List of potential checkers
This page contains a list of potential checkers to implement in the static analyzer. If you are interested in contributing to the analyzer's development, this is a good resource to help you get started. The specific names of the checkers are subject to review, and are provided here as suggestions.
memory
| Name, Description | Example | Progress | 
| 
memory.LeakEvalOrder
(C, C++) 
Potential memory leaks caused by an undefined argument evaluation order.
 Source: boost docs: shared_ptr. | 
void f(int, int);
int g(void *);
int h() __attribute__((noreturn));
void test() {
  // It is possible that 'malloc(1)' is called first,
  // then 'h()', that is (or calls) noreturn and eventually
  // 'g()' is never called.
  f(g(malloc(1)), h()); // warn: 'g()' may never be called.
}
void f(int, int);
int g(int *);
int h() { throw 1; };
void test() {
  // It is possible that 'new int' is called first,
  // then 'h()', that throws an exception and eventually
  // 'g()' is never called.
  f(g(new int), h()); // warn: 'g()' may never be called.
}
 | |
| 
memory.DstBufferTooSmall
(C, C++) 
Destination buffer passed to memory function is too small.
 Note: security.insecureAPI.strcpy currently warns on usage of strcpyand suggests to replace it.Note: alpha.unix.CStringChecker contains some similar checks. Source: CWE-120. | 
void test() {
  const char* s1 = "abc";
  char *s2 = new char;
  strcpy(s2, s1); // warn
}
void test() {
  int* p1 = new int[3];
  int* p2 = new int;
  memcpy(p2, p1, 3); // warn
}
 | |
| 
memory.NegativeArraySize
(C, C++) 
'n' is used to specify the buffer size may be negative.
 Note: possibly an enhancement to alpha.security.MallocOverflow. Source: CWE-20, Example 2. | 
void test() {
  int *p;
  int n1 = -1;
  p = new int[n1]; // warn
}
 | |
| 
memory.ZeroAlloc
(C, C++) 
Allocation of zero bytes.
 Note: an enhancement to unix.Malloc. Note: unix.API perform C-checks for zero allocation. This should be moved to unix.Malloc. Source: C++03 3.7.3.1p2; C++11 3.7.4.1p2. | 
#include <stdlib.h>
void test() {
  int *p = malloc(0); // warn
  free(p);
}
void test() {
  int *p = new int[0]; // warn
  delete[] p;
}
 | D6178 | 
constructors/destructors
| Name, Description | Example | Progress | 
| 
ctordtor.ExptInsideDtor
(C++) 
It is dangerous to let an exception leave a destructor.
Using  try..catchsolves the problem.Source: Scott Meyers "More Effective C++", item 11: Prevent exceptions from leaving destructors. | 
class A {
  A() {}
  ~A() { throw 1; } // warn
};
void f() throw(int);
class A {
  A() {}
  ~A() { f(); } // warn
};
 | |
| 
ctordtor.PlacementSelfCopy
(C++11) 
For a placement copy or move, it is almost certainly an error if the
constructed object is also the object being copied from. | 
class A {};
void test(A *dst, A *src) {
  ::new (dst) A(*dst); // warn (should be 'src')
}
 | 
exceptions
| Name, Description | Example | Progress | 
| 
exceptions.ThrowSpecButNotThrow
(C++) 
Function declaration has a  throw(type)specifier but the
function do not throw exceptions. | 
void test() throw(int) {
} // warn
 | |
| 
exceptions.NoThrowSpecButThrows
(C++) 
An exception is throw from a function having a  throw()specifier. | 
void test() throw() {
  throw(1); // warn
}
 | |
| 
exceptions.ThrownTypeDiffersSpec
(C++) 
The type of a thrown exception differs from those specified in
a  throw(type)specifier. | 
struct S{};
void test() throw(int) {
  S s;
  throw (s); // warn
}
 | 
smart pointers
| Name, Description | Example | Progress | 
| 
smartptr.SmartPtrInit
(C++) 
C++03:  auto_ptrshould store a pointer to an object obtained via
new as allocated memory will be cleaned usingdelete.C++11: one should use unique_ptr<type[]>to keep a
pointer to memory allocated bynew[].C++11: to keep a pointer to memory allocated by new[]in
ashared_ptrone should use a custom deleter that calls
delete[]..Source: C++03 20.4.5p1; C++11  | 
#include <stdlib.h>
#include <memory>
void test() {
  std::auto_ptr<int> p1(new int); // Ok
  std::auto_ptr<int> p2(new int[3]); // warn
}
#include <stdlib.h>
#include <memory>
void test() {
  std::auto_ptr<int> p((int *)malloc(sizeof(int))); // warn
}
 | 
dead code
| Name, Description | Example | Progress | 
| 
deadcode.UnmodifiedVariable
(C, C++) 
A variable is never modified but was not declared const and is not a
reference. (opt-in checker) | 
extern int computeDelta();
int test(bool cond) {
  int i = 0;
  if (cond) {
    const int delta = computeDelta();
    // warn: forgot to modify 'i'
  }
  return i;
}
 | PR16890 | 
| 
deadcode.IdempotentOperations
(C) 
Warn about idempotent operations. | 
void test() {
  int x = 7;
  x = x; // warn: value is always the same
}
void test() {
  int x = 7;
  x /= x; // warn: value is always 1
}
void test() {
  int x = 7, one = 1;
  x *= one; // warn: right op is always 1
}
void test() {
  int x = 7, zero = 0;
  x = x - zero;
   // warn: the right operand to '-' is always 0
}
 | removed from alpha.deadcode.* at r198476 | 
POSIX
| Name, Description | Example | Progress | 
| 
posix.Errno
(C) 
Record that  errnois non-zero when certain functions
fail. | 
#include <stdlib.h>
int readWrapper(int fd, int *count) {
  int lcount = read(fd, globalBuf, sizeof(globalBuf));
  if (lcount < 0)
    return errno;
  *count = lcount;
  return 0;
}
void use(int fd) {
  int count;
  if (!readWrapper(fd, &count))
    print("%d", count); // should not warn
}
 | PR18701 | 
undefined behavior
| Name, Description | Example | Progress | 
| 
undefbehavior.ExitInDtor
(C++) 
Undefined behavior:  std::exit()is called to end the program during
the destruction of an object with static storage duration.Source: C++11 3.6.1p4. | 
#include <cstdlib>
class A {
public:
  ~A() {
    std::exit(1); // warn
  }
};
 | |
| 
undefbehavior.LocalStaticDestroyed
(C++) 
Undefined behavior: function containing a definition of static local object is 
called during the destruction of an object with static storage duration so that 
flow of control passes through the definition of the previously destroyed 
static local object.
 Source: C++11 3.6.3p2. | 
void f();
class A {
public:
  ~A() {
    f(); // warn
  }
};
class B {};
A a;
void f() {
  static B b;
}
 | |
| 
undefbehavior.ZeroAllocDereference
(C, C++) 
The effect of dereferencing a pointer returned as a request for zero size is 
undefined. Note: possibly an enhancement to unix.Malloc. Source: C++03 3.7.3.1p2; C++11 3.7.4.1p2. | 
#include <stdlib.h>
void test() {
  int *p = (int *)malloc(0);
  *p = 1; // warn
  free(p);
}
void f(int);
void test() {
  int *p = new int[0];
  f(*p); // warn
  delete[] p;
}
 | D8273 | 
| 
undefbehavior.DeadReferenced
(C++) 
Undefined behavior: the following usage of the pointer to the object whose
lifetime has ended can result in undefined behavior: The object will be or was of a class type with a non-trivial destructor and 
 
 Source: C++03 3.8p5, p7; C++11 3.8p5, p7. | 
#include <new>
class A {
public:
  ~A();
};
class B : public A {};
void test() {
  A *a = new A;
  new(a) B;
  delete a; // warn
}
#include <new>
class A {
public:
  ~A();
};
class B {};
void test() {
  A *a = new A;
  new(a) B;
  a->~A();
}
#include <new>
class A {
public:
  ~A();
};
class B : public A {};
class C {};
void f(A*);
void test() {
  B *b = new B;
  new(b) C;
  f(b); // warn
}
#include <new>
class A {
public:
  ~A();
};
class B : public A {};
class C {};
A* test() {
  B *b = new B;
  new(b) C;
  return static_cast<A*>(b); // warn
}
#include <new>
class A {
public:
  ~A();
};
class B : public A {};
class C {};
A* test() {
  B *b = new B;
  new(b) C;
  return dynamic_cast<A*>(b); // warn
}
 | |
| 
undefbehavior.ObjLocChanges
(C++) 
Undefined behavior: the program must ensure that an object occupies the same 
storage location when the implicit or explicit destructor call takes place.
 Source: C++11 3.8p8. | 
#include <new>
class A {};
class B {
public:
  ~B();
};
void test() {
  B b;
  new (&b) A;
} // warn
#include <new>
class A {};
class B {
public:
  ~B();
};
void test() {
  B *b = new B;
  new (b) A;
  delete b; // warn
}
 | |
| 
undefbehavior.ExprEvalOrderUndef
(C, C++03) 
Undefined behavior: a scalar object shall have its stored value modified at 
most once by the evaluation of an expression. Note: most cases are currently handled by the Clang core (search for 'multiple unsequenced modifications' warning in Clang tests). Source: C++03 5p4. | 
int test () {
  int i = 0;
  i = ++i + 1; // warn
  return i;
}
 | |
| 
undefbehavior.StaticInitReentered
(C++) 
Undefined behavior: static declaration is re-entered while the object is being 
initialized.
 Source: C++11 6.7p4. | 
int test(int i) {
  static int s = test(2 * i); // warn
  return i + 1;
}
 | |
| 
undefbehavior.ConstModified
(C, C++) 
Undefined behavior: const object is being modified.
 Source: C++03 7.1.5.1p4, C++11 7.1.6.1p4. | 
void test() {
  const int *cp = new const int (0);
  int *p = const_cast<int *>(cp);
  *p = 1; // warn
  delete p;
}
class C {
public :
  int i;
  C();
};
void test() {
  const C cb;
  C* cp = const_cast<C *>(&cb);
  cp->i = 1; // warn
}
 | |
| 
undefbehavior.DeadDestructed
(C++) 
Undefined behavior: the destructor is invoked for an object whose lifetime 
has ended.
 Source: C++11 12.4p14. | 
class A {
public:
  void f();
  A();
  ~A();
};
void test() {
  A a;
  a.~A();
} // warn
 | |
| 
undefbehavior.MethodCallBeforeBaseInit
(C++) 
Undefined behavior: calls member function but base not yet initialized.
 Source: C++03 12.6.2p8; C++11 12.6.2p13. | 
class A {
public :
  A(int);
};
class B : public A {
public :
  int f();
  B() : A(f()) {} // warn
};
 | |
| 
undefbehavior.MemberOrBaseRefBeforeCtor
(C++) 
C++ Undefined behavior: non-static member or base class of non-POD class type 
is referred before constructor begins execution. C++11 Undefined behavior: non-static member or base class of a class with a non-trivial constructor is referred before constructor begins execution. Source: C++03 12.7p1; C++11 12.7p1. | 
struct non_POD {
  int i;
  non_POD();
};
extern non_POD non_pod;
int *p = &non_pod.i; // warn
struct POD { 
  int i; 
};
struct non_POD : public POD {
  POD pod;
};
extern non_POD non_pod;
int *p = &non_pod.pod.i; // warn
struct POD {
  int i; 
};
struct non_POD : public POD {};
extern non_POD non_pod;
POD *p = &non_pod; // warn
struct non_POD {
  int i;
  non_POD();
};
struct S {
  int *k;
  non_POD non_pod;
  S() : k(&non_pod.i) {} // warn
};
 | |
| 
undefbehavior.MemberRefAfterDtor
(C++) 
C++03: Undefined behavior: non-static member of non-POD class type is referred 
after destructor ends execution. C++11: Undefined behavior: non-static member of a class with a non-trivial destructor is referred after destructor ends execution. Source: C++03 12.7p1; C++11 12.7p1. | 
class C {
public:
  C();
  void f();
};
void test() {
  C *c = new C();
  c->~C();
  c->f(); // warn
}
 | |
| 
undefbehavior.CtorForeignCall
(C++) 
Undefined behavior: call to virtual function of an object under construction 
whose type is neither the constructors own class or one of its bases.
 Source: C++11 12.7p4. | 
class A {
public:
  virtual void f() {};
};
class B {
public:
  B(A* a) { a->f(); } // warn
};
class C : public A, B {
public:
  C() : B((A*)this) {}
};
 | |
| 
undefbehavior.CtorForeignTypeid
(C++) 
Undefined behavior: the operand of  typeidis an object under
construction whose type is neither the constructors own class or one of its 
bases.Source: C++11 12.7p5. | 
#include <typeinfo>
class A {};
class B {
public:
  B(A* a) {
    (void)typeid(*a); // warn
  }
};
class C : public A, B {
public:
  C() : B((A*)this) {}
};
 | |
| 
undefbehavior.CtorForeignCast
(C++) 
Undefined behavior: the operand of  dynamic_castis an object under
construction whose type is neither the constructors own class or one of its
bases.Source: C++11 12.7p6. | 
#include <typeinfo>
class A {
public:
  virtual void f() {};
};
class B {
public:
  B(A* a) { 
    (void)dynamic_cast<B*>(a); //warn
  }
};
class C : public A, B {
public:
  C() : B((A*)this) {}
};
 | |
| 
undefbehavior.MemberOrBaseRefInCatch
(C++) 
Undefined behavior: referring to any non-static member or base class of an 
object in the handler for a function-try-block of a constructor or destructor 
for that object results in undefined behavior.
 Source: C++11 15.3p10. | 
void f() { throw 1; }
class C {
  int i;
public :
  C()
  try {
    f();
  }
  catch (...) {
    i=2; // warn
  }
};
void f() { throw 1; }
class Base {
public:
  int i;
};
class C: public Base {
public :
  ~C() try {
    f();
  }
  catch (...) {
    i=2; // warn
  }
};
 | |
| 
undefbehavior.ReturnAtCatchEnd
(C++) 
Undefined behavior: a function returns when control reaches the end of a 
handler. This results in undefined behavior in a value-returning function.
 Source: C++11 15.3p10. | 
void f() { throw 1; }
int test() try {
  f();
  return 1;
}
catch(int) {
} // warn
 | |
| 
undefbehavior.AutoptrsOwnSameObj
(C++03) 
Undefined behavior: if more than one  auto_ptrowns the same object
at the same time the behavior of the program is undefined.Source: C++03 20.4.5p3; C++11  | 
#include <memory>
void test() {
  int *data = new int;
  std::auto_ptr<int> p(data);
  std::auto_ptr<int> q(data); // warn
}
 | |
| 
undefbehavior.BasicStringOutOfBound
(C++03) 
Undefined behavior: out-of-bound  basic_stringaccess/modification.Note: possibly an enhancement to alpha.security.ArrayBoundV2. Source: C++03 21.3.4p1; C++11 behavior is defined (21.4.5p2). | 
#include <string>
void test() {
  std::basic_string<char> s;
  char c = s[10]; // warn
}
#include <string>
void test() {
  std::basic_string<char> s;
  s[10] = 0; // warn
}
 | |
| 
undefbehavior.EosDereference
(C++) 
Undefined behavior: the result of  operator*()on an end of a
stream is undefined.Source: C++03 24.5.3p2; C++11 24.6.3p2. | 
#include <vector>
int test() {
  std::vector<int> v;
  return *v.end(); // warn
}
 | |
| 
undefbehavior.QsortNonPODNonTrivial
(C++) 
C++03: Undefined behavior: the objects in the array passed to qsort are of 
non-POD type. C++11: Undefined behavior: the objects in the array passed to qsort are of non-trivial type. Source: C++03 25.4p4; C++11 25.5p4. | 
// C++03
#include <cstdlib>
struct non_POD {
  non_POD();
};
non_POD values[] = { non_POD(), non_POD() };
int compare(const void *a, const void *b);
void test() {
  qsort(values, 2, sizeof(non_POD), compare); // warn
}
// C++11
#include <cstdlib>
struct S {};
struct trivial_non_POD : public S {
  int i;
};
struct non_trivial {
  int i;
  non_trivial();
};
trivial_non_POD tnp[2];
non_trivial nt[2];
int compare1(const void *a, const void *b);
int compare2(const void *a, const void *b);
void test() {
  qsort(tnp, 2, sizeof(trivial_non_POD), compare1); // ok
  qsort(nt, 2, sizeof(non_trivial), compare2); // warn
}
 | |
| 
undefbehavior.ThrowWhileCopy
(C++) 
Undefined behavior: copy constructor/assignment operator can throw an exception.
The effects are undefined if an exception is thrown. | 
class C {
public:
  int i, j;
  C (const C &c) {
    i = c.i;
    throw 1; // warn
    j = c.j;
  };
};
class C {
public:
  int i, j;
  C &operator=(const C &c) {
    i = c.i;
    throw 1; // warn
    j = c.j;
  };
};
 | |
| 
undefbehavior.ValarrayArgBound
(C++) 
Undefined behavior: the value of the  nargument passed
tovalarrayconstructor is greater than the number of values
pointed to by the first argument (source).Source: C++03 26.3.2.1p4; C++11 26.6.2.2p4. | 
#include <valarray>
struct S {
  int i;
  S(int ii) : i(ii) {};
};
void test(void) {
  S s[] = { S(1), S(2) };
  std::valarray<S> v(s,3); // warn
}
 | |
| 
undefbehavior.ValarrayLengthDiffer
(C++) 
Undefined behavior:  valarrayoperands are of different length.Source: C++03 26.3.2.2p1, 26.3.2.6p3, 26.3.3.1p3, 26.3.3.2p3; C++11 defined (26.6.2.3p1), 26.6.2.7p3, 26.6.3.1p3, 26.6.3.2p3. | 
// C++03
#include <valarray>
void test(void) {
  std::valarray<int> a(0, 1), b(0, 2);
  a = b; // warn
  b.resize(1);
  a = b; // ok
}
// C++03, C++11
#include <valarray>
void test(void) {
  std::valarray<int> a(0, 1), b(0, 2);
  a *= b; // warn
}
// C++03, C++11
#include <valarray>
void test(void) {
  std::valarray<int> a(0, 1), b(0, 2);
  a = a + b; // warn
}
// C++03, C++11
#include <valarray>
void test(void) {
  std::valarray<int> a(0, 1), b(0, 2);
  std::valarray<bool> c(false, 1);
  c = a == b; // warn
}
 | |
| 
undefbehavior.ValarrayZeroLength
(C++) 
Undefined behavior: calling  sum()/min()/
max()methods of a zero lengthvalarray | 
#include <valarray>
void test(void) {
  std::valarray<int> v(0, 0);
  v.sum(); // warn
}
 | |
| 
undefbehavior.ValarrayBadIndirection
(C++) 
Undefined behavior: element is specified more than once in an indirection.
 Source: C++03 26.3.9.2p2, 26.3.9.3p2; C++11 26.6.9.2p2, 26.6.9.3p2. | 
#include <valarray>
void test() {
  // '1' is specified more then once
  size_t addr[] = {0, 1, 1};
  std::valarray<size_t>indirect(addr, 3);
  std::valarray<int> a(0, 5), b(1, 3);
  a[indirect] = b; //warn
}
#include <valarray>
void test() {
  // '1' is specified more then once
  size_t addr[] = {0, 1, 1};
  std::valarray<size_t>indirect(addr, 3);
  std::valarray<int> a(0, 5), b(1, 3);
  a[indirect] *= b; //warn
}
 | |
| 
undefbehavior.IosBaseDestroyedBeforeInit
(C++) 
Undefined behavior:  ios_baseobject is destroyed before
initialization have taken place.basic_ios::initshould be call to
initializeios_basemembers.Source: C++03 27.4.2.7p1, 27.4.4.1p2; C++11 27.5.3.7p1, 27.5.5.2p2. | 
#include <ios>
using namespace std;
template <class T, class Traits = std::char_traits<T> >
class my_stream1 : public std::basic_ios<T, Traits> {
};
template <class T, class Traits = std::char_traits<T> >
class my_stream2 : public std::basic_ios<T, Traits> {
  class my_streambuf
  : public std::basic_streambuf<T, Traits> {
  };
public:
  my_stream2() {
    this->init(new my_streambuf);
  }
};
void test() {
  my_stream1<char> *p1 = new my_stream1<char>;
  my_stream2<char> *p2 = new my_stream2<char>;
  delete p1; // warn
  delete p2; // ok
}
 | |
| 
undefbehavior.IosBaseUsedBeforeInit
(C++11) 
Undefined behavior:  ios_baseobject is used before initialization
have taken place.basic_ios::initshould be call to
initializeios_basemembers.Source: C++11 27.5.3.7p1, 27.5.5.2p2. | 
#include <ios>
using namespace std;
template <class T, class Traits = std::char_traits<T> >
class my_stream1 : public std::basic_ios<T, Traits> {
};
template <class T, class Traits = std::char_traits<T> >
class my_stream2 : public std::basic_ios<T, Traits> {
  class my_streambuf
  : public std::basic_streambuf<T, Traits> {
  };
public:
  my_stream2() {
    this->init(new my_streambuf);
  }
};
void test() {
  my_stream1<char> *p1 = new my_stream1<char>;
  my_stream2<char> *p2 = new my_stream2<char>;
  p1->narrow('a', 'b'); // warn
  p2->narrow('a', 'b'); // ok
}
 | |
| 
undefbehavior.MinusOnePosType
(C++) 
Undefined behavior: passing -1 to any  streambuf/
istream/ostreammember that accepts a value of
typetraits::pos_typeresult in undefined behavior.Source: C++03 27.4.3.2p3; C++11 27.5.4.2p3. | 
#include <fstream>
class my_streambuf : public std::streambuf {
  void f() {
    seekpos(-1); // warn
  }
};
#include <fstream>
void test() {
  std::filebuf fb;
  std::istream in(&fb);
  std::filebuf::off_type pos(-1);
  in.seekg(pos); // warn
}
 | 
different
| Name, Description | Example | Progress | 
| 
different.SuccessiveAssign
(C) 
Successive assign to a variable. | 
int test() {
  int i;
  i=1;
  i=2; // warn
  return i;
}
 | |
| 
different.NullDerefStmtOrder
(C) 
Dereferencing of the null pointer might take place. Checking the pointer for 
null should be performed first.
 Note: possibly an enhancement to core.NullDereference. | 
struct S {
  int x;
};
struct S* f();
void test() {
  struct S *p1 = f();
  int x1 = p1->x; // warn
  if (p1) {};
  struct S *p2 = f();
  int x2 = p2->x; // ok
}
 | |
| 
different.NullDerefCondOrder
(C) 
Dereferencing of the null pointer might take place. Checking the pointer for 
null should be performed first.
 Note: possibly an enhancement to core.NullDereference. | 
struct S {int i;};
struct S* f();
void test() {
  struct S *p = f();
  if (p->i && p) {}; // warn
}
 | |
| 
different.MultipleAccessors
(C++) 
Identical accessor bodies. Possibly a misprint. | 
class A {
  int i;
  int j;
public:
  int getI() { return i; }
  int getJ() { return i; } // warn
};
class A {
  int i;
  int j;
public:
  void setI(int& ii) { i = ii; }
  void setJ(int& jj) { i = jj; } // warn
};
 | |
| 
different.AccessorsForPublic
(C++) 
Accessors exist for a public class field. Should this field really be
public? | 
class A {
public:
  int i; // warn
  int getI() { return i; }
  void setI(int& ii) { i = ii; }
};
 | |
| 
different.LibFuncResultUnised
(C, C++) 
Calling a function ignoring its return value is of no use (create the list of
known system/library/API functions falling into this category). | 
#include <vector>
void test() {
  std::vector<int> v;
  v.empty(); // warn
}
 | |
| 
different.WrongVarForStmt
(C, C++) 
Wrong variable is possibly used in the loop/cond-expression of
the  forstatement. Did you mean
'proper_variable_name'? | 
void test() {
  int i = 0;
  int j = 0;
  for (i = 0; i < 3; j += 1); // warn
}
void test() {
  int i = 0;
  int j = 0;
  for (int j = 0; i < 3; ++j); // warn
}
 | |
| 
different.FloatingCompare
(C) 
Comparing floating point numbers may be not precise. | 
#include <math.h>
double test() {
  double b = sin(M_PI / 6.0);
  if (b == 0.5) // warn
    b = 0;
  return b;
}
 | |
| 
different.BitwiseOpBoolArg
(C, C++) 
Boolean value met at the left/right part of the bitwise  &or|operator.
Did you mean&&(||) ? | 
int f();
void test() {
  bool b = true;
  if (b & f()) {} // warn
}
 | |
| 
different.LabelInsideSwitch
(C) 
Possibly a misprint: label found inside a  switch()statement. | 
void test(int c) {
  switch(c){
  case 1:
    c += 1; break;
  defalt: // warn (did you mean 'default'?)
    c -= 1; break;
  }
}
 | |
| 
different.IdenticalCondIfIf
(C) 
The conditions of two subsequent  ifstatements are
identical. | 
int test(int c) {
  if (c > 5)
    c += 1;
  if (c > 5) // warn
    c -= 1;
  return c;
}
 | |
| 
different.LogicalOpUselessArg
(C) 
The second operand of a  &&operator has no impact on
expression result. | 
void test(unsigned a) {
  if (a<7 && a<10) {}; // warn
}
 | |
| 
different.SameResLogicalExpr
(C) 
An expression is always evaluated to true/false. | 
void test() {
  int i = 0;
  if (i != 0) {}; // warn
}
void test(int i) {
  if (i == 0 && i == 1) {}; // warn
}
void test(int i) {
  if (i < 0 || i >= 0) {}; // warn
}
 | |
| 
different.OpPrecedenceAssignCmp
(C, C++) 
Comparison operation has higher precedence then assignment. Boolean value is
assigned to a variable of other type. Parenthesis may bee required around an
assignment. | 
int f();
void test(int x, int y) {
  bool b;
  if((b = x != y)) {} // ok
  if((x = f() != y)) {} // warn
}
 | |
| 
different.OpPrecedenceIifShift
(C, C++) ?:has lower precedence then<<.Source: Stephen C. Dewhurst "C++ Gotchas: Avoiding Common Problems in Coding and Design", advise 15. | 
#include <iostream>
void test(int a) {
  std::cout << a ? "a" : "b"; // warn
}
void test(int a) {
  a << a > 7 ? 1 : 2; // warn
}
 | |
| 
different.ObjectUnused
(C++) 
The object was created but is not being used. | 
struct S {
  int x, y;
  S(int xx, int yy) : x(xx), y(yy) {}
  S(int xx) {
    S(xx, 0); // warn
  }
};
#include <exception>
void test() {
  std::exception();
    // warn (did you mean 'throw std::exception()'?)
}
 | |
| 
different.StaticArrayPtrCompare
(C) 
Pointer to static array is being compared to NULL. May the subscripting is
missing. | 
void test() {
  int a[1][1];
  if (a[0] == 0) {}; // warn
}
 | |
| 
different.ConversionToBool
(C, C++) 
Odd implicit conversion to boolean.
 Note: possibly merge with alpha.core.BoolAssignment. | 
bool test() {
  return 1.; // warn
}
bool test() {
  return ""; // warn
}
 | |
| 
different.ArrayBound
(C++) 
Out-of-bound dynamic array access.
 Note: possibly an enhancement to alpha.security.ArrayBoundV2. | 
void test() {
  int *p = new int[1];
  int i = 1;
  if(p[i]) {}; // warn
  delete[] p;
}
 | |
| 
different.StrcpyInputSize
(C) 
Buffer copy without checking the size of input.
 Note: possibly an enhancement to alpha.unix.cstring.OutOfBounds. | 
void test(char* string) {
  char buf[24];
  strcpy(buf, string); // warn
}
 | |
| 
different.IntegerOverflow
(C) 
Integer overflow.
 Note: partially handled by Clang core (search for 'overflow in expression' warning in Clang tests). Source: CWE-190. | 
#include <limits.h>
int f(int x);
void test() {
  f(INT_MAX + 1); // warn
}
#include <limits.h>
int test() {
  int x = INT_MAX / 2 + 1;
  return x * 2; // warn
}
 | |
| 
unsigned long long test(long long sll) {
  unsigned long long ull = sll; // warn
  return ull;
}
void f(unsigned int i);
void test(int si) {
  f(si); // warn
}
unsigned int test(int i) {
  return i;
}
 | ||
| 
unsigned long test(unsigned long long ull) {
  unsigned long ul = ull; // warn
  return ul;
}
void f(int i);
void test(long long sll) {
  f(sll); // warn
}
int f();
short test(long long sll) {
  short ss = f();
  return ss;
}
 | ||
| 
different.MissingCopyCtorAssignOp
(C++) 
A class has dynamically allocated data members but do not define a copy
constructor/assignment operator.
 Source: Scott Meyers "Effective C++", item 11: Prevent exceptions from leaving destructors. | 
class C {
  int *p; // warn
public:
  C() { p = new int; }
  ~C() { delete p; }
};
 | 
WinAPI
| Name, Description | Example | Progress | 
| 
WinAPI.CreateProcess
(C) CreateProcess(): if the first parameter
lpApplicationNameis NULL then the executable name must be in the
white space-delimited string pointed to bylpCommandLine.
If the executable or path name has a space in it, there is a risk that a
different executable could be run because of the way the function parses
spaces. | 
#include <windows.h>
void test() {
  STARTUPINFO si;
  PROCESS_INFORMATION pi;
  CreateProcess(NULL, TEXT("C:\\Program Files\\App -L -S"),
                NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi);
    // warn
}
 | |
| 
WinAPI.LoadLibrary
(C) 
The  SearchPath()function is used to retrieve a path to a DLL for
a subsequentLoadLibrary()call. | 
#include <windows.h>
HINSTANCE test() {
  char filePath[100];
  SearchPath(NULL, "file.dll", NULL, 100, filePath, NULL);
  return LoadLibrary(filePath); // warn
}
 | |
| 
WinAPI.WideCharToMultiByte
(C) 
Buffer overrun while calling  WideCharToMultiByte(). The size of
the input buffer equals the number of characters in the Unicode string, while
the size of the output buffer equals the number of bytes.Source: MSDN: WideCharToMultiByte function. | 
#include <windows.h>
void test() {
  wchar_t ws[] = L"abc";
  char s[3];
  WideCharToMultiByte(CP_UTF8, 0, ws, -1, s,
                      3, NULL, NULL); // warn
}
 | 
optimization
| Name, Description | Example | Progress | 
| 
optimization.PassConstObjByValue
(C, C++) 
Optimization: It is more effective to pass constant parameter by reference to
avoid unnecessary object copying. | 
struct A {};
void f(const struct A a); // warn
 | |
| 
optimization.PostfixIncIter
(C++) 
Optimization: It is more effective to use prefix increment operator with
iterator.
 Source: Scott Meyers "More Effective C++", item 6: Distinguish between prefix and postfix forms of increment and decrement operators. | 
#include <vector>
void test() {
  std::vector<int> v;
  std::vector<int>::const_iterator it;
  for(it = v.begin(); 
      it != v.end(); it++) {}; // warn
}
 | |
| 
optimization.MultipleCallsStrlen
(C) 
Optimization: multiple calls to  strlen()for a string in an
expression. It is more effective to hold a value returned
fromstrlen()in a temporary variable. | 
#include <string.h>
void test(const char* s) {
  if (strlen(s) > 0 &&
      strlen(s) < 7) {}; // warn
}
 | |
| 
optimization.StrLengthCalculation
(C++) 
Optimization: it is more efficient to use  string::length()to
calculate the length of anstd::string. | 
#include <string>
#include <string.h>
void test() {
  std::string s;
  if (strlen(s.c_str()) != 0) {}; // warn
}
 | |
| 
optimization.EmptyContainerDetect
(C++) 
Optimization: It is more efficient to use containers  empty()method to identify an empty container. | 
#include <list>
void test() {
  std::list<int> l;
  if (l.size() != 0) {}; // warn
}
 |