List of potential checkers
This page contains a list of potential checkers to implement in the static analyzer. If you are interested in contributing to the analyzer's development, this is a good resource to help you get started. The specific names of the checkers are subject to review, and are provided here as suggestions.
memory
| Name, Description | Example | Progress |
memory.LeakEvalOrder
(C, C++)
Potential memory leaks caused by an undefined argument evaluation order.
Source: boost docs: shared_ptr. |
void f(int, int);
int g(void *);
int h() __attribute__((noreturn));
void test() {
// It is possible that 'malloc(1)' is called first,
// then 'h()', that is (or calls) noreturn and eventually
// 'g()' is never called.
f(g(malloc(1)), h()); // warn: 'g()' may never be called.
}
void f(int, int);
int g(int *);
int h() { throw 1; };
void test() {
// It is possible that 'new int' is called first,
// then 'h()', that throws an exception and eventually
// 'g()' is never called.
f(g(new int), h()); // warn: 'g()' may never be called.
}
|
|
memory.DstBufferTooSmall
(C, C++)
Destination buffer passed to memory function is too small.
Note: security.insecureAPI.strcpy currently warns on usage of strcpy and suggests to replace it.
Note: alpha.unix.CStringChecker contains some similar checks. Source: CWE-120. |
void test() {
const char* s1 = "abc";
char *s2 = new char;
strcpy(s2, s1); // warn
}
void test() {
int* p1 = new int[3];
int* p2 = new int;
memcpy(p2, p1, 3); // warn
}
|
|
memory.NegativeArraySize
(C, C++)
'n' is used to specify the buffer size may be negative.
Note: possibly an enhancement to alpha.security.MallocOverflow. Source: CWE-20, Example 2. |
void test() {
int *p;
int n1 = -1;
p = new int[n1]; // warn
}
|
|
memory.ZeroAlloc
(C, C++)
Allocation of zero bytes.
Note: an enhancement to unix.Malloc. Note: unix.API perform C-checks for zero allocation. This should be moved to unix.Malloc. Source: C++03 3.7.3.1p2; C++11 3.7.4.1p2. |
#include <stdlib.h>
void test() {
int *p = malloc(0); // warn
free(p);
}
void test() {
int *p = new int[0]; // warn
delete[] p;
}
|
D6178 |
constructors/destructors
| Name, Description | Example | Progress |
ctordtor.ExptInsideDtor
(C++)
It is dangerous to let an exception leave a destructor.
Using try..catch solves the problem.
Source: Scott Meyers "More Effective C++", item 11: Prevent exceptions from leaving destructors. |
class A {
A() {}
~A() { throw 1; } // warn
};
void f() throw(int);
class A {
A() {}
~A() { f(); } // warn
};
|
|
ctordtor.PlacementSelfCopy
(C++11)
For a placement copy or move, it is almost certainly an error if the
constructed object is also the object being copied from. |
class A {};
void test(A *dst, A *src) {
::new (dst) A(*dst); // warn (should be 'src')
}
|
va_list
| Name, Description | Example | Progress |
valist.Uninitialized
(C)
Calls to the va_arg, va_copy, or
va_end macro must happen after calling va_start and
before calling va_end. |
#include <stdarg.h>
void test(int x, ...) {
va_list args;
int y = va_arg(args, int); // warn
}
#include <stdarg.h>
void test(int x, ...) {
va_list args;
va_start(args, x);
va_end(args);
int z = va_arg(args, int); // warn
}
|
PR16811 |
valist.Unterminated
(C)
Every va_start must be matched by a va_end. A va_list
can only be ended once.
This should be folded into the generalized "ownership checker"
described on the
Open Projects page. |
#include <stdarg.h>
void test(int x, ...) {
va_list args;
va_start(args, x);
int y = x + va_arg(args, int);
} // warn: missing va_end
|
PR16812 |
exceptions
| Name, Description | Example | Progress |
exceptions.ThrowSpecButNotThrow
(C++)
Function declaration has a throw(type) specifier but the
function do not throw exceptions. |
void test() throw(int) {
} // warn
|
|
exceptions.NoThrowSpecButThrows
(C++)
An exception is throw from a function having a throw()
specifier. |
void test() throw() {
throw(1); // warn
}
|
|
exceptions.ThrownTypeDiffersSpec
(C++)
The type of a thrown exception differs from those specified in
a throw(type) specifier. |
struct S{};
void test() throw(int) {
S s;
throw (s); // warn
}
|
smart pointers
| Name, Description | Example | Progress |
smartptr.SmartPtrInit
(C++)
C++03: auto_ptr should store a pointer to an object obtained via
new as allocated memory will be cleaned using delete.C++11: one should use unique_ptr<type[]> to keep a
pointer to memory allocated by new[].C++11: to keep a pointer to memory allocated by new[] in
a shared_ptr one should use a custom deleter that calls
delete[]..
Source: C++03 20.4.5p1; C++11 |
#include <stdlib.h>
#include <memory>
void test() {
std::auto_ptr<int> p1(new int); // Ok
std::auto_ptr<int> p2(new int[3]); // warn
}
#include <stdlib.h>
#include <memory>
void test() {
std::auto_ptr<int> p((int *)malloc(sizeof(int))); // warn
}
|
dead code
| Name, Description | Example | Progress |
deadcode.UnmodifiedVariable
(C, C++)
A variable is never modified but was not declared const and is not a
reference. (opt-in checker) |
extern int computeDelta();
int test(bool cond) {
int i = 0;
if (cond) {
const int delta = computeDelta();
// warn: forgot to modify 'i'
}
return i;
}
|
PR16890 |
deadcode.IdempotentOperations
(C)
Warn about idempotent operations. |
void test() {
int x = 7;
x = x; // warn: value is always the same
}
void test() {
int x = 7;
x /= x; // warn: value is always 1
}
void test() {
int x = 7, one = 1;
x *= one; // warn: right op is always 1
}
void test() {
int x = 7, zero = 0;
x = x - zero;
// warn: the right operand to '-' is always 0
}
|
removed from alpha.deadcode.* at r198476 |
POSIX
| Name, Description | Example | Progress |
posix.Errno
(C)
Record that errno is non-zero when certain functions
fail. |
#include <stdlib.h>
int readWrapper(int fd, int *count) {
int lcount = read(fd, globalBuf, sizeof(globalBuf));
if (lcount < 0)
return errno;
*count = lcount;
return 0;
}
void use(int fd) {
int count;
if (!readWrapper(fd, &count))
print("%d", count); // should not warn
}
|
PR18701 |
undefined behavior
| Name, Description | Example | Progress |
undefbehavior.ExitInDtor
(C++)
Undefined behavior: std::exit() is called to end the program during
the destruction of an object with static storage duration.
Source: C++11 3.6.1p4. |
#include <cstdlib>
class A {
public:
~A() {
std::exit(1); // warn
}
};
|
|
undefbehavior.LocalStaticDestroyed
(C++)
Undefined behavior: function containing a definition of static local object is
called during the destruction of an object with static storage duration so that
flow of control passes through the definition of the previously destroyed
static local object.
Source: C++11 3.6.3p2. |
void f();
class A {
public:
~A() {
f(); // warn
}
};
class B {};
A a;
void f() {
static B b;
}
|
|
undefbehavior.ZeroAllocDereference
(C, C++)
The effect of dereferencing a pointer returned as a request for zero size is
undefined. Note: possibly an enhancement to unix.Malloc. Source: C++03 3.7.3.1p2; C++11 3.7.4.1p2. |
#include <stdlib.h>
void test() {
int *p = (int *)malloc(0);
*p = 1; // warn
free(p);
}
void f(int);
void test() {
int *p = new int[0];
f(*p); // warn
delete[] p;
}
|
D8273 |
undefbehavior.DeadReferenced
(C++)
Undefined behavior: the following usage of the pointer to the object whose
lifetime has ended can result in undefined behavior: The object will be or was of a class type with a non-trivial destructor and
Source: C++03 3.8p5, p7; C++11 3.8p5, p7. |
#include <new>
class A {
public:
~A();
};
class B : public A {};
void test() {
A *a = new A;
new(a) B;
delete a; // warn
}
#include <new>
class A {
public:
~A();
};
class B {};
void test() {
A *a = new A;
new(a) B;
a->~A();
}
#include <new>
class A {
public:
~A();
};
class B : public A {};
class C {};
void f(A*);
void test() {
B *b = new B;
new(b) C;
f(b); // warn
}
#include <new>
class A {
public:
~A();
};
class B : public A {};
class C {};
A* test() {
B *b = new B;
new(b) C;
return static_cast<A*>(b); // warn
}
#include <new>
class A {
public:
~A();
};
class B : public A {};
class C {};
A* test() {
B *b = new B;
new(b) C;
return dynamic_cast<A*>(b); // warn
}
|
|
undefbehavior.ObjLocChanges
(C++)
Undefined behavior: the program must ensure that an object occupies the same
storage location when the implicit or explicit destructor call takes place.
Source: C++11 3.8p8. |
#include <new>
class A {};
class B {
public:
~B();
};
void test() {
B b;
new (&b) A;
} // warn
#include <new>
class A {};
class B {
public:
~B();
};
void test() {
B *b = new B;
new (b) A;
delete b; // warn
}
|
|
undefbehavior.ExprEvalOrderUndef
(C, C++03)
Undefined behavior: a scalar object shall have its stored value modified at
most once by the evaluation of an expression. Note: most cases are currently handled by the Clang core (search for 'multiple unsequenced modifications' warning in Clang tests). Source: C++03 5p4. |
int test () {
int i = 0;
i = ++i + 1; // warn
return i;
}
|
|
undefbehavior.StaticInitReentered
(C++)
Undefined behavior: static declaration is re-entered while the object is being
initialized.
Source: C++11 6.7p4. |
int test(int i) {
static int s = test(2 * i); // warn
return i + 1;
}
|
|
undefbehavior.ConstModified
(C, C++)
Undefined behavior: const object is being modified.
Source: C++03 7.1.5.1p4, C++11 7.1.6.1p4. |
void test() {
const int *cp = new const int (0);
int *p = const_cast<int *>(cp);
*p = 1; // warn
delete p;
}
class C {
public :
int i;
C();
};
void test() {
const C cb;
C* cp = const_cast<C *>(&cb);
cp->i = 1; // warn
}
|
|
undefbehavior.DeadDestructed
(C++)
Undefined behavior: the destructor is invoked for an object whose lifetime
has ended.
Source: C++11 12.4p14. |
class A {
public:
void f();
A();
~A();
};
void test() {
A a;
a.~A();
} // warn
|
|
undefbehavior.MethodCallBeforeBaseInit
(C++)
Undefined behavior: calls member function but base not yet initialized.
Source: C++03 12.6.2p8; C++11 12.6.2p13. |
class A {
public :
A(int);
};
class B : public A {
public :
int f();
B() : A(f()) {} // warn
};
|
|
undefbehavior.MemberOrBaseRefBeforeCtor
(C++)
C++ Undefined behavior: non-static member or base class of non-POD class type
is referred before constructor begins execution. C++11 Undefined behavior: non-static member or base class of a class with a non-trivial constructor is referred before constructor begins execution. Source: C++03 12.7p1; C++11 12.7p1. |
struct non_POD {
int i;
non_POD();
};
extern non_POD non_pod;
int *p = &non_pod.i; // warn
struct POD {
int i;
};
struct non_POD : public POD {
POD pod;
};
extern non_POD non_pod;
int *p = &non_pod.pod.i; // warn
struct POD {
int i;
};
struct non_POD : public POD {};
extern non_POD non_pod;
POD *p = &non_pod; // warn
struct non_POD {
int i;
non_POD();
};
struct S {
int *k;
non_POD non_pod;
S() : k(&non_pod.i) {} // warn
};
|
|
undefbehavior.MemberRefAfterDtor
(C++)
C++03: Undefined behavior: non-static member of non-POD class type is referred
after destructor ends execution. C++11: Undefined behavior: non-static member of a class with a non-trivial destructor is referred after destructor ends execution. Source: C++03 12.7p1; C++11 12.7p1. |
class C {
public:
C();
void f();
};
void test() {
C *c = new C();
c->~C();
c->f(); // warn
}
|
|
undefbehavior.CtorForeignCall
(C++)
Undefined behavior: call to virtual function of an object under construction
whose type is neither the constructors own class or one of its bases.
Source: C++11 12.7p4. |
class A {
public:
virtual void f() {};
};
class B {
public:
B(A* a) { a->f(); } // warn
};
class C : public A, B {
public:
C() : B((A*)this) {}
};
|
|
undefbehavior.CtorForeignTypeid
(C++)
Undefined behavior: the operand of typeid is an object under
construction whose type is neither the constructors own class or one of its
bases.
Source: C++11 12.7p5. |
#include <typeinfo>
class A {};
class B {
public:
B(A* a) {
(void)typeid(*a); // warn
}
};
class C : public A, B {
public:
C() : B((A*)this) {}
};
|
|
undefbehavior.CtorForeignCast
(C++)
Undefined behavior: the operand of dynamic_cast is an object under
construction whose type is neither the constructors own class or one of its
bases.
Source: C++11 12.7p6. |
#include <typeinfo>
class A {
public:
virtual void f() {};
};
class B {
public:
B(A* a) {
(void)dynamic_cast<B*>(a); //warn
}
};
class C : public A, B {
public:
C() : B((A*)this) {}
};
|
|
undefbehavior.MemberOrBaseRefInCatch
(C++)
Undefined behavior: referring to any non-static member or base class of an
object in the handler for a function-try-block of a constructor or destructor
for that object results in undefined behavior.
Source: C++11 15.3p10. |
void f() { throw 1; }
class C {
int i;
public :
C()
try {
f();
}
catch (...) {
i=2; // warn
}
};
void f() { throw 1; }
class Base {
public:
int i;
};
class C: public Base {
public :
~C() try {
f();
}
catch (...) {
i=2; // warn
}
};
|
|
undefbehavior.ReturnAtCatchEnd
(C++)
Undefined behavior: a function returns when control reaches the end of a
handler. This results in undefined behavior in a value-returning function.
Source: C++11 15.3p10. |
void f() { throw 1; }
int test() try {
f();
return 1;
}
catch(int) {
} // warn
|
|
undefbehavior.AutoptrsOwnSameObj
(C++03)
Undefined behavior: if more than one auto_ptr owns the same object
at the same time the behavior of the program is undefined.
Source: C++03 20.4.5p3; C++11 |
#include <memory>
void test() {
int *data = new int;
std::auto_ptr<int> p(data);
std::auto_ptr<int> q(data); // warn
}
|
|
undefbehavior.BasicStringOutOfBound
(C++03)
Undefined behavior: out-of-bound basic_string access/modification.
Note: possibly an enhancement to alpha.security.ArrayBoundV2. Source: C++03 21.3.4p1; C++11 behavior is defined (21.4.5p2). |
#include <string>
void test() {
std::basic_string<char> s;
char c = s[10]; // warn
}
#include <string>
void test() {
std::basic_string<char> s;
s[10] = 0; // warn
}
|
|
undefbehavior.EosDereference
(C++)
Undefined behavior: the result of operator*() on an end of a
stream is undefined.
Source: C++03 24.5.3p2; C++11 24.6.3p2. |
#include <vector>
int test() {
std::vector<int> v;
return *v.end(); // warn
}
|
|
undefbehavior.QsortNonPODNonTrivial
(C++)
C++03: Undefined behavior: the objects in the array passed to qsort are of
non-POD type. C++11: Undefined behavior: the objects in the array passed to qsort are of non-trivial type. Source: C++03 25.4p4; C++11 25.5p4. |
// C++03
#include <cstdlib>
struct non_POD {
non_POD();
};
non_POD values[] = { non_POD(), non_POD() };
int compare(const void *a, const void *b);
void test() {
qsort(values, 2, sizeof(non_POD), compare); // warn
}
// C++11
#include <cstdlib>
struct S {};
struct trivial_non_POD : public S {
int i;
};
struct non_trivial {
int i;
non_trivial();
};
trivial_non_POD tnp[2];
non_trivial nt[2];
int compare1(const void *a, const void *b);
int compare2(const void *a, const void *b);
void test() {
qsort(tnp, 2, sizeof(trivial_non_POD), compare1); // ok
qsort(nt, 2, sizeof(non_trivial), compare2); // warn
}
|
|
undefbehavior.ThrowWhileCopy
(C++)
Undefined behavior: copy constructor/assignment operator can throw an exception.
The effects are undefined if an exception is thrown. |
class C {
public:
int i, j;
C (const C &c) {
i = c.i;
throw 1; // warn
j = c.j;
};
};
class C {
public:
int i, j;
C &operator=(const C &c) {
i = c.i;
throw 1; // warn
j = c.j;
};
};
|
|
undefbehavior.ValarrayArgBound
(C++)
Undefined behavior: the value of the n argument passed
to valarray constructor is greater than the number of values
pointed to by the first argument (source).
Source: C++03 26.3.2.1p4; C++11 26.6.2.2p4. |
#include <valarray>
struct S {
int i;
S(int ii) : i(ii) {};
};
void test(void) {
S s[] = { S(1), S(2) };
std::valarray<S> v(s,3); // warn
}
|
|
undefbehavior.ValarrayLengthDiffer
(C++)
Undefined behavior: valarray operands are of different length.
Source: C++03 26.3.2.2p1, 26.3.2.6p3, 26.3.3.1p3, 26.3.3.2p3; C++11 defined (26.6.2.3p1), 26.6.2.7p3, 26.6.3.1p3, 26.6.3.2p3. |
// C++03
#include <valarray>
void test(void) {
std::valarray<int> a(0, 1), b(0, 2);
a = b; // warn
b.resize(1);
a = b; // ok
}
// C++03, C++11
#include <valarray>
void test(void) {
std::valarray<int> a(0, 1), b(0, 2);
a *= b; // warn
}
// C++03, C++11
#include <valarray>
void test(void) {
std::valarray<int> a(0, 1), b(0, 2);
a = a + b; // warn
}
// C++03, C++11
#include <valarray>
void test(void) {
std::valarray<int> a(0, 1), b(0, 2);
std::valarray<bool> c(false, 1);
c = a == b; // warn
}
|
|
undefbehavior.ValarrayZeroLength
(C++)
Undefined behavior: calling sum()/min()/
max() methods of a zero length valarray |
#include <valarray>
void test(void) {
std::valarray<int> v(0, 0);
v.sum(); // warn
}
|
|
undefbehavior.ValarrayBadIndirection
(C++)
Undefined behavior: element is specified more than once in an indirection.
Source: C++03 26.3.9.2p2, 26.3.9.3p2; C++11 26.6.9.2p2, 26.6.9.3p2. |
#include <valarray>
void test() {
// '1' is specified more then once
size_t addr[] = {0, 1, 1};
std::valarray<size_t>indirect(addr, 3);
std::valarray<int> a(0, 5), b(1, 3);
a[indirect] = b; //warn
}
#include <valarray>
void test() {
// '1' is specified more then once
size_t addr[] = {0, 1, 1};
std::valarray<size_t>indirect(addr, 3);
std::valarray<int> a(0, 5), b(1, 3);
a[indirect] *= b; //warn
}
|
|
undefbehavior.IosBaseDestroyedBeforeInit
(C++)
Undefined behavior: ios_base object is destroyed before
initialization have taken place. basic_ios::init should be call to
initialize ios_base members.
Source: C++03 27.4.2.7p1, 27.4.4.1p2; C++11 27.5.3.7p1, 27.5.5.2p2. |
#include <ios>
using namespace std;
template <class T, class Traits = std::char_traits<T> >
class my_stream1 : public std::basic_ios<T, Traits> {
};
template <class T, class Traits = std::char_traits<T> >
class my_stream2 : public std::basic_ios<T, Traits> {
class my_streambuf
: public std::basic_streambuf<T, Traits> {
};
public:
my_stream2() {
this->init(new my_streambuf);
}
};
void test() {
my_stream1<char> *p1 = new my_stream1<char>;
my_stream2<char> *p2 = new my_stream2<char>;
delete p1; // warn
delete p2; // ok
}
|
|
undefbehavior.IosBaseUsedBeforeInit
(C++11)
Undefined behavior: ios_base object is used before initialization
have taken place. basic_ios::init should be call to
initialize ios_base members.
Source: C++11 27.5.3.7p1, 27.5.5.2p2. |
#include <ios>
using namespace std;
template <class T, class Traits = std::char_traits<T> >
class my_stream1 : public std::basic_ios<T, Traits> {
};
template <class T, class Traits = std::char_traits<T> >
class my_stream2 : public std::basic_ios<T, Traits> {
class my_streambuf
: public std::basic_streambuf<T, Traits> {
};
public:
my_stream2() {
this->init(new my_streambuf);
}
};
void test() {
my_stream1<char> *p1 = new my_stream1<char>;
my_stream2<char> *p2 = new my_stream2<char>;
p1->narrow('a', 'b'); // warn
p2->narrow('a', 'b'); // ok
}
|
|
undefbehavior.MinusOnePosType
(C++)
Undefined behavior: passing -1 to any streambuf/
istream/ostream member that accepts a value of
type traits::pos_type result in undefined behavior.
Source: C++03 27.4.3.2p3; C++11 27.5.4.2p3. |
#include <fstream>
class my_streambuf : public std::streambuf {
void f() {
seekpos(-1); // warn
}
};
#include <fstream>
void test() {
std::filebuf fb;
std::istream in(&fb);
std::filebuf::off_type pos(-1);
in.seekg(pos); // warn
}
|
different
| Name, Description | Example | Progress |
different.SuccessiveAssign
(C)
Successive assign to a variable. |
int test() {
int i;
i=1;
i=2; // warn
return i;
}
|
|
different.NullDerefStmtOrder
(C)
Dereferencing of the null pointer might take place. Checking the pointer for
null should be performed first.
Note: possibly an enhancement to core.NullDereference. |
struct S {
int x;
};
struct S* f();
void test() {
struct S *p1 = f();
int x1 = p1->x; // warn
if (p1) {};
struct S *p2 = f();
int x2 = p2->x; // ok
}
|
|
different.NullDerefCondOrder
(C)
Dereferencing of the null pointer might take place. Checking the pointer for
null should be performed first.
Note: possibly an enhancement to core.NullDereference. |
struct S {int i;};
struct S* f();
void test() {
struct S *p = f();
if (p->i && p) {}; // warn
}
|
|
different.MultipleAccessors
(C++)
Identical accessor bodies. Possibly a misprint. |
class A {
int i;
int j;
public:
int getI() { return i; }
int getJ() { return i; } // warn
};
class A {
int i;
int j;
public:
void setI(int& ii) { i = ii; }
void setJ(int& jj) { i = jj; } // warn
};
|
|
different.AccessorsForPublic
(C++)
Accessors exist for a public class field. Should this field really be
public? |
class A {
public:
int i; // warn
int getI() { return i; }
void setI(int& ii) { i = ii; }
};
|
|
different.LibFuncResultUnised
(C, C++)
Calling a function ignoring its return value is of no use (create the list of
known system/library/API functions falling into this category). |
#include <vector>
void test() {
std::vector<int> v;
v.empty(); // warn
}
|
|
different.WrongVarForStmt
(C, C++)
Wrong variable is possibly used in the loop/cond-expression of
the for statement. Did you mean
'proper_variable_name'? |
void test() {
int i = 0;
int j = 0;
for (i = 0; i < 3; j += 1); // warn
}
void test() {
int i = 0;
int j = 0;
for (int j = 0; i < 3; ++j); // warn
}
|
|
different.FloatingCompare
(C)
Comparing floating point numbers may be not precise. |
#include <math.h>
double test() {
double b = sin(M_PI / 6.0);
if (b == 0.5) // warn
b = 0;
return b;
}
|
|
different.BitwiseOpBoolArg
(C, C++)
Boolean value met at the left/right part of the bitwise &
or | operator.
Did you mean && (||) ? |
int f();
void test() {
bool b = true;
if (b & f()) {} // warn
}
|
|
different.LabelInsideSwitch
(C)
Possibly a misprint: label found inside a switch()
statement. |
void test(int c) {
switch(c){
case 1:
c += 1; break;
defalt: // warn (did you mean 'default'?)
c -= 1; break;
}
}
|
|
different.IdenticalCondIfIf
(C)
The conditions of two subsequent if statements are
identical. |
int test(int c) {
if (c > 5)
c += 1;
if (c > 5) // warn
c -= 1;
return c;
}
|
|
different.LogicalOpUselessArg
(C)
The second operand of a && operator has no impact on
expression result. |
void test(unsigned a) {
if (a<7 && a<10) {}; // warn
}
|
|
different.SameResLogicalExpr
(C)
An expression is always evaluated to true/false. |
void test() {
int i = 0;
if (i != 0) {}; // warn
}
void test(int i) {
if (i == 0 && i == 1) {}; // warn
}
void test(int i) {
if (i < 0 || i >= 0) {}; // warn
}
|
|
different.OpPrecedenceAssignCmp
(C, C++)
Comparison operation has higher precedence then assignment. Boolean value is
assigned to a variable of other type. Parenthesis may bee required around an
assignment. |
int f();
void test(int x, int y) {
bool b;
if((b = x != y)) {} // ok
if((x = f() != y)) {} // warn
}
|
|
different.OpPrecedenceIifShift
(C, C++) ?: has lower precedence then <<.
Source: Stephen C. Dewhurst "C++ Gotchas: Avoiding Common Problems in Coding and Design", advise 15. |
#include <iostream>
void test(int a) {
std::cout << a ? "a" : "b"; // warn
}
void test(int a) {
a << a > 7 ? 1 : 2; // warn
}
|
|
different.ObjectUnused
(C++)
The object was created but is not being used. |
struct S {
int x, y;
S(int xx, int yy) : x(xx), y(yy) {}
S(int xx) {
S(xx, 0); // warn
}
};
#include <exception>
void test() {
std::exception();
// warn (did you mean 'throw std::exception()'?)
}
|
|
different.StaticArrayPtrCompare
(C)
Pointer to static array is being compared to NULL. May the subscripting is
missing. |
void test() {
int a[1][1];
if (a[0] == 0) {}; // warn
}
|
|
different.ConversionToBool
(C, C++)
Odd implicit conversion to boolean.
Note: possibly merge with alpha.core.BoolAssignment. |
bool test() {
return 1.; // warn
}
bool test() {
return ""; // warn
}
|
|
different.ArrayBound
(C++)
Out-of-bound dynamic array access.
Note: possibly an enhancement to alpha.security.ArrayBoundV2. |
void test() {
int *p = new int[1];
int i = 1;
if(p[i]) {}; // warn
delete[] p;
}
|
|
different.StrcpyInputSize
(C)
Buffer copy without checking the size of input.
Note: possibly an enhancement to alpha.unix.cstring.OutOfBounds. |
void test(char* string) {
char buf[24];
strcpy(buf, string); // warn
}
|
|
different.IntegerOverflow
(C)
Integer overflow.
Note: partially handled by Clang core (search for 'overflow in expression' warning in Clang tests). Source: CWE-190. |
#include <limits.h>
int f(int x);
void test() {
f(INT_MAX + 1); // warn
}
#include <limits.h>
int test() {
int x = INT_MAX / 2 + 1;
return x * 2; // warn
}
|
|
unsigned long long test(long long sll) {
unsigned long long ull = sll; // warn
return ull;
}
void f(unsigned int i);
void test(int si) {
f(si); // warn
}
unsigned int test(int i) {
return i;
}
|
||
unsigned long test(unsigned long long ull) {
unsigned long ul = ull; // warn
return ul;
}
void f(int i);
void test(long long sll) {
f(sll); // warn
}
int f();
short test(long long sll) {
short ss = f();
return ss;
}
|
||
different.MissingCopyCtorAssignOp
(C++)
A class has dynamically allocated data members but do not define a copy
constructor/assignment operator.
Source: Scott Meyers "Effective C++", item 11: Prevent exceptions from leaving destructors. |
class C {
int *p; // warn
public:
C() { p = new int; }
~C() { delete p; }
};
|
WinAPI
| Name, Description | Example | Progress |
WinAPI.CreateProcess
(C) CreateProcess(): if the first parameter
lpApplicationName is NULL then the executable name must be in the
white space-delimited string pointed to by lpCommandLine.
If the executable or path name has a space in it, there is a risk that a
different executable could be run because of the way the function parses
spaces.
|
#include <windows.h>
void test() {
STARTUPINFO si;
PROCESS_INFORMATION pi;
CreateProcess(NULL, TEXT("C:\\Program Files\\App -L -S"),
NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi);
// warn
}
|
|
WinAPI.LoadLibrary
(C)
The SearchPath() function is used to retrieve a path to a DLL for
a subsequent LoadLibrary() call.
|
#include <windows.h>
HINSTANCE test() {
char filePath[100];
SearchPath(NULL, "file.dll", NULL, 100, filePath, NULL);
return LoadLibrary(filePath); // warn
}
|
|
WinAPI.WideCharToMultiByte
(C)
Buffer overrun while calling WideCharToMultiByte(). The size of
the input buffer equals the number of characters in the Unicode string, while
the size of the output buffer equals the number of bytes.
Source: MSDN: WideCharToMultiByte function. |
#include <windows.h>
void test() {
wchar_t ws[] = L"abc";
char s[3];
WideCharToMultiByte(CP_UTF8, 0, ws, -1, s,
3, NULL, NULL); // warn
}
|
optimization
| Name, Description | Example | Progress |
optimization.PassConstObjByValue
(C, C++)
Optimization: It is more effective to pass constant parameter by reference to
avoid unnecessary object copying. |
struct A {};
void f(const struct A a); // warn
|
|
optimization.PostfixIncIter
(C++)
Optimization: It is more effective to use prefix increment operator with
iterator.
Source: Scott Meyers "More Effective C++", item 6: Distinguish between prefix and postfix forms of increment and decrement operators. |
#include <vector>
void test() {
std::vector<int> v;
std::vector<int>::const_iterator it;
for(it = v.begin();
it != v.end(); it++) {}; // warn
}
|
|
optimization.MultipleCallsStrlen
(C)
Optimization: multiple calls to strlen() for a string in an
expression. It is more effective to hold a value returned
from strlen() in a temporary variable. |
#include <string.h>
void test(const char* s) {
if (strlen(s) > 0 &&
strlen(s) < 7) {}; // warn
}
|
|
optimization.StrLengthCalculation
(C++)
Optimization: it is more efficient to use string::length() to
calculate the length of an std::string. |
#include <string>
#include <string.h>
void test() {
std::string s;
if (strlen(s.c_str()) != 0) {}; // warn
}
|
|
optimization.EmptyContainerDetect
(C++)
Optimization: It is more efficient to use containers empty()
method to identify an empty container. |
#include <list>
void test() {
std::list<int> l;
if (l.size() != 0) {}; // warn
}
|