Daniel Marjamäki Cppcheck 2010

This is a short guide for developers who want to write Cppcheck rules. There are two ways to write rules. Regular expressions Simple rules can be created by using regular expressions. No compilation is required. C++ Advanced rules must be created with C++. These rules must be compiled and linked statically with Cppcheck. It is a good first step to use regular expressions. It is easier. You'll get results quicker. Therefore this guide will focus on regular expressions.

The data used by the rules are not the raw source code. Cppcheck will read the source code and process it before the rules are used. Cppcheck is designed to find bugs and dangerous code. Stylistic information such as indentation, comments, etc are filtered out at an early state. You don't need to worry about such stylistic information when you write rules. Between each token in the code there is always a space. For instance the raw code "1+f()" is processed into "1 + f ( )". The code is simplified in many ways. For example: The templates are instantiated The typedefs are handled There is no "else if". These are converted into "else { if.." The bodies of "if", "else", "while", "do" and "for" are always enclosed in "{" and "}" A declaration of multiple variables is split up into multiple variable declarations. "int a,b;" => "int a; int b;" There is no sizeof NULL is replaced with 0 Static value flow analysis is made. Known values are inserted into the code. .. and many more The simplifications are made in the Cppcheck Tokenizer. For more information see: http://cppcheck.sourceforge.net/doxyoutput/classTokenizer.html

Simple rules can be defined through regular expressions. Cppcheck uses PCRE to handle regular expressions.

Let's create a regular expression that checks for: if (p) free(p); The condition is often redundant, on most implementations it is valid to free a NULL pointer. The regular expression must match the simplified code. Create a source file that has the bad code: void f() { if (p) free(p); } To see the simplified code use cppcheck --debug dealloc.cpp. ##file dealloc.cpp 1: void f ( ) { 2: if ( p ) { 3: free ( p ) ; } 4: } In the --debug output there are line feeds and line numbers. But the newlines and line numbers are only there to make the output easier to read. The real simplified code is written on a single line: void f ( ) { if ( p ) { free ( p ) ; } } Now we can use cppcheck --rule to develop a regular expression. $ cppcheck --rule="if \( p \) { free \( p \) ; }" dealloc.cpp Checking dealloc.cpp... [dealloc.cpp:2]: (style) found 'if ( p ) { free ( p ) ; }' Feel free to improve the pattern. Above, the pointer name must be "p" to get a match.

A rule consist of: a pattern to search for. an error message that is reported when pattern is found - this is optional, if none is given a default message is written. Here is a simple example: <?xml version="1.0"?> <rule version="1"> <pattern>if \( p \) { free \( p \) ; }</pattern> <message> <id>redundantCondition</id> <severity>style</severity> <summary>Redundant condition. It is valid to free a NULL pointer.</summary> </message> </rule> The message, id, severity and summary elements are optional. But highly recommended. If you save that xml data in dealloc.rule you can test this rule: $ cppcheck --rule-file=dealloc.rule dealloc.cpp Checking dealloc.cpp... [dealloc.cpp:2]: (style) Redundant condition. It is valid to free a NULL pointer.