_capabilities could propagate undetected to callers in cmd_capabilities.c","Logic error or untested edge case in cmd_capabilities",3,2,3,"low" +FM-088,"cfusa_lint_register_rules","cmd_lint.c",527,"cfusa_lint_register_rules (general function) does not perform its intended action","Failure of cfusa_lint_register_rules could propagate undetected to callers in cmd_lint.c","Logic error or untested edge case in cfusa_lint_register_rules",3,2,3,"low" +FM-089,"cmd_lint","cmd_lint.c",535,"cmd_lint (general function) does not perform its intended action","Failure of cmd_lint could propagate undetected to callers in cmd_lint.c","Logic error or untested edge case in cmd_lint",3,2,3,"low" +FM-090,"cfusa_watchdog_kick","cfusa_runtime.c",26,"cfusa_watchdog_kick (safety-critical function) does not perform its intended action","Failure of cfusa_watchdog_kick could propagate undetected to callers in cfusa_runtime.c","Unhandled fault or invalid input condition within cfusa_watchdog_kick",9,4,6,"high" +FM-091,"cfusa_watchdog_check","cfusa_runtime.c",33,"cfusa_watchdog_check (safety-critical function) does not perform its intended action","Failure of cfusa_watchdog_check could propagate undetected to callers in cfusa_runtime.c","Unhandled fault or invalid input condition within cfusa_watchdog_check",9,4,6,"high" +FM-092,"cfusa_watchdog_stop","cfusa_runtime.c",43,"cfusa_watchdog_stop (safety-critical function) does not perform its intended action","Failure of cfusa_watchdog_stop could propagate undetected to callers in cfusa_runtime.c","Unhandled fault or invalid input condition within cfusa_watchdog_stop",9,4,6,"high" +FM-093,"cfusa_watchdog_fired","cfusa_runtime.c",48,"cfusa_watchdog_fired (safety-critical function) does not perform its intended action","Failure of cfusa_watchdog_fired could propagate undetected to callers in cfusa_runtime.c","Unhandled fault or invalid input condition within cfusa_watchdog_fired",9,4,6,"high" +FM-094,"cfusa_heartbeat_beat","cfusa_runtime.c",67,"cfusa_heartbeat_beat (general function) does not perform its intended action","Failure of cfusa_heartbeat_beat could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_heartbeat_beat",3,2,3,"low" +FM-095,"cfusa_heartbeat_check","cfusa_runtime.c",74,"cfusa_heartbeat_check (monitoring/control function) does not perform its intended action","Failure of cfusa_heartbeat_check could propagate undetected to callers in cfusa_runtime.c","Configuration or state inconsistency affecting cfusa_heartbeat_check",5,3,4,"medium" +FM-096,"cfusa_heartbeat_stop","cfusa_runtime.c",85,"cfusa_heartbeat_stop (general function) does not perform its intended action","Failure of cfusa_heartbeat_stop could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_heartbeat_stop",3,2,3,"low" +FM-097,"cfusa_heartbeat_missed","cfusa_runtime.c",90,"cfusa_heartbeat_missed (general function) does not perform its intended action","Failure of cfusa_heartbeat_missed could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_heartbeat_missed",3,2,3,"low" +FM-098,"cfusa_state_get","cfusa_runtime.c",107,"cfusa_state_get (general function) does not perform its intended action","Failure of cfusa_state_get could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_state_get",3,2,3,"low" +FM-099,"cfusa_state_transition","cfusa_runtime.c",112,"cfusa_state_transition (general function) does not perform its intended action","Failure of cfusa_state_transition could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_state_transition",3,2,3,"low" +FM-100,"cfusa_diag_init","cfusa_runtime.c",137,"cfusa_diag_init (monitoring/control function) does not perform its intended action","Failure of cfusa_diag_init could propagate undetected to callers in cfusa_runtime.c","Configuration or state inconsistency affecting cfusa_diag_init",5,3,4,"medium" +FM-101,"cfusa_diag_count","cfusa_runtime.c",160,"cfusa_diag_count (general function) does not perform its intended action","Failure of cfusa_diag_count could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_diag_count",3,2,3,"low" +FM-102,"cfusa_diag_get","cfusa_runtime.c",165,"cfusa_diag_get (general function) does not perform its intended action","Failure of cfusa_diag_get could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_diag_get",3,2,3,"low" +FM-103,"cfusa_diag_clear","cfusa_runtime.c",174,"cfusa_diag_clear (general function) does not perform its intended action","Failure of cfusa_diag_clear could propagate undetected to callers in cfusa_runtime.c","Logic error or untested edge case in cfusa_diag_clear",3,2,3,"low" +FM-104,"cfusa_fault_record","cfusa_runtime.c",223,"cfusa_fault_record (safety-critical function) does not perform its intended action","Failure of cfusa_fault_record could propagate undetected to callers in cfusa_runtime.c","Unhandled fault or invalid input condition within cfusa_fault_record",9,4,6,"high" +FM-105,"cfusa_fault_reset","cfusa_runtime.c",233,"cfusa_fault_reset (safety-critical function) does not perform its intended action","Failure of cfusa_fault_reset could propagate undetected to callers in cfusa_runtime.c","Unhandled fault or invalid input condition within cfusa_fault_reset",9,4,6,"high" +FM-106,"cfusa_fault_count","cfusa_runtime.c",240,"cfusa_fault_count (safety-critical function) does not perform its intended action","Failure of cfusa_fault_count could propagate undetected to callers in cfusa_runtime.c","Unhandled fault or invalid input condition within cfusa_fault_count",9,4,6,"high" +FM-107,"cfusa_report_init","report.c",14,"cfusa_report_init (monitoring/control function) does not perform its intended action","Failure of cfusa_report_init could propagate undetected to callers in report.c","Configuration or state inconsistency affecting cfusa_report_init",5,3,4,"medium" +FM-108,"cfusa_report_free","report.c",27,"cfusa_report_free (general function) does not perform its intended action","Failure of cfusa_report_free could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_report_free",3,2,3,"low" +FM-109,"cfusa_format_parse","report.c",137,"cfusa_format_parse (general function) does not perform its intended action","Failure of cfusa_format_parse could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_format_parse",3,2,3,"low" +FM-110,"cfusa_report_score","report.c",148,"cfusa_report_score (general function) does not perform its intended action","Failure of cfusa_report_score could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_report_score",3,2,3,"low" +FM-111,"cfusa_report_score","report.c",256,"cfusa_report_score (general function) does not perform its intended action","Failure of cfusa_report_score could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_report_score",3,2,3,"low" +FM-112,"cfusa_severity_str","report.c",262,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" +FM-113,"cfusa_report_score","report.c",307,"cfusa_report_score (general function) does not perform its intended action","Failure of cfusa_report_score could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_report_score",3,2,3,"low" +FM-114,"cfusa_severity_str","report.c",344,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" +FM-115,"cfusa_severity_str","report.c",360,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" +FM-116,"cfusa_severity_str","report.c",375,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" +FM-117,"cfusa_report_score","report.c",508,"cfusa_report_score (general function) does not perform its intended action","Failure of cfusa_report_score could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_report_score",3,2,3,"low" +FM-118,"cfusa_severity_str","report.c",523,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" +FM-119,"cfusa_severity_str","report.c",524,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" +FM-120,"cfusa_report_score","report.c",550,"cfusa_report_score (general function) does not perform its intended action","Failure of cfusa_report_score could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_report_score",3,2,3,"low" +FM-121,"cfusa_severity_str","report.c",564,"cfusa_severity_str (general function) does not perform its intended action","Failure of cfusa_severity_str could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_severity_str",3,2,3,"low" +FM-122,"cfusa_report_print","report.c",571,"cfusa_report_print (general function) does not perform its intended action","Failure of cfusa_report_print could propagate undetected to callers in report.c","Logic error or untested edge case in cfusa_report_print",3,2,3,"low" +FM-123,"cfusa_qb_is_stub_text","qualitybar.c",44,"cfusa_qb_is_stub_text (general function) does not perform its intended action","Failure of cfusa_qb_is_stub_text could propagate undetected to callers in qualitybar.c","Logic error or untested edge case in cfusa_qb_is_stub_text",3,2,3,"low" +FM-124,"cfusa_qb_rule_b_flagged","qualitybar.c",59,"cfusa_qb_rule_b_flagged (general function) does not perform its intended action","Failure of cfusa_qb_rule_b_flagged could propagate undetected to callers in qualitybar.c","Logic error or untested edge case in cfusa_qb_rule_b_flagged",3,2,3,"low" +FM-125,"cfusa_qb_attestation_read","qualitybar.c",100,"cfusa_qb_attestation_read (general function) does not perform its intended action","Failure of cfusa_qb_attestation_read could propagate undetected to callers in qualitybar.c","Logic error or untested edge case in cfusa_qb_attestation_read",3,2,3,"low" +FM-126,"cfusa_qb_attestation_valid","qualitybar.c",161,"cfusa_qb_attestation_valid (general function) does not perform its intended action","Failure of cfusa_qb_attestation_valid could propagate undetected to callers in qualitybar.c","Logic error or untested edge case in cfusa_qb_attestation_valid",3,2,3,"low" +FM-127,"cfusa_qb_rule_disposed","qualitybar.c",180,"cfusa_qb_rule_disposed (general function) does not perform its intended action","Failure of cfusa_qb_rule_disposed could propagate undetected to callers in qualitybar.c","Logic error or untested edge case in cfusa_qb_rule_disposed",3,2,3,"low" +FM-128,"cfusa_qb_content_hash","qualitybar.c",206,"cfusa_qb_content_hash (general function) does not perform its intended action","Failure of cfusa_qb_content_hash could propagate undetected to callers in qualitybar.c","Logic error or untested edge case in cfusa_qb_content_hash",3,2,3,"low" +FM-129,"cfusa_engine_reset","engine.c",9,"cfusa_engine_reset (general function) does not perform its intended action","Failure of cfusa_engine_reset could propagate undetected to callers in engine.c","Logic error or untested edge case in cfusa_engine_reset",3,2,3,"low" +FM-130,"cfusa_engine_register","engine.c",14,"cfusa_engine_register (general function) does not perform its intended action","Failure of cfusa_engine_register could propagate undetected to callers in engine.c","Logic error or untested edge case in cfusa_engine_register",3,2,3,"low" +FM-131,"cfusa_engine_rule_count","engine.c",23,"cfusa_engine_rule_count (general function) does not perform its intended action","Failure of cfusa_engine_rule_count could propagate undetected to callers in engine.c","Logic error or untested edge case in cfusa_engine_rule_count",3,2,3,"low" +FM-132,"cfusa_engine_list_rules","engine.c",34,"cfusa_engine_list_rules (general function) does not perform its intended action","Failure of cfusa_engine_list_rules could propagate undetected to callers in engine.c","Logic error or untested edge case in cfusa_engine_list_rules",3,2,3,"low" +FM-133,"cfusa_config_is_rule_disabled","engine.c",65,"cfusa_config_is_rule_disabled (monitoring/control function) does not perform its intended action","Failure of cfusa_config_is_rule_disabled could propagate undetected to callers in engine.c","Configuration or state inconsistency affecting cfusa_config_is_rule_disabled",5,3,4,"medium" +FM-134,"cfusa_read_file","utils.c",81,"cfusa_read_file (general function) does not perform its intended action","Failure of cfusa_read_file could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_read_file",3,2,3,"low" +FM-135,"cfusa_fopen_write","utils.c",99,"cfusa_fopen_write (general function) does not perform its intended action","Failure of cfusa_fopen_write could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_fopen_write",3,2,3,"low" +FM-136,"cfusa_file_exists","utils.c",108,"cfusa_file_exists (general function) does not perform its intended action","Failure of cfusa_file_exists could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_file_exists",3,2,3,"low" +FM-137,"cfusa_dir_exists","utils.c",114,"cfusa_dir_exists (general function) does not perform its intended action","Failure of cfusa_dir_exists could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_dir_exists",3,2,3,"low" +FM-138,"cfusa_mkdir_p","utils.c",120,"cfusa_mkdir_p (general function) does not perform its intended action","Failure of cfusa_mkdir_p could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_mkdir_p",3,2,3,"low" +FM-139,"cfusa_scan_lines","utils.c",136,"cfusa_scan_lines (general function) does not perform its intended action","Failure of cfusa_scan_lines could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_scan_lines",3,2,3,"low" +FM-140,"cfusa_str_contains","utils.c",168,"cfusa_str_contains (general function) does not perform its intended action","Failure of cfusa_str_contains could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_str_contains",3,2,3,"low" +FM-141,"cfusa_str_starts_with","utils.c",173,"cfusa_str_starts_with (general function) does not perform its intended action","Failure of cfusa_str_starts_with could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_str_starts_with",3,2,3,"low" +FM-142,"cfusa_str_trim","utils.c",178,"cfusa_str_trim (general function) does not perform its intended action","Failure of cfusa_str_trim could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_str_trim",3,2,3,"low" +FM-143,"cfusa_str_escape_json","utils.c",189,"cfusa_str_escape_json (general function) does not perform its intended action","Failure of cfusa_str_escape_json could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_str_escape_json",3,2,3,"low" +FM-144,"cfusa_path_join","utils.c",209,"cfusa_path_join (general function) does not perform its intended action","Failure of cfusa_path_join could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_path_join",3,2,3,"low" +FM-145,"cfusa_relativize_path","utils.c",224,"cfusa_relativize_path (general function) does not perform its intended action","Failure of cfusa_relativize_path could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_relativize_path",3,2,3,"low" +FM-146,"cfusa_is_test_source_file","utils.c",240,"cfusa_is_test_source_file (general function) does not perform its intended action","Failure of cfusa_is_test_source_file could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_is_test_source_file",3,2,3,"low" +FM-147,"cfusa_is_stdlib_call","utils.c",269,"cfusa_is_stdlib_call (general function) does not perform its intended action","Failure of cfusa_is_stdlib_call could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_is_stdlib_call",3,2,3,"low" +FM-148,"cfusa_extract_call_name","utils.c",336,"cfusa_extract_call_name (general function) does not perform its intended action","Failure of cfusa_extract_call_name could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_extract_call_name",3,2,3,"low" +FM-149,"cfusa_sha256_buf","utils.c",486,"cfusa_sha256_buf (general function) does not perform its intended action","Failure of cfusa_sha256_buf could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_sha256_buf",3,2,3,"low" +FM-150,"cfusa_sha256_file","utils.c",498,"cfusa_sha256_file (general function) does not perform its intended action","Failure of cfusa_sha256_file could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_sha256_file",3,2,3,"low" +FM-151,"cfusa_sha256_buf","utils.c",527,"cfusa_sha256_buf (general function) does not perform its intended action","Failure of cfusa_sha256_buf could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_sha256_buf",3,2,3,"low" +FM-152,"cfusa_timestamp_now","utils.c",558,"cfusa_timestamp_now (general function) does not perform its intended action","Failure of cfusa_timestamp_now could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_timestamp_now",3,2,3,"low" +FM-153,"cfusa_count_c_files","utils.c",575,"cfusa_count_c_files (general function) does not perform its intended action","Failure of cfusa_count_c_files could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_count_c_files",3,2,3,"low" +FM-154,"cfusa_count_lines_in_file","utils.c",583,"cfusa_count_lines_in_file (general function) does not perform its intended action","Failure of cfusa_count_lines_in_file could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_count_lines_in_file",3,2,3,"low" +FM-155,"cfusa_match_outside_string","utils.c",596,"cfusa_match_outside_string (general function) does not perform its intended action","Failure of cfusa_match_outside_string could propagate undetected to callers in utils.c","Logic error or untested edge case in cfusa_match_outside_string",3,2,3,"low" +FM-156,"cfusa_config_defaults","config.c",8,"cfusa_config_defaults (safety-critical function) does not perform its intended action","Failure of cfusa_config_defaults could propagate undetected to callers in config.c","Unhandled fault or invalid input condition within cfusa_config_defaults",9,4,6,"high" +FM-157,"cfusa_config_load","config.c",92,"cfusa_config_load (monitoring/control function) does not perform its intended action","Failure of cfusa_config_load could propagate undetected to callers in config.c","Configuration or state inconsistency affecting cfusa_config_load",5,3,4,"medium" +FM-158,"extract_str_array_n","config.c",150,"extract_str_array_n (general function) does not perform its intended action","Failure of extract_str_array_n could propagate undetected to callers in config.c","Logic error or untested edge case in extract_str_array_n",3,2,3,"low" +FM-159,"extract_str_array_n","config.c",160,"extract_str_array_n (general function) does not perform its intended action","Failure of extract_str_array_n could propagate undetected to callers in config.c","Logic error or untested edge case in extract_str_array_n",3,2,3,"low" +FM-160,"extract_str_array_n","config.c",170,"extract_str_array_n (general function) does not perform its intended action","Failure of extract_str_array_n could propagate undetected to callers in config.c","Logic error or untested edge case in extract_str_array_n",3,2,3,"low" +FM-161,"extract_str_array_n","config.c",177,"extract_str_array_n (general function) does not perform its intended action","Failure of extract_str_array_n could propagate undetected to callers in config.c","Logic error or untested edge case in extract_str_array_n",3,2,3,"low" +FM-162,"cfusa_config_is_rule_disabled","config.c",186,"cfusa_config_is_rule_disabled (monitoring/control function) does not perform its intended action","Failure of cfusa_config_is_rule_disabled could propagate undetected to callers in config.c","Configuration or state inconsistency affecting cfusa_config_is_rule_disabled",5,3,4,"medium" +FM-163,"cfusa_config_save","config.c",193,"cfusa_config_save (monitoring/control function) does not perform its intended action","Failure of cfusa_config_save could propagate undetected to callers in config.c","Configuration or state inconsistency affecting cfusa_config_save",5,3,4,"medium" +FM-164,"cfusa_config_is_excluded","config.c",225,"cfusa_config_is_excluded (monitoring/control function) does not perform its intended action","Failure of cfusa_config_is_excluded could propagate undetected to callers in config.c","Configuration or state inconsistency affecting cfusa_config_is_excluded",5,3,4,"medium" diff --git a/fmea.json b/fmea.json index 22ae330..18c4574 100644 --- a/fmea.json +++ b/fmea.json @@ -1,19 +1,19 @@ { - "schemaVersion": "1.14.0", + "schemaVersion": "1.15.0", "kind": "fmea-report", "tool": "c-FuSa", - "toolVersion": "0.5.46", + "toolVersion": "0.5.47", "language": "c", - "generatedAt": "2026-07-28T19:47:38Z", + "generatedAt": "2026-07-28T21:51:15Z", "project": "c-FuSa", "version": "0.5.1", - "standard": "IEC 60812:2018 / ISO 26262-5", + "standard": "iso26262", "ratingScale": "cfusa-heuristic-1-10", "entries": [ { "id": "FM-001", "item": "cmd_pr", - "file": "cmd_pr.c", + "file": "cmd/cfusa/cmd_pr.c", "line": 146, "failureMode": "cmd_pr (general function) does not perform its intended action", "effect": "Failure of cmd_pr could propagate undetected to callers in cmd_pr.c", @@ -28,7 +28,7 @@ { "id": "FM-002", "item": "cmd_version", - "file": "cmd_version.c", + "file": "cmd/cfusa/cmd_version.c", "line": 7, "failureMode": "cmd_version (general function) does not perform its intended action", "effect": "Failure of cmd_version could propagate undetected to callers in cmd_version.c", @@ -43,7 +43,7 @@ { "id": "FM-003", "item": "cmd_help", - "file": "cmd_dispatch.c", + "file": "cmd/cfusa/cmd_dispatch.c", "line": 66, "failureMode": "cmd_help (general function) does not perform its intended action", "effect": "Failure of cmd_help could propagate undetected to callers in cmd_dispatch.c", @@ -57,12 +57,12 @@ }, { "id": "FM-004", - "item": "snprintf", - "file": "cmd_coupling.c", - "line": 56, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_coupling.c", - "cause": "Logic error or untested edge case in snprintf", + "item": "cmd_coupling", + "file": "cmd/cfusa/cmd_coupling.c", + "line": 121, + "failureMode": "cmd_coupling (general function) does not perform its intended action", + "effect": "Failure of cmd_coupling could propagate undetected to callers in cmd_coupling.c", + "cause": "Logic error or untested edge case in cmd_coupling", "severity": 3, "occurrence": 2, "detection": 3, @@ -72,12 +72,12 @@ }, { "id": "FM-005", - "item": "snprintf", - "file": "cmd_coupling.c", - "line": 65, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_coupling.c", - "cause": "Logic error or untested edge case in snprintf", + "item": "cmd_qualify", + "file": "cmd/cfusa/cmd_qualify.c", + "line": 472, + "failureMode": "cmd_qualify (general function) does not perform its intended action", + "effect": "Failure of cmd_qualify could propagate undetected to callers in cmd_qualify.c", + "cause": "Logic error or untested edge case in cmd_qualify", "severity": 3, "occurrence": 2, "detection": 3, @@ -87,12 +87,12 @@ }, { "id": "FM-006", - "item": "cmd_coupling", - "file": "cmd_coupling.c", - "line": 121, - "failureMode": "cmd_coupling (general function) does not perform its intended action", - "effect": "Failure of cmd_coupling could propagate undetected to callers in cmd_coupling.c", - "cause": "Logic error or untested edge case in cmd_coupling", + "item": "cmd_misra", + "file": "cmd/cfusa/cmd_misra.c", + "line": 60, + "failureMode": "cmd_misra (general function) does not perform its intended action", + "effect": "Failure of cmd_misra could propagate undetected to callers in cmd_misra.c", + "cause": "Logic error or untested edge case in cmd_misra", "severity": 3, "occurrence": 2, "detection": 3, @@ -102,12 +102,12 @@ }, { "id": "FM-007", - "item": "printf", - "file": "cmd_coupling.c", - "line": 177, - "failureMode": "printf (general function) does not perform its intended action", - "effect": "Failure of printf could propagate undetected to callers in cmd_coupling.c", - "cause": "Logic error or untested edge case in printf", + "item": "path_exists", + "file": "cmd/cfusa/cmd_safety_rules.c", + "line": 120, + "failureMode": "path_exists (general function) does not perform its intended action", + "effect": "Failure of path_exists could propagate undetected to callers in cmd_safety_rules.c", + "cause": "Logic error or untested edge case in path_exists", "severity": 3, "occurrence": 2, "detection": 3, @@ -117,12 +117,12 @@ }, { "id": "FM-008", - "item": "fn", - "file": "cmd_qualify.c", - "line": 347, - "failureMode": "fn (general function) does not perform its intended action", - "effect": "Failure of fn could propagate undetected to callers in cmd_qualify.c", - "cause": "Logic error or untested edge case in fn", + "item": "json_sec_code", + "file": "cmd/cfusa/cmd_safety_rules.c", + "line": 428, + "failureMode": "json_sec_code (general function) does not perform its intended action", + "effect": "Failure of json_sec_code could propagate undetected to callers in cmd_safety_rules.c", + "cause": "Logic error or untested edge case in json_sec_code", "severity": 3, "occurrence": 2, "detection": 3, @@ -132,12 +132,12 @@ }, { "id": "FM-009", - "item": "fn", - "file": "cmd_qualify.c", - "line": 375, - "failureMode": "fn (general function) does not perform its intended action", - "effect": "Failure of fn could propagate undetected to callers in cmd_qualify.c", - "cause": "Logic error or untested edge case in fn", + "item": "path_exists", + "file": "cmd/cfusa/cmd_safety_rules.c", + "line": 455, + "failureMode": "path_exists (general function) does not perform its intended action", + "effect": "Failure of path_exists could propagate undetected to callers in cmd_safety_rules.c", + "cause": "Logic error or untested edge case in path_exists", "severity": 3, "occurrence": 2, "detection": 3, @@ -147,12 +147,12 @@ }, { "id": "FM-010", - "item": "fn", - "file": "cmd_qualify.c", - "line": 398, - "failureMode": "fn (general function) does not perform its intended action", - "effect": "Failure of fn could propagate undetected to callers in cmd_qualify.c", - "cause": "Logic error or untested edge case in fn", + "item": "path_exists", + "file": "cmd/cfusa/cmd_safety_rules.c", + "line": 868, + "failureMode": "path_exists (general function) does not perform its intended action", + "effect": "Failure of path_exists could propagate undetected to callers in cmd_safety_rules.c", + "cause": "Logic error or untested edge case in path_exists", "severity": 3, "occurrence": 2, "detection": 3, @@ -162,12 +162,12 @@ }, { "id": "FM-011", - "item": "fn", - "file": "cmd_qualify.c", - "line": 408, - "failureMode": "fn (general function) does not perform its intended action", - "effect": "Failure of fn could propagate undetected to callers in cmd_qualify.c", - "cause": "Logic error or untested edge case in fn", + "item": "path_exists", + "file": "cmd/cfusa/cmd_safety_rules.c", + "line": 882, + "failureMode": "path_exists (general function) does not perform its intended action", + "effect": "Failure of path_exists could propagate undetected to callers in cmd_safety_rules.c", + "cause": "Logic error or untested edge case in path_exists", "severity": 3, "occurrence": 2, "detection": 3, @@ -177,12 +177,12 @@ }, { "id": "FM-012", - "item": "\"strcpy", - "file": "cmd_qualify.c", - "line": 427, - "failureMode": "\"strcpy (general function) does not perform its intended action", - "effect": "Failure of \"strcpy could propagate undetected to callers in cmd_qualify.c", - "cause": "Logic error or untested edge case in \"strcpy", + "item": "path_exists", + "file": "cmd/cfusa/cmd_safety_rules.c", + "line": 895, + "failureMode": "path_exists (general function) does not perform its intended action", + "effect": "Failure of path_exists could propagate undetected to callers in cmd_safety_rules.c", + "cause": "Logic error or untested edge case in path_exists", "severity": 3, "occurrence": 2, "detection": 3, @@ -192,42 +192,42 @@ }, { "id": "FM-013", - "item": "\"snprintf", - "file": "cmd_qualify.c", - "line": 428, - "failureMode": "\"snprintf (general function) does not perform its intended action", - "effect": "Failure of \"snprintf could propagate undetected to callers in cmd_qualify.c", - "cause": "Logic error or untested edge case in \"snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", + "item": "cfusa_safety_register_rules", + "file": "cmd/cfusa/cmd_safety_rules.c", + "line": 987, + "failureMode": "cfusa_safety_register_rules (safety-critical function) does not perform its intended action", + "effect": "Failure of cfusa_safety_register_rules could propagate undetected to callers in cmd_safety_rules.c", + "cause": "Unhandled fault or invalid input condition within cfusa_safety_register_rules", + "severity": 9, + "occurrence": 4, + "detection": 6, + "actionPriority": "high", "mitigations": [], "requirementIds": [] }, { "id": "FM-014", - "item": "\"MD5_Init", - "file": "cmd_qualify.c", - "line": 429, - "failureMode": "\"MD5_Init (general function) does not perform its intended action", - "effect": "Failure of \"MD5_Init could propagate undetected to callers in cmd_qualify.c", - "cause": "Logic error or untested edge case in \"MD5_Init", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", + "item": "cfusa_safety_rule_count", + "file": "cmd/cfusa/cmd_safety_rules.c", + "line": 995, + "failureMode": "cfusa_safety_rule_count (safety-critical function) does not perform its intended action", + "effect": "Failure of cfusa_safety_rule_count could propagate undetected to callers in cmd_safety_rules.c", + "cause": "Unhandled fault or invalid input condition within cfusa_safety_rule_count", + "severity": 9, + "occurrence": 4, + "detection": 6, + "actionPriority": "high", "mitigations": [], "requirementIds": [] }, { "id": "FM-015", - "item": "\"SHA256_Init", - "file": "cmd_qualify.c", - "line": 430, - "failureMode": "\"SHA256_Init (general function) does not perform its intended action", - "effect": "Failure of \"SHA256_Init could propagate undetected to callers in cmd_qualify.c", - "cause": "Logic error or untested edge case in \"SHA256_Init", + "item": "cmd_iso26262", + "file": "cmd/cfusa/cmd_iso26262.c", + "line": 84, + "failureMode": "cmd_iso26262 (general function) does not perform its intended action", + "effect": "Failure of cmd_iso26262 could propagate undetected to callers in cmd_iso26262.c", + "cause": "Logic error or untested edge case in cmd_iso26262", "severity": 3, "occurrence": 2, "detection": 3, @@ -237,12 +237,12 @@ }, { "id": "FM-016", - "item": "cmd_qualify", - "file": "cmd_qualify.c", - "line": 472, - "failureMode": "cmd_qualify (general function) does not perform its intended action", - "effect": "Failure of cmd_qualify could propagate undetected to callers in cmd_qualify.c", - "cause": "Logic error or untested edge case in cmd_qualify", + "item": "cfusa_scan_lines", + "file": "cmd/cfusa/cmd_req.c", + "line": 135, + "failureMode": "cfusa_scan_lines (general function) does not perform its intended action", + "effect": "Failure of cfusa_scan_lines could propagate undetected to callers in cmd_req.c", + "cause": "Logic error or untested edge case in cfusa_scan_lines", "severity": 3, "occurrence": 2, "detection": 3, @@ -252,12 +252,12 @@ }, { "id": "FM-017", - "item": "qualification_badge", - "file": "cmd_qualify.c", - "line": 579, - "failureMode": "qualification_badge (general function) does not perform its intended action", - "effect": "Failure of qualification_badge could propagate undetected to callers in cmd_qualify.c", - "cause": "Logic error or untested edge case in qualification_badge", + "item": "xml_escape", + "file": "cmd/cfusa/cmd_req.c", + "line": 172, + "failureMode": "xml_escape (general function) does not perform its intended action", + "effect": "Failure of xml_escape could propagate undetected to callers in cmd_req.c", + "cause": "Logic error or untested edge case in xml_escape", "severity": 3, "occurrence": 2, "detection": 3, @@ -267,12 +267,12 @@ }, { "id": "FM-018", - "item": "independence_status", - "file": "cmd_qualify.c", - "line": 580, - "failureMode": "independence_status (general function) does not perform its intended action", - "effect": "Failure of independence_status could propagate undetected to callers in cmd_qualify.c", - "cause": "Logic error or untested edge case in independence_status", + "item": "xml_escape", + "file": "cmd/cfusa/cmd_req.c", + "line": 176, + "failureMode": "xml_escape (general function) does not perform its intended action", + "effect": "Failure of xml_escape could propagate undetected to callers in cmd_req.c", + "cause": "Logic error or untested edge case in xml_escape", "severity": 3, "occurrence": 2, "detection": 3, @@ -282,12 +282,12 @@ }, { "id": "FM-019", - "item": "cmd_misra", - "file": "cmd_misra.c", - "line": 60, - "failureMode": "cmd_misra (general function) does not perform its intended action", - "effect": "Failure of cmd_misra could propagate undetected to callers in cmd_misra.c", - "cause": "Logic error or untested edge case in cmd_misra", + "item": "xml_escape", + "file": "cmd/cfusa/cmd_req.c", + "line": 180, + "failureMode": "xml_escape (general function) does not perform its intended action", + "effect": "Failure of xml_escape could propagate undetected to callers in cmd_req.c", + "cause": "Logic error or untested edge case in xml_escape", "severity": 3, "occurrence": 2, "detection": 3, @@ -297,12 +297,12 @@ }, { "id": "FM-020", - "item": "!path_exists", - "file": "cmd_safety_rules.c", - "line": 119, - "failureMode": "!path_exists (general function) does not perform its intended action", - "effect": "Failure of !path_exists could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Logic error or untested edge case in !path_exists", + "item": "import_reqif", + "file": "cmd/cfusa/cmd_req.c", + "line": 646, + "failureMode": "import_reqif (general function) does not perform its intended action", + "effect": "Failure of import_reqif could propagate undetected to callers in cmd_req.c", + "cause": "Logic error or untested edge case in import_reqif", "severity": 3, "occurrence": 2, "detection": 3, @@ -312,12 +312,12 @@ }, { "id": "FM-021", - "item": "strcmp", - "file": "cmd_safety_rules.c", - "line": 278, - "failureMode": "strcmp (general function) does not perform its intended action", - "effect": "Failure of strcmp could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Logic error or untested edge case in strcmp", + "item": "import_polarion_xml", + "file": "cmd/cfusa/cmd_req.c", + "line": 652, + "failureMode": "import_polarion_xml (general function) does not perform its intended action", + "effect": "Failure of import_polarion_xml could propagate undetected to callers in cmd_req.c", + "cause": "Logic error or untested edge case in import_polarion_xml", "severity": 3, "occurrence": 2, "detection": 3, @@ -327,12 +327,12 @@ }, { "id": "FM-022", - "item": "!path_exists", - "file": "cmd_safety_rules.c", - "line": 391, - "failureMode": "!path_exists (general function) does not perform its intended action", - "effect": "Failure of !path_exists could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Logic error or untested edge case in !path_exists", + "item": "import_reqif", + "file": "cmd/cfusa/cmd_req.c", + "line": 655, + "failureMode": "import_reqif (general function) does not perform its intended action", + "effect": "Failure of import_reqif could propagate undetected to callers in cmd_req.c", + "cause": "Logic error or untested edge case in import_reqif", "severity": 3, "occurrence": 2, "detection": 3, @@ -342,12 +342,12 @@ }, { "id": "FM-023", - "item": "sscanf", - "file": "cmd_safety_rules.c", - "line": 422, - "failureMode": "sscanf (general function) does not perform its intended action", - "effect": "Failure of sscanf could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Logic error or untested edge case in sscanf", + "item": "import_codebeamer_xml", + "file": "cmd/cfusa/cmd_req.c", + "line": 660, + "failureMode": "import_codebeamer_xml (general function) does not perform its intended action", + "effect": "Failure of import_codebeamer_xml could propagate undetected to callers in cmd_req.c", + "cause": "Logic error or untested edge case in import_codebeamer_xml", "severity": 3, "occurrence": 2, "detection": 3, @@ -357,12 +357,12 @@ }, { "id": "FM-024", - "item": "failure", - "file": "cmd_safety_rules.c", - "line": 483, - "failureMode": "failure (general function) does not perform its intended action", - "effect": "Failure of failure could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Logic error or untested edge case in failure", + "item": "import_jama_xml", + "file": "cmd/cfusa/cmd_req.c", + "line": 671, + "failureMode": "import_jama_xml (general function) does not perform its intended action", + "effect": "Failure of import_jama_xml could propagate undetected to callers in cmd_req.c", + "cause": "Logic error or untested edge case in import_jama_xml", "severity": 3, "occurrence": 2, "detection": 3, @@ -372,12 +372,12 @@ }, { "id": "FM-025", - "item": "!strchr", - "file": "cmd_safety_rules.c", - "line": 506, - "failureMode": "!strchr (general function) does not perform its intended action", - "effect": "Failure of !strchr could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Logic error or untested edge case in !strchr", + "item": "sizeof", + "file": "cmd/cfusa/cmd_req.c", + "line": 695, + "failureMode": "sizeof (general function) does not perform its intended action", + "effect": "Failure of sizeof could propagate undetected to callers in cmd_req.c", + "cause": "Logic error or untested edge case in sizeof", "severity": 3, "occurrence": 2, "detection": 3, @@ -387,12 +387,12 @@ }, { "id": "FM-026", - "item": "!strstr", - "file": "cmd_safety_rules.c", - "line": 507, - "failureMode": "!strstr (general function) does not perform its intended action", - "effect": "Failure of !strstr could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Logic error or untested edge case in !strstr", + "item": "append_entry", + "file": "cmd/cfusa/cmd_req.c", + "line": 713, + "failureMode": "append_entry (general function) does not perform its intended action", + "effect": "Failure of append_entry could propagate undetected to callers in cmd_req.c", + "cause": "Logic error or untested edge case in append_entry", "severity": 3, "occurrence": 2, "detection": 3, @@ -402,12 +402,12 @@ }, { "id": "FM-027", - "item": "strchr", - "file": "cmd_safety_rules.c", - "line": 544, - "failureMode": "strchr (general function) does not perform its intended action", - "effect": "Failure of strchr could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Logic error or untested edge case in strchr", + "item": "cmd_req", + "file": "cmd/cfusa/cmd_req.c", + "line": 760, + "failureMode": "cmd_req (general function) does not perform its intended action", + "effect": "Failure of cmd_req could propagate undetected to callers in cmd_req.c", + "cause": "Logic error or untested edge case in cmd_req", "severity": 3, "occurrence": 2, "detection": 3, @@ -417,12 +417,12 @@ }, { "id": "FM-028", - "item": "sscanf", - "file": "cmd_safety_rules.c", - "line": 614, - "failureMode": "sscanf (general function) does not perform its intended action", - "effect": "Failure of sscanf could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Logic error or untested edge case in sscanf", + "item": "cmd_release", + "file": "cmd/cfusa/cmd_release.c", + "line": 100, + "failureMode": "cmd_release (general function) does not perform its intended action", + "effect": "Failure of cmd_release could propagate undetected to callers in cmd_release.c", + "cause": "Logic error or untested edge case in cmd_release", "severity": 3, "occurrence": 2, "detection": 3, @@ -432,27 +432,27 @@ }, { "id": "FM-029", - "item": "strstr", - "file": "cmd_safety_rules.c", - "line": 724, - "failureMode": "strstr (general function) does not perform its intended action", - "effect": "Failure of strstr could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Logic error or untested edge case in strstr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", + "item": "cmd_check", + "file": "cmd/cfusa/cmd_check.c", + "line": 14, + "failureMode": "cmd_check (monitoring/control function) does not perform its intended action", + "effect": "Failure of cmd_check could propagate undetected to callers in cmd_check.c", + "cause": "Configuration or state inconsistency affecting cmd_check", + "severity": 5, + "occurrence": 3, + "detection": 4, + "actionPriority": "medium", "mitigations": [], "requirementIds": [] }, { "id": "FM-030", - "item": "!path_exists", - "file": "cmd_safety_rules.c", - "line": 804, - "failureMode": "!path_exists (general function) does not perform its intended action", - "effect": "Failure of !path_exists could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Logic error or untested edge case in !path_exists", + "item": "cfusa_template_generate_all", + "file": "cmd/cfusa/cmd_template.c", + "line": 84, + "failureMode": "cfusa_template_generate_all (general function) does not perform its intended action", + "effect": "Failure of cfusa_template_generate_all could propagate undetected to callers in cmd_template.c", + "cause": "Logic error or untested edge case in cfusa_template_generate_all", "severity": 3, "occurrence": 2, "detection": 3, @@ -462,12 +462,12 @@ }, { "id": "FM-031", - "item": "!path_exists", - "file": "cmd_safety_rules.c", - "line": 818, - "failureMode": "!path_exists (general function) does not perform its intended action", - "effect": "Failure of !path_exists could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Logic error or untested edge case in !path_exists", + "item": "cmd_template", + "file": "cmd/cfusa/cmd_template.c", + "line": 106, + "failureMode": "cmd_template (general function) does not perform its intended action", + "effect": "Failure of cmd_template could propagate undetected to callers in cmd_template.c", + "cause": "Logic error or untested edge case in cmd_template", "severity": 3, "occurrence": 2, "detection": 3, @@ -477,12 +477,12 @@ }, { "id": "FM-032", - "item": "!path_exists", - "file": "cmd_safety_rules.c", - "line": 831, - "failureMode": "!path_exists (general function) does not perform its intended action", - "effect": "Failure of !path_exists could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Logic error or untested edge case in !path_exists", + "item": "cmd_tara", + "file": "cmd/cfusa/cmd_tara.c", + "line": 338, + "failureMode": "cmd_tara (general function) does not perform its intended action", + "effect": "Failure of cmd_tara could propagate undetected to callers in cmd_tara.c", + "cause": "Logic error or untested edge case in cmd_tara", "severity": 3, "occurrence": 2, "detection": 3, @@ -492,12 +492,12 @@ }, { "id": "FM-033", - "item": "\"V", - "file": "cmd_safety_rules.c", - "line": 915, - "failureMode": "\"V (general function) does not perform its intended action", - "effect": "Failure of \"V could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Logic error or untested edge case in \"V", + "item": "write_threat_json", + "file": "cmd/cfusa/cmd_tara.c", + "line": 454, + "failureMode": "write_threat_json (general function) does not perform its intended action", + "effect": "Failure of write_threat_json could propagate undetected to callers in cmd_tara.c", + "cause": "Logic error or untested edge case in write_threat_json", "severity": 3, "occurrence": 2, "detection": 3, @@ -507,42 +507,42 @@ }, { "id": "FM-034", - "item": "cfusa_safety_register_rules", - "file": "cmd_safety_rules.c", - "line": 919, - "failureMode": "cfusa_safety_register_rules (safety-critical function) does not perform its intended action", - "effect": "Failure of cfusa_safety_register_rules could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Unhandled fault or invalid input condition within cfusa_safety_register_rules", - "severity": 9, - "occurrence": 4, - "detection": 6, - "actionPriority": "high", + "item": "link", + "file": "cmd/cfusa/cmd_trace.c", + "line": 35, + "failureMode": "link (general function) does not perform its intended action", + "effect": "Failure of link could propagate undetected to callers in cmd_trace.c", + "cause": "Logic error or untested edge case in link", + "severity": 3, + "occurrence": 2, + "detection": 3, + "actionPriority": "low", "mitigations": [], "requirementIds": [] }, { "id": "FM-035", - "item": "cfusa_safety_rule_count", - "file": "cmd_safety_rules.c", - "line": 927, - "failureMode": "cfusa_safety_rule_count (safety-critical function) does not perform its intended action", - "effect": "Failure of cfusa_safety_rule_count could propagate undetected to callers in cmd_safety_rules.c", - "cause": "Unhandled fault or invalid input condition within cfusa_safety_rule_count", - "severity": 9, - "occurrence": 4, - "detection": 6, - "actionPriority": "high", + "item": "cfusa_scan_lines", + "file": "cmd/cfusa/cmd_trace.c", + "line": 184, + "failureMode": "cfusa_scan_lines (general function) does not perform its intended action", + "effect": "Failure of cfusa_scan_lines could propagate undetected to callers in cmd_trace.c", + "cause": "Logic error or untested edge case in cfusa_scan_lines", + "severity": 3, + "occurrence": 2, + "detection": 3, + "actionPriority": "low", "mitigations": [], "requirementIds": [] }, { "id": "FM-036", - "item": "cmd_iso26262", - "file": "cmd_iso26262.c", - "line": 84, - "failureMode": "cmd_iso26262 (general function) does not perform its intended action", - "effect": "Failure of cmd_iso26262 could propagate undetected to callers in cmd_iso26262.c", - "cause": "Logic error or untested edge case in cmd_iso26262", + "item": "cmd_trace", + "file": "cmd/cfusa/cmd_trace.c", + "line": 336, + "failureMode": "cmd_trace (general function) does not perform its intended action", + "effect": "Failure of cmd_trace could propagate undetected to callers in cmd_trace.c", + "cause": "Logic error or untested edge case in cmd_trace", "severity": 3, "occurrence": 2, "detection": 3, @@ -552,12 +552,12 @@ }, { "id": "FM-037", - "item": "fprintf", - "file": "cmd_iso26262.c", - "line": 183, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_iso26262.c", - "cause": "Logic error or untested edge case in fprintf", + "item": "compute_hlr_llr", + "file": "cmd/cfusa/cmd_trace.c", + "line": 436, + "failureMode": "compute_hlr_llr (general function) does not perform its intended action", + "effect": "Failure of compute_hlr_llr could propagate undetected to callers in cmd_trace.c", + "cause": "Logic error or untested edge case in compute_hlr_llr", "severity": 3, "occurrence": 2, "detection": 3, @@ -567,12 +567,12 @@ }, { "id": "FM-038", - "item": "fprintf", - "file": "cmd_iso26262.c", - "line": 206, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_iso26262.c", - "cause": "Logic error or untested edge case in fprintf", + "item": "cfusa_basename", + "file": "cmd/cfusa/cmd_trace.c", + "line": 716, + "failureMode": "cfusa_basename (general function) does not perform its intended action", + "effect": "Failure of cfusa_basename could propagate undetected to callers in cmd_trace.c", + "cause": "Logic error or untested edge case in cfusa_basename", "severity": 3, "occurrence": 2, "detection": 3, @@ -582,12 +582,12 @@ }, { "id": "FM-039", - "item": "cfusa_scan_lines", - "file": "cmd_req.c", - "line": 135, - "failureMode": "cfusa_scan_lines (general function) does not perform its intended action", - "effect": "Failure of cfusa_scan_lines could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in cfusa_scan_lines", + "item": "cfusa_analyze_register_rules", + "file": "cmd/cfusa/cmd_analyze.c", + "line": 292, + "failureMode": "cfusa_analyze_register_rules (general function) does not perform its intended action", + "effect": "Failure of cfusa_analyze_register_rules could propagate undetected to callers in cmd_analyze.c", + "cause": "Logic error or untested edge case in cfusa_analyze_register_rules", "severity": 3, "occurrence": 2, "detection": 3, @@ -597,12 +597,12 @@ }, { "id": "FM-040", - "item": "xml_escape", - "file": "cmd_req.c", - "line": 172, - "failureMode": "xml_escape (general function) does not perform its intended action", - "effect": "Failure of xml_escape could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in xml_escape", + "item": "cmd_analyze", + "file": "cmd/cfusa/cmd_analyze.c", + "line": 298, + "failureMode": "cmd_analyze (general function) does not perform its intended action", + "effect": "Failure of cmd_analyze could propagate undetected to callers in cmd_analyze.c", + "cause": "Logic error or untested edge case in cmd_analyze", "severity": 3, "occurrence": 2, "detection": 3, @@ -612,12 +612,12 @@ }, { "id": "FM-041", - "item": "xml_escape", - "file": "cmd_req.c", - "line": 176, - "failureMode": "xml_escape (general function) does not perform its intended action", - "effect": "Failure of xml_escape could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in xml_escape", + "item": "cmd_report", + "file": "cmd/cfusa/cmd_report.c", + "line": 14, + "failureMode": "cmd_report (general function) does not perform its intended action", + "effect": "Failure of cmd_report could propagate undetected to callers in cmd_report.c", + "cause": "Logic error or untested edge case in cmd_report", "severity": 3, "occurrence": 2, "detection": 3, @@ -627,267 +627,12 @@ }, { "id": "FM-042", - "item": "xml_escape", - "file": "cmd_req.c", - "line": 180, - "failureMode": "xml_escape (general function) does not perform its intended action", - "effect": "Failure of xml_escape could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in xml_escape", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-043", - "item": "fprintf", - "file": "cmd_req.c", - "line": 193, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-044", - "item": "fprintf", - "file": "cmd_req.c", - "line": 209, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-045", - "item": "fprintf", - "file": "cmd_req.c", - "line": 225, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-046", - "item": "snprintf", - "file": "cmd_req.c", - "line": 257, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-047", - "item": "!strcmp", - "file": "cmd_req.c", - "line": 520, - "failureMode": "!strcmp (general function) does not perform its intended action", - "effect": "Failure of !strcmp could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in !strcmp", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-048", - "item": "import_reqif", - "file": "cmd_req.c", - "line": 646, - "failureMode": "import_reqif (general function) does not perform its intended action", - "effect": "Failure of import_reqif could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in import_reqif", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-049", - "item": "import_polarion_xml", - "file": "cmd_req.c", - "line": 652, - "failureMode": "import_polarion_xml (general function) does not perform its intended action", - "effect": "Failure of import_polarion_xml could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in import_polarion_xml", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-050", - "item": "import_reqif", - "file": "cmd_req.c", - "line": 655, - "failureMode": "import_reqif (general function) does not perform its intended action", - "effect": "Failure of import_reqif could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in import_reqif", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-051", - "item": "import_codebeamer_xml", - "file": "cmd_req.c", - "line": 660, - "failureMode": "import_codebeamer_xml (general function) does not perform its intended action", - "effect": "Failure of import_codebeamer_xml could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in import_codebeamer_xml", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-052", - "item": "import_jama_xml", - "file": "cmd_req.c", - "line": 671, - "failureMode": "import_jama_xml (general function) does not perform its intended action", - "effect": "Failure of import_jama_xml could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in import_jama_xml", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-053", - "item": "sizeof", - "file": "cmd_req.c", - "line": 695, - "failureMode": "sizeof (general function) does not perform its intended action", - "effect": "Failure of sizeof could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in sizeof", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-054", - "item": "append_entry", - "file": "cmd_req.c", - "line": 713, - "failureMode": "append_entry (general function) does not perform its intended action", - "effect": "Failure of append_entry could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in append_entry", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-055", - "item": "printf", - "file": "cmd_req.c", - "line": 755, - "failureMode": "printf (general function) does not perform its intended action", - "effect": "Failure of printf could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in printf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-056", - "item": "cmd_req", - "file": "cmd_req.c", - "line": 760, - "failureMode": "cmd_req (general function) does not perform its intended action", - "effect": "Failure of cmd_req could propagate undetected to callers in cmd_req.c", - "cause": "Logic error or untested edge case in cmd_req", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-057", - "item": "cmd_release", - "file": "cmd_release.c", - "line": 100, - "failureMode": "cmd_release (general function) does not perform its intended action", - "effect": "Failure of cmd_release could propagate undetected to callers in cmd_release.c", - "cause": "Logic error or untested edge case in cmd_release", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-058", - "item": "snprintf", - "file": "cmd_release.c", - "line": 174, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_release.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-059", - "item": "cmd_check", - "file": "cmd_check.c", - "line": 14, - "failureMode": "cmd_check (monitoring/control function) does not perform its intended action", - "effect": "Failure of cmd_check could propagate undetected to callers in cmd_check.c", - "cause": "Configuration or state inconsistency affecting cmd_check", + "item": "cmd_init", + "file": "cmd/cfusa/cmd_init.c", + "line": 15, + "failureMode": "cmd_init (monitoring/control function) does not perform its intended action", + "effect": "Failure of cmd_init could propagate undetected to callers in cmd_init.c", + "cause": "Configuration or state inconsistency affecting cmd_init", "severity": 5, "occurrence": 3, "detection": 4, @@ -896,13 +641,13 @@ "requirementIds": [] }, { - "id": "FM-060", - "item": "cfusa_template_generate_all", - "file": "cmd_template.c", - "line": 84, - "failureMode": "cfusa_template_generate_all (general function) does not perform its intended action", - "effect": "Failure of cfusa_template_generate_all could propagate undetected to callers in cmd_template.c", - "cause": "Logic error or untested edge case in cfusa_template_generate_all", + "id": "FM-043", + "item": "required", + "file": "cmd/cfusa/cmd_iec62443.c", + "line": 24, + "failureMode": "required (general function) does not perform its intended action", + "effect": "Failure of required could propagate undetected to callers in cmd_iec62443.c", + "cause": "Logic error or untested edge case in required", "severity": 3, "occurrence": 2, "detection": 3, @@ -911,13 +656,13 @@ "requirementIds": [] }, { - "id": "FM-061", - "item": "cmd_template", - "file": "cmd_template.c", - "line": 106, - "failureMode": "cmd_template (general function) does not perform its intended action", - "effect": "Failure of cmd_template could propagate undetected to callers in cmd_template.c", - "cause": "Logic error or untested edge case in cmd_template", + "id": "FM-044", + "item": "cmd_iec62443", + "file": "cmd/cfusa/cmd_iec62443.c", + "line": 85, + "failureMode": "cmd_iec62443 (general function) does not perform its intended action", + "effect": "Failure of cmd_iec62443 could propagate undetected to callers in cmd_iec62443.c", + "cause": "Logic error or untested edge case in cmd_iec62443", "severity": 3, "occurrence": 2, "detection": 3, @@ -926,13 +671,13 @@ "requirementIds": [] }, { - "id": "FM-062", - "item": "fprintf", - "file": "cmd_tara.c", - "line": 326, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_tara.c", - "cause": "Logic error or untested edge case in fprintf", + "id": "FM-045", + "item": "cmd_fmea", + "file": "cmd/cfusa/cmd_fmea.c", + "line": 262, + "failureMode": "cmd_fmea (general function) does not perform its intended action", + "effect": "Failure of cmd_fmea could propagate undetected to callers in cmd_fmea.c", + "cause": "Logic error or untested edge case in cmd_fmea", "severity": 3, "occurrence": 2, "detection": 3, @@ -941,13 +686,13 @@ "requirementIds": [] }, { - "id": "FM-063", - "item": "cmd_tara", - "file": "cmd_tara.c", - "line": 330, - "failureMode": "cmd_tara (general function) does not perform its intended action", - "effect": "Failure of cmd_tara could propagate undetected to callers in cmd_tara.c", - "cause": "Logic error or untested edge case in cmd_tara", + "id": "FM-046", + "item": "cfusa_path_join", + "file": "cmd/cfusa/cmd_fmea.c", + "line": 403, + "failureMode": "cfusa_path_join (general function) does not perform its intended action", + "effect": "Failure of cfusa_path_join could propagate undetected to callers in cmd_fmea.c", + "cause": "Logic error or untested edge case in cfusa_path_join", "severity": 3, "occurrence": 2, "detection": 3, @@ -956,13 +701,13 @@ "requirementIds": [] }, { - "id": "FM-064", - "item": "fprintf", - "file": "cmd_tara.c", - "line": 426, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_tara.c", - "cause": "Logic error or untested edge case in fprintf", + "id": "FM-047", + "item": "cfusa_basename", + "file": "cmd/cfusa/cmd_fmea.c", + "line": 446, + "failureMode": "cfusa_basename (general function) does not perform its intended action", + "effect": "Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c", + "cause": "Logic error or untested edge case in cfusa_basename", "severity": 3, "occurrence": 2, "detection": 3, @@ -971,2803 +716,13 @@ "requirementIds": [] }, { - "id": "FM-065", - "item": "write_threat_json", - "file": "cmd_tara.c", - "line": 439, - "failureMode": "write_threat_json (general function) does not perform its intended action", - "effect": "Failure of write_threat_json could propagate undetected to callers in cmd_tara.c", - "cause": "Logic error or untested edge case in write_threat_json", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-066", - "item": "fprintf", - "file": "cmd_tara.c", - "line": 440, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_tara.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-067", - "item": "fprintf", - "file": "cmd_tara.c", - "line": 449, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_tara.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-068", - "item": "fprintf", - "file": "cmd_tara.c", - "line": 459, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_tara.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-069", - "item": "fprintf", - "file": "cmd_tara.c", - "line": 461, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_tara.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-070", - "item": "cfusa_scan_lines", - "file": "cmd_trace.c", - "line": 184, - "failureMode": "cfusa_scan_lines (general function) does not perform its intended action", - "effect": "Failure of cfusa_scan_lines could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in cfusa_scan_lines", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-071", - "item": "cmd_trace", - "file": "cmd_trace.c", - "line": 336, - "failureMode": "cmd_trace (general function) does not perform its intended action", - "effect": "Failure of cmd_trace could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in cmd_trace", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-072", - "item": "compute_hlr_llr", - "file": "cmd_trace.c", - "line": 436, - "failureMode": "compute_hlr_llr (general function) does not perform its intended action", - "effect": "Failure of compute_hlr_llr could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in compute_hlr_llr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-073", - "item": "printf", - "file": "cmd_trace.c", - "line": 453, - "failureMode": "printf (general function) does not perform its intended action", - "effect": "Failure of printf could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in printf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-074", - "item": "LLR", - "file": "cmd_trace.c", - "line": 460, - "failureMode": "LLR (general function) does not perform its intended action", - "effect": "Failure of LLR could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in LLR", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-075", - "item": "printf", - "file": "cmd_trace.c", - "line": 478, - "failureMode": "printf (general function) does not perform its intended action", - "effect": "Failure of printf could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in printf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-076", - "item": "printf", - "file": "cmd_trace.c", - "line": 497, - "failureMode": "printf (general function) does not perform its intended action", - "effect": "Failure of printf could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in printf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-077", - "item": "printf", - "file": "cmd_trace.c", - "line": 530, - "failureMode": "printf (general function) does not perform its intended action", - "effect": "Failure of printf could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in printf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-078", - "item": "printf", - "file": "cmd_trace.c", - "line": 558, - "failureMode": "printf (general function) does not perform its intended action", - "effect": "Failure of printf could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in printf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-079", - "item": "snprintf", - "file": "cmd_trace.c", - "line": 696, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-080", - "item": "snprintf", - "file": "cmd_trace.c", - "line": 700, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-081", + "id": "FM-048", "item": "cfusa_basename", - "file": "cmd_trace.c", - "line": 716, - "failureMode": "cfusa_basename (general function) does not perform its intended action", - "effect": "Failure of cfusa_basename could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in cfusa_basename", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-082", - "item": "snprintf", - "file": "cmd_trace.c", - "line": 763, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-083", - "item": "snprintf", - "file": "cmd_trace.c", - "line": 767, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-084", - "item": "fprintf", - "file": "cmd_trace.c", - "line": 790, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_trace.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-085", - "item": "for", - "file": "cmd_analyze.c", - "line": 25, - "failureMode": "for (general function) does not perform its intended action", - "effect": "Failure of for could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in for", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-086", - "item": "if", - "file": "cmd_analyze.c", - "line": 67, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-087", - "item": "!strstr", - "file": "cmd_analyze.c", - "line": 68, - "failureMode": "!strstr (general function) does not perform its intended action", - "effect": "Failure of !strstr could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in !strstr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-088", - "item": "strstr", - "file": "cmd_analyze.c", - "line": 102, - "failureMode": "strstr (general function) does not perform its intended action", - "effect": "Failure of strstr could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in strstr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-089", - "item": "strstr", - "file": "cmd_analyze.c", - "line": 103, - "failureMode": "strstr (general function) does not perform its intended action", - "effect": "Failure of strstr could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in strstr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-090", - "item": "!strstr", - "file": "cmd_analyze.c", - "line": 104, - "failureMode": "!strstr (general function) does not perform its intended action", - "effect": "Failure of !strstr could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in !strstr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-091", - "item": "if", - "file": "cmd_analyze.c", - "line": 135, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-092", - "item": "!strstr", - "file": "cmd_analyze.c", - "line": 136, - "failureMode": "!strstr (general function) does not perform its intended action", - "effect": "Failure of !strstr could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in !strstr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-093", - "item": "if", - "file": "cmd_analyze.c", - "line": 167, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-094", - "item": "\"assert", - "file": "cmd_analyze.c", - "line": 171, - "failureMode": "\"assert (general function) does not perform its intended action", - "effect": "Failure of \"assert could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in \"assert", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-095", - "item": "if", - "file": "cmd_analyze.c", - "line": 199, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-096", - "item": "strstr", - "file": "cmd_analyze.c", - "line": 200, - "failureMode": "strstr (general function) does not perform its intended action", - "effect": "Failure of strstr could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in strstr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-097", - "item": "strstr", - "file": "cmd_analyze.c", - "line": 201, - "failureMode": "strstr (general function) does not perform its intended action", - "effect": "Failure of strstr could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in strstr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-098", - "item": "for", - "file": "cmd_analyze.c", - "line": 238, - "failureMode": "for (general function) does not perform its intended action", - "effect": "Failure of for could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in for", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-099", - "item": "\"assert", - "file": "cmd_analyze.c", - "line": 284, - "failureMode": "\"assert (general function) does not perform its intended action", - "effect": "Failure of \"assert could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in \"assert", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-100", - "item": "cfusa_analyze_register_rules", - "file": "cmd_analyze.c", - "line": 292, - "failureMode": "cfusa_analyze_register_rules (general function) does not perform its intended action", - "effect": "Failure of cfusa_analyze_register_rules could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in cfusa_analyze_register_rules", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-101", - "item": "cmd_analyze", - "file": "cmd_analyze.c", - "line": 298, - "failureMode": "cmd_analyze (general function) does not perform its intended action", - "effect": "Failure of cmd_analyze could propagate undetected to callers in cmd_analyze.c", - "cause": "Logic error or untested edge case in cmd_analyze", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-102", - "item": "cmd_report", - "file": "cmd_report.c", - "line": 14, - "failureMode": "cmd_report (general function) does not perform its intended action", - "effect": "Failure of cmd_report could propagate undetected to callers in cmd_report.c", - "cause": "Logic error or untested edge case in cmd_report", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-103", - "item": "cmd_init", - "file": "cmd_init.c", - "line": 15, - "failureMode": "cmd_init (monitoring/control function) does not perform its intended action", - "effect": "Failure of cmd_init could propagate undetected to callers in cmd_init.c", - "cause": "Configuration or state inconsistency affecting cmd_init", - "severity": 5, - "occurrence": 3, - "detection": 4, - "actionPriority": "medium", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-104", - "item": "fprintf", - "file": "cmd_init.c", - "line": 99, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_init.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-105", - "item": "fprintf", - "file": "cmd_init.c", - "line": 116, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_init.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-106", - "item": "cmd_iec62443", - "file": "cmd_iec62443.c", - "line": 85, - "failureMode": "cmd_iec62443 (general function) does not perform its intended action", - "effect": "Failure of cmd_iec62443 could propagate undetected to callers in cmd_iec62443.c", - "cause": "Logic error or untested edge case in cmd_iec62443", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-107", - "item": "fprintf", - "file": "cmd_iec62443.c", - "line": 223, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_iec62443.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-108", - "item": "cfusa_basename", - "file": "cmd_fmea.c", - "line": 187, - "failureMode": "cfusa_basename (general function) does not perform its intended action", - "effect": "Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c", - "cause": "Logic error or untested edge case in cfusa_basename", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-109", - "item": "cfusa_basename", - "file": "cmd_fmea.c", - "line": 267, - "failureMode": "cfusa_basename (general function) does not perform its intended action", - "effect": "Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c", - "cause": "Logic error or untested edge case in cfusa_basename", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-110", - "item": "cmd_fmea", - "file": "cmd_fmea.c", - "line": 274, - "failureMode": "cmd_fmea (general function) does not perform its intended action", - "effect": "Failure of cmd_fmea could propagate undetected to callers in cmd_fmea.c", - "cause": "Logic error or untested edge case in cmd_fmea", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-111", - "item": "fprintf", - "file": "cmd_fmea.c", - "line": 383, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_fmea.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-112", - "item": "fprintf", - "file": "cmd_fmea.c", - "line": 393, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_fmea.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-113", - "item": "cfusa_path_join", - "file": "cmd_fmea.c", - "line": 399, - "failureMode": "cfusa_path_join (general function) does not perform its intended action", - "effect": "Failure of cfusa_path_join could propagate undetected to callers in cmd_fmea.c", - "cause": "Logic error or untested edge case in cfusa_path_join", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-114", - "item": "printf", - "file": "cmd_fmea.c", - "line": 402, - "failureMode": "printf (general function) does not perform its intended action", - "effect": "Failure of printf could propagate undetected to callers in cmd_fmea.c", - "cause": "Logic error or untested edge case in printf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-115", - "item": "cfusa_basename", - "file": "cmd_fmea.c", - "line": 442, + "file": "cmd/cfusa/cmd_fmea.c", + "line": 519, "failureMode": "cfusa_basename (general function) does not perform its intended action", "effect": "Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c", - "cause": "Logic error or untested edge case in cfusa_basename", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-116", - "item": "cfusa_basename", - "file": "cmd_fmea.c", - "line": 506, - "failureMode": "cfusa_basename (general function) does not perform its intended action", - "effect": "Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c", - "cause": "Logic error or untested edge case in cfusa_basename", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-117", - "item": "cfusa_basename", - "file": "cmd_fmea.c", - "line": 534, - "failureMode": "cfusa_basename (general function) does not perform its intended action", - "effect": "Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c", - "cause": "Logic error or untested edge case in cfusa_basename", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-118", - "item": "strtol", - "file": "cmd_fix.c", - "line": 50, - "failureMode": "strtol (general function) does not perform its intended action", - "effect": "Failure of strtol could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in strtol", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-119", - "item": "fgets", - "file": "cmd_fix.c", - "line": 57, - "failureMode": "fgets (general function) does not perform its intended action", - "effect": "Failure of fgets could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in fgets", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-120", - "item": "strncpy", - "file": "cmd_fix.c", - "line": 58, - "failureMode": "strncpy (general function) does not perform its intended action", - "effect": "Failure of strncpy could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in strncpy", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-121", - "item": "snprintf", - "file": "cmd_fix.c", - "line": 59, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-122", - "item": "malloc", - "file": "cmd_fix.c", - "line": 63, - "failureMode": "malloc (general function) does not perform its intended action", - "effect": "Failure of malloc could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in malloc", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-123", - "item": "assert", - "file": "cmd_fix.c", - "line": 73, - "failureMode": "assert (general function) does not perform its intended action", - "effect": "Failure of assert could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in assert", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-124", - "item": "strncpy", - "file": "cmd_fix.c", - "line": 80, - "failureMode": "strncpy (general function) does not perform its intended action", - "effect": "Failure of strncpy could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in strncpy", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-125", - "item": "dst[sizeof", - "file": "cmd_fix.c", - "line": 81, - "failureMode": "dst[sizeof (general function) does not perform its intended action", - "effect": "Failure of dst[sizeof could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in dst[sizeof", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-126", - "item": "printf", - "file": "cmd_fix.c", - "line": 85, - "failureMode": "printf (general function) does not perform its intended action", - "effect": "Failure of printf could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in printf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-127", - "item": "printf", - "file": "cmd_fix.c", - "line": 86, - "failureMode": "printf (general function) does not perform its intended action", - "effect": "Failure of printf could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in printf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-128", - "item": "execve", - "file": "cmd_fix.c", - "line": 90, - "failureMode": "execve (general function) does not perform its intended action", - "effect": "Failure of execve could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in execve", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-129", - "item": "sizeof", - "file": "cmd_fix.c", - "line": 97, - "failureMode": "sizeof (general function) does not perform its intended action", - "effect": "Failure of sizeof could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in sizeof", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-130", - "item": "malloc", - "file": "cmd_fix.c", - "line": 99, - "failureMode": "malloc (general function) does not perform its intended action", - "effect": "Failure of malloc could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in malloc", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-131", - "item": "free", - "file": "cmd_fix.c", - "line": 103, - "failureMode": "free (general function) does not perform its intended action", - "effect": "Failure of free could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in free", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-132", - "item": "cmd_fix", - "file": "cmd_fix.c", - "line": 125, - "failureMode": "cmd_fix (general function) does not perform its intended action", - "effect": "Failure of cmd_fix could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in cmd_fix", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-133", - "item": "printf", - "file": "cmd_fix.c", - "line": 175, - "failureMode": "printf (general function) does not perform its intended action", - "effect": "Failure of printf could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in printf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-134", - "item": "printf", - "file": "cmd_fix.c", - "line": 195, - "failureMode": "printf (general function) does not perform its intended action", - "effect": "Failure of printf could propagate undetected to callers in cmd_fix.c", - "cause": "Logic error or untested edge case in printf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-135", - "item": "main", - "file": "main.c", - "line": 14, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in main.c", - "cause": "Logic error or untested edge case in main", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-136", - "item": "cmd_boundary", - "file": "cmd_boundary.c", - "line": 72, - "failureMode": "cmd_boundary (general function) does not perform its intended action", - "effect": "Failure of cmd_boundary could propagate undetected to callers in cmd_boundary.c", - "cause": "Logic error or untested edge case in cmd_boundary", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-137", - "item": "cmd_impact", - "file": "cmd_impact.c", - "line": 106, - "failureMode": "cmd_impact (general function) does not perform its intended action", - "effect": "Failure of cmd_impact could propagate undetected to callers in cmd_impact.c", - "cause": "Logic error or untested edge case in cmd_impact", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-138", - "item": "printf", - "file": "cmd_impact.c", - "line": 194, - "failureMode": "printf (general function) does not perform its intended action", - "effect": "Failure of printf could propagate undetected to callers in cmd_impact.c", - "cause": "Logic error or untested edge case in printf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-139", - "item": "cmd_sci", - "file": "cmd_sci.c", - "line": 44, - "failureMode": "cmd_sci (general function) does not perform its intended action", - "effect": "Failure of cmd_sci could propagate undetected to callers in cmd_sci.c", - "cause": "Logic error or untested edge case in cmd_sci", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-140", - "item": "cmd_iec61508", - "file": "cmd_iec61508.c", - "line": 78, - "failureMode": "cmd_iec61508 (general function) does not perform its intended action", - "effect": "Failure of cmd_iec61508 could propagate undetected to callers in cmd_iec61508.c", - "cause": "Logic error or untested edge case in cmd_iec61508", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-141", - "item": "fprintf", - "file": "cmd_iec61508.c", - "line": 204, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_iec61508.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-142", - "item": "cmd_badge", - "file": "cmd_badge.c", - "line": 9, - "failureMode": "cmd_badge (general function) does not perform its intended action", - "effect": "Failure of cmd_badge could propagate undetected to callers in cmd_badge.c", - "cause": "Logic error or untested edge case in cmd_badge", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-143", - "item": "fill=\\\"url", - "file": "cmd_badge.c", - "line": 87, - "failureMode": "fill=\\\"url (general function) does not perform its intended action", - "effect": "Failure of fill=\\\"url could propagate undetected to callers in cmd_badge.c", - "cause": "Logic error or untested edge case in fill=\\\"url", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-144", - "item": "cmd_unece", - "file": "cmd_unece.c", - "line": 57, - "failureMode": "cmd_unece (general function) does not perform its intended action", - "effect": "Failure of cmd_unece could propagate undetected to callers in cmd_unece.c", - "cause": "Logic error or untested edge case in cmd_unece", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-145", - "item": "cmd_sign", - "file": "cmd_sign.c", - "line": 43, - "failureMode": "cmd_sign (general function) does not perform its intended action", - "effect": "Failure of cmd_sign could propagate undetected to callers in cmd_sign.c", - "cause": "Logic error or untested edge case in cmd_sign", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-146", - "item": "cfusa_hmac_sha256", - "file": "cmd_sign.c", - "line": 120, - "failureMode": "cfusa_hmac_sha256 (general function) does not perform its intended action", - "effect": "Failure of cfusa_hmac_sha256 could propagate undetected to callers in cmd_sign.c", - "cause": "Logic error or untested edge case in cfusa_hmac_sha256", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-147", - "item": "cmd_iso21434", - "file": "cmd_iso21434.c", - "line": 77, - "failureMode": "cmd_iso21434 (general function) does not perform its intended action", - "effect": "Failure of cmd_iso21434 could propagate undetected to callers in cmd_iso21434.c", - "cause": "Logic error or untested edge case in cmd_iso21434", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-148", - "item": "fprintf", - "file": "cmd_iso21434.c", - "line": 212, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_iso21434.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-149", - "item": "\"gets", - "file": "cmd_vuln.c", - "line": 26, - "failureMode": "\"gets (general function) does not perform its intended action", - "effect": "Failure of \"gets could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in \"gets", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-150", - "item": "fgets", - "file": "cmd_vuln.c", - "line": 27, - "failureMode": "fgets (general function) does not perform its intended action", - "effect": "Failure of fgets could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in fgets", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-151", - "item": "\"sprintf", - "file": "cmd_vuln.c", - "line": 29, - "failureMode": "\"sprintf (general function) does not perform its intended action", - "effect": "Failure of \"sprintf could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in \"sprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-152", - "item": "snprintf", - "file": "cmd_vuln.c", - "line": 30, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-153", - "item": "\"strcpy", - "file": "cmd_vuln.c", - "line": 32, - "failureMode": "\"strcpy (general function) does not perform its intended action", - "effect": "Failure of \"strcpy could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in \"strcpy", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-154", - "item": "strlcpy", - "file": "cmd_vuln.c", - "line": 33, - "failureMode": "strlcpy (general function) does not perform its intended action", - "effect": "Failure of strlcpy could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in strlcpy", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-155", - "item": "\"strcat", - "file": "cmd_vuln.c", - "line": 35, - "failureMode": "\"strcat (general function) does not perform its intended action", - "effect": "Failure of \"strcat could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in \"strcat", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-156", - "item": "strlcat", - "file": "cmd_vuln.c", - "line": 36, - "failureMode": "strlcat (general function) does not perform its intended action", - "effect": "Failure of strlcat could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in strlcat", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-157", - "item": "scanf", - "file": "cmd_vuln.c", - "line": 39, - "failureMode": "scanf (general function) does not perform its intended action", - "effect": "Failure of scanf could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in scanf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-158", - "item": "\"tmpnam", - "file": "cmd_vuln.c", - "line": 41, - "failureMode": "\"tmpnam (general function) does not perform its intended action", - "effect": "Failure of \"tmpnam could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in \"tmpnam", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-159", - "item": "mkstemp", - "file": "cmd_vuln.c", - "line": 42, - "failureMode": "mkstemp (general function) does not perform its intended action", - "effect": "Failure of mkstemp could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in mkstemp", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-160", - "item": "\"system", - "file": "cmd_vuln.c", - "line": 44, - "failureMode": "\"system (general function) does not perform its intended action", - "effect": "Failure of \"system could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in \"system", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-161", - "item": "system", - "file": "cmd_vuln.c", - "line": 45, - "failureMode": "system (general function) does not perform its intended action", - "effect": "Failure of system could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in system", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-162", - "item": "\"rand", - "file": "cmd_vuln.c", - "line": 47, - "failureMode": "\"rand (general function) does not perform its intended action", - "effect": "Failure of \"rand could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in \"rand", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-163", - "item": "\"mktemp", - "file": "cmd_vuln.c", - "line": 50, - "failureMode": "\"mktemp (general function) does not perform its intended action", - "effect": "Failure of \"mktemp could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in \"mktemp", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-164", - "item": "mkstemp", - "file": "cmd_vuln.c", - "line": 51, - "failureMode": "mkstemp (general function) does not perform its intended action", - "effect": "Failure of mkstemp could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in mkstemp", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-165", - "item": "\"popen", - "file": "cmd_vuln.c", - "line": 53, - "failureMode": "\"popen (general function) does not perform its intended action", - "effect": "Failure of \"popen could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in \"popen", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-166", - "item": "execv", - "file": "cmd_vuln.c", - "line": 54, - "failureMode": "execv (general function) does not perform its intended action", - "effect": "Failure of execv could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in execv", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-167", - "item": "cfusa_scan_lines", - "file": "cmd_vuln.c", - "line": 107, - "failureMode": "cfusa_scan_lines (general function) does not perform its intended action", - "effect": "Failure of cfusa_scan_lines could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in cfusa_scan_lines", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-168", - "item": "cmd_vuln", - "file": "cmd_vuln.c", - "line": 109, - "failureMode": "cmd_vuln (general function) does not perform its intended action", - "effect": "Failure of cmd_vuln could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in cmd_vuln", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-169", - "item": "printf", - "file": "cmd_vuln.c", - "line": 181, - "failureMode": "printf (general function) does not perform its intended action", - "effect": "Failure of printf could propagate undetected to callers in cmd_vuln.c", - "cause": "Logic error or untested edge case in printf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-170", - "item": "strstr", - "file": "cmd_comp.c", - "line": 102, - "failureMode": "strstr (general function) does not perform its intended action", - "effect": "Failure of strstr could propagate undetected to callers in cmd_comp.c", - "cause": "Logic error or untested edge case in strstr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-171", - "item": "fprintf", - "file": "cmd_comp.c", - "line": 184, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_comp.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-172", - "item": "cmd_comp", - "file": "cmd_comp.c", - "line": 222, - "failureMode": "cmd_comp (general function) does not perform its intended action", - "effect": "Failure of cmd_comp could propagate undetected to callers in cmd_comp.c", - "cause": "Logic error or untested edge case in cmd_comp", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-173", - "item": "cmd_audit_pack", - "file": "cmd_audit_pack.c", - "line": 21, - "failureMode": "cmd_audit_pack (general function) does not perform its intended action", - "effect": "Failure of cmd_audit_pack could propagate undetected to callers in cmd_audit_pack.c", - "cause": "Logic error or untested edge case in cmd_audit_pack", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-174", - "item": "snprintf", - "file": "cmd_audit_pack.c", - "line": 149, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_audit_pack.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-175", - "item": "snprintf", - "file": "cmd_audit_pack.c", - "line": 162, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_audit_pack.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-176", - "item": "snprintf", - "file": "cmd_audit_pack.c", - "line": 187, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_audit_pack.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-177", - "item": "cmd_hooks", - "file": "cmd_hooks.c", - "line": 20, - "failureMode": "cmd_hooks (general function) does not perform its intended action", - "effect": "Failure of cmd_hooks could propagate undetected to callers in cmd_hooks.c", - "cause": "Logic error or untested edge case in cmd_hooks", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-178", - "item": "cmd_disposition", - "file": "cmd_disposition.c", - "line": 184, - "failureMode": "cmd_disposition (general function) does not perform its intended action", - "effect": "Failure of cmd_disposition could propagate undetected to callers in cmd_disposition.c", - "cause": "Logic error or untested edge case in cmd_disposition", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-179", - "item": "strcmp", - "file": "cmd_disposition.c", - "line": 261, - "failureMode": "strcmp (general function) does not perform its intended action", - "effect": "Failure of strcmp could propagate undetected to callers in cmd_disposition.c", - "cause": "Logic error or untested edge case in strcmp", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-180", - "item": "snprintf", - "file": "cmd_coverage.c", - "line": 42, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_coverage.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-181", - "item": "snprintf", - "file": "cmd_coverage.c", - "line": 81, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_coverage.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-182", - "item": "snprintf", - "file": "cmd_coverage.c", - "line": 93, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_coverage.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-183", - "item": "cmd_coverage", - "file": "cmd_coverage.c", - "line": 174, - "failureMode": "cmd_coverage (general function) does not perform its intended action", - "effect": "Failure of cmd_coverage could propagate undetected to callers in cmd_coverage.c", - "cause": "Logic error or untested edge case in cmd_coverage", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-184", - "item": "strcmp", - "file": "cmd_coverage.c", - "line": 258, - "failureMode": "strcmp (general function) does not perform its intended action", - "effect": "Failure of strcmp could propagate undetected to callers in cmd_coverage.c", - "cause": "Logic error or untested edge case in strcmp", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-185", - "item": "fprintf", - "file": "cmd_coverage.c", - "line": 408, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_coverage.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-186", - "item": "fprintf", - "file": "cmd_coverage.c", - "line": 411, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_coverage.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-187", - "item": "fprintf", - "file": "cmd_coverage.c", - "line": 413, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_coverage.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-188", - "item": "fprintf", - "file": "cmd_coverage.c", - "line": 425, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_coverage.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-189", - "item": "cmd_diff", - "file": "cmd_diff.c", - "line": 66, - "failureMode": "cmd_diff (general function) does not perform its intended action", - "effect": "Failure of cmd_diff could propagate undetected to callers in cmd_diff.c", - "cause": "Logic error or untested edge case in cmd_diff", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-190", - "item": "fprintf", - "file": "cmd_hara.c", - "line": 622, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_hara.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-191", - "item": "parse_sec_code", - "file": "cmd_hara.c", - "line": 650, - "failureMode": "parse_sec_code (general function) does not perform its intended action", - "effect": "Failure of parse_sec_code could propagate undetected to callers in cmd_hara.c", - "cause": "Logic error or untested edge case in parse_sec_code", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-192", - "item": "cmd_hara", - "file": "cmd_hara.c", - "line": 770, - "failureMode": "cmd_hara (general function) does not perform its intended action", - "effect": "Failure of cmd_hara could propagate undetected to callers in cmd_hara.c", - "cause": "Logic error or untested edge case in cmd_hara", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-193", - "item": "cmd_slsa", - "file": "cmd_slsa.c", - "line": 71, - "failureMode": "cmd_slsa (general function) does not perform its intended action", - "effect": "Failure of cmd_slsa could propagate undetected to callers in cmd_slsa.c", - "cause": "Logic error or untested edge case in cmd_slsa", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-194", - "item": "slsa_file_exists", - "file": "cmd_slsa.c", - "line": 123, - "failureMode": "slsa_file_exists (general function) does not perform its intended action", - "effect": "Failure of slsa_file_exists could propagate undetected to callers in cmd_slsa.c", - "cause": "Logic error or untested edge case in slsa_file_exists", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-195", - "item": "cmd_do178", - "file": "cmd_do178.c", - "line": 113, - "failureMode": "cmd_do178 (general function) does not perform its intended action", - "effect": "Failure of cmd_do178 could propagate undetected to callers in cmd_do178.c", - "cause": "Logic error or untested edge case in cmd_do178", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-196", - "item": "cmd_verify", - "file": "cmd_verify.c", - "line": 14, - "failureMode": "cmd_verify (general function) does not perform its intended action", - "effect": "Failure of cmd_verify could propagate undetected to callers in cmd_verify.c", - "cause": "Logic error or untested edge case in cmd_verify", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-197", - "item": "fprintf", - "file": "cmd_sas.c", - "line": 61, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_sas.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-198", - "item": "cmd_sas", - "file": "cmd_sas.c", - "line": 90, - "failureMode": "cmd_sas (general function) does not perform its intended action", - "effect": "Failure of cmd_sas could propagate undetected to callers in cmd_sas.c", - "cause": "Logic error or untested edge case in cmd_sas", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-199", - "item": "fprintf", - "file": "cmd_sas.c", - "line": 178, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_sas.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-200", - "item": "fprintf", - "file": "cmd_sas.c", - "line": 255, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_sas.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-201", - "item": "for", - "file": "cmd_cyber.c", - "line": 19, - "failureMode": "for (general function) does not perform its intended action", - "effect": "Failure of for could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in for", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-202", - "item": "if", - "file": "cmd_cyber.c", - "line": 22, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-203", - "item": "||", - "file": "cmd_cyber.c", - "line": 23, - "failureMode": "|| (general function) does not perform its intended action", - "effect": "Failure of || could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in ||", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-204", - "item": "for", - "file": "cmd_cyber.c", - "line": 51, - "failureMode": "for (general function) does not perform its intended action", - "effect": "Failure of for could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in for", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-205", - "item": "if", - "file": "cmd_cyber.c", - "line": 55, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-206", - "item": "if", - "file": "cmd_cyber.c", - "line": 63, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-207", - "item": "if", - "file": "cmd_cyber.c", - "line": 71, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-208", - "item": "strncmp", - "file": "cmd_cyber.c", - "line": 72, - "failureMode": "strncmp (general function) does not perform its intended action", - "effect": "Failure of strncmp could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in strncmp", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-209", - "item": "for", - "file": "cmd_cyber.c", - "line": 96, - "failureMode": "for (general function) does not perform its intended action", - "effect": "Failure of for could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in for", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-210", - "item": "if", - "file": "cmd_cyber.c", - "line": 103, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-211", - "item": "if", - "file": "cmd_cyber.c", - "line": 155, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-212", - "item": "strstr", - "file": "cmd_cyber.c", - "line": 156, - "failureMode": "strstr (general function) does not perform its intended action", - "effect": "Failure of strstr could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in strstr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-213", - "item": "if", - "file": "cmd_cyber.c", - "line": 179, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-214", - "item": "free", - "file": "cmd_cyber.c", - "line": 182, - "failureMode": "free (general function) does not perform its intended action", - "effect": "Failure of free could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in free", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-215", - "item": "if", - "file": "cmd_cyber.c", - "line": 204, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-216", - "item": "if", - "file": "cmd_cyber.c", - "line": 223, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-217", - "item": "cfusa_match_outside_string", - "file": "cmd_cyber.c", - "line": 224, - "failureMode": "cfusa_match_outside_string (general function) does not perform its intended action", - "effect": "Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in cfusa_match_outside_string", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-218", - "item": "mkstemp", - "file": "cmd_cyber.c", - "line": 227, - "failureMode": "mkstemp (general function) does not perform its intended action", - "effect": "Failure of mkstemp could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in mkstemp", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-219", - "item": "for", - "file": "cmd_cyber.c", - "line": 246, - "failureMode": "for (general function) does not perform its intended action", - "effect": "Failure of for could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in for", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-220", - "item": "if", - "file": "cmd_cyber.c", - "line": 247, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-221", - "item": "for", - "file": "cmd_cyber.c", - "line": 270, - "failureMode": "for (general function) does not perform its intended action", - "effect": "Failure of for could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in for", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-222", - "item": "if", - "file": "cmd_cyber.c", - "line": 274, - "failureMode": "if (general function) does not perform its intended action", - "effect": "Failure of if could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in if", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-223", - "item": "cfusa_match_outside_string", - "file": "cmd_cyber.c", - "line": 329, - "failureMode": "cfusa_match_outside_string (general function) does not perform its intended action", - "effect": "Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in cfusa_match_outside_string", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-224", - "item": "cfusa_match_outside_string", - "file": "cmd_cyber.c", - "line": 349, - "failureMode": "cfusa_match_outside_string (general function) does not perform its intended action", - "effect": "Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in cfusa_match_outside_string", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-225", - "item": "cfusa_match_outside_string", - "file": "cmd_cyber.c", - "line": 350, - "failureMode": "cfusa_match_outside_string (general function) does not perform its intended action", - "effect": "Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in cfusa_match_outside_string", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-226", - "item": "realpath", - "file": "cmd_cyber.c", - "line": 352, - "failureMode": "realpath (general function) does not perform its intended action", - "effect": "Failure of realpath could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in realpath", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-227", - "item": "TLS_method", - "file": "cmd_cyber.c", - "line": 378, - "failureMode": "TLS_method (general function) does not perform its intended action", - "effect": "Failure of TLS_method could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in TLS_method", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-228", - "item": "cfusa_match_outside_string", - "file": "cmd_cyber.c", - "line": 445, - "failureMode": "cfusa_match_outside_string (general function) does not perform its intended action", - "effect": "Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in cfusa_match_outside_string", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-229", - "item": "cfusa_match_outside_string", - "file": "cmd_cyber.c", - "line": 479, - "failureMode": "cfusa_match_outside_string (general function) does not perform its intended action", - "effect": "Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in cfusa_match_outside_string", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-230", - "item": "access", - "file": "cmd_cyber.c", - "line": 503, - "failureMode": "access (general function) does not perform its intended action", - "effect": "Failure of access could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in access", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-231", - "item": "cfusa_cyber_register_rules", - "file": "cmd_cyber.c", - "line": 564, - "failureMode": "cfusa_cyber_register_rules (general function) does not perform its intended action", - "effect": "Failure of cfusa_cyber_register_rules could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in cfusa_cyber_register_rules", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-232", - "item": "for", - "file": "cmd_cyber.c", - "line": 566, - "failureMode": "for (general function) does not perform its intended action", - "effect": "Failure of for could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in for", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-233", - "item": "cmd_cyber", - "file": "cmd_cyber.c", - "line": 570, - "failureMode": "cmd_cyber (general function) does not perform its intended action", - "effect": "Failure of cmd_cyber could propagate undetected to callers in cmd_cyber.c", - "cause": "Logic error or untested edge case in cmd_cyber", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-234", - "item": "cmd_safety_case", - "file": "cmd_safety_case.c", - "line": 35, - "failureMode": "cmd_safety_case (safety-critical function) does not perform its intended action", - "effect": "Failure of cmd_safety_case could propagate undetected to callers in cmd_safety_case.c", - "cause": "Unhandled fault or invalid input condition within cmd_safety_case", - "severity": 9, - "occurrence": 4, - "detection": 6, - "actionPriority": "high", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-235", - "item": "snprintf", - "file": "cmd_safety_case.c", - "line": 106, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_safety_case.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-236", - "item": "snprintf", - "file": "cmd_safety_case.c", - "line": 110, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_safety_case.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-237", - "item": "snprintf", - "file": "cmd_safety_case.c", - "line": 113, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_safety_case.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-238", - "item": "snprintf", - "file": "cmd_safety_case.c", - "line": 116, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_safety_case.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-239", - "item": "snprintf", - "file": "cmd_safety_case.c", - "line": 119, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in cmd_safety_case.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-240", - "item": "fprintf", - "file": "cmd_safety_case.c", - "line": 223, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_safety_case.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-241", - "item": "fprintf", - "file": "cmd_safety_case.c", - "line": 317, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_safety_case.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-242", - "item": "cmd_metrics", - "file": "cmd_metrics.c", - "line": 288, - "failureMode": "cmd_metrics (general function) does not perform its intended action", - "effect": "Failure of cmd_metrics could propagate undetected to callers in cmd_metrics.c", - "cause": "Logic error or untested edge case in cmd_metrics", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-243", - "item": "cmd_capabilities", - "file": "cmd_capabilities.c", - "line": 15, - "failureMode": "cmd_capabilities (general function) does not perform its intended action", - "effect": "Failure of cmd_capabilities could propagate undetected to callers in cmd_capabilities.c", - "cause": "Logic error or untested edge case in cmd_capabilities", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-244", - "item": "fprintf", - "file": "cmd_capabilities.c", - "line": 86, - "failureMode": "fprintf (general function) does not perform its intended action", - "effect": "Failure of fprintf could propagate undetected to callers in cmd_capabilities.c", - "cause": "Logic error or untested edge case in fprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-245", - "item": "strstr", - "file": "cmd_lint.c", - "line": 42, - "failureMode": "strstr (general function) does not perform its intended action", - "effect": "Failure of strstr could propagate undetected to callers in cmd_lint.c", - "cause": "Logic error or untested edge case in strstr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-246", - "item": "fgets", - "file": "cmd_lint.c", - "line": 186, - "failureMode": "fgets (general function) does not perform its intended action", - "effect": "Failure of fgets could propagate undetected to callers in cmd_lint.c", - "cause": "Logic error or untested edge case in fgets", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-247", - "item": "strstr", - "file": "cmd_lint.c", - "line": 220, - "failureMode": "strstr (general function) does not perform its intended action", - "effect": "Failure of strstr could propagate undetected to callers in cmd_lint.c", - "cause": "Logic error or untested edge case in strstr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-248", - "item": "!strstr", - "file": "cmd_lint.c", - "line": 222, - "failureMode": "!strstr (general function) does not perform its intended action", - "effect": "Failure of !strstr could propagate undetected to callers in cmd_lint.c", - "cause": "Logic error or untested edge case in !strstr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-249", - "item": "!strstr", - "file": "cmd_lint.c", - "line": 384, - "failureMode": "!strstr (general function) does not perform its intended action", - "effect": "Failure of !strstr could propagate undetected to callers in cmd_lint.c", - "cause": "Logic error or untested edge case in !strstr", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-250", - "item": "cfusa_lint_register_rules", - "file": "cmd_lint.c", - "line": 527, - "failureMode": "cfusa_lint_register_rules (general function) does not perform its intended action", - "effect": "Failure of cfusa_lint_register_rules could propagate undetected to callers in cmd_lint.c", - "cause": "Logic error or untested edge case in cfusa_lint_register_rules", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-251", - "item": "cmd_lint", - "file": "cmd_lint.c", - "line": 535, - "failureMode": "cmd_lint (general function) does not perform its intended action", - "effect": "Failure of cmd_lint could propagate undetected to callers in cmd_lint.c", - "cause": "Logic error or untested edge case in cmd_lint", + "cause": "Logic error or untested edge case in cfusa_basename", "severity": 3, "occurrence": 2, "detection": 3, @@ -3776,13 +731,13 @@ "requirementIds": [] }, { - "id": "FM-252", - "item": "defined", - "file": "CMakeCCompilerId.c", - "line": 891, - "failureMode": "defined (general function) does not perform its intended action", - "effect": "Failure of defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in defined", + "id": "FM-049", + "item": "cfusa_basename", + "file": "cmd/cfusa/cmd_fmea.c", + "line": 547, + "failureMode": "cfusa_basename (general function) does not perform its intended action", + "effect": "Failure of cfusa_basename could propagate undetected to callers in cmd_fmea.c", + "cause": "Logic error or untested edge case in cfusa_basename", "severity": 3, "occurrence": 2, "detection": 3, @@ -3791,13 +746,13 @@ "requirementIds": [] }, { - "id": "FM-253", - "item": "!defined", - "file": "CMakeCCompilerId.c", - "line": 892, - "failureMode": "!defined (general function) does not perform its intended action", - "effect": "Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in !defined", + "id": "FM-050", + "item": "cmd_fix", + "file": "cmd/cfusa/cmd_fix.c", + "line": 125, + "failureMode": "cmd_fix (general function) does not perform its intended action", + "effect": "Failure of cmd_fix could propagate undetected to callers in cmd_fix.c", + "cause": "Logic error or untested edge case in cmd_fix", "severity": 3, "occurrence": 2, "detection": 3, @@ -3806,12 +761,12 @@ "requirementIds": [] }, { - "id": "FM-254", + "id": "FM-051", "item": "main", - "file": "CMakeCCompilerId.c", - "line": 902, + "file": "cmd/cfusa/main.c", + "line": 14, "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", + "effect": "Failure of main could propagate undetected to callers in main.c", "cause": "Logic error or untested edge case in main", "severity": 3, "occurrence": 2, @@ -3821,13 +776,13 @@ "requirementIds": [] }, { - "id": "FM-255", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 907, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-052", + "item": "cmd_boundary", + "file": "cmd/cfusa/cmd_boundary.c", + "line": 72, + "failureMode": "cmd_boundary (general function) does not perform its intended action", + "effect": "Failure of cmd_boundary could propagate undetected to callers in cmd_boundary.c", + "cause": "Logic error or untested edge case in cmd_boundary", "severity": 3, "occurrence": 2, "detection": 3, @@ -3836,13 +791,13 @@ "requirementIds": [] }, { - "id": "FM-256", - "item": "defined", - "file": "CMakeCCompilerId.c", - "line": 891, - "failureMode": "defined (general function) does not perform its intended action", - "effect": "Failure of defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in defined", + "id": "FM-053", + "item": "cmd_impact", + "file": "cmd/cfusa/cmd_impact.c", + "line": 106, + "failureMode": "cmd_impact (general function) does not perform its intended action", + "effect": "Failure of cmd_impact could propagate undetected to callers in cmd_impact.c", + "cause": "Logic error or untested edge case in cmd_impact", "severity": 3, "occurrence": 2, "detection": 3, @@ -3851,13 +806,13 @@ "requirementIds": [] }, { - "id": "FM-257", - "item": "!defined", - "file": "CMakeCCompilerId.c", - "line": 892, - "failureMode": "!defined (general function) does not perform its intended action", - "effect": "Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in !defined", + "id": "FM-054", + "item": "cmd_sci", + "file": "cmd/cfusa/cmd_sci.c", + "line": 51, + "failureMode": "cmd_sci (general function) does not perform its intended action", + "effect": "Failure of cmd_sci could propagate undetected to callers in cmd_sci.c", + "cause": "Logic error or untested edge case in cmd_sci", "severity": 3, "occurrence": 2, "detection": 3, @@ -3866,13 +821,13 @@ "requirementIds": [] }, { - "id": "FM-258", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 902, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-055", + "item": "cmd_iec61508", + "file": "cmd/cfusa/cmd_iec61508.c", + "line": 78, + "failureMode": "cmd_iec61508 (general function) does not perform its intended action", + "effect": "Failure of cmd_iec61508 could propagate undetected to callers in cmd_iec61508.c", + "cause": "Logic error or untested edge case in cmd_iec61508", "severity": 3, "occurrence": 2, "detection": 3, @@ -3881,13 +836,13 @@ "requirementIds": [] }, { - "id": "FM-259", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 907, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-056", + "item": "cmd_badge", + "file": "cmd/cfusa/cmd_badge.c", + "line": 9, + "failureMode": "cmd_badge (general function) does not perform its intended action", + "effect": "Failure of cmd_badge could propagate undetected to callers in cmd_badge.c", + "cause": "Logic error or untested edge case in cmd_badge", "severity": 3, "occurrence": 2, "detection": 3, @@ -3896,13 +851,13 @@ "requirementIds": [] }, { - "id": "FM-260", - "item": "defined", - "file": "CMakeCCompilerId.c", - "line": 891, - "failureMode": "defined (general function) does not perform its intended action", - "effect": "Failure of defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in defined", + "id": "FM-057", + "item": "cmd_unece", + "file": "cmd/cfusa/cmd_unece.c", + "line": 57, + "failureMode": "cmd_unece (general function) does not perform its intended action", + "effect": "Failure of cmd_unece could propagate undetected to callers in cmd_unece.c", + "cause": "Logic error or untested edge case in cmd_unece", "severity": 3, "occurrence": 2, "detection": 3, @@ -3911,13 +866,13 @@ "requirementIds": [] }, { - "id": "FM-261", - "item": "!defined", - "file": "CMakeCCompilerId.c", - "line": 892, - "failureMode": "!defined (general function) does not perform its intended action", - "effect": "Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in !defined", + "id": "FM-058", + "item": "cmd_sign", + "file": "cmd/cfusa/cmd_sign.c", + "line": 43, + "failureMode": "cmd_sign (general function) does not perform its intended action", + "effect": "Failure of cmd_sign could propagate undetected to callers in cmd_sign.c", + "cause": "Logic error or untested edge case in cmd_sign", "severity": 3, "occurrence": 2, "detection": 3, @@ -3926,13 +881,13 @@ "requirementIds": [] }, { - "id": "FM-262", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 902, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-059", + "item": "cfusa_hmac_sha256", + "file": "cmd/cfusa/cmd_sign.c", + "line": 120, + "failureMode": "cfusa_hmac_sha256 (general function) does not perform its intended action", + "effect": "Failure of cfusa_hmac_sha256 could propagate undetected to callers in cmd_sign.c", + "cause": "Logic error or untested edge case in cfusa_hmac_sha256", "severity": 3, "occurrence": 2, "detection": 3, @@ -3941,13 +896,13 @@ "requirementIds": [] }, { - "id": "FM-263", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 907, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-060", + "item": "cmd_iso21434", + "file": "cmd/cfusa/cmd_iso21434.c", + "line": 77, + "failureMode": "cmd_iso21434 (general function) does not perform its intended action", + "effect": "Failure of cmd_iso21434 could propagate undetected to callers in cmd_iso21434.c", + "cause": "Logic error or untested edge case in cmd_iso21434", "severity": 3, "occurrence": 2, "detection": 3, @@ -3956,13 +911,13 @@ "requirementIds": [] }, { - "id": "FM-264", - "item": "defined", - "file": "CMakeCCompilerId.c", - "line": 891, - "failureMode": "defined (general function) does not perform its intended action", - "effect": "Failure of defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in defined", + "id": "FM-061", + "item": "cfusa_scan_lines", + "file": "cmd/cfusa/cmd_vuln.c", + "line": 107, + "failureMode": "cfusa_scan_lines (general function) does not perform its intended action", + "effect": "Failure of cfusa_scan_lines could propagate undetected to callers in cmd_vuln.c", + "cause": "Logic error or untested edge case in cfusa_scan_lines", "severity": 3, "occurrence": 2, "detection": 3, @@ -3971,13 +926,13 @@ "requirementIds": [] }, { - "id": "FM-265", - "item": "!defined", - "file": "CMakeCCompilerId.c", - "line": 892, - "failureMode": "!defined (general function) does not perform its intended action", - "effect": "Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in !defined", + "id": "FM-062", + "item": "cmd_vuln", + "file": "cmd/cfusa/cmd_vuln.c", + "line": 109, + "failureMode": "cmd_vuln (general function) does not perform its intended action", + "effect": "Failure of cmd_vuln could propagate undetected to callers in cmd_vuln.c", + "cause": "Logic error or untested edge case in cmd_vuln", "severity": 3, "occurrence": 2, "detection": 3, @@ -3986,13 +941,13 @@ "requirementIds": [] }, { - "id": "FM-266", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 902, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-063", + "item": "cmd_comp", + "file": "cmd/cfusa/cmd_comp.c", + "line": 222, + "failureMode": "cmd_comp (general function) does not perform its intended action", + "effect": "Failure of cmd_comp could propagate undetected to callers in cmd_comp.c", + "cause": "Logic error or untested edge case in cmd_comp", "severity": 3, "occurrence": 2, "detection": 3, @@ -4001,13 +956,13 @@ "requirementIds": [] }, { - "id": "FM-267", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 907, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-064", + "item": "cmd_audit_pack", + "file": "cmd/cfusa/cmd_audit_pack.c", + "line": 21, + "failureMode": "cmd_audit_pack (general function) does not perform its intended action", + "effect": "Failure of cmd_audit_pack could propagate undetected to callers in cmd_audit_pack.c", + "cause": "Logic error or untested edge case in cmd_audit_pack", "severity": 3, "occurrence": 2, "detection": 3, @@ -4016,13 +971,13 @@ "requirementIds": [] }, { - "id": "FM-268", - "item": "defined", - "file": "CMakeCCompilerId.c", - "line": 891, - "failureMode": "defined (general function) does not perform its intended action", - "effect": "Failure of defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in defined", + "id": "FM-065", + "item": "cmd_hooks", + "file": "cmd/cfusa/cmd_hooks.c", + "line": 20, + "failureMode": "cmd_hooks (general function) does not perform its intended action", + "effect": "Failure of cmd_hooks could propagate undetected to callers in cmd_hooks.c", + "cause": "Logic error or untested edge case in cmd_hooks", "severity": 3, "occurrence": 2, "detection": 3, @@ -4031,13 +986,13 @@ "requirementIds": [] }, { - "id": "FM-269", - "item": "!defined", - "file": "CMakeCCompilerId.c", - "line": 892, - "failureMode": "!defined (general function) does not perform its intended action", - "effect": "Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in !defined", + "id": "FM-066", + "item": "cmd_disposition", + "file": "cmd/cfusa/cmd_disposition.c", + "line": 184, + "failureMode": "cmd_disposition (general function) does not perform its intended action", + "effect": "Failure of cmd_disposition could propagate undetected to callers in cmd_disposition.c", + "cause": "Logic error or untested edge case in cmd_disposition", "severity": 3, "occurrence": 2, "detection": 3, @@ -4046,13 +1001,13 @@ "requirementIds": [] }, { - "id": "FM-270", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 902, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-067", + "item": "cmd_coverage", + "file": "cmd/cfusa/cmd_coverage.c", + "line": 174, + "failureMode": "cmd_coverage (general function) does not perform its intended action", + "effect": "Failure of cmd_coverage could propagate undetected to callers in cmd_coverage.c", + "cause": "Logic error or untested edge case in cmd_coverage", "severity": 3, "occurrence": 2, "detection": 3, @@ -4061,13 +1016,13 @@ "requirementIds": [] }, { - "id": "FM-271", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 907, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-068", + "item": "cmd_diff", + "file": "cmd/cfusa/cmd_diff.c", + "line": 66, + "failureMode": "cmd_diff (general function) does not perform its intended action", + "effect": "Failure of cmd_diff could propagate undetected to callers in cmd_diff.c", + "cause": "Logic error or untested edge case in cmd_diff", "severity": 3, "occurrence": 2, "detection": 3, @@ -4076,13 +1031,13 @@ "requirementIds": [] }, { - "id": "FM-272", - "item": "defined", - "file": "CMakeCCompilerId.c", - "line": 891, - "failureMode": "defined (general function) does not perform its intended action", - "effect": "Failure of defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in defined", + "id": "FM-069", + "item": "parse_sec_code", + "file": "cmd/cfusa/cmd_hara.c", + "line": 622, + "failureMode": "parse_sec_code (general function) does not perform its intended action", + "effect": "Failure of parse_sec_code could propagate undetected to callers in cmd_hara.c", + "cause": "Logic error or untested edge case in parse_sec_code", "severity": 3, "occurrence": 2, "detection": 3, @@ -4091,13 +1046,13 @@ "requirementIds": [] }, { - "id": "FM-273", - "item": "!defined", - "file": "CMakeCCompilerId.c", - "line": 892, - "failureMode": "!defined (general function) does not perform its intended action", - "effect": "Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in !defined", + "id": "FM-070", + "item": "parse_sec_code", + "file": "cmd/cfusa/cmd_hara.c", + "line": 677, + "failureMode": "parse_sec_code (general function) does not perform its intended action", + "effect": "Failure of parse_sec_code could propagate undetected to callers in cmd_hara.c", + "cause": "Logic error or untested edge case in parse_sec_code", "severity": 3, "occurrence": 2, "detection": 3, @@ -4106,13 +1061,13 @@ "requirementIds": [] }, { - "id": "FM-274", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 902, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-071", + "item": "cmd_hara", + "file": "cmd/cfusa/cmd_hara.c", + "line": 792, + "failureMode": "cmd_hara (general function) does not perform its intended action", + "effect": "Failure of cmd_hara could propagate undetected to callers in cmd_hara.c", + "cause": "Logic error or untested edge case in cmd_hara", "severity": 3, "occurrence": 2, "detection": 3, @@ -4121,13 +1076,13 @@ "requirementIds": [] }, { - "id": "FM-275", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 907, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-072", + "item": "cmd_slsa", + "file": "cmd/cfusa/cmd_slsa.c", + "line": 71, + "failureMode": "cmd_slsa (general function) does not perform its intended action", + "effect": "Failure of cmd_slsa could propagate undetected to callers in cmd_slsa.c", + "cause": "Logic error or untested edge case in cmd_slsa", "severity": 3, "occurrence": 2, "detection": 3, @@ -4136,13 +1091,13 @@ "requirementIds": [] }, { - "id": "FM-276", - "item": "defined", - "file": "CMakeCCompilerId.c", - "line": 891, - "failureMode": "defined (general function) does not perform its intended action", - "effect": "Failure of defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in defined", + "id": "FM-073", + "item": "slsa_file_exists", + "file": "cmd/cfusa/cmd_slsa.c", + "line": 123, + "failureMode": "slsa_file_exists (general function) does not perform its intended action", + "effect": "Failure of slsa_file_exists could propagate undetected to callers in cmd_slsa.c", + "cause": "Logic error or untested edge case in slsa_file_exists", "severity": 3, "occurrence": 2, "detection": 3, @@ -4151,13 +1106,13 @@ "requirementIds": [] }, { - "id": "FM-277", - "item": "!defined", - "file": "CMakeCCompilerId.c", - "line": 892, - "failureMode": "!defined (general function) does not perform its intended action", - "effect": "Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in !defined", + "id": "FM-074", + "item": "cmd_do178", + "file": "cmd/cfusa/cmd_do178.c", + "line": 113, + "failureMode": "cmd_do178 (general function) does not perform its intended action", + "effect": "Failure of cmd_do178 could propagate undetected to callers in cmd_do178.c", + "cause": "Logic error or untested edge case in cmd_do178", "severity": 3, "occurrence": 2, "detection": 3, @@ -4166,13 +1121,13 @@ "requirementIds": [] }, { - "id": "FM-278", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 902, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-075", + "item": "cmd_verify", + "file": "cmd/cfusa/cmd_verify.c", + "line": 14, + "failureMode": "cmd_verify (general function) does not perform its intended action", + "effect": "Failure of cmd_verify could propagate undetected to callers in cmd_verify.c", + "cause": "Logic error or untested edge case in cmd_verify", "severity": 3, "occurrence": 2, "detection": 3, @@ -4181,13 +1136,13 @@ "requirementIds": [] }, { - "id": "FM-279", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 907, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-076", + "item": "cmd_sas", + "file": "cmd/cfusa/cmd_sas.c", + "line": 90, + "failureMode": "cmd_sas (general function) does not perform its intended action", + "effect": "Failure of cmd_sas could propagate undetected to callers in cmd_sas.c", + "cause": "Logic error or untested edge case in cmd_sas", "severity": 3, "occurrence": 2, "detection": 3, @@ -4196,13 +1151,13 @@ "requirementIds": [] }, { - "id": "FM-280", - "item": "defined", - "file": "CMakeCCompilerId.c", - "line": 891, - "failureMode": "defined (general function) does not perform its intended action", - "effect": "Failure of defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in defined", + "id": "FM-077", + "item": "cfusa_match_outside_string", + "file": "cmd/cfusa/cmd_cyber.c", + "line": 224, + "failureMode": "cfusa_match_outside_string (general function) does not perform its intended action", + "effect": "Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c", + "cause": "Logic error or untested edge case in cfusa_match_outside_string", "severity": 3, "occurrence": 2, "detection": 3, @@ -4211,13 +1166,13 @@ "requirementIds": [] }, { - "id": "FM-281", - "item": "!defined", - "file": "CMakeCCompilerId.c", - "line": 892, - "failureMode": "!defined (general function) does not perform its intended action", - "effect": "Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in !defined", + "id": "FM-078", + "item": "cfusa_match_outside_string", + "file": "cmd/cfusa/cmd_cyber.c", + "line": 329, + "failureMode": "cfusa_match_outside_string (general function) does not perform its intended action", + "effect": "Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c", + "cause": "Logic error or untested edge case in cfusa_match_outside_string", "severity": 3, "occurrence": 2, "detection": 3, @@ -4226,13 +1181,13 @@ "requirementIds": [] }, { - "id": "FM-282", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 902, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-079", + "item": "cfusa_match_outside_string", + "file": "cmd/cfusa/cmd_cyber.c", + "line": 349, + "failureMode": "cfusa_match_outside_string (general function) does not perform its intended action", + "effect": "Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c", + "cause": "Logic error or untested edge case in cfusa_match_outside_string", "severity": 3, "occurrence": 2, "detection": 3, @@ -4241,13 +1196,28 @@ "requirementIds": [] }, { - "id": "FM-283", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 907, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-080", + "item": "cfusa_match_outside_string", + "file": "cmd/cfusa/cmd_cyber.c", + "line": 350, + "failureMode": "cfusa_match_outside_string (general function) does not perform its intended action", + "effect": "Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c", + "cause": "Logic error or untested edge case in cfusa_match_outside_string", + "severity": 3, + "occurrence": 2, + "detection": 3, + "actionPriority": "low", + "mitigations": [], + "requirementIds": [] + }, + { + "id": "FM-081", + "item": "cfusa_match_outside_string", + "file": "cmd/cfusa/cmd_cyber.c", + "line": 445, + "failureMode": "cfusa_match_outside_string (general function) does not perform its intended action", + "effect": "Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c", + "cause": "Logic error or untested edge case in cfusa_match_outside_string", "severity": 3, "occurrence": 2, "detection": 3, @@ -4256,13 +1226,13 @@ "requirementIds": [] }, { - "id": "FM-284", - "item": "defined", - "file": "CMakeCCompilerId.c", - "line": 891, - "failureMode": "defined (general function) does not perform its intended action", - "effect": "Failure of defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in defined", + "id": "FM-082", + "item": "cfusa_match_outside_string", + "file": "cmd/cfusa/cmd_cyber.c", + "line": 479, + "failureMode": "cfusa_match_outside_string (general function) does not perform its intended action", + "effect": "Failure of cfusa_match_outside_string could propagate undetected to callers in cmd_cyber.c", + "cause": "Logic error or untested edge case in cfusa_match_outside_string", "severity": 3, "occurrence": 2, "detection": 3, @@ -4271,13 +1241,13 @@ "requirementIds": [] }, { - "id": "FM-285", - "item": "!defined", - "file": "CMakeCCompilerId.c", - "line": 892, - "failureMode": "!defined (general function) does not perform its intended action", - "effect": "Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in !defined", + "id": "FM-083", + "item": "cfusa_cyber_register_rules", + "file": "cmd/cfusa/cmd_cyber.c", + "line": 564, + "failureMode": "cfusa_cyber_register_rules (general function) does not perform its intended action", + "effect": "Failure of cfusa_cyber_register_rules could propagate undetected to callers in cmd_cyber.c", + "cause": "Logic error or untested edge case in cfusa_cyber_register_rules", "severity": 3, "occurrence": 2, "detection": 3, @@ -4286,13 +1256,13 @@ "requirementIds": [] }, { - "id": "FM-286", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 902, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-084", + "item": "cmd_cyber", + "file": "cmd/cfusa/cmd_cyber.c", + "line": 570, + "failureMode": "cmd_cyber (general function) does not perform its intended action", + "effect": "Failure of cmd_cyber could propagate undetected to callers in cmd_cyber.c", + "cause": "Logic error or untested edge case in cmd_cyber", "severity": 3, "occurrence": 2, "detection": 3, @@ -4301,28 +1271,28 @@ "requirementIds": [] }, { - "id": "FM-287", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 907, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", + "id": "FM-085", + "item": "cmd_safety_case", + "file": "cmd/cfusa/cmd_safety_case.c", + "line": 35, + "failureMode": "cmd_safety_case (safety-critical function) does not perform its intended action", + "effect": "Failure of cmd_safety_case could propagate undetected to callers in cmd_safety_case.c", + "cause": "Unhandled fault or invalid input condition within cmd_safety_case", + "severity": 9, + "occurrence": 4, + "detection": 6, + "actionPriority": "high", "mitigations": [], "requirementIds": [] }, { - "id": "FM-288", - "item": "defined", - "file": "CMakeCCompilerId.c", - "line": 891, - "failureMode": "defined (general function) does not perform its intended action", - "effect": "Failure of defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in defined", + "id": "FM-086", + "item": "cmd_metrics", + "file": "cmd/cfusa/cmd_metrics.c", + "line": 288, + "failureMode": "cmd_metrics (general function) does not perform its intended action", + "effect": "Failure of cmd_metrics could propagate undetected to callers in cmd_metrics.c", + "cause": "Logic error or untested edge case in cmd_metrics", "severity": 3, "occurrence": 2, "detection": 3, @@ -4331,13 +1301,13 @@ "requirementIds": [] }, { - "id": "FM-289", - "item": "!defined", - "file": "CMakeCCompilerId.c", - "line": 892, - "failureMode": "!defined (general function) does not perform its intended action", - "effect": "Failure of !defined could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in !defined", + "id": "FM-087", + "item": "cmd_capabilities", + "file": "cmd/cfusa/cmd_capabilities.c", + "line": 15, + "failureMode": "cmd_capabilities (general function) does not perform its intended action", + "effect": "Failure of cmd_capabilities could propagate undetected to callers in cmd_capabilities.c", + "cause": "Logic error or untested edge case in cmd_capabilities", "severity": 3, "occurrence": 2, "detection": 3, @@ -4346,13 +1316,13 @@ "requirementIds": [] }, { - "id": "FM-290", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 902, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-088", + "item": "cfusa_lint_register_rules", + "file": "cmd/cfusa/cmd_lint.c", + "line": 527, + "failureMode": "cfusa_lint_register_rules (general function) does not perform its intended action", + "effect": "Failure of cfusa_lint_register_rules could propagate undetected to callers in cmd_lint.c", + "cause": "Logic error or untested edge case in cfusa_lint_register_rules", "severity": 3, "occurrence": 2, "detection": 3, @@ -4361,13 +1331,13 @@ "requirementIds": [] }, { - "id": "FM-291", - "item": "main", - "file": "CMakeCCompilerId.c", - "line": 907, - "failureMode": "main (general function) does not perform its intended action", - "effect": "Failure of main could propagate undetected to callers in CMakeCCompilerId.c", - "cause": "Logic error or untested edge case in main", + "id": "FM-089", + "item": "cmd_lint", + "file": "cmd/cfusa/cmd_lint.c", + "line": 535, + "failureMode": "cmd_lint (general function) does not perform its intended action", + "effect": "Failure of cmd_lint could propagate undetected to callers in cmd_lint.c", + "cause": "Logic error or untested edge case in cmd_lint", "severity": 3, "occurrence": 2, "detection": 3, @@ -4376,9 +1346,9 @@ "requirementIds": [] }, { - "id": "FM-292", + "id": "FM-090", "item": "cfusa_watchdog_kick", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 26, "failureMode": "cfusa_watchdog_kick (safety-critical function) does not perform its intended action", "effect": "Failure of cfusa_watchdog_kick could propagate undetected to callers in cfusa_runtime.c", @@ -4391,9 +1361,9 @@ "requirementIds": [] }, { - "id": "FM-293", + "id": "FM-091", "item": "cfusa_watchdog_check", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 33, "failureMode": "cfusa_watchdog_check (safety-critical function) does not perform its intended action", "effect": "Failure of cfusa_watchdog_check could propagate undetected to callers in cfusa_runtime.c", @@ -4406,9 +1376,9 @@ "requirementIds": [] }, { - "id": "FM-294", + "id": "FM-092", "item": "cfusa_watchdog_stop", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 43, "failureMode": "cfusa_watchdog_stop (safety-critical function) does not perform its intended action", "effect": "Failure of cfusa_watchdog_stop could propagate undetected to callers in cfusa_runtime.c", @@ -4421,9 +1391,9 @@ "requirementIds": [] }, { - "id": "FM-295", + "id": "FM-093", "item": "cfusa_watchdog_fired", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 48, "failureMode": "cfusa_watchdog_fired (safety-critical function) does not perform its intended action", "effect": "Failure of cfusa_watchdog_fired could propagate undetected to callers in cfusa_runtime.c", @@ -4436,9 +1406,9 @@ "requirementIds": [] }, { - "id": "FM-296", + "id": "FM-094", "item": "cfusa_heartbeat_beat", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 67, "failureMode": "cfusa_heartbeat_beat (general function) does not perform its intended action", "effect": "Failure of cfusa_heartbeat_beat could propagate undetected to callers in cfusa_runtime.c", @@ -4451,9 +1421,9 @@ "requirementIds": [] }, { - "id": "FM-297", + "id": "FM-095", "item": "cfusa_heartbeat_check", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 74, "failureMode": "cfusa_heartbeat_check (monitoring/control function) does not perform its intended action", "effect": "Failure of cfusa_heartbeat_check could propagate undetected to callers in cfusa_runtime.c", @@ -4466,9 +1436,9 @@ "requirementIds": [] }, { - "id": "FM-298", + "id": "FM-096", "item": "cfusa_heartbeat_stop", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 85, "failureMode": "cfusa_heartbeat_stop (general function) does not perform its intended action", "effect": "Failure of cfusa_heartbeat_stop could propagate undetected to callers in cfusa_runtime.c", @@ -4481,9 +1451,9 @@ "requirementIds": [] }, { - "id": "FM-299", + "id": "FM-097", "item": "cfusa_heartbeat_missed", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 90, "failureMode": "cfusa_heartbeat_missed (general function) does not perform its intended action", "effect": "Failure of cfusa_heartbeat_missed could propagate undetected to callers in cfusa_runtime.c", @@ -4496,9 +1466,9 @@ "requirementIds": [] }, { - "id": "FM-300", + "id": "FM-098", "item": "cfusa_state_get", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 107, "failureMode": "cfusa_state_get (general function) does not perform its intended action", "effect": "Failure of cfusa_state_get could propagate undetected to callers in cfusa_runtime.c", @@ -4511,9 +1481,9 @@ "requirementIds": [] }, { - "id": "FM-301", + "id": "FM-099", "item": "cfusa_state_transition", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 112, "failureMode": "cfusa_state_transition (general function) does not perform its intended action", "effect": "Failure of cfusa_state_transition could propagate undetected to callers in cfusa_runtime.c", @@ -4526,24 +1496,9 @@ "requirementIds": [] }, { - "id": "FM-302", - "item": "cfusa_state_name", - "file": "cfusa_runtime.c", - "line": 123, - "failureMode": "cfusa_state_name (general function) does not perform its intended action", - "effect": "Failure of cfusa_state_name could propagate undetected to callers in cfusa_runtime.c", - "cause": "Logic error or untested edge case in cfusa_state_name", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-303", + "id": "FM-100", "item": "cfusa_diag_init", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 137, "failureMode": "cfusa_diag_init (monitoring/control function) does not perform its intended action", "effect": "Failure of cfusa_diag_init could propagate undetected to callers in cfusa_runtime.c", @@ -4556,9 +1511,9 @@ "requirementIds": [] }, { - "id": "FM-304", + "id": "FM-101", "item": "cfusa_diag_count", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 160, "failureMode": "cfusa_diag_count (general function) does not perform its intended action", "effect": "Failure of cfusa_diag_count could propagate undetected to callers in cfusa_runtime.c", @@ -4571,9 +1526,9 @@ "requirementIds": [] }, { - "id": "FM-305", + "id": "FM-102", "item": "cfusa_diag_get", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 165, "failureMode": "cfusa_diag_get (general function) does not perform its intended action", "effect": "Failure of cfusa_diag_get could propagate undetected to callers in cfusa_runtime.c", @@ -4586,9 +1541,9 @@ "requirementIds": [] }, { - "id": "FM-306", + "id": "FM-103", "item": "cfusa_diag_clear", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 174, "failureMode": "cfusa_diag_clear (general function) does not perform its intended action", "effect": "Failure of cfusa_diag_clear could propagate undetected to callers in cfusa_runtime.c", @@ -4601,24 +1556,9 @@ "requirementIds": [] }, { - "id": "FM-307", - "item": "cfusa_diag_level_name", - "file": "cfusa_runtime.c", - "line": 179, - "failureMode": "cfusa_diag_level_name (general function) does not perform its intended action", - "effect": "Failure of cfusa_diag_level_name could propagate undetected to callers in cfusa_runtime.c", - "cause": "Logic error or untested edge case in cfusa_diag_level_name", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-308", + "id": "FM-104", "item": "cfusa_fault_record", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 223, "failureMode": "cfusa_fault_record (safety-critical function) does not perform its intended action", "effect": "Failure of cfusa_fault_record could propagate undetected to callers in cfusa_runtime.c", @@ -4631,9 +1571,9 @@ "requirementIds": [] }, { - "id": "FM-309", + "id": "FM-105", "item": "cfusa_fault_reset", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 233, "failureMode": "cfusa_fault_reset (safety-critical function) does not perform its intended action", "effect": "Failure of cfusa_fault_reset could propagate undetected to callers in cfusa_runtime.c", @@ -4646,9 +1586,9 @@ "requirementIds": [] }, { - "id": "FM-310", + "id": "FM-106", "item": "cfusa_fault_count", - "file": "cfusa_runtime.c", + "file": "src/cfusa_runtime.c", "line": 240, "failureMode": "cfusa_fault_count (safety-critical function) does not perform its intended action", "effect": "Failure of cfusa_fault_count could propagate undetected to callers in cfusa_runtime.c", @@ -4661,9 +1601,9 @@ "requirementIds": [] }, { - "id": "FM-311", + "id": "FM-107", "item": "cfusa_report_init", - "file": "report.c", + "file": "src/report.c", "line": 14, "failureMode": "cfusa_report_init (monitoring/control function) does not perform its intended action", "effect": "Failure of cfusa_report_init could propagate undetected to callers in report.c", @@ -4676,9 +1616,9 @@ "requirementIds": [] }, { - "id": "FM-312", + "id": "FM-108", "item": "cfusa_report_free", - "file": "report.c", + "file": "src/report.c", "line": 27, "failureMode": "cfusa_report_free (general function) does not perform its intended action", "effect": "Failure of cfusa_report_free could propagate undetected to callers in report.c", @@ -4691,39 +1631,9 @@ "requirementIds": [] }, { - "id": "FM-313", - "item": "snprintf", - "file": "report.c", - "line": 117, - "failureMode": "snprintf (general function) does not perform its intended action", - "effect": "Failure of snprintf could propagate undetected to callers in report.c", - "cause": "Logic error or untested edge case in snprintf", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-314", - "item": "cfusa_severity_str", - "file": "report.c", - "line": 127, - "failureMode": "cfusa_severity_str (general function) does not perform its intended action", - "effect": "Failure of cfusa_severity_str could propagate undetected to callers in report.c", - "cause": "Logic error or untested edge case in cfusa_severity_str", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-315", + "id": "FM-109", "item": "cfusa_format_parse", - "file": "report.c", + "file": "src/report.c", "line": 137, "failureMode": "cfusa_format_parse (general function) does not perform its intended action", "effect": "Failure of cfusa_format_parse could propagate undetected to callers in report.c", @@ -4736,9 +1646,9 @@ "requirementIds": [] }, { - "id": "FM-316", + "id": "FM-110", "item": "cfusa_report_score", - "file": "report.c", + "file": "src/report.c", "line": 148, "failureMode": "cfusa_report_score (general function) does not perform its intended action", "effect": "Failure of cfusa_report_score could propagate undetected to callers in report.c", @@ -4751,9 +1661,9 @@ "requirementIds": [] }, { - "id": "FM-317", + "id": "FM-111", "item": "cfusa_report_score", - "file": "report.c", + "file": "src/report.c", "line": 256, "failureMode": "cfusa_report_score (general function) does not perform its intended action", "effect": "Failure of cfusa_report_score could propagate undetected to callers in report.c", @@ -4766,9 +1676,9 @@ "requirementIds": [] }, { - "id": "FM-318", + "id": "FM-112", "item": "cfusa_severity_str", - "file": "report.c", + "file": "src/report.c", "line": 262, "failureMode": "cfusa_severity_str (general function) does not perform its intended action", "effect": "Failure of cfusa_severity_str could propagate undetected to callers in report.c", @@ -4781,9 +1691,9 @@ "requirementIds": [] }, { - "id": "FM-319", + "id": "FM-113", "item": "cfusa_report_score", - "file": "report.c", + "file": "src/report.c", "line": 307, "failureMode": "cfusa_report_score (general function) does not perform its intended action", "effect": "Failure of cfusa_report_score could propagate undetected to callers in report.c", @@ -4796,9 +1706,9 @@ "requirementIds": [] }, { - "id": "FM-320", + "id": "FM-114", "item": "cfusa_severity_str", - "file": "report.c", + "file": "src/report.c", "line": 344, "failureMode": "cfusa_severity_str (general function) does not perform its intended action", "effect": "Failure of cfusa_severity_str could propagate undetected to callers in report.c", @@ -4811,9 +1721,9 @@ "requirementIds": [] }, { - "id": "FM-321", + "id": "FM-115", "item": "cfusa_severity_str", - "file": "report.c", + "file": "src/report.c", "line": 360, "failureMode": "cfusa_severity_str (general function) does not perform its intended action", "effect": "Failure of cfusa_severity_str could propagate undetected to callers in report.c", @@ -4826,9 +1736,9 @@ "requirementIds": [] }, { - "id": "FM-322", + "id": "FM-116", "item": "cfusa_severity_str", - "file": "report.c", + "file": "src/report.c", "line": 375, "failureMode": "cfusa_severity_str (general function) does not perform its intended action", "effect": "Failure of cfusa_severity_str could propagate undetected to callers in report.c", @@ -4841,9 +1751,9 @@ "requirementIds": [] }, { - "id": "FM-323", + "id": "FM-117", "item": "cfusa_report_score", - "file": "report.c", + "file": "src/report.c", "line": 508, "failureMode": "cfusa_report_score (general function) does not perform its intended action", "effect": "Failure of cfusa_report_score could propagate undetected to callers in report.c", @@ -4856,9 +1766,9 @@ "requirementIds": [] }, { - "id": "FM-324", + "id": "FM-118", "item": "cfusa_severity_str", - "file": "report.c", + "file": "src/report.c", "line": 523, "failureMode": "cfusa_severity_str (general function) does not perform its intended action", "effect": "Failure of cfusa_severity_str could propagate undetected to callers in report.c", @@ -4871,9 +1781,9 @@ "requirementIds": [] }, { - "id": "FM-325", + "id": "FM-119", "item": "cfusa_severity_str", - "file": "report.c", + "file": "src/report.c", "line": 524, "failureMode": "cfusa_severity_str (general function) does not perform its intended action", "effect": "Failure of cfusa_severity_str could propagate undetected to callers in report.c", @@ -4886,9 +1796,9 @@ "requirementIds": [] }, { - "id": "FM-326", + "id": "FM-120", "item": "cfusa_report_score", - "file": "report.c", + "file": "src/report.c", "line": 550, "failureMode": "cfusa_report_score (general function) does not perform its intended action", "effect": "Failure of cfusa_report_score could propagate undetected to callers in report.c", @@ -4901,9 +1811,9 @@ "requirementIds": [] }, { - "id": "FM-327", + "id": "FM-121", "item": "cfusa_severity_str", - "file": "report.c", + "file": "src/report.c", "line": 564, "failureMode": "cfusa_severity_str (general function) does not perform its intended action", "effect": "Failure of cfusa_severity_str could propagate undetected to callers in report.c", @@ -4916,9 +1826,9 @@ "requirementIds": [] }, { - "id": "FM-328", + "id": "FM-122", "item": "cfusa_report_print", - "file": "report.c", + "file": "src/report.c", "line": 571, "failureMode": "cfusa_report_print (general function) does not perform its intended action", "effect": "Failure of cfusa_report_print could propagate undetected to callers in report.c", @@ -4931,9 +1841,9 @@ "requirementIds": [] }, { - "id": "FM-329", + "id": "FM-123", "item": "cfusa_qb_is_stub_text", - "file": "qualitybar.c", + "file": "src/qualitybar.c", "line": 44, "failureMode": "cfusa_qb_is_stub_text (general function) does not perform its intended action", "effect": "Failure of cfusa_qb_is_stub_text could propagate undetected to callers in qualitybar.c", @@ -4946,9 +1856,9 @@ "requirementIds": [] }, { - "id": "FM-330", + "id": "FM-124", "item": "cfusa_qb_rule_b_flagged", - "file": "qualitybar.c", + "file": "src/qualitybar.c", "line": 59, "failureMode": "cfusa_qb_rule_b_flagged (general function) does not perform its intended action", "effect": "Failure of cfusa_qb_rule_b_flagged could propagate undetected to callers in qualitybar.c", @@ -4961,9 +1871,9 @@ "requirementIds": [] }, { - "id": "FM-331", + "id": "FM-125", "item": "cfusa_qb_attestation_read", - "file": "qualitybar.c", + "file": "src/qualitybar.c", "line": 100, "failureMode": "cfusa_qb_attestation_read (general function) does not perform its intended action", "effect": "Failure of cfusa_qb_attestation_read could propagate undetected to callers in qualitybar.c", @@ -4976,9 +1886,9 @@ "requirementIds": [] }, { - "id": "FM-332", + "id": "FM-126", "item": "cfusa_qb_attestation_valid", - "file": "qualitybar.c", + "file": "src/qualitybar.c", "line": 161, "failureMode": "cfusa_qb_attestation_valid (general function) does not perform its intended action", "effect": "Failure of cfusa_qb_attestation_valid could propagate undetected to callers in qualitybar.c", @@ -4991,9 +1901,9 @@ "requirementIds": [] }, { - "id": "FM-333", + "id": "FM-127", "item": "cfusa_qb_rule_disposed", - "file": "qualitybar.c", + "file": "src/qualitybar.c", "line": 180, "failureMode": "cfusa_qb_rule_disposed (general function) does not perform its intended action", "effect": "Failure of cfusa_qb_rule_disposed could propagate undetected to callers in qualitybar.c", @@ -5006,9 +1916,9 @@ "requirementIds": [] }, { - "id": "FM-334", + "id": "FM-128", "item": "cfusa_qb_content_hash", - "file": "qualitybar.c", + "file": "src/qualitybar.c", "line": 206, "failureMode": "cfusa_qb_content_hash (general function) does not perform its intended action", "effect": "Failure of cfusa_qb_content_hash could propagate undetected to callers in qualitybar.c", @@ -5021,9 +1931,9 @@ "requirementIds": [] }, { - "id": "FM-335", + "id": "FM-129", "item": "cfusa_engine_reset", - "file": "engine.c", + "file": "src/engine.c", "line": 9, "failureMode": "cfusa_engine_reset (general function) does not perform its intended action", "effect": "Failure of cfusa_engine_reset could propagate undetected to callers in engine.c", @@ -5036,9 +1946,9 @@ "requirementIds": [] }, { - "id": "FM-336", + "id": "FM-130", "item": "cfusa_engine_register", - "file": "engine.c", + "file": "src/engine.c", "line": 14, "failureMode": "cfusa_engine_register (general function) does not perform its intended action", "effect": "Failure of cfusa_engine_register could propagate undetected to callers in engine.c", @@ -5051,9 +1961,9 @@ "requirementIds": [] }, { - "id": "FM-337", + "id": "FM-131", "item": "cfusa_engine_rule_count", - "file": "engine.c", + "file": "src/engine.c", "line": 23, "failureMode": "cfusa_engine_rule_count (general function) does not perform its intended action", "effect": "Failure of cfusa_engine_rule_count could propagate undetected to callers in engine.c", @@ -5066,24 +1976,9 @@ "requirementIds": [] }, { - "id": "FM-338", - "item": "cfusa_engine_get_rule", - "file": "engine.c", - "line": 28, - "failureMode": "cfusa_engine_get_rule (general function) does not perform its intended action", - "effect": "Failure of cfusa_engine_get_rule could propagate undetected to callers in engine.c", - "cause": "Logic error or untested edge case in cfusa_engine_get_rule", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-339", + "id": "FM-132", "item": "cfusa_engine_list_rules", - "file": "engine.c", + "file": "src/engine.c", "line": 34, "failureMode": "cfusa_engine_list_rules (general function) does not perform its intended action", "effect": "Failure of cfusa_engine_list_rules could propagate undetected to callers in engine.c", @@ -5096,13 +1991,13 @@ "requirementIds": [] }, { - "id": "FM-340", - "item": "!cfusa_config_is_rule_disabled", - "file": "engine.c", + "id": "FM-133", + "item": "cfusa_config_is_rule_disabled", + "file": "src/engine.c", "line": 65, - "failureMode": "!cfusa_config_is_rule_disabled (monitoring/control function) does not perform its intended action", - "effect": "Failure of !cfusa_config_is_rule_disabled could propagate undetected to callers in engine.c", - "cause": "Configuration or state inconsistency affecting !cfusa_config_is_rule_disabled", + "failureMode": "cfusa_config_is_rule_disabled (monitoring/control function) does not perform its intended action", + "effect": "Failure of cfusa_config_is_rule_disabled could propagate undetected to callers in engine.c", + "cause": "Configuration or state inconsistency affecting cfusa_config_is_rule_disabled", "severity": 5, "occurrence": 3, "detection": 4, @@ -5111,25 +2006,10 @@ "requirementIds": [] }, { - "id": "FM-341", - "item": "strcmp", - "file": "utils.c", - "line": 46, - "failureMode": "strcmp (general function) does not perform its intended action", - "effect": "Failure of strcmp could propagate undetected to callers in utils.c", - "cause": "Logic error or untested edge case in strcmp", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-342", + "id": "FM-134", "item": "cfusa_read_file", - "file": "utils.c", - "line": 60, + "file": "src/utils.c", + "line": 81, "failureMode": "cfusa_read_file (general function) does not perform its intended action", "effect": "Failure of cfusa_read_file could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_read_file", @@ -5141,10 +2021,10 @@ "requirementIds": [] }, { - "id": "FM-343", + "id": "FM-135", "item": "cfusa_fopen_write", - "file": "utils.c", - "line": 78, + "file": "src/utils.c", + "line": 99, "failureMode": "cfusa_fopen_write (general function) does not perform its intended action", "effect": "Failure of cfusa_fopen_write could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_fopen_write", @@ -5156,10 +2036,10 @@ "requirementIds": [] }, { - "id": "FM-344", + "id": "FM-136", "item": "cfusa_file_exists", - "file": "utils.c", - "line": 87, + "file": "src/utils.c", + "line": 108, "failureMode": "cfusa_file_exists (general function) does not perform its intended action", "effect": "Failure of cfusa_file_exists could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_file_exists", @@ -5171,10 +2051,10 @@ "requirementIds": [] }, { - "id": "FM-345", + "id": "FM-137", "item": "cfusa_dir_exists", - "file": "utils.c", - "line": 93, + "file": "src/utils.c", + "line": 114, "failureMode": "cfusa_dir_exists (general function) does not perform its intended action", "effect": "Failure of cfusa_dir_exists could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_dir_exists", @@ -5186,10 +2066,10 @@ "requirementIds": [] }, { - "id": "FM-346", + "id": "FM-138", "item": "cfusa_mkdir_p", - "file": "utils.c", - "line": 99, + "file": "src/utils.c", + "line": 120, "failureMode": "cfusa_mkdir_p (general function) does not perform its intended action", "effect": "Failure of cfusa_mkdir_p could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_mkdir_p", @@ -5201,10 +2081,10 @@ "requirementIds": [] }, { - "id": "FM-347", + "id": "FM-139", "item": "cfusa_scan_lines", - "file": "utils.c", - "line": 115, + "file": "src/utils.c", + "line": 136, "failureMode": "cfusa_scan_lines (general function) does not perform its intended action", "effect": "Failure of cfusa_scan_lines could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_scan_lines", @@ -5216,40 +2096,10 @@ "requirementIds": [] }, { - "id": "FM-348", - "item": "cfusa_basename", - "file": "utils.c", - "line": 134, - "failureMode": "cfusa_basename (general function) does not perform its intended action", - "effect": "Failure of cfusa_basename could propagate undetected to callers in utils.c", - "cause": "Logic error or untested edge case in cfusa_basename", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-349", - "item": "cfusa_extension", - "file": "utils.c", - "line": 140, - "failureMode": "cfusa_extension (general function) does not perform its intended action", - "effect": "Failure of cfusa_extension could propagate undetected to callers in utils.c", - "cause": "Logic error or untested edge case in cfusa_extension", - "severity": 3, - "occurrence": 2, - "detection": 3, - "actionPriority": "low", - "mitigations": [], - "requirementIds": [] - }, - { - "id": "FM-350", + "id": "FM-140", "item": "cfusa_str_contains", - "file": "utils.c", - "line": 147, + "file": "src/utils.c", + "line": 168, "failureMode": "cfusa_str_contains (general function) does not perform its intended action", "effect": "Failure of cfusa_str_contains could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_str_contains", @@ -5261,10 +2111,10 @@ "requirementIds": [] }, { - "id": "FM-351", + "id": "FM-141", "item": "cfusa_str_starts_with", - "file": "utils.c", - "line": 152, + "file": "src/utils.c", + "line": 173, "failureMode": "cfusa_str_starts_with (general function) does not perform its intended action", "effect": "Failure of cfusa_str_starts_with could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_str_starts_with", @@ -5276,10 +2126,10 @@ "requirementIds": [] }, { - "id": "FM-352", + "id": "FM-142", "item": "cfusa_str_trim", - "file": "utils.c", - "line": 157, + "file": "src/utils.c", + "line": 178, "failureMode": "cfusa_str_trim (general function) does not perform its intended action", "effect": "Failure of cfusa_str_trim could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_str_trim", @@ -5291,10 +2141,10 @@ "requirementIds": [] }, { - "id": "FM-353", + "id": "FM-143", "item": "cfusa_str_escape_json", - "file": "utils.c", - "line": 168, + "file": "src/utils.c", + "line": 189, "failureMode": "cfusa_str_escape_json (general function) does not perform its intended action", "effect": "Failure of cfusa_str_escape_json could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_str_escape_json", @@ -5306,10 +2156,10 @@ "requirementIds": [] }, { - "id": "FM-354", + "id": "FM-144", "item": "cfusa_path_join", - "file": "utils.c", - "line": 188, + "file": "src/utils.c", + "line": 209, "failureMode": "cfusa_path_join (general function) does not perform its intended action", "effect": "Failure of cfusa_path_join could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_path_join", @@ -5321,10 +2171,70 @@ "requirementIds": [] }, { - "id": "FM-355", + "id": "FM-145", + "item": "cfusa_relativize_path", + "file": "src/utils.c", + "line": 224, + "failureMode": "cfusa_relativize_path (general function) does not perform its intended action", + "effect": "Failure of cfusa_relativize_path could propagate undetected to callers in utils.c", + "cause": "Logic error or untested edge case in cfusa_relativize_path", + "severity": 3, + "occurrence": 2, + "detection": 3, + "actionPriority": "low", + "mitigations": [], + "requirementIds": [] + }, + { + "id": "FM-146", + "item": "cfusa_is_test_source_file", + "file": "src/utils.c", + "line": 240, + "failureMode": "cfusa_is_test_source_file (general function) does not perform its intended action", + "effect": "Failure of cfusa_is_test_source_file could propagate undetected to callers in utils.c", + "cause": "Logic error or untested edge case in cfusa_is_test_source_file", + "severity": 3, + "occurrence": 2, + "detection": 3, + "actionPriority": "low", + "mitigations": [], + "requirementIds": [] + }, + { + "id": "FM-147", + "item": "cfusa_is_stdlib_call", + "file": "src/utils.c", + "line": 269, + "failureMode": "cfusa_is_stdlib_call (general function) does not perform its intended action", + "effect": "Failure of cfusa_is_stdlib_call could propagate undetected to callers in utils.c", + "cause": "Logic error or untested edge case in cfusa_is_stdlib_call", + "severity": 3, + "occurrence": 2, + "detection": 3, + "actionPriority": "low", + "mitigations": [], + "requirementIds": [] + }, + { + "id": "FM-148", + "item": "cfusa_extract_call_name", + "file": "src/utils.c", + "line": 336, + "failureMode": "cfusa_extract_call_name (general function) does not perform its intended action", + "effect": "Failure of cfusa_extract_call_name could propagate undetected to callers in utils.c", + "cause": "Logic error or untested edge case in cfusa_extract_call_name", + "severity": 3, + "occurrence": 2, + "detection": 3, + "actionPriority": "low", + "mitigations": [], + "requirementIds": [] + }, + { + "id": "FM-149", "item": "cfusa_sha256_buf", - "file": "utils.c", - "line": 311, + "file": "src/utils.c", + "line": 486, "failureMode": "cfusa_sha256_buf (general function) does not perform its intended action", "effect": "Failure of cfusa_sha256_buf could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_sha256_buf", @@ -5336,10 +2246,10 @@ "requirementIds": [] }, { - "id": "FM-356", + "id": "FM-150", "item": "cfusa_sha256_file", - "file": "utils.c", - "line": 323, + "file": "src/utils.c", + "line": 498, "failureMode": "cfusa_sha256_file (general function) does not perform its intended action", "effect": "Failure of cfusa_sha256_file could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_sha256_file", @@ -5351,10 +2261,10 @@ "requirementIds": [] }, { - "id": "FM-357", + "id": "FM-151", "item": "cfusa_sha256_buf", - "file": "utils.c", - "line": 352, + "file": "src/utils.c", + "line": 527, "failureMode": "cfusa_sha256_buf (general function) does not perform its intended action", "effect": "Failure of cfusa_sha256_buf could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_sha256_buf", @@ -5366,10 +2276,10 @@ "requirementIds": [] }, { - "id": "FM-358", + "id": "FM-152", "item": "cfusa_timestamp_now", - "file": "utils.c", - "line": 383, + "file": "src/utils.c", + "line": 558, "failureMode": "cfusa_timestamp_now (general function) does not perform its intended action", "effect": "Failure of cfusa_timestamp_now could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_timestamp_now", @@ -5381,10 +2291,10 @@ "requirementIds": [] }, { - "id": "FM-359", + "id": "FM-153", "item": "cfusa_count_c_files", - "file": "utils.c", - "line": 400, + "file": "src/utils.c", + "line": 575, "failureMode": "cfusa_count_c_files (general function) does not perform its intended action", "effect": "Failure of cfusa_count_c_files could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_count_c_files", @@ -5396,10 +2306,10 @@ "requirementIds": [] }, { - "id": "FM-360", + "id": "FM-154", "item": "cfusa_count_lines_in_file", - "file": "utils.c", - "line": 408, + "file": "src/utils.c", + "line": 583, "failureMode": "cfusa_count_lines_in_file (general function) does not perform its intended action", "effect": "Failure of cfusa_count_lines_in_file could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_count_lines_in_file", @@ -5411,10 +2321,10 @@ "requirementIds": [] }, { - "id": "FM-361", + "id": "FM-155", "item": "cfusa_match_outside_string", - "file": "utils.c", - "line": 421, + "file": "src/utils.c", + "line": 596, "failureMode": "cfusa_match_outside_string (general function) does not perform its intended action", "effect": "Failure of cfusa_match_outside_string could propagate undetected to callers in utils.c", "cause": "Logic error or untested edge case in cfusa_match_outside_string", @@ -5426,9 +2336,9 @@ "requirementIds": [] }, { - "id": "FM-362", + "id": "FM-156", "item": "cfusa_config_defaults", - "file": "config.c", + "file": "src/config.c", "line": 8, "failureMode": "cfusa_config_defaults (safety-critical function) does not perform its intended action", "effect": "Failure of cfusa_config_defaults could propagate undetected to callers in config.c", @@ -5441,9 +2351,9 @@ "requirementIds": [] }, { - "id": "FM-363", + "id": "FM-157", "item": "cfusa_config_load", - "file": "config.c", + "file": "src/config.c", "line": 92, "failureMode": "cfusa_config_load (monitoring/control function) does not perform its intended action", "effect": "Failure of cfusa_config_load could propagate undetected to callers in config.c", @@ -5456,9 +2366,9 @@ "requirementIds": [] }, { - "id": "FM-364", + "id": "FM-158", "item": "extract_str_array_n", - "file": "config.c", + "file": "src/config.c", "line": 150, "failureMode": "extract_str_array_n (general function) does not perform its intended action", "effect": "Failure of extract_str_array_n could propagate undetected to callers in config.c", @@ -5471,9 +2381,9 @@ "requirementIds": [] }, { - "id": "FM-365", + "id": "FM-159", "item": "extract_str_array_n", - "file": "config.c", + "file": "src/config.c", "line": 160, "failureMode": "extract_str_array_n (general function) does not perform its intended action", "effect": "Failure of extract_str_array_n could propagate undetected to callers in config.c", @@ -5486,9 +2396,9 @@ "requirementIds": [] }, { - "id": "FM-366", + "id": "FM-160", "item": "extract_str_array_n", - "file": "config.c", + "file": "src/config.c", "line": 170, "failureMode": "extract_str_array_n (general function) does not perform its intended action", "effect": "Failure of extract_str_array_n could propagate undetected to callers in config.c", @@ -5501,9 +2411,9 @@ "requirementIds": [] }, { - "id": "FM-367", + "id": "FM-161", "item": "extract_str_array_n", - "file": "config.c", + "file": "src/config.c", "line": 177, "failureMode": "extract_str_array_n (general function) does not perform its intended action", "effect": "Failure of extract_str_array_n could propagate undetected to callers in config.c", @@ -5516,9 +2426,9 @@ "requirementIds": [] }, { - "id": "FM-368", + "id": "FM-162", "item": "cfusa_config_is_rule_disabled", - "file": "config.c", + "file": "src/config.c", "line": 186, "failureMode": "cfusa_config_is_rule_disabled (monitoring/control function) does not perform its intended action", "effect": "Failure of cfusa_config_is_rule_disabled could propagate undetected to callers in config.c", @@ -5531,9 +2441,9 @@ "requirementIds": [] }, { - "id": "FM-369", + "id": "FM-163", "item": "cfusa_config_save", - "file": "config.c", + "file": "src/config.c", "line": 193, "failureMode": "cfusa_config_save (monitoring/control function) does not perform its intended action", "effect": "Failure of cfusa_config_save could propagate undetected to callers in config.c", @@ -5546,9 +2456,9 @@ "requirementIds": [] }, { - "id": "FM-370", + "id": "FM-164", "item": "cfusa_config_is_excluded", - "file": "config.c", + "file": "src/config.c", "line": 225, "failureMode": "cfusa_config_is_excluded (monitoring/control function) does not perform its intended action", "effect": "Failure of cfusa_config_is_excluded could propagate undetected to callers in config.c", @@ -5562,7 +2472,7 @@ } ], "summary": { - "total": 370, "highPriority": 11, - "componentsAnalyzed": 370, "componentsInProject": 370, "coveragePct": 100 + "total": 164, "highPriority": 11, + "componentsAnalyzed": 164, "componentsInProject": 164, "coveragePct": 100 } } diff --git a/include/cfusa/asil.h b/include/cfusa/asil.h new file mode 100644 index 0000000..0b82a4e --- /dev/null +++ b/include/cfusa/asil.h @@ -0,0 +1,20 @@ +#ifndef CFUSA_ASIL_H +#define CFUSA_ASIL_H + +/* + * ISO 26262-3:2018 Table 4 ASIL determination, with the C0 extension. + * + * Shared by `cfusa hara` (which computes it for the text-mode "stored ASIL + * differs from computed" warning) and the `check` engine's HARA rules + * (which gate on the same computation — x-FuSa spec §1.2.5's "ASIL + * determination (MUST when standard: iso26262)"). Previously duplicated as + * a static table inside cmd_hara.c; consolidated here so both call sites + * are provably using the identical table. + */ + +/* s: 1-3 (S1-S3), e: 1-4 (E1-E4), c: 0-3 (C0-C3). Returns "QM" for any + * out-of-range input (fail-safe: never returns an ASIL for an unparseable + * rating). */ +const char *cfusa_compute_asil(int s, int e, int c); + +#endif /* CFUSA_ASIL_H */ diff --git a/include/cfusa/utils.h b/include/cfusa/utils.h index 15e97f1..8700098 100644 --- a/include/cfusa/utils.h +++ b/include/cfusa/utils.h @@ -38,6 +38,57 @@ void cfusa_str_escape_json(const char *in, char *out, size_t out_sz); /* ---- path helpers ---- */ void cfusa_path_join(char *out, size_t sz, const char *a, const char *b); +/* Relativizes `path` against `root` — the same --dir value (relative or + * absolute, exactly as given, NOT run through realpath()) that was passed + * to cfusa_walk_sources() to produce `path` in the first place — so the + * result satisfies x-FuSa spec §4's "location.file MUST be project- + * relative" rule. Deliberately does NOT resolve symlinks: since + * cfusa_walk_sources() builds every `path` by literally concatenating + * `root` with each traversed entry, `root` is always already the correct + * literal prefix to strip, and running it through realpath() first would + * silently break relativization whenever the two disagree on a symlink + * (e.g. macOS aliases /tmp -> /private/tmp, so realpath("/tmp/x") no + * longer prefixes a `path` built from the literal "/tmp/x"). Handles a + * trailing slash on `root` and strips any remaining leading "./" once + * `path` is already relative. This is the one canonical implementation of + * the relativization logic `check`/`trace` already used (previously + * duplicated ad hoc in cfusa_report_add() and cmd_trace.c) — every command + * producing a project-relative `file` field SHOULD reuse it. */ +void cfusa_relativize_path(const char *root, const char *path, char *out, size_t out_sz); + +/* Returns 1 when `path`'s basename looks like this project's test-source + * naming convention (`test_*.c` or `*_test.c`), 0 otherwise. Shared by + * `trace --func-coverage` (§1.4.1), `fmea`, and `tara` so all three + * commands' component/asset denominators are scoped to the same + * non-test-source tree (x-FuSa spec §1.6 rule 4 implementation note) rather + * than each maintaining its own narrower, independently-drifting copy. */ +int cfusa_is_test_source_file(const char *path); + +/* Returns a pointer to the first un-quoted occurrence of `ch` in `line` (a + * single line of C source), or NULL when every occurrence is inside a + * string literal (or there is none). Uses the same in-string tracking + * algorithm as cfusa_match_outside_string(), generalised to return a + * position instead of a boolean token match — used to avoid mistaking a + * `(` found inside a quoted string (e.g. a test-case description literal) + * for a real call/definition site (x-FuSa spec §1.6 rule 4). */ +const char *cfusa_find_outside_string(const char *line, char ch); + +/* Returns 1 when `name` is a well-known C standard-library/CRT function + * (printf, malloc, strcpy, ...), 0 otherwise. A scanner building + * fmea/tara-style entries from source text SHOULD exclude these from + * "components in project" — a call to a stdlib function is not a project + * symbol (x-FuSa spec §1.6 rule 4). */ +int cfusa_is_stdlib_call(const char *name); + +/* Scans a single line of C source for something that looks like a real + * call/definition site — `(` — outside a string literal, not a + * control-flow/storage-class keyword, and not a standard-library call, and + * copies the identifier into `out` (which must be at least 2 bytes). + * Returns 1 on a match, 0 otherwise. Centralises the heuristic previously + * duplicated (and independently under-guarded) in cmd_fmea.c's fmea_line() + * and cmd_tara.c's asset_line() — x-FuSa spec §1.6 rule 4. */ +int cfusa_extract_call_name(const char *line, char *out, size_t out_sz); + /* ---- SHA-256 ---- */ void cfusa_sha256_file(const char *path, char hex_out[65]); void cfusa_sha256_buf(const unsigned char *buf, size_t len, char hex_out[65]); diff --git a/include/cfusa/version.h b/include/cfusa/version.h index 18793e0..546ce72 100644 --- a/include/cfusa/version.h +++ b/include/cfusa/version.h @@ -3,16 +3,28 @@ #define CFUSA_VERSION_MAJOR 0 #define CFUSA_VERSION_MINOR 5 -#define CFUSA_VERSION_PATCH 46 -#define CFUSA_VERSION_STRING "0.5.46" -#define CFUSA_SCHEMA_VERSION "1.14.0" -/* Bumped from 1.11.0 to 1.14.0: adopts the x-FuSa master spec's §1.2.5/§9.2/ - * §9.3 evidence-artifact schema formalization (hara/fmea/tara/safety-case/ - * sas/sci field-level shapes — SFOP TARA impact, GSN safety-case node - * types, HARA's three cross-referenced collections with MUST fssrRefs) and - * the §1.6/§1.6.1/§1.6.2 content-quality baseline (FUSA-STUB001/002 - * detection, attestation, summary.coveragePct/--min-coverage on fmea/tara). - * See issue #71. */ -#define CFUSA_SPEC_VERSION "1.14.0" +#define CFUSA_VERSION_PATCH 47 +#define CFUSA_VERSION_STRING "0.5.47" +#define CFUSA_SCHEMA_VERSION "1.15.0" +/* Bumped from 1.14.0 to 1.15.0: adopts the x-FuSa master spec's v1.15.0 + * attestation-carry-forward MUST (already conformant for fmea/tara/ + * safety-case/sas; hara's own JSON output now also passes through its + * input file's attestation and cross-references verbatim, per §9.2), the + * §1.6 rule 4 test-tree/stdlib-exclusion reuse guidance (fmea/tara now + * share cfusa_is_test_source_file()/cfusa_extract_call_name() rather than + * each maintaining an independently-drifting scanner), and the §9.2 + * coveragePct <= 100 MUST (defensive clamp + regression tests with a + * non-trivial test-source tree on both fmea and tara). Also fixes several + * post-v1.14.0 rollout-audit findings: fmea/tara `standard` now emits the + * canonical id instead of a display string (§2.4.1); tara's `impact.*` + * uses the v1.14.1 closed enum (critical|major|moderate|negligible) and + * `risk` is derived from the spec's combination table instead of an ad hoc + * score; fmea/tara/sci `file`/`location.file` are project-relative + * (including subdirectory) instead of a bare basename or a leaked absolute + * path; HARA's stored `risk.asil` is now cross-checked against the S x E x + * C table both in `hara --format json`'s completeness block and as a new + * `check` engine rule (HARA006), not just a text-mode warning. See issues + * #73-80. */ +#define CFUSA_SPEC_VERSION "1.15.0" #endif /* CFUSA_VERSION_H */ diff --git a/safety-case.json b/safety-case.json index 7164044..ba5bf41 100644 --- a/safety-case.json +++ b/safety-case.json @@ -1,16 +1,16 @@ { - "schemaVersion": "1.14.0", + "schemaVersion": "1.15.0", "kind": "safety-case", "tool": "c-FuSa", - "toolVersion": "0.5.46", + "toolVersion": "0.5.47", "language": "c", - "generatedAt": "2026-07-28T19:47:39Z", + "generatedAt": "2026-07-28T21:51:15Z", "project": "c-FuSa", "standard": "iso26262", "nodes": [ {"id": "G1", "type": "goal", "text": "c-FuSa v0.5.1 has no unmitigated hazard from .fusa-hara.json and no unresolved ERROR finding from `cfusa check` at the iso26262 analysis boundary"}, {"id": "St1", "type": "strategy", "text": "Argue over hazard elimination and process confidence separately"}, - {"id": "C1", "type": "context", "text": "Scope: c-FuSa source under \".\", analyzed against iso26262 by c-FuSa v0.5.46"}, + {"id": "C1", "type": "context", "text": "Scope: c-FuSa source under \".\", analyzed against iso26262 by c-FuSa v0.5.47"}, {"id": "A1", "type": "assumption", "text": "The underlying hardware/platform on which c-FuSa runs meets its own safety requirements independently of this software safety case"}, {"id": "G1.1", "type": "goal", "text": "Every hazard recorded in .fusa-hara.json is eliminated or controlled to its assigned ASIL (ISO 26262-3 Clause 6)"}, {"id": "G1.2", "type": "goal", "text": "The c-FuSa development process gives justified confidence: static analysis, FMEA/TARA, and tool qualification evidence are current"}, diff --git a/safety-case.md b/safety-case.md index 8e6f411..8c016be 100644 --- a/safety-case.md +++ b/safety-case.md @@ -1,6 +1,6 @@ # Safety Case — c-FuSa v0.5.1 -**Standard:** iso26262 | **Generated:** 2026-07-28T19:47:39Z +**Standard:** iso26262 | **Generated:** 2026-07-28T21:51:15Z --- @@ -14,7 +14,7 @@ ## C1 — context -> Scope: c-FuSa source under ".", analyzed against iso26262 by c-FuSa v0.5.46 +> Scope: c-FuSa source under ".", analyzed against iso26262 by c-FuSa v0.5.47 ## A1 — assumption @@ -78,7 +78,7 @@ _Completeness: 3 goal(s), 1 with cited evidence, 1 undeveloped._ |---|---|---| | hara.md | absent | — | | safety-plan.md | absent | — | -| tara.md | present | `dcfdbf0fe1239b5a9f1263b1e328d5d7f7938678f74d937ff382dfb1c846517a` | +| tara.md | present | `ceb6fd83e1a063d41e4b2dfc72d8eeb9811c4edff2c5e4db7173aee58f25f844` | | fmea.md | absent | — | | test-evidence.md | absent | — | | sas.md | absent | — | diff --git a/src/asil.c b/src/asil.c new file mode 100644 index 0000000..3e82f99 --- /dev/null +++ b/src/asil.c @@ -0,0 +1,35 @@ +#include "cfusa/asil.h" + +/* + * ISO 26262-3:2018 Table 4 ASIL determination with C0 extension. + * Indices: [S1-S3][E1-E4][C0-C3] + */ +static const char *asil_table[3][4][4] = { + /* S1: slight to moderate injuries */ + { + {"QM","QM","QM","QM"}, /* E1: C0,C1,C2,C3 */ + {"QM","QM","QM","QM"}, /* E2 */ + {"QM","QM","QM","ASIL-A"}, /* E3 */ + {"QM","QM","ASIL-A","ASIL-B"} /* E4 */ + }, + /* S2: severe/life-threatening injuries, survival probable */ + { + {"QM","QM","QM","QM"}, /* E1 */ + {"QM","QM","ASIL-A","ASIL-B"}, /* E2 */ + {"QM","ASIL-A","ASIL-B","ASIL-C"}, /* E3 */ + {"ASIL-A","ASIL-B","ASIL-C","ASIL-D"} /* E4 */ + }, + /* S3: life-threatening injuries, survival uncertain / fatal */ + { + {"QM","ASIL-A","ASIL-B","ASIL-C"}, /* E1 */ + {"ASIL-A","ASIL-B","ASIL-C","ASIL-D"}, /* E2 */ + {"ASIL-B","ASIL-C","ASIL-D","ASIL-D"}, /* E3 */ + {"ASIL-C","ASIL-D","ASIL-D","ASIL-D"} /* E4 */ + } +}; + +const char *cfusa_compute_asil(int s, int e, int c) +{ + if (s < 1 || s > 3 || e < 1 || e > 4 || c < 0 || c > 3) return "QM"; + return asil_table[s - 1][e - 1][c]; +} diff --git a/src/utils.c b/src/utils.c index 5150f25..cea7852 100644 --- a/src/utils.c +++ b/src/utils.c @@ -11,6 +11,7 @@ #include #include #include +#include #include #include #include @@ -48,10 +49,22 @@ int cfusa_walk_sources(const char *dir, const char * const *exts, int n_exts, if (stat(path, &st) != 0) continue; if (S_ISDIR(st.st_mode)) { - /* Skip well-known non-source directories */ + /* Skip well-known non-source directories. Matches this + * project's own .gitignore convention (a "build" directory, or + * anything named "build-something"/"build_something") rather + * than a fixed enum of names -- a local working tree commonly + * has several build-type variants side by side (build-asan, + * build-release, build_fortify, ...), and a generated file + * inside any of them (e.g. CMake's own CompilerIdC probe, + * which defines a real main function) is not project source. + * Scanning one in was a real x-FuSa spec section 1.6 rule 4 + * violation found while dogfooding the fmea/tara scanners + * against this repo's own (gitignored, untracked) build + * directories. */ const char *bn = ent->d_name; if (strcmp(bn,"build")==0 || strcmp(bn,"vendor")==0 || - strcmp(bn,"build-cov")==0 || strcmp(bn,"node_modules")==0) + strcmp(bn,"node_modules")==0 || + strncmp(bn,"build-",6)==0 || strncmp(bn,"build_",6)==0) continue; ret += cfusa_walk_sources(path, exts, n_exts, cb, ctx); } else if (S_ISREG(st.st_mode)) { @@ -202,6 +215,160 @@ void cfusa_path_join(char *out, size_t sz, const char *a, const char *b) snprintf(out, sz, "%s/%s", a, b); } +/* x-FuSa spec §4: location.file MUST be project-relative regardless of + * whether --dir was given as a relative or an absolute path. This is the + * single canonical implementation of the relativization logic previously + * duplicated ad hoc in cfusa_report_add() (src/report.c) and cmd_trace.c's + * add_tag()/funcfile_cb() — see the "deliberately does NOT resolve + * symlinks" note in the header. */ +void cfusa_relativize_path(const char *root, const char *path, char *out, size_t out_sz) +{ + const char *rel = path; + if (root && root[0]) { + size_t rlen = strlen(root); + while (rlen > 1 && root[rlen - 1] == '/') rlen--; /* tolerate a trailing slash on root */ + if (strncmp(path, root, rlen) == 0 && + (path[rlen] == '/' || path[rlen] == '\0')) + rel = path + rlen + (path[rlen] == '/'); + } + while (rel[0] == '.' && rel[1] == '/') rel += 2; + if (!rel[0]) rel = "."; + strncpy(out, rel, out_sz - 1); + out[out_sz - 1] = '\0'; +} + +int cfusa_is_test_source_file(const char *path) +{ + const char *b = strrchr(path, '/'); + b = b ? b + 1 : path; + if (strncmp(b, "test_", 5) == 0) return 1; + size_t n = strlen(b); + return n > 7 && strcmp(b + n - 7, "_test.c") == 0; +} + +const char *cfusa_find_outside_string(const char *line, char ch) +{ + int in_str = 0; + const char *p = line; + while (*p) { + if (*p == '"' && (p == line || p[-1] != '\\')) { + in_str = !in_str; + } else if (!in_str && *p == ch) { + return p; + } + p++; + } + return NULL; +} + +/* Non-exhaustive but broad deny-list of C standard-library / CRT function + * names, sorted for readability (linear scan — this list is short enough + * that a call-site table isn't worth the complexity). A call to any of + * these is never a project-defined "component"/"asset" for fmea/tara + * purposes (x-FuSa spec §1.6 rule 4). */ +int cfusa_is_stdlib_call(const char *name) +{ + static const char * const stdlib_fns[] = { + "abort", "abs", "access", "asctime", "assert", "atexit", "atof", + "atoi", "atol", "atoll", + "bsearch", + "calloc", "chdir", "chmod", "clock", "closedir", "close", + "ctime", + "difftime", "dup", "dup2", + "errno", "execve", "execvp", "exit", + "fclose", "fdopen", "feof", "ferror", "fflush", "fgetc", "fgets", + "fopen", "fork", "fprintf", "fputc", "fputs", "fread", "free", + "freopen", "fscanf", "fseek", "fstat", "ftell", "fwrite", + "getchar", "getcwd", "getc", "getenv", "getline", + "isalnum", "isalpha", "iscntrl", "isdigit", "isgraph", "islower", + "isprint", "ispunct", "isspace", "isupper", "isxdigit", + "labs", "llabs", "localtime", "lseek", "lstat", + "malloc", "memchr", "memcmp", "memcpy", "memmove", "memset", + "mkdir", "mkstemp", "mktime", + "open", "opendir", + "perror", "pipe", "printf", "putchar", "putc", + "qsort", + "rand", "random", "read", "readdir", "realloc", "realpath", + "remove", "rename", "rewind", "rmdir", + "scanf", "setenv", "snprintf", "sprintf", "srand", "sscanf", + "stat", "strcasecmp", "strcat", "strchr", "strcmp", "strcpy", + "strdup", "strerror", "strftime", "strlen", "strncasecmp", + "strncat", "strncmp", "strncpy", "strndup", "strrchr", "strstr", + "strtod", "strtof", "strtok_r", "strtok", "strtol", "strtoul", + "system", + "time", "tmpfile", "tmpnam", "tolower", "toupper", + "unlink", + "vfprintf", "vfscanf", "vprintf", "vscanf", "vsnprintf", + "vsprintf", "vsscanf", + "write", + NULL + }; + for (int i = 0; stdlib_fns[i]; i++) + if (strcmp(name, stdlib_fns[i]) == 0) return 1; + return 0; +} + +/* Word-boundary check: does `p` start with keyword `kw` followed by a + * non-identifier character (or end of string)? Handles both "if (" and + * "if(" (the previous per-caller skip-lists only matched the former, a + * separate bug this consolidation also fixes). */ +static int starts_with_kw(const char *p, const char *kw) +{ + size_t l = strlen(kw); + if (strncmp(p, kw, l) != 0) return 0; + unsigned char after = (unsigned char)p[l]; + return !(isalnum(after) || after == '_'); +} + +static int starts_with_any_kw(const char *p) +{ + static const char * const kws[] = { + "if", "for", "while", "switch", "return", "else", "case", + "default", "typedef", "struct", "enum", "union", "static", + "extern", "inline", "sizeof", "defined", "do", "goto", "break", + "continue", "const", "volatile", "register", NULL + }; + for (int i = 0; kws[i]; i++) + if (starts_with_kw(p, kws[i])) return 1; + return 0; +} + +int cfusa_extract_call_name(const char *line, char *out, size_t out_sz) +{ + const char *p = line; + while (*p == ' ' || *p == '\t') p++; + if (!*p || *p == '/' || *p == '#' || *p == '*' || *p == '}') return 0; + if (starts_with_any_kw(p)) return 0; + + const char *end = line + strlen(line); + while (end > line && (end[-1] == ' ' || end[-1] == '\t' || + end[-1] == '\n' || end[-1] == '\r')) end--; + if (end > line && end[-1] == ';') return 0; + + /* The '(' (and a ')' somewhere on the line) must be real code, not text + * sitting inside a quoted string literal (x-FuSa spec §1.6 rule 4). */ + const char *paren = cfusa_find_outside_string(p, '('); + if (!paren) return 0; + if (!cfusa_find_outside_string(p, ')')) return 0; + + const char *ident_end = paren; + while (ident_end > p && (ident_end[-1] == ' ' || ident_end[-1] == '\t' || + ident_end[-1] == '*')) ident_end--; + const char *ident_start = ident_end; + while (ident_start > p && (isalnum((unsigned char)ident_start[-1]) || + ident_start[-1] == '_')) ident_start--; + + size_t n = (size_t)(ident_end - ident_start); + if (n < 2 || n >= out_sz) return 0; + if (!isalpha((unsigned char)ident_start[0]) && ident_start[0] != '_') return 0; + + memcpy(out, ident_start, n); + out[n] = '\0'; + + if (cfusa_is_stdlib_call(out)) return 0; + return 1; +} + /* ---- SHA-256 ---- */ #define ROTR32(x, n) (((x) >> (n)) | ((x) << (32 - (n)))) diff --git a/tara.json b/tara.json index fb79a4f..cd20db4 100644 --- a/tara.json +++ b/tara.json @@ -1,173 +1,137 @@ { - "schemaVersion": "1.14.0", + "schemaVersion": "1.15.0", "kind": "tara-report", "tool": "c-FuSa", - "toolVersion": "0.5.46", + "toolVersion": "0.5.47", "language": "c", - "generatedAt": "2026-07-28T19:47:38Z", + "generatedAt": "2026-07-28T21:51:15Z", "project": "c-FuSa", "version": "0.5.1", - "standard": "ISO/SAE 21434:2021 Clause 15", + "standard": "iso21434", "threats": [ { "id": "TARA-001", - "asset": "Data handled by \"strcpy (cmd_qualify.c)", - "threat": "An attacker supplies malformed/untrusted input to \"strcpy, potentially causing incorrect behaviour, a crash, or information disclosure", - "attackVector": "local", - "attackFeasibility": "medium", - "impact": {"safety": "high", "financial": "low", "operational": "medium", "privacy": "low"}, - "risk": "high", - "treatment": "mitigate", - "mitigations": ["Use bounds-checked copy/allocation APIs", "Add static analysis (cfusa analyze/lint) to the CI gate for this file"], - "location": {"file": "cmd_qualify.c", "line": 427} - }, - { - "id": "TARA-002", "asset": "Data handled by import_reqif (cmd_req.c)", "threat": "An attacker supplies malformed/untrusted input to import_reqif, potentially causing incorrect behaviour, a crash, or information disclosure", "attackVector": "local", "attackFeasibility": "medium", - "impact": {"safety": "low", "financial": "low", "operational": "medium", "privacy": "low"}, - "risk": "medium", + "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"}, + "risk": "high", "treatment": "mitigate", "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"], - "location": {"file": "cmd_req.c", "line": 646} + "location": {"file": "cmd/cfusa/cmd_req.c", "line": 646} }, { - "id": "TARA-003", + "id": "TARA-002", "asset": "Data handled by import_polarion_xml (cmd_req.c)", "threat": "An attacker supplies malformed/untrusted input to import_polarion_xml, potentially causing incorrect behaviour, a crash, or information disclosure", "attackVector": "local", "attackFeasibility": "medium", - "impact": {"safety": "low", "financial": "low", "operational": "medium", "privacy": "low"}, - "risk": "medium", + "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"}, + "risk": "high", "treatment": "mitigate", "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"], - "location": {"file": "cmd_req.c", "line": 652} + "location": {"file": "cmd/cfusa/cmd_req.c", "line": 652} }, { - "id": "TARA-004", + "id": "TARA-003", "asset": "Data handled by import_reqif (cmd_req.c)", "threat": "An attacker supplies malformed/untrusted input to import_reqif, potentially causing incorrect behaviour, a crash, or information disclosure", "attackVector": "local", "attackFeasibility": "medium", - "impact": {"safety": "low", "financial": "low", "operational": "medium", "privacy": "low"}, - "risk": "medium", + "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"}, + "risk": "high", "treatment": "mitigate", "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"], - "location": {"file": "cmd_req.c", "line": 655} + "location": {"file": "cmd/cfusa/cmd_req.c", "line": 655} }, { - "id": "TARA-005", + "id": "TARA-004", "asset": "Data handled by import_codebeamer_xml (cmd_req.c)", "threat": "An attacker supplies malformed/untrusted input to import_codebeamer_xml, potentially causing incorrect behaviour, a crash, or information disclosure", "attackVector": "local", "attackFeasibility": "medium", - "impact": {"safety": "low", "financial": "low", "operational": "medium", "privacy": "low"}, - "risk": "medium", + "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"}, + "risk": "high", "treatment": "mitigate", "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"], - "location": {"file": "cmd_req.c", "line": 660} + "location": {"file": "cmd/cfusa/cmd_req.c", "line": 660} }, { - "id": "TARA-006", + "id": "TARA-005", "asset": "Data handled by import_jama_xml (cmd_req.c)", "threat": "An attacker supplies malformed/untrusted input to import_jama_xml, potentially causing incorrect behaviour, a crash, or information disclosure", "attackVector": "local", "attackFeasibility": "medium", - "impact": {"safety": "low", "financial": "low", "operational": "medium", "privacy": "low"}, - "risk": "medium", - "treatment": "mitigate", - "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"], - "location": {"file": "cmd_req.c", "line": 671} - }, - { - "id": "TARA-007", - "asset": "Data handled by malloc (cmd_fix.c)", - "threat": "An attacker supplies malformed/untrusted input to malloc, potentially causing incorrect behaviour, a crash, or information disclosure", - "attackVector": "local", - "attackFeasibility": "medium", - "impact": {"safety": "high", "financial": "low", "operational": "medium", "privacy": "low"}, - "risk": "high", - "treatment": "mitigate", - "mitigations": ["Use bounds-checked copy/allocation APIs", "Add static analysis (cfusa analyze/lint) to the CI gate for this file"], - "location": {"file": "cmd_fix.c", "line": 63} - }, - { - "id": "TARA-008", - "asset": "Data handled by malloc (cmd_fix.c)", - "threat": "An attacker supplies malformed/untrusted input to malloc, potentially causing incorrect behaviour, a crash, or information disclosure", - "attackVector": "local", - "attackFeasibility": "medium", - "impact": {"safety": "high", "financial": "low", "operational": "medium", "privacy": "low"}, + "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"}, "risk": "high", "treatment": "mitigate", - "mitigations": ["Use bounds-checked copy/allocation APIs", "Add static analysis (cfusa analyze/lint) to the CI gate for this file"], - "location": {"file": "cmd_fix.c", "line": 99} + "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"], + "location": {"file": "cmd/cfusa/cmd_req.c", "line": 671} }, { - "id": "TARA-009", - "asset": "Data handled by \"strcpy (cmd_vuln.c)", - "threat": "An attacker supplies malformed/untrusted input to \"strcpy, potentially causing incorrect behaviour, a crash, or information disclosure", + "id": "TARA-006", + "asset": "Data handled by parse_sec_code (cmd_hara.c)", + "threat": "An attacker supplies malformed/untrusted input to parse_sec_code, potentially causing incorrect behaviour, a crash, or information disclosure", "attackVector": "local", "attackFeasibility": "medium", - "impact": {"safety": "high", "financial": "low", "operational": "medium", "privacy": "low"}, + "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"}, "risk": "high", "treatment": "mitigate", - "mitigations": ["Use bounds-checked copy/allocation APIs", "Add static analysis (cfusa analyze/lint) to the CI gate for this file"], - "location": {"file": "cmd_vuln.c", "line": 32} + "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"], + "location": {"file": "cmd/cfusa/cmd_hara.c", "line": 622} }, { - "id": "TARA-010", + "id": "TARA-007", "asset": "Data handled by parse_sec_code (cmd_hara.c)", "threat": "An attacker supplies malformed/untrusted input to parse_sec_code, potentially causing incorrect behaviour, a crash, or information disclosure", "attackVector": "local", "attackFeasibility": "medium", - "impact": {"safety": "low", "financial": "low", "operational": "medium", "privacy": "low"}, - "risk": "medium", + "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"}, + "risk": "high", "treatment": "mitigate", "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"], - "location": {"file": "cmd_hara.c", "line": 650} + "location": {"file": "cmd/cfusa/cmd_hara.c", "line": 677} }, { - "id": "TARA-011", + "id": "TARA-008", "asset": "Data handled by cfusa_format_parse (report.c)", "threat": "An attacker supplies malformed/untrusted input to cfusa_format_parse, potentially causing incorrect behaviour, a crash, or information disclosure", "attackVector": "local", "attackFeasibility": "medium", - "impact": {"safety": "low", "financial": "low", "operational": "medium", "privacy": "low"}, - "risk": "medium", + "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"}, + "risk": "high", "treatment": "mitigate", "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"], - "location": {"file": "report.c", "line": 137} + "location": {"file": "src/report.c", "line": 137} }, { - "id": "TARA-012", + "id": "TARA-009", "asset": "Data handled by cfusa_fopen_write (utils.c)", "threat": "An attacker supplies malformed/untrusted input to cfusa_fopen_write, potentially causing incorrect behaviour, a crash, or information disclosure", "attackVector": "local", "attackFeasibility": "medium", - "impact": {"safety": "low", "financial": "low", "operational": "medium", "privacy": "low"}, - "risk": "medium", + "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"}, + "risk": "high", "treatment": "mitigate", "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"], - "location": {"file": "utils.c", "line": 78} + "location": {"file": "src/utils.c", "line": 99} }, { - "id": "TARA-013", + "id": "TARA-010", "asset": "Data handled by cfusa_config_load (config.c)", "threat": "An attacker supplies malformed/untrusted input to cfusa_config_load, potentially causing incorrect behaviour, a crash, or information disclosure", "attackVector": "local", "attackFeasibility": "medium", - "impact": {"safety": "low", "financial": "low", "operational": "medium", "privacy": "low"}, - "risk": "medium", + "impact": {"safety": "moderate", "financial": "moderate", "operational": "major", "privacy": "moderate"}, + "risk": "high", "treatment": "mitigate", "mitigations": ["Validate file contents against an expected schema before use", "Reject unexpected file sizes/paths"], - "location": {"file": "config.c", "line": 92} + "location": {"file": "src/config.c", "line": 92} } ], "summary": { - "assetsAnalyzed": 13, "assetsInProject": 13, "coveragePct": 100, + "assetsAnalyzed": 10, "assetsInProject": 10, "coveragePct": 100, "assetInventoryMethod": "Keyword-based scan of public C function names against a network/file/auth/memory-input vocabulary; not a formal asset inventory." } } diff --git a/tara.md b/tara.md index cea9f60..7da3f4b 100644 --- a/tara.md +++ b/tara.md @@ -1,6 +1,6 @@ # Threat Analysis and Risk Assessment (TARA) ## ISO/SAE 21434:2021 Clause 15 — c-FuSa v0.5.1 -Generated: 2026-07-28T19:47:38Z +Generated: 2026-07-28T21:51:15Z Assets and threats below were discovered by a keyword-based scan of public functions handling network, file, credential, or raw-memory input (see `assetInventoryMethod` in `tara.json`) — not a formal asset inventory. @@ -8,19 +8,16 @@ Assets and threats below were discovered by a keyword-based scan of public funct | ID | Asset | Threat | Attack Vector | Feasibility | Safety | Financial | Operational | Privacy | Risk | Treatment | |---|---|---|---|---|---|---|---|---|---|---| -| TARA-001 | Data handled by "strcpy (cmd_qualify.c) | An attacker supplies malformed/untrusted input to "strcpy, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | high | low | medium | low | high | mitigate | -| TARA-002 | Data handled by import_reqif (cmd_req.c) | An attacker supplies malformed/untrusted input to import_reqif, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | low | low | medium | low | medium | mitigate | -| TARA-003 | Data handled by import_polarion_xml (cmd_req.c) | An attacker supplies malformed/untrusted input to import_polarion_xml, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | low | low | medium | low | medium | mitigate | -| TARA-004 | Data handled by import_reqif (cmd_req.c) | An attacker supplies malformed/untrusted input to import_reqif, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | low | low | medium | low | medium | mitigate | -| TARA-005 | Data handled by import_codebeamer_xml (cmd_req.c) | An attacker supplies malformed/untrusted input to import_codebeamer_xml, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | low | low | medium | low | medium | mitigate | -| TARA-006 | Data handled by import_jama_xml (cmd_req.c) | An attacker supplies malformed/untrusted input to import_jama_xml, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | low | low | medium | low | medium | mitigate | -| TARA-007 | Data handled by malloc (cmd_fix.c) | An attacker supplies malformed/untrusted input to malloc, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | high | low | medium | low | high | mitigate | -| TARA-008 | Data handled by malloc (cmd_fix.c) | An attacker supplies malformed/untrusted input to malloc, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | high | low | medium | low | high | mitigate | -| TARA-009 | Data handled by "strcpy (cmd_vuln.c) | An attacker supplies malformed/untrusted input to "strcpy, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | high | low | medium | low | high | mitigate | -| TARA-010 | Data handled by parse_sec_code (cmd_hara.c) | An attacker supplies malformed/untrusted input to parse_sec_code, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | low | low | medium | low | medium | mitigate | -| TARA-011 | Data handled by cfusa_format_parse (report.c) | An attacker supplies malformed/untrusted input to cfusa_format_parse, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | low | low | medium | low | medium | mitigate | -| TARA-012 | Data handled by cfusa_fopen_write (utils.c) | An attacker supplies malformed/untrusted input to cfusa_fopen_write, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | low | low | medium | low | medium | mitigate | -| TARA-013 | Data handled by cfusa_config_load (config.c) | An attacker supplies malformed/untrusted input to cfusa_config_load, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | low | low | medium | low | medium | mitigate | +| TARA-001 | Data handled by import_reqif (cmd_req.c) | An attacker supplies malformed/untrusted input to import_reqif, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | moderate | moderate | major | moderate | high | mitigate | +| TARA-002 | Data handled by import_polarion_xml (cmd_req.c) | An attacker supplies malformed/untrusted input to import_polarion_xml, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | moderate | moderate | major | moderate | high | mitigate | +| TARA-003 | Data handled by import_reqif (cmd_req.c) | An attacker supplies malformed/untrusted input to import_reqif, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | moderate | moderate | major | moderate | high | mitigate | +| TARA-004 | Data handled by import_codebeamer_xml (cmd_req.c) | An attacker supplies malformed/untrusted input to import_codebeamer_xml, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | moderate | moderate | major | moderate | high | mitigate | +| TARA-005 | Data handled by import_jama_xml (cmd_req.c) | An attacker supplies malformed/untrusted input to import_jama_xml, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | moderate | moderate | major | moderate | high | mitigate | +| TARA-006 | Data handled by parse_sec_code (cmd_hara.c) | An attacker supplies malformed/untrusted input to parse_sec_code, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | moderate | moderate | major | moderate | high | mitigate | +| TARA-007 | Data handled by parse_sec_code (cmd_hara.c) | An attacker supplies malformed/untrusted input to parse_sec_code, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | moderate | moderate | major | moderate | high | mitigate | +| TARA-008 | Data handled by cfusa_format_parse (report.c) | An attacker supplies malformed/untrusted input to cfusa_format_parse, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | moderate | moderate | major | moderate | high | mitigate | +| TARA-009 | Data handled by cfusa_fopen_write (utils.c) | An attacker supplies malformed/untrusted input to cfusa_fopen_write, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | moderate | moderate | major | moderate | high | mitigate | +| TARA-010 | Data handled by cfusa_config_load (config.c) | An attacker supplies malformed/untrusted input to cfusa_config_load, potentially causing incorrect behaviour, a crash, or information disclosure | local | medium | moderate | moderate | major | moderate | high | mitigate | --- -_Total assets analysed: 13 (100% of 13 discovered by the scan)_ +_Total assets analysed: 10 (100% of 10 discovered by the scan)_ diff --git a/tests/test_safety_rules.c b/tests/test_safety_rules.c index d8059fc..21c1b83 100644 --- a/tests/test_safety_rules.c +++ b/tests/test_safety_rules.c @@ -13,10 +13,10 @@ #include "cfusa/report.h" #include "cfusa/config.h" -//cfusa:req REQ-HARA001 REQ-HARA002 REQ-HARA003 REQ-HARA004 REQ-HARA005 +//cfusa:req REQ-HARA001 REQ-HARA002 REQ-HARA003 REQ-HARA004 REQ-HARA005 REQ-HARA010 //cfusa:req REQ-COUPLING001 REQ-COUPLING002 REQ-COUPLING003 //cfusa:req REQ-DISP001 REQ-COMP001 -//cfusa:test REQ-HARA001 REQ-HARA002 REQ-HARA003 REQ-HARA004 REQ-HARA005 +//cfusa:test REQ-HARA001 REQ-HARA002 REQ-HARA003 REQ-HARA004 REQ-HARA005 REQ-HARA010 //cfusa:test REQ-COUPLING001 REQ-COUPLING002 REQ-COUPLING003 //cfusa:test REQ-DISP001 REQ-COMP001 @@ -185,6 +185,64 @@ void test_hara004_fires_on_tbd_asil(void) rm_file(".fusa-hara.json"); } +/* ── HARA006 ────────────────────────────────────────────────────────── */ + +void test_hara006_fires_on_asil_mismatch(void) +{ + /* S3/E4/C2 derives to ASIL-D per ISO 26262-3 Table 4 — stored ASIL-A + * is wrong and must be caught even though it's a well-formed value + * (not TBD/empty, so HARA004 alone would not catch it). */ + make_file(".fusa-hara.json", + "{\"operationalSituations\":[]," + "\"hazards\":[{\"id\":\"H-9\",\"description\":\"Test hazard\"," + "\"risk\":{\"severity\":\"S3\",\"exposure\":\"E4\",\"controllability\":\"C2\"," + "\"asil\":\"ASIL-A\"},\"safetyGoals\":[\"SG-1\"]}]," + "\"safetyGoals\":[{\"id\":\"SG-1\",\"description\":\"Goal\"," + "\"asil\":\"ASIL-A\",\"safeState\":\"Safe\",\"fssrRefs\":[\"REQ-1\"]}]}"); + + cfusa_engine_reset(); + cfusa_safety_register_rules(); + + cfusa_config_t cfg; cfusa_config_load(SR_DIR, &cfg); + cfusa_report_t rpt; cfusa_report_init(&rpt); + + int count = cfusa_engine_rule_count(); + for (int i = 0; i < count; i++) { + const cfusa_rule_t *r = cfusa_engine_get_rule(i); + if (strcmp(r->id, "HARA006") == 0) r->run(SR_DIR, &cfg, &rpt); + } + TEST_ASSERT_TRUE(rpt.error_count > 0); + cfusa_report_free(&rpt); + rm_file(".fusa-hara.json"); +} + +void test_hara006_passes_when_asil_matches(void) +{ + /* S3/E4/C2 correctly stored as ASIL-D. */ + make_file(".fusa-hara.json", + "{\"operationalSituations\":[]," + "\"hazards\":[{\"id\":\"H-10\",\"description\":\"Test hazard\"," + "\"risk\":{\"severity\":\"S3\",\"exposure\":\"E4\",\"controllability\":\"C2\"," + "\"asil\":\"ASIL-D\"},\"safetyGoals\":[\"SG-1\"]}]," + "\"safetyGoals\":[{\"id\":\"SG-1\",\"description\":\"Goal\"," + "\"asil\":\"ASIL-D\",\"safeState\":\"Safe\",\"fssrRefs\":[\"REQ-1\"]}]}"); + + cfusa_engine_reset(); + cfusa_safety_register_rules(); + + cfusa_config_t cfg; cfusa_config_load(SR_DIR, &cfg); + cfusa_report_t rpt; cfusa_report_init(&rpt); + + int count = cfusa_engine_rule_count(); + for (int i = 0; i < count; i++) { + const cfusa_rule_t *r = cfusa_engine_get_rule(i); + if (strcmp(r->id, "HARA006") == 0) r->run(SR_DIR, &cfg, &rpt); + } + TEST_ASSERT_EQUAL_INT(0, rpt.error_count); + cfusa_report_free(&rpt); + rm_file(".fusa-hara.json"); +} + /* ── ISO26262001 ────────────────────────────────────────────────────── */ void test_iso26262001_fires_when_no_report(void) @@ -375,6 +433,8 @@ int main(void) RUN_TEST(test_hara002_fires_on_incomplete_rating); RUN_TEST(test_hara003_fires_when_no_safety_goal); RUN_TEST(test_hara004_fires_on_tbd_asil); + RUN_TEST(test_hara006_fires_on_asil_mismatch); + RUN_TEST(test_hara006_passes_when_asil_matches); /* ISO 26262 rules */ RUN_TEST(test_iso26262001_fires_when_no_report); RUN_TEST(test_iso26262001_passes_when_report_present); diff --git a/tests/test_xfusa_v114.c b/tests/test_xfusa_v114.c index e139217..cd43829 100644 --- a/tests/test_xfusa_v114.c +++ b/tests/test_xfusa_v114.c @@ -1,14 +1,20 @@ /* - * Tests for x-FuSa spec v1.13.0/v1.14.0 conformance: + * Tests for x-FuSa spec v1.13.0/v1.14.0/v1.15.0 conformance: * - qualitybar (FUSA-STUB001/FUSA-STUB002 detection + attestation) * - hara/fmea/tara/safety-case/sas/sci schema conformance * - summary.coveragePct + --min-coverage (fmea/tara) * - --strict/--require-attestation gating + * - v1.15.0: hara attestation/cross-reference passthrough (§9.2), + * canonical `standard` ids + TARA closed impact/risk enums (§2.4.1/§9.2), + * project-relative file paths that exclude stdlib calls and + * string-literal text (§4/§1.6 rule 4), fmea --output, and + * summary.coveragePct <= 100 with a non-trivial test-source tree */ #include #include #include #include +#include #include "../vendor/unity/unity.h" #include "cfusa/qualitybar.h" #include "cfusa/utils.h" @@ -271,6 +277,56 @@ void test_hara_show_text_detects_placeholder(void) (void)remove(path); } +/* x-FuSa spec v1.15.0 / §9.2: `hara --format json` MUST be a verbatim + * passthrough of .fusa-hara.json's own §1.2.5 shape (source/situations/ + * safetyGoals per hazard, hazards/safeState per safety goal) plus a + * passthrough `attestation`, and completeness MUST surface an ASIL + * mismatch, not just leave it as a text-mode-only warning. */ +//cfusa:req REQ-HARA-SCHEMA004 +//cfusa:test REQ-HARA-SCHEMA004 +void test_hara_show_json_passes_through_cross_refs_and_attestation(void) +{ + write_file(".fusa-hara.json", + "{\"project\":\"p\",\"standard\":\"iso26262\",\"operationalSituations\":" + "[{\"id\":\"OS-1\",\"description\":\"Highway driving at speed\"}]," + "\"hazards\":[{\"id\":\"H-1\",\"description\":\"Unintended acceleration\"," + "\"source\":\"design review\",\"situations\":[\"OS-1\"]," + "\"risk\":{\"severity\":\"S3\",\"exposure\":\"E3\",\"controllability\":\"C2\"," + "\"asil\":\"ASIL-A\"},\"safetyGoals\":[\"SG-1\"]}]," + "\"safetyGoals\":[{\"id\":\"SG-1\",\"description\":\"Prevent unintended accel\"," + "\"hazards\":[\"H-1\"],\"asil\":\"ASIL-A\",\"safeState\":\"Engine off\"," + "\"fssrRefs\":[\"REQ-1\"]}]," + "\"attestation\":{\"status\":\"reviewed\",\"implementationAuthor\":\"auto\"," + "\"independentReviewer\":\"Jane Doe\",\"reviewedAt\":\"2026-01-01T00:00:00Z\"," + "\"contentHash\":\"sha256:deadbeef\"}}"); + + /* --output so we can inspect the JSON body directly (not stdout). */ + char out[512]; snprintf(out, sizeof(out), "%s/hara_passthrough.json", V114_DIR); + char *argv2[] = {"cfusa", "show", "--dir", V114_DIR, "--format", "json", + "--output", out, NULL}; + cmd_hara(8, argv2); + + FILE *f = fopen(out, "r"); + TEST_ASSERT_NOT_NULL(f); + char jbuf[16384]; + size_t n = fread(jbuf, 1, sizeof(jbuf) - 1, f); + jbuf[n] = '\0'; + fclose(f); + + TEST_ASSERT_NOT_NULL(strstr(jbuf, "\"source\": \"design review\"")); + TEST_ASSERT_NOT_NULL(strstr(jbuf, "\"situations\": [\"OS-1\"]")); + TEST_ASSERT_NOT_NULL(strstr(jbuf, "\"safetyGoals\": [\"SG-1\"]")); + TEST_ASSERT_NOT_NULL(strstr(jbuf, "\"hazards\": [\"H-1\"]")); + TEST_ASSERT_NOT_NULL(strstr(jbuf, "\"safeState\": \"Engine off\"")); + TEST_ASSERT_NOT_NULL(strstr(jbuf, "\"independentReviewer\": \"Jane Doe\"")); + /* S3/E3/C2 derives to ASIL-C, not the stored ASIL-A. */ + TEST_ASSERT_NOT_NULL(strstr(jbuf, "\"asilMismatches\": 1")); + + remove(out); + char path[512]; snprintf(path, sizeof(path), "%s/.fusa-hara.json", V114_DIR); + (void)remove(path); +} + /* ================================================================== */ /* fmea schema conformance + coverage + attestation */ /* ================================================================== */ @@ -364,6 +420,171 @@ void test_fmea_attest_flag_stamps_attestation(void) char p2[512]; snprintf(p2, sizeof(p2), "%s/fmea.json", V114_DIR); remove(p2); } +/* x-FuSa spec §2.4.1: `standard` is a canonical lowercase id, never a + * display string. */ +//cfusa:req REQ-FMEA-SCHEMA003 +//cfusa:test REQ-FMEA-SCHEMA003 +void test_fmea_standard_is_canonical_id(void) +{ + write_fmea_source(2); + char *argv[] = {"cfusa", "--dir", V114_DIR, "--format", "json", NULL}; + cmd_fmea(5, argv); + + size_t len; + char *buf = slurp("fmea.json", &len); + TEST_ASSERT_NOT_NULL(buf); + TEST_ASSERT_NOT_NULL(strstr(buf, "\"standard\": \"iso26262\"")); + TEST_ASSERT_NULL(strstr(buf, "IEC 60812")); + + char p1[512]; snprintf(p1, sizeof(p1), "%s/fmea_v114_src.c", V114_DIR); remove(p1); + char p2[512]; snprintf(p2, sizeof(p2), "%s/fmea.json", V114_DIR); remove(p2); +} + +/* x-FuSa spec §4: entries[].file MUST be project-relative — including the + * subdirectory, not truncated to a bare basename — regardless of whether + * --dir is given relative or absolute. */ +//cfusa:req REQ-FMEA-SCHEMA004 +//cfusa:test REQ-FMEA-SCHEMA004 +void test_fmea_file_field_is_project_relative_with_subdir(void) +{ + char subdir[512]; snprintf(subdir, sizeof(subdir), "%s/sub", V114_DIR); + mkdir(subdir, 0700); + char srcpath[512]; snprintf(srcpath, sizeof(srcpath), "%s/nested.c", subdir); + FILE *f = cfusa_fopen_write(srcpath); + TEST_ASSERT_NOT_NULL(f); + fprintf(f, "int handle_request(int x)\n{\n return x;\n}\n"); + fclose(f); + + /* Relative --dir: the "file" field must include the subdirectory, not + * be truncated to a bare basename. */ + char *argv[] = {"cfusa", "--dir", V114_DIR, "--format", "json", NULL}; + cmd_fmea(5, argv); + size_t len; char *buf = slurp("fmea.json", &len); + TEST_ASSERT_NOT_NULL(buf); + TEST_ASSERT_NOT_NULL(strstr(buf, "\"file\": \"sub/nested.c\"")); + TEST_ASSERT_NULL(strstr(buf, "\"file\": \"nested.c\"")); + + remove(srcpath); + (void)rmdir(subdir); + char p2[512]; snprintf(p2, sizeof(p2), "%s/fmea.json", V114_DIR); remove(p2); +} + +/* x-FuSa spec §1.6 rule 4: a call to a standard-library function is not a + * project component, and a `(` found inside a string literal (a test-case + * description, not real code) must not be mistaken for a call site. */ +//cfusa:req REQ-FMEA-SCHEMA005 +//cfusa:test REQ-FMEA-SCHEMA005 +void test_fmea_skips_stdlib_calls_and_string_literal_parens(void) +{ + char srcpath[512]; snprintf(srcpath, sizeof(srcpath), "%s/stub_src.c", V114_DIR); + FILE *f = cfusa_fopen_write(srcpath); + TEST_ASSERT_NOT_NULL(f); + fprintf(f, + "int real_project_fn(int x)\n{\n return x;\n}\n\n" + "void user_of_stdlib(char *buf, size_t n)\n" + "{\n" + " snprintf(buf, n,\n" + " \"some multi-line format\");\n" + " fprintf(stderr, \"error\\n\");\n" + "}\n\n" + "static const struct { const char *desc; } CASES[] = {\n" + " {\"strcpy fires\"},\n" + "};\n"); + fclose(f); + + char *argv[] = {"cfusa", "--dir", V114_DIR, "--format", "json", NULL}; + cmd_fmea(5, argv); + size_t len; char *buf = slurp("fmea.json", &len); + TEST_ASSERT_NOT_NULL(buf); + + TEST_ASSERT_NOT_NULL(strstr(buf, "\"item\": \"real_project_fn\"")); + TEST_ASSERT_NOT_NULL(strstr(buf, "\"item\": \"user_of_stdlib\"")); + /* Neither the stdlib calls nor the string-literal-embedded "strcpy" + * text should appear as an `item`. */ + TEST_ASSERT_NULL(strstr(buf, "\"item\": \"snprintf\"")); + TEST_ASSERT_NULL(strstr(buf, "\"item\": \"fprintf\"")); + TEST_ASSERT_NULL(strstr(buf, "strcpy")); + + remove(srcpath); + char p2[512]; snprintf(p2, sizeof(p2), "%s/fmea.json", V114_DIR); remove(p2); +} + +/* x-FuSa spec §9.2: `fmea --output ` writes exactly that path, + * distinct from --output-dir (GitHub issue: getopt_long's unambiguous- + * prefix matching previously silently treated --output as an abbreviation + * of --output-dir since fmea defined no --output long option at all). */ +//cfusa:req REQ-FMEA-OUTPUT001 +//cfusa:test REQ-FMEA-OUTPUT001 +void test_fmea_output_flag_writes_exact_path(void) +{ + write_fmea_source(2); + char out[512]; snprintf(out, sizeof(out), "%s/fmea_direct.json", V114_DIR); + char *argv[] = {"cfusa", "--dir", V114_DIR, "--format", "json", "--output", out, NULL}; + int rc = cmd_fmea(7, argv); + TEST_ASSERT_EQUAL(0, rc); + + FILE *f = fopen(out, "r"); + TEST_ASSERT_NOT_NULL(f); + if (f) fclose(f); + + /* --output alone (no --format) must default to JSON, not silently + * misbehave the way the previously-missing long option did. */ + char out2[512]; snprintf(out2, sizeof(out2), "%s/fmea_direct2.json", V114_DIR); + char *argv2[] = {"cfusa", "--dir", V114_DIR, "--output", out2, NULL}; + int rc2 = cmd_fmea(5, argv2); + TEST_ASSERT_EQUAL(0, rc2); + FILE *f2 = fopen(out2, "r"); + TEST_ASSERT_NOT_NULL(f2); + if (f2) { + char buf[64] = ""; + size_t n = fread(buf, 1, sizeof(buf) - 1, f2); + buf[n] = '\0'; + TEST_ASSERT_NOT_NULL(strstr(buf, "schemaVersion")); + fclose(f2); + } + + remove(out); remove(out2); + char p1[512]; snprintf(p1, sizeof(p1), "%s/fmea_v114_src.c", V114_DIR); remove(p1); +} + +/* x-FuSa spec §9.2: summary.coveragePct MUST NOT exceed 100. A fixture with + * only project source can never exercise this (there's no denominator to + * overcount against) — the regression needs a non-trivial test-source tree + * alongside real project source, per the spec's own implementation note. */ +//cfusa:req REQ-FMEA-COV002 +//cfusa:test REQ-FMEA-COV002 +void test_fmea_coveragepct_never_exceeds_100_with_test_tree(void) +{ + write_fmea_source(3); + /* A test-source file (test_ prefix) is excluded from both the + * numerator and denominator — its own functions must never leak into + * componentsInProject regardless of how many "real-looking" function + * definitions it contains. */ + char testpath[512]; snprintf(testpath, sizeof(testpath), "%s/test_fmea_v114.c", V114_DIR); + FILE *f = cfusa_fopen_write(testpath); + TEST_ASSERT_NOT_NULL(f); + for (int i = 0; i < 20; i++) + fprintf(f, "void test_case_%d(void)\n{\n}\n\n", i); + fclose(f); + + char *argv[] = {"cfusa", "--dir", V114_DIR, "--format", "json", NULL}; + int rc = cmd_fmea(5, argv); + TEST_ASSERT_EQUAL(0, rc); + + size_t len; char *buf = slurp("fmea.json", &len); + TEST_ASSERT_NOT_NULL(buf); + TEST_ASSERT_NULL(strstr(buf, "\"coveragePct\": 101")); + /* Cheap structural check that coveragePct is a plausible 0-100 value + * and the test-tree functions were not folded into the count. */ + TEST_ASSERT_NOT_NULL(strstr(buf, "\"componentsAnalyzed\": 3, \"componentsInProject\": 3")); + TEST_ASSERT_NOT_NULL(strstr(buf, "\"coveragePct\": 100")); + TEST_ASSERT_NULL(strstr(buf, "test_case_")); + + remove(testpath); + char p1[512]; snprintf(p1, sizeof(p1), "%s/fmea_v114_src.c", V114_DIR); remove(p1); + char p2[512]; snprintf(p2, sizeof(p2), "%s/fmea.json", V114_DIR); remove(p2); +} + /* ================================================================== */ /* tara schema conformance (SFOP impact) */ /* ================================================================== */ @@ -408,6 +629,115 @@ void test_tara_json_has_sfop_impact(void) char p3[512]; snprintf(p3, sizeof(p3), "%s/tara.md", V114_DIR); remove(p3); } +/* x-FuSa spec §2.4.1/§9.2 (v1.14.1 closed enums, clarified by the same-day + * v1.15.0 audit): `standard` is the canonical lowercase id, and + * impact.{safety,financial,operational,privacy} MUST use + * critical|major|moderate|negligible — never high|medium|low, which is a + * distinct scale reserved for attackFeasibility. `risk` MUST be derived + * from the spec's combination table, not an ad hoc score. */ +//cfusa:req REQ-TARA-SCHEMA002 +//cfusa:test REQ-TARA-SCHEMA002 +void test_tara_standard_id_and_closed_impact_enum(void) +{ + write_tara_source(); + char *argv[] = {"cfusa", "--dir", V114_DIR, "--format", "json", NULL}; + cmd_tara(5, argv); + + size_t len; char *buf = slurp("tara.json", &len); + TEST_ASSERT_NOT_NULL(buf); + TEST_ASSERT_NOT_NULL(strstr(buf, "\"standard\": \"iso21434\"")); + TEST_ASSERT_NULL(strstr(buf, "ISO/SAE 21434:2021 Clause 15\",")); + + /* Every impact.* value must be one of the four closed-enum members — + * spot-check that none of the old high|medium|low vocabulary leaked + * into a `impact` object (attackFeasibility legitimately uses "medium" + * elsewhere in the same document, so this checks specifically inside + * an "impact": {...} block). */ + const char *imp = strstr(buf, "\"impact\": {"); + TEST_ASSERT_NOT_NULL(imp); + const char *imp_end = strchr(imp, '}'); + TEST_ASSERT_NOT_NULL(imp_end); + char block[512] = ""; + size_t blen = (size_t)(imp_end - imp); + if (blen < sizeof(block)) { memcpy(block, imp, blen); block[blen] = '\0'; } + TEST_ASSERT_NULL(strstr(block, "\"high\"")); + TEST_ASSERT_NULL(strstr(block, "\"medium\"")); + TEST_ASSERT_NULL(strstr(block, "\"low\"")); + + char p1[512]; snprintf(p1, sizeof(p1), "%s/tara_v114_src.c", V114_DIR); remove(p1); + char p2[512]; snprintf(p2, sizeof(p2), "%s/tara.json", V114_DIR); remove(p2); + char p3[512]; snprintf(p3, sizeof(p3), "%s/tara.md", V114_DIR); remove(p3); +} + +/* x-FuSa spec §9.2: threats[].location.file MUST be project-relative + * (including subdirectory), and a call to a standard-library function + * (e.g. strcpy/memcpy themselves) MUST NOT be emitted as the asset/item — + * §1.6 rule 4 applies to tara's asset scanner the same way it does to + * fmea's. */ +//cfusa:req REQ-TARA-SCHEMA003 +//cfusa:test REQ-TARA-SCHEMA003 +void test_tara_location_relative_and_skips_stdlib_calls(void) +{ + char subdir[512]; snprintf(subdir, sizeof(subdir), "%s/sub", V114_DIR); + mkdir(subdir, 0700); + char srcpath[512]; snprintf(srcpath, sizeof(srcpath), "%s/nested_asset.c", subdir); + FILE *f = cfusa_fopen_write(srcpath); + TEST_ASSERT_NOT_NULL(f); + fprintf(f, + "int recv_data(int fd, char *buf, int n)\n" + "{\n" + " return fd + n + (int)(long)buf;\n" + "}\n\n" + "void raw_stdlib_only(char *dst, const char *src)\n" + "{\n" + " memcpy(dst, src,\n" + " 128);\n" + "}\n"); + fclose(f); + + char *argv[] = {"cfusa", "--dir", V114_DIR, "--format", "json", NULL}; + cmd_tara(5, argv); + + size_t len; char *buf = slurp("tara.json", &len); + TEST_ASSERT_NOT_NULL(buf); + TEST_ASSERT_NOT_NULL(strstr(buf, "\"file\": \"sub/nested_asset.c\"")); + TEST_ASSERT_NULL(strstr(buf, "\"asset\": \"Data handled by memcpy")); + + remove(srcpath); + (void)rmdir(subdir); + char p2[512]; snprintf(p2, sizeof(p2), "%s/tara.json", V114_DIR); remove(p2); + char p3[512]; snprintf(p3, sizeof(p3), "%s/tara.md", V114_DIR); remove(p3); +} + +/* x-FuSa spec §9.2: summary.coveragePct MUST NOT exceed 100, exercised with + * a non-trivial test-source tree alongside real project source. */ +//cfusa:req REQ-TARA-COV001 +//cfusa:test REQ-TARA-COV001 +void test_tara_coveragepct_never_exceeds_100_with_test_tree(void) +{ + write_tara_source(); + char testpath[512]; snprintf(testpath, sizeof(testpath), "%s/test_tara_v114.c", V114_DIR); + FILE *f = cfusa_fopen_write(testpath); + TEST_ASSERT_NOT_NULL(f); + for (int i = 0; i < 15; i++) + fprintf(f, "int test_recv_packet_%d(int fd)\n{\n return fd;\n}\n\n", i); + fclose(f); + + char *argv[] = {"cfusa", "--dir", V114_DIR, "--format", "json", NULL}; + int rc = cmd_tara(5, argv); + TEST_ASSERT_EQUAL(0, rc); + + size_t len; char *buf = slurp("tara.json", &len); + TEST_ASSERT_NOT_NULL(buf); + TEST_ASSERT_NULL(strstr(buf, "\"coveragePct\": 101")); + TEST_ASSERT_NULL(strstr(buf, "test_recv_packet_")); + + remove(testpath); + char p1[512]; snprintf(p1, sizeof(p1), "%s/tara_v114_src.c", V114_DIR); remove(p1); + char p2[512]; snprintf(p2, sizeof(p2), "%s/tara.json", V114_DIR); remove(p2); + char p3[512]; snprintf(p3, sizeof(p3), "%s/tara.md", V114_DIR); remove(p3); +} + /* ================================================================== */ /* safety-case GSN schema */ /* ================================================================== */ @@ -495,6 +825,41 @@ void test_sci_json_hash_field_is_prefixed(void) remove(srcpath); } +/* x-FuSa spec §4: artifacts[].file MUST be project-relative even when --dir + * is given as an absolute path (V114_DIR itself is already absolute — on + * macOS /tmp is a symlink to /private/tmp, so this also exercises the + * "don't resolve symlinks before relativizing" fix). */ +//cfusa:req REQ-SCI-SCHEMA002 +//cfusa:test REQ-SCI-SCHEMA002 +void test_sci_json_file_field_is_project_relative(void) +{ + char subdir[512]; snprintf(subdir, sizeof(subdir), "%s/sub", V114_DIR); + mkdir(subdir, 0700); + char srcpath[512]; snprintf(srcpath, sizeof(srcpath), "%s/nested_sci.c", subdir); + FILE *f = cfusa_fopen_write(srcpath); + TEST_ASSERT_NOT_NULL(f); + fprintf(f, "int sci_nested_probe(void) { return 0; }\n"); + fclose(f); + + char out[512]; snprintf(out, sizeof(out), "%s/sci_rel.json", V114_DIR); + char *argv[] = {"cfusa", "--dir", V114_DIR, "--format", "json", "--output", out, NULL}; + int rc = cmd_sci(7, argv); + TEST_ASSERT_EQUAL(0, rc); + + FILE *rf = fopen(out, "r"); + TEST_ASSERT_NOT_NULL(rf); + char buf[16384]; + size_t n = fread(buf, 1, sizeof(buf) - 1, rf); + buf[n] = '\0'; + fclose(rf); + TEST_ASSERT_NOT_NULL(strstr(buf, "\"file\": \"sub/nested_sci.c\"")); + TEST_ASSERT_NULL(strstr(buf, V114_DIR)); + + remove(out); + remove(srcpath); + (void)rmdir(subdir); +} + int main(void) { UNITY_BEGIN(); @@ -515,19 +880,29 @@ int main(void) RUN_TEST(test_hara_init_scaffold_has_three_empty_collections); RUN_TEST(test_hara_show_json_reports_fssr_gap); RUN_TEST(test_hara_show_text_detects_placeholder); + RUN_TEST(test_hara_show_json_passes_through_cross_refs_and_attestation); RUN_TEST(test_fmea_json_has_ratingscale_and_summary); RUN_TEST(test_fmea_failure_mode_varies_per_function); RUN_TEST(test_fmea_min_coverage_gate); RUN_TEST(test_fmea_attest_flag_stamps_attestation); + RUN_TEST(test_fmea_standard_is_canonical_id); + RUN_TEST(test_fmea_file_field_is_project_relative_with_subdir); + RUN_TEST(test_fmea_skips_stdlib_calls_and_string_literal_parens); + RUN_TEST(test_fmea_output_flag_writes_exact_path); + RUN_TEST(test_fmea_coveragepct_never_exceeds_100_with_test_tree); RUN_TEST(test_tara_json_has_sfop_impact); + RUN_TEST(test_tara_standard_id_and_closed_impact_enum); + RUN_TEST(test_tara_location_relative_and_skips_stdlib_calls); + RUN_TEST(test_tara_coveragepct_never_exceeds_100_with_test_tree); RUN_TEST(test_safety_case_json_has_gsn_node_types); RUN_TEST(test_sas_json_has_checklist_and_summary); RUN_TEST(test_sci_json_hash_field_is_prefixed); + RUN_TEST(test_sci_json_file_field_is_project_relative); return UNITY_END(); }