Part 2 - The Cppcheck data representation
Daniel
Marjamäki
Cppcheck
2010
Introduction
In this article I will discuss the data representation that Cppcheck
uses.
The data representation that Cppcheck uses is specifically designed
for static analysis. It is not intended to be generic and useful for other
tasks.
See the data
There are two ways to look at the data representation at
runtime.
Using --rule=.+ is one way.
All tokens are written on a line:
int a ; int b ;
Using --debug is another way.
The tokens are line separated in the same way as the original code:
1: int a@1 ;
2: int b@2 ;
In the --debug output there are
"@1" and "@2" shown. These are the
variable ids (Cppcheck gives each variable a unique id). You can ignore
these if you only plan to write rules with regular expressions, you can't
use variable ids with regular expressions.
In general, I will use the --rule=.+
output in this article because it is more compact.
Some of the simplifications
The data is simplified in many ways.
Preprocessing
The Cppcheck data is preprocessed. There are no comments, #define,
#include, etc.
Original source code:
#define SIZE 123
char a[SIZE];
The Cppcheck data for that is:
char a [ 123 ] ;
typedef
The typedefs are simplified.
typedef char s8;
s8 x;
The Cppcheck data for that is:
; char x ;
Calculations
Calculations are simplified.
int a[10 + 4];
The Cppcheck data for that is:
int a [ 14 ] ;
Variables
Variable declarations
Variable declarations are simplified. Only one variable can be
declared at a time. The initialization is also broken out into a
separate statement.
int *a=0, b=2;
The Cppcheck data for that is:
int * a ; a = 0 ; int b ; b = 2 ;
This is even done in the global scope. Even though that is
invalid in C/C++.
Known variable values
Known variable values are simplified.
void f()
{
int x = 0;
x++;
array[x + 2] = 0;
}
The --debug output for that
is:
1: void f ( )
2: {
3: ; ;
4: ;
5: array [ 3 ] = 0 ;
6: }
The variable x is removed because it is not used after the
simplification. It is therefore redundant.
The "known values" doesn't have to be numeric. Variable aliases,
pointer aliases, strings, etc should be handled too.
Example code:
void f()
{
char *a = strdup("hello");
char *b = a;
free(b);
}
The --debug output for that
is:
1: void f ( )
2: {
3: char * a@1 ; a@1 = strdup ( "hello" ) ;
4: ; ;
5: free ( a@1 ) ;
6: }
if/for/while
Braces in if/for/while-body
Cppcheck makes sure that there are always braces in if/for/while
bodies.
if (x)
f1();
The Cppcheck data for that is:
if ( x ) { f1 ( ) ; }
No else if
The simplified data representation doesn't have "else
if".
void f(int x)
{
if (x == 1)
f1();
else if (x == 2)
f2();
}
The --debug output:
1: void f ( int x@1 )
2: {
3: if ( x@1 == 1 ) {
4: f1 ( ) ; }
5: else { if ( x@1 == 2 ) {
6: f2 ( ) ; } }
7: }
Condition is always true / false
Conditions that are always true / false are simplified.
void f()
{
if (true) {
f1();
}
}
The Cppcheck data is:
void f ( ) { { f1 ( ) ; } }
Another example:
void f()
{
if (false) {
f1();
}
}
The debug output:
void f ( ) { }
Assignments
Assignments within conditions are broken out from the
condition.
void f()
{
int x;
if ((x = f1()) == 12) {
f2();
}
}
The x=f1() is broken out. The
--debug output:
1: void f ( )
2: {
3: int x@1 ;
4: x@1 = f1 ( ) ; if ( x@1 == 12 ) {
5: f2 ( ) ;
6: }
7: }
Replacing the "if" with "while" in the above example:
void f()
{
int x;
while ((x = f1()) == 12) {
f2();
}
}
The x=f1() is broken out twice. The
--debug output:
1: void f ( )
2: {
3: int x@1 ;
4: x@1 = f1 ( ) ; while ( x@1 == 12 ) {
5: f2 ( ) ; x@1 = f1 ( ) ;
5:
6: }
7: }
Comparison with >
Comparisons are simplified. The two conditions in this example
are logically the same:
void f()
{
if (x < 2);
if (2 > x);
}
Cppcheck data doesn't use > for
comparisons. It is converted into < instead. In
the Cppcheck data there is no difference for 2>x
and x<2.
1:
2: void f ( )
3: {
4: if ( x < 2 ) { ; }
5: if ( x < 2 ) { ; }
6: }
A similar conversion happens when >= is
used.
if (x) and if (!x)
If possible a condition will be reduced to x or !x. Here is an
example code:
void f()
{
if (!x);
if (NULL == x);
if (x == 0);
if (x);
if (NULL != x);
if (x != 0);
}
The --debug output is:
1: void f ( )
2: {
3: if ( ! x ) { ; }
4: if ( ! x ) { ; }
5: if ( ! x ) { ; }
6:
7: if ( x ) { ; }
8: if ( x ) { ; }
9: if ( x ) { ; }
10: }