From 8dae9bcbf7df849d110ce7201ca96f7759dece61 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20Marjam=C3=A4ki?= Date: Wed, 29 Dec 2010 18:03:57 +0100 Subject: [PATCH] Cppcheck Design: some more tweaks --- man/cppcheck-design.docbook | 44 +++++++++++++++++++++++++++++-------- 1 file changed, 35 insertions(+), 9 deletions(-) diff --git a/man/cppcheck-design.docbook b/man/cppcheck-design.docbook index f55c4f1f9..cd674812a 100644 --- a/man/cppcheck-design.docbook +++ b/man/cppcheck-design.docbook @@ -23,13 +23,16 @@
Introduction - This article contains an overview of how Cppcheck works. + The goal with this article is to give users an idea of how Cppcheck + works. - The primary goal is that Cppcheck won't write any false warnings. - This means that when an error is reported there must definitely be a bug - in the code. + Cppcheck is a static analysis tool that tries to completely avoid + false warnings. A false warning is when the tool reports that there is an + error even though there is no error. - The secondary goal is to detect as many bugs as possible. + Cppcheck is a relatively simple tool. I hope that this article will + highlight that it is possible to avoid false warnings with simple + analysis.
@@ -48,15 +51,38 @@ int days(int hours) therefore he could see that "23" is wrong. A tool will probably not know that there are 24 hours in a day. - A tool that tries to guarantee that all bugs are found could write a - warning message for every "suspicious" calculation in the program. It - might correctly report that "hours / 23" is wrong but incorrectly warn - about "hours / 24". + A tool that tries to detect all bugs could write a warning message + for every calculation in the program. Then it will correctly report that + "hours / 23" is wrong but incorrectly warn about "hours / 24". Cppcheck will only write a warning message if it can determine that the calculation is wrong. In this case, no error will be written.
+
+ Control flow analysis + + Control flow analysis is when the tool tries to determine if certain + execution paths are possible. + + void f(int x) +{ + if (x == 1) + f1(); + if (x & 2) + f2(); +} + + The function has 3 possible execution paths. The analysis you do in + your head when you determine that there are 3 possible execution paths is + "control flow analysis". + + When you review code you will probably use "control flow analysis" + in your head to determine if there are bugs or not. + + The control flow analysis in Cppcheck is quite simple. +
+
Buffer overflows