Writing Cppcheck rules
Part 2 - The Cppcheck data representation
Daniel
Marjamäki
Cppcheck
2010
Introduction
In this article I will discuss the data representation that Cppcheck
uses.
The data representation that Cppcheck uses is specifically designed
for static analysis. It is not intended to be generic and useful for other
tasks.
See the data
There are two ways to look at the data representation at
runtime.
Using --rule=.+ is one way. All tokens are written on a line:
int a ; int b ;
Using --debug is another way. The tokens are line separated in the
same way as the original code:
1: int a@1 ;
2: int b@2 ;
In the --debug output there are "@1" and "@2" shown. These are the
variable ids (Cppcheck gives each variable a unique id). You can ignore
these if you only plan to write rules with regular expressions, you can't
use variable ids with regular expressions.
In general, I will use the --rule=.+ output in
this article because it is more compact.
Some of the simplifications
The data is simplified in many ways. The intention with the
simplifications is to remove all information that the rules don't
use.
The best way to see what simplifications there are is to look at the
doxygen documentation for the Tokenizer. Some developer information such
as doxygen output is available online at
http://cppcheck.sf.net/devinfo.html
Preprocessing
The Cppcheck data is preprocessed. There are no comments, #define,
#include, etc.
Original source code:
#define SIZE 123
char a[SIZE];
The Cppcheck data for that is:
char a [ 123 ] ;
typedef (Tokenizer::simplifyTypedef)
The typedefs are simplified.
typedef char s8;
s8 x;
The Cppcheck data for that is:
; char x ;
Calculations (Tokenizer::simplifyCalculations)
Calculations are simplified.
int a[10 + 4]; => int a [ 14 ] ;
Variables
Variable declarations (Tokenizer::simplifyVarDecl)
Variable declarations are simplified. Only one variable can be
declared at a time. The initialization is also broken out into a
separate statement.
int *a=0, b=2; => int * a ; a = 0 ; int b ; b = 2 ;
This is even done in the global scope. Even though that is
invalid in C/C++.
Known variable values
(Tokenizer::simplifyKnownVariables)
Known variable values are simplified.
void f()
{
int x = 0;
x++;
array[x + 2] = 0;
}
The --debug output for that is:
1: void f ( )
2: {
3: ; ;
4: ;
5: array [ 3 ] = 0 ;
6: }
The variable x is removed because it is not used after the
simplification. It is therefore redundant.
The "known values" doesn't have to be numeric. Variable aliases,
pointer aliases, strings, etc should be handled too.
Example code:
void f()
{
char *a = strdup("hello");
char *b = a;
free(b);
}
The --debug output for that is:
1: void f ( )
2: {
3: char * a@1 ; a@1 = strdup ( "hello" ) ;
4: ; ;
5: free ( a@1 ) ;
6: }
if/for/while
Braces in if/for/while-body
(Tokenizer::simplifyIfAddBraces)
Cppcheck makes sure that there are always braces in if/for/while
bodies.
if (x) f1(); => if ( x ) { f1 ( ) ; }
No else if
The simplified data representation doesn't have "else
if".
void f(int x)
{
if (x == 1)
f1();
else if (x == 2)
f2();
}
The --debug output:
1: void f ( int x@1 )
2: {
3: if ( x@1 == 1 ) {
4: f1 ( ) ; }
5: else { if ( x@1 == 2 ) {
6: f2 ( ) ; } }
7: }
Condition is always true / false
Conditions that are always true / false are simplified.
void f()
{
if (true) {
f1();
}
}
The Cppcheck data is:
void f ( ) { { f1 ( ) ; } }
Another example:
void f()
{
if (false) {
f1();
}
}
The debug output:
void f ( ) { }
Assignments (Tokenizer::simplifyIfAssign)
Assignments within conditions are broken out from the
condition.
void f()
{
int x;
if ((x = f1()) == 12) {
f2();
}
}
The "x = f1()" is broken out. The --debug
output:
1: void f ( )
2: {
3: int x@1 ;
4: x@1 = f1 ( ) ; if ( x@1 == 12 ) {
5: f2 ( ) ;
6: }
7: }
Replacing the "if" with "while" in the above example:
void f()
{
int x;
while ((x = f1()) == 12) {
f2();
}
}
The "x = f1()" is broken out twice. The
--debug output:
1: void f ( )
2: {
3: int x@1 ;
4: x@1 = f1 ( ) ; while ( x@1 == 12 ) {
5: f2 ( ) ; x@1 = f1 ( ) ;
5:
6: }
7: }