CDT/Archive/designs/StaticAnalysis/CheckerIdeas

This page is collection of ideas for checker that can be implemented for C/C++ Static Analysis in CDT (Codan). Feel free to add your own ideas or links.

Checkers

Unused #include

 #include <stdio.h>
 int main() { return 1; }

Malloc called without sizeof consideration

 int * arr = (int *)malloc(20); // should be malloc(20*sizeof(int))

Assigned to itself

 x = x;

Result of comparison is constant

 (x==x)
 (!x && x)

Redundant comparison operations

 (!(!x))
 (x!=0 || 0!=x)

Comparison is used on "boolean" values

 0<x<3
 !x>5

Consequent re-assignment without usage (sub-case of Value is never used after assignment)

 x=1;
 x=2;

Value is never used after assignment

 int x;
 x=23;
 return;

Unused local variable

local variable is not used in function

Undeclared variable

This is compiler error - catch early and have a quick fix so Ctrl-1 work like in java, I so like java quick fixes and code generation!

 { x = 5; }

Quick fix

 { int x = 5; }

Buffer over flow

This code is unsafe

 char x[10];
 char y[15];
 memcpy(x,y,20);

Invalid value assignment to enum

enum ee { a, b };
ee dd;
dd = 7;

Reduce scope

When a variable or a function has a greater scope than where it is used, that scope may be reduced.

For example: a variable with file scope that is only used in one function, can be declared static with function scope.

Or, a function that is only used in one file, may be declared with the static keyword, and its declaration removed from header files included by other files.

Links

• http://www.aristeia.com/ddjpaper1.html