Teaching cppcheck about `BOOST_THROW_EXCEPTION` and
`boost::throw_exception`, and using noreturn information from libraries
in value flow.
This fixes false positive nullPointerRedundantCheck with the following
code:
```
void throwexception(int * buf)
{
if (!buf)
boost::throw_exception(std::bad_alloc());
*buf = 0;
}
```
A missing definition for g_assert_cmp*() causes syntax errors if code
like g_assert_cmpint(a, ==, b); is encountered.
The function g_hash_table_iter_replace() does not have to be marked
with leak-ignore since the memory could be freed later if corresponding
functions are present in the GHashTable. Since we can not know if this
is the case we have to assume that the memory is freed to avoid false
positives. The same is true for g_hash_table_insert() and
g_hash_table_replace().
* openssl.cfg: Add OpenSSL library configuration with tests
Reference: https://www.openssl.org/docs/man1.1.1/man3/
* openssl.cfg: Add some configurations for EVP functions
Add alloc/dealloc configuration for EVP_CIPHER_CTX_new and
EVP_CIPHER_CTX_free.
Add configuration for encryption functions that are used in example code
which is added to the tests.
* libsigc++.cfg: Add configuration for library libsigc++
Reference: https://libsigcplusplus.github.io/libsigcplusplus/
* Make code compatible with libsigc++-2.0 instead of 3.0
Since Version 3.0 C++14 is required which is not (fully) supported in
some older GCC versions.
TODO:
Somehow Cppcheck fails to print an ignoredReturnValue message when the
return value is not used (see ticket
https://trac.cppcheck.net/ticket/9369 )
This will now warn when doing something like this:
```cpp
template <class T, class K, class V>
const V& get_default(const T& t, const K& k, const V& v) {
auto it = t.find(k);
if (it == t.end()) return v;
return it->second;
}
const int& bar(const std::unordered_map<int, int>& m, int k) {
auto x = 0;
return get_default(m, k, x);
}
```
The lifetime warning is considered inconclusive in this case.
I also updated valueflow to no tinject inconclusive values unless `--inconclusive` flag is passed. This creates some false negatives because library functions are not configured to not modify their input parameters, and there are some checks that do not check if the value is inconclusive or not.
-Add iterator end patterns
-Add/fix size and access functions
-Remove marking QList and QStringList as std-like strings
-QStringList configuration now inherits from QList like it is actually the case
-Add tests
It is hard to find good references, one that describes it a bit can
be found here:
https://manpages.ubuntu.com/manpages/bionic/man3/xmalloc.3pub.html
xfree() can be used instead of free().
A check, to verify that a memory leak is found if the memory allocated
via xmalloc() is not freed, has also been added.
* Use library for memleak checks
Change memleakOnRealloc and leakReturnValNotUsed to use library
configuration instead of hardcoding "realloc".
In order to do so, some care needs to be taken when matching for a
reallocation function, since it can no longer be assumed that the input
to be allocated is the first argument of the function. This complicates
getReallocationType() and checkReallocUsage() but is necessary in order
to handle for example freopen() properly.
Also, refactor memleakOnRealloc check to reduce duplicated code when
checking "a" and "*a". When doing so, extending the check to look for
arbitrary number of "*" can be done for free (just change an if
statement to a while statement). Most likely, this is an unusual case in
real world code.
* Remove redundant whitespace in Token::Match()
* Run on simplified checks
* Fix cppcheck warning
* Improve configuration of g_try_realloc and g_try_realloc_n
* Mark g_realloc and similar functions as realloc functions
* Remove g_new, g_new0, etc as <alloc> functions, these are defined as
macros and handled as the functions they're expanded to.
* Add tests. TODO tests will be resolved by using the library
configuration in the checker.
* Allow to configure realloc like functions
* memleakonrealloc: Bring back tests.
The old memleak checker was removed, and the tests for it was removed in
commit 9765a2dfab. This also removed the
tests for memleakOnRealloc. Bring back those tests, somewhat modified
since the checker no longer checks for memory leaks.
* Add realloc to mem leak check
* Add tests of realloc buffer size
* Configure realloc functions
* Add test of freopen
* Allow to configure which element is realloc argument
* Fix wrong close in test
cppcheck now warns for this
* Update manual
* Update docs
* Rename alloc/dalloc/realloc functions
Naming the member function realloc caused problems on appveyor. Rename
the alloc and dealloc functions as well for consistency.
* Change comparisson order
* Remove variable and use function call directly
* Create temporary variable to simplify
* Throw mismatchError on mismatching allocation/reallocation
* Refactor to separate function
* Fix potential nullptr dereference
As pointed out by cppcheck.
* Fix#9047 (c-style casts before malloc)
Note that there are still no warnings for c++-style casts
* Fix memleak check with casts of assignments in if-statements
* Fix possible null pointer dereference
As pointed out by cppcheck.
* Add check of astOperand2 when removing casts
This is similar to how it is done in other checks.
Some POSIX and Windows functions require buffers of at least some
specific size. This is now possible to configure via for example this
minsize configuration: `<minsize type="value" value="26"/>`.
The range for valid buffer size values is 1 to LLONG_MAX
(9223372036854775807)
- Remove redundant function configurations for the same function since
it is not (yet) possible to configure overloaded functions. Instead mark
the optional arguments with `default="0"` so the configuration works
with a different number of arguments.
- Add documentation to boost.cfg (links and function declarations).
- Rearranged configurations so functions, defines, ... are together now.
- Add `direction` for function arguments where applicable.
- Add some tests to boost.cpp.
strcpy_s belongs to the standard so it must be in std.cfg instead of
windows.cfg.
Configuration for strcpy_s has been improved and tests were added.
Found by daca@home
* std.cfg: Add further argument directions (in, out, inout).
* testlibrary.cpp: Add test for function argument direction configuration.
* std.cfg: runastyle and add some more direction configurations.
* library.h: Add documentation for function argument direction enum.
* Do not use "direction" library information for pointer arguments.
Also fix further unmatched uninitvar messages in std configuration
tests.
* std.cfg: Add more argument direction configurations.
* test/cfg/std.c: Add test for argument direction configuration.
* astutils.cpp: Only ignore pointer arguments for out/inout arguments.
* library.h: Use suggested documentation for argument direction enum.
Qt defines `Q_NULLPTR` with `nullptr` if it is available, otherwise with `NULL`.
Since there seems to be no (sane) way to configure it the same way in the library configuration it is just defined with `NULL`.
Use `--check-library` for all tests as it was done before.
Re-enable all tests in runtests.sh again.
The regressions where runtests.sh would fail are disabled via "FIXME"
comment in the inline suppression comment.
As discussed in https://trac.cppcheck.net/ticket/8931 a regression test is added
to the test/cfg/runtests.sh script to make sure that unmatchedSuppression messages result in an Cppcheck exit code that signals a failure.
On linux systems (like travis) Qt often seems to be built with the option "reduce_relocations" which requires an application using it to specify the option "-fPIC".
To be able to use real Qt-Code in "test/cfg/qt.cpp" and still do a
syntax check the Qt settings are read out via pkg-config now if it is
available. This way the test now can contain Qt macros and functions and
the syntax check can still be used.
Additionally the same options as for the other tests are used now for
the Qt config tests.
Installing the package "qtbase5-dev" should be enough to enable the
syntax checks (already installed for travis tests).
* #4241: Check for address of single character passed as string
Add a check that address of a single character is not passed as argument
to argument marked as strings (using strz). The check does not warn if
the address of a character with known value '\0'.
Since ValueFlow currently does not handle global constants (see #7597),
do not warn if the variable is global to avoid FPs when the address of
a global variable assigned to '\0' is passed to a function expecting a
string.
Remove comment in docs saying strz is unused.
* Change asdf to Hello world
* Add test of address to first element in string
* Add error reporting function to getErrorMessages
* Fix strings in test
Commit 5cc8da2db4 introduced syntax checking of xml-files. This broke
running the file directly in the test/cfg folder since it assumed the
config files to check were located in cfg in the current working
directory. Fix this by adding a variable that holds the correct path.
Make the names of uninitvar_* functions consistent and fix typos.
Remove completely redundant functions/tests. Combine according tests if
they are not completely redundant.
minsize with argvalue for arg 2 which is a char pointer makes no sense.
Changing it to minsize with strlen for arg 2 results in false positives
(and i think false negatives too).
In std.c a test with a valid vsprintf usage is added that would result
in a FP when minsize with strlen for arg 2 would be used.
Add configuration and tests for LocalAlloc, LocalFree and some other
Local* functions.
LocalReAlloc is currently not configured as an alloc/dealloc function
(like realloc is not configured in std.cfg), i am not sure how to
correctly configure it.
Enhance *Equal/*Compare/*Copy/*Move/*Zero/*Fill memory functions to
catch buffer access out of bounds errors and ignored return values.
Replaced some function configuration by according defines as it is done
in windows to avoid redundant (and error prone) configurations.
Add configuration for G_UNLIKELY and G_LIKELY to avoid syntax errors
when these macros are used as condition without enclosing brackets.
Add test file to verify Gtk library configuration. Syntax check for the
test file is only done when Gtk+2.0 or Gtk+3.0 is found and working.
Tested on Cygwin and on Ubuntu 16.04.
Add Windows Socket 2 type/function configuration. There are still many
(microsoft specific) socket functions that are not yet configured.
Add configuration for GetUserName(), GetWindowText() and _fileno().
On Windows __wchar_t is a synonym for wchar_t, so an according define is
added.
wxDebugContext is only defined if wxUSE_DEBUG_CONTEXT is 1, so otherwise
just skip it for syntax checking because it will fail.
Change wxT to wxT_2 and add wxT_2 to the config to remove a warning
during syntax check and be more compatible with newer/older wxwidgets
versions.
Be more precise when replacing function like macros, fix redundant macro
definition for "_".
First resolved TODO in std.c is obsolete since the "res" variable is used later
and there is therefore no warning issued.
Second resolved TODO in std.c: A warning for uninit variables is issued by
cppcheck, so this check can be enabled. Since assert() has no noreturn configuration
(currently a useful configuration is not really possible, see ticket 8329) the
check-library message is suppressed.
Add equivalent tests for the wide character string functions like they
are already done for the normal string functions.
Fixed some issues with the configuration of the wide character string
functions that arised through the tests and were already fixed for the
normal string functions.
For the syntax check g++ needs to know the wxWidgets include paths which
are retrieved via wx-config. If includes are missing or not working the
syntax check is skipped.
wxwidgets.cpp: Fixed syntax, includes and added code so the syntax check
does not fail if some special features are not present.
Add test file for wxwidgets configuration, fix found issues and enhance
the cfg a bit:
Fix declarations in comments for wxLog* functions.
Merge the two wxTextFile::Create overloaded function configurations into
one that works for both now.
Removed use-retval attribute from wxBoxSizer::AddSpacer and
wxButton::SetDefault configuration since the functions have side effects
and there is no need to use the return value.
Add some function configurations, the macro _(str) and POD wxLogLevel.
Add function configurations with tests for:
GetLocalTime, GetSystemTime, GetLastError, SetLastError,
AllocateAndInitializeSid, FreeSid, HeapAlloc, HeapReAlloc, HeapFree,
HeapSize, HeapValidate and GetProcessHeap.
test/cfg/runtests.sh: Enable --inconclusive for the windows tests to
avoid some issues in the future.
Add configuration for the deprecated strlwr/strupr functions with
according warning.
test/cfg/windows.cpp: Added tests for strlwr and strupr. Moved function
call that does not return (FreeLibraryAndExitThread) to the end of the
function to fix analysis that was silently aborted at that point
(reported as issue #8378).
* posix library: Add strtok tests
In the posix library there is the same configuration for strtok but a
warning is added.
* posix.cfg: Remove redundant configuration for strtok, add comment.
* checkio: Fixed potential usage of invalid iterator.
* formatted the code.
A ticket about FN (invalidIterator1) is created at https://trac.cppcheck.net/ticket/8373
Implemented tests for the following windows configurations (more will
follow):
-Semaphore usage
-lstrcat function configuration
-_countof macro configuration
-Mutex usage
-Library usage (LoadLibrary, GetProcAddress, ...)
I intentionally removed the second access() configuraion because it was
missing the use-retval attribute. But calling access() without using the
return value is absolutely senseless.
I added tests to posix.c to verify the correct configuration of
access().
* Fix#7504: posix: open() was twice in configuration file
This fixes ticket #7504: Problems with the open function were not always
detected because the open function was twice in posix.cfg and only the
second configuration was used by cppcheck. Like suggested now only
one configuration is used and the third parameter has a default value
and is thereby optional.
use-retval has been removed to avoid duplicate warnings because the
alloc/dealloc configuration already warns about unused retval.
According tests to verify that open is configured
correctly now have been added to test/cfg/posix.c.
* posix.cfg: open(): Add TODO for use-retval configuration
orbitcowboy
Daniel Marjamäki
Jens Yllman
Ken-Patrick Lehrmann
Sebastian
Steven Hoving
Paul Fultz II
Dmitry-Me
Armin Müller
KenPatrickLehrmann
Rikard Falkeborn
Martin Ettl
amai2012
versat
Matthias Krüger
orbitcowboy