GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GeezerVison is showing cppcheck.sourceforge.io — Cppcheck - A tool for static C/C++ code analysis CppcheckA tool for static C/C++ code analysis Cppcheck is a static analysis tool for C/C++ code. It provides unique code analysis to detect bugs and focuses on detecting undefined behaviour and dangerous coding constructs. The goal is to have very few false positives. Cppcheck is designed to be able to analyze your C/C++ code even if it has non-standard syntax (common in embedded projects). Cppcheck is available both as open-source (this page) and as Cppcheck Premium with extended functionality and support. Please visit www.cppcheck.com for more information and purchase options for the commercial version. DownloadCppcheck 2.22 (open source)
PackagesCppcheck can also be installed from various package managers; however, you might get an outdated version then. Debian:sudo apt-get install cppcheck Fedora:sudo yum install cppcheck Mac:brew install cppcheck FeaturesUnique code analysis that detect various kinds of bugs in your code. Both command line interface and graphical user interface are available. Cppcheck has a strong focus on detecting undefined behaviour. Unique analysisUsing several static analysis tools can be a good idea. There are unique features in each tool. This has been established in many studies. So what is unique in Cppcheck. Cppcheck uses unsound flow sensitive analysis. Several other analyzers use path sensitive analysis based on abstract interpretation, that is also great however that has both advantages and disadvantages. In theory by definition, it is better with path sensitive analysis than flow sensitive analysis. But in practice, it means Cppcheck will detect bugs that the other tools do not detect. In Cppcheck the data flow analysis is not only "forward" but "bi-directional". Most analyzers will diagnose this: void foo(int x)
{
int buf[10];
if (x == 1000)
buf[x] = 0; // <- ERROR
}
Most tools can determine that the array index will be 1000 and there will be overflow. Cppcheck will also diagnose this: void foo(int x)
{
int buf[10];
buf[x] = 0; // <- ERROR
if (x == 1000) {}
}
Undefined behaviour
SecurityThe most common types of security vulnerabilities in 2017 (CVE count) was:
CVEs that was found using Cppcheck:
These CVEs are shown when you google "cppcheck CVE". Feel free to compare the search results with other static analysis tools. Security experts recommend that static analysis is used. And using several tools is the best approach from a security perspective. Coding standards
All checksFor a list of all checks in Cppcheck see: https://sourceforge.net/p/cppcheck/wiki/ListOfChecks. Clients and pluginsCppcheck is integrated with many popular development tools. For instance:
Other static analysis toolsUsing a battery of tools is better than using one tool. Each tool has unique code analysis and therefore we recommend that you also use other tools. Cppcheck focus on bugs instead of stylistic issues. Therefore a tool that focus on stylistic issues could be a good addition. Cppcheck tries very hard to avoid false positives. Sometimes people want to detect all bugs even if there will be many false warnings, for instance when they are working on a release and want to verify that there are no bugs. A tool that is much more noisy than Cppcheck might be a good addition. Even tools that have the same design goals as Cppcheck will probably be good additions. Static analysis is such a big field, Cppcheck only covers a small fraction of it. No tool covers the whole field. The day when all manual testing will be obsolete because of some tool is very far away. NewsDocumentationYou can read the manual or download some articles. Support
Donate CPUThe Cppcheck project is a hobby project with limited resources. You can help us by donating CPU (1 core or as many as you like). It is simple:
The script will analyse debian source code and upload the results to a cppcheck server. We need these results both to improve Cppcheck and to detect regressions. You can stop the script whenever you like with Ctrl C. ContributeYou are welcome to contribute. Help is needed. A presentation that might be interesting: Contribute to open source static analysis
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |