cppcheck Activity
Static source code analysis tool for C and C++ code
Brought to you by:
danielmarjamaki
Activity for cppcheck
-
Rodri posted a comment on discussion General Discussion
Hi, I found a false negative in Cppcheck 2.21.0 and 2.22 dev when destruction of a temporary object changes a global value to zero before a division. Affected tool Cppcheck 2.21.0; also reproduced with Cppcheck 2.22 dev Affected checker Cppcheck CheckOther::checkZeroDivision (zerodiv / zerodivcond) Minimal reproducer int global; struct Value { Value() { global = 1; } ~Value() { global = 0; } }; int test() { Value{}; return 1 / global; } Reproduction command cppcheck --version cppcheck --enable=warning...
-
Hi, I found a false negative in Cppcheck 2.21.0 and 2.22 dev when a constant argument makes a division inside a function-template instantiation divide by zero. Affected tool Cppcheck 2.21.0; also reproduced with Cppcheck 2.22 dev Affected checker Cppcheck CheckOther::checkZeroDivision (zerodiv / zerodivcond) Minimal reproducer bool unknown(); template <class T> void divide(T value) { if (unknown()) value = 1 / (value - 5); } void test() { divide<int>(5); } Reproduction command cppcheck --version...
-
Hi, I found a false negative in Cppcheck 2.21.0 when a switch case constrains the divisor to zero. Affected tool Cppcheck 2.21.0 Affected checker Cppcheck CheckOther::checkZeroDivision (zerodiv / zerodivcond) Minimal reproducer int divide_in_zero_case(int value) { switch (value) { case 0: return 1 / value; default: return 0; } } Reproduction command cppcheck --version cppcheck --enable=warning --std=c11 --checkers-report=checkers.txt --template='{file}:{line}:{column}: [{id}] {message}' cppcheck-zerodiv-fn-switch-case.c...
-
Hi, I found a false negative in Cppcheck 2.21.0 and 2.22 dev when a helper writes zero through a pointer before the pointed-to value is used as a divisor. Affected tool Cppcheck 2.21.0; also reproduced with Cppcheck 2.22 dev Affected checker Cppcheck CheckOther::checkZeroDivision (zerodiv / zerodivcond) Minimal reproducer void set_zero(int *value) { *value = 0; } int test() { int value; set_zero(&value); return 1 / value; } Reproduction command cppcheck --version cppcheck --enable=warning --std=c++17...
-
Hi, I found a false negative in Cppcheck 2.21.0 when two branch constraints establish that an expression used as a divisor is zero. Affected tool Cppcheck 2.21.0 Affected checker Cppcheck CheckOther::checkZeroDivision (zerodiv / zerodivcond) Minimal reproducer int divide_after_two_constraints(int x, int y) { if (y != 0) return 0; if (x + y != 0) return 0; return y / (x + y); } Reproduction command cppcheck --version cppcheck --enable=warning --std=c++11 --checkers-report=checkers.txt --template='{file}:{line}:{column}:...
-
Hi, I found a false negative in Cppcheck 2.21.0 and 2.22 dev when memset zeroes a local integer before it is used as a divisor. Affected tool Cppcheck 2.21.0; also reproduced with Cppcheck 2.22 dev Affected checker Cppcheck CheckOther::checkZeroDivision (zerodiv / zerodivcond) Minimal reproducer #include <cstring> int test() { int value = 1; std::memset(&value, 0, sizeof(value)); return 1 / value; } Reproduction command cppcheck --version cppcheck --enable=warning --std=c++17 --checkers-report=checkers.txt...
-
Hi, I found a false negative in Cppcheck 2.21.0 when a logical expression selects a zero-valued ternary branch. Affected tool Cppcheck 2.21.0 Affected checker Cppcheck CheckOther::checkZeroDivision (zerodiv / zerodivcond) Minimal reproducer int divide_after_logical_ternary(bool left, bool right) { int divisor = (left || right) ? 0 : 1; return 1 / divisor; } Reproduction command cppcheck --version cppcheck --enable=warning --std=c++11 --checkers-report=checkers.txt --template='{file}:{line}:{column}:...
-
CHR posted a comment on discussion General Discussion
We don't warn about the expression return true || divisor;, which is arguably dubious, but may be intentional, similar to if (false) etc. So we won't report the induced unreadVariable either.
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/15037
-
There is a deliberate bailout to allow "trivial" initialization.
-
See https://trac.cppcheck.net/ticket/14405
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/15036
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/15035
-
Hi, I found a false negative in Cppcheck 2.21.0 when a local variable is used only on the unevaluated right-hand side of a short-circuit expression. Affected tool Cppcheck 2.21.0 Affected checker unreadVariable Minimal reproducer int test() { int source = 0; int divisor = source; return true || divisor; } Reproduction command cppcheck --version cppcheck --enable=all --inconclusive --check-level=exhaustive --std=c++17 --output-format=xmlv2 mutant-cppcheck-unreadvariable-fn-short-circuit-rhs.cpp Current...
-
Cppcheck 2.21.0 misses a scalar store that is never read before a switch completes. The minimal trigger contains no loop or continue. Affected tool and checker Cppcheck 2.21.0, unreadVariable / CheckUnusedVar liveness handling. Minimal reproducer void test(int input) { int value; value = 0; switch (input) { case 0: break; default: break; } } Reproduction command cppcheck --enable=all --inconclusive --check-level=exhaustive --std=c++17 \ --template='{file}:{line}:{column}: [{id}] {message}' \ mutant-cppcheck-unreadvariable-fn-switch-dead-store.cpp...
-
Cppcheck 2.21.0 misses an initialization whose explicit floating conversion is overwritten before the initialized value is read. Affected tool and checker Cppcheck 2.21.0, redundantInitialization. Minimal reproducer void initialize(double &); float test() { double input; initialize(input); float value = (float)input; value = 3.14f; return value; } Reproduction command cppcheck --enable=all --inconclusive --check-level=exhaustive --std=c++17 \ --template='{file}:{line}:{column}: [{id}] {message}'...
-
Cppcheck 2.21.0 does not report a dead first store when its value is zero, although the otherwise equivalent nonzero store is reported as redundantAssignment. Affected tool and checker Cppcheck 2.21.0, redundantAssignment. Minimal reproducer void test() { int value; value = 0; value = 1; (void)value; } Reproduction command cppcheck --enable=all --inconclusive --check-level=exhaustive --std=c++17 \ --template='{file}:{line}:{column}: [{id}] {message}' \ mutant-cppcheck-redundantassignment-fn-zero-overwrite.cpp...
-
Hi, I found a false negative in Cppcheck 2.21.0 when a pointer allocated by scalar new is stored in an object member and released with delete[]. Affected tool Cppcheck 2.21.0 Affected checker mismatchAllocDealloc Minimal reproducer struct Owner { int *data; }; void test() { Owner owner; owner.data = new int; delete[] owner.data; } Reproduction command cppcheck --version cppcheck --enable=warning --inconclusive --check-level=exhaustive --std=c++17 --checkers-report=checkers.txt --template='{file}:{line}:{column}:...
-
Hi, I found a false negative in Cppcheck 2.21.0 when an indexed member access occurs between a scalar allocation and mismatched array deletion. Affected tool Cppcheck 2.21.0 Affected checker mismatchAllocDealloc Minimal reproducer struct Item { int value; }; void test() { Item *item = new Item; item[0].value = 0; delete[] item; } Reproduction command cppcheck --version cppcheck --enable=warning --inconclusive --check-level=exhaustive --std=c++17 --checkers-report=checkers.txt --template='{file}:{line}:{column}:...
-
Andrew C Aitchison posted a comment on discussion General Discussion
it is because in cfg/posix.cfg the return value is calculated as <returnValue type="int">arg1==0 &0</returnValue> Is it as simple as that ? That stanza is for <function name="ffsl,ffsll"> but not ffs itself.
-
Thanks for reporting, example added here: https://trac.cppcheck.net/ticket/11222
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/15022
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/15021
-
This seems like a bad fit for unreadVariable/unusedVariable because there would be no loop without declaring the variable. Currently we don't flag empty loop/if/... scopes.
-
Aaron Danen posted a comment on discussion General Discussion
void f() { const int y = ffs(5); if (y == 0) {} } analyzing with ./cppcheck --enable=all --library=posix throws Checking examples/ffs.c ... examples/ffs.c:3:11: style: Condition 'y==0' is always true [knownConditionTrueFalse] if (y == 0) {} ^ examples/ffs.c:2:22: note: Assignment 'y=ffs(5)', assigned value is 0 const int y = ffs(5); ^ examples/ffs.c:3:11: note: Condition 'y==0' is always true if (y == 0) {} ^ it is because in cfg/posix.cfg the return value is calculated as <returnValue type="int">arg1==0...
-
See https://trac.cppcheck.net/ticket/3172
-
See https://trac.cppcheck.net/ticket/12957
-
Hi, I found a false negative in Cppcheck 2.21.0 and 2.22 dev when both values from a structured binding are overwritten before either initial value is read. Affected tool Cppcheck 2.21.0; also reproduced with Cppcheck 2.22 dev Affected checker Cppcheck unreadVariable Minimal reproducer struct Pair { int left; int right; }; Pair make_pair(); int test() { auto [left, right] = make_pair(); left = 1; right = 2; return left + right; } Reproduction command cppcheck --version cppcheck --enable=style --inconclusive...
-
Hi, I found a false negative in Cppcheck 2.21.0 and 2.22 dev when a range-based for loop initializes its loop variable but the body never reads it. Affected tool Cppcheck 2.21.0; also reproduced with Cppcheck 2.22 dev Affected checker Cppcheck unreadVariable Minimal reproducer void test(int (&values)[3]) { for (int value : values) { } } Reproduction command cppcheck --version cppcheck --enable=style --inconclusive --std=c++17 --checkers-report=checkers.txt --template='{file}:{line}:{column}: [{id}]...
-
Hi, I found a false negative in Cppcheck 2.21.0 and 2.22 dev when an assignment's expression value is returned but the value stored in the local variable is never read. Affected tool Cppcheck 2.21.0; also reproduced with Cppcheck 2.22 dev Affected checker Cppcheck unreadVariable Minimal reproducer int make_value(); int test() { int value; return value = make_value(); } Reproduction command cppcheck --version cppcheck --enable=style --inconclusive --std=c++17 --checkers-report=checkers.txt --template='{file}:{line}:{column}:...
-
Hi, I found a false negative in Cppcheck 2.21.0 and 2.22 dev when a local lambda object is initialized but never read. Affected tool Cppcheck 2.21.0; also reproduced with Cppcheck 2.22 dev Affected checker Cppcheck unreadVariable Minimal reproducer void test(int value) { auto callback = [value] {}; } Reproduction command cppcheck --version cppcheck --enable=style --inconclusive --std=c++17 --checkers-report=checkers.txt --template='{file}:{line}:{column}: [{id}] {message}' cppcheck-unreadvariable-fn-lambda.cpp...
-
Hi, I found a false negative in Cppcheck 2.22 dev when an array allocated with new[] is returned by a function and deallocated with delete. Affected tool Cppcheck 2.22 dev (Git commit 71de6753d64f) Affected checker Cppcheck mismatchAllocDealloc Minimal reproducer int *allocate_array() { return new int[1]; } void release_array() { int *p = allocate_array(); delete p; } Reproduction command cppcheck --version cppcheck --enable=warning --std=c++17 --checkers-report=checkers.txt --template='{file}:{line}:{column}:...
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/15020
-
Marcin Pytel posted a comment on discussion General Discussion
I'm using cppcheck 2.21.1 Here is code: enum type { ONE, TWO, THREE, LAST = THREE, }; static_assert(THREE == LAST, "error"); int main() { static_assert(THREE == LAST, "error"); } When running cppcheck --enable=all I have issue: file.c:13:22: style: The comparison 'THREE == LAST' is always true because 'THREE' and 'LAST' represent the same value. [knownConditionTrueFalse] static_assert(THREE == LAST, "error"); Although the cppcheck has right, the assert is to make sure the last enumerator is set to...
-
Lugnier posted a comment on discussion Development
Hi all, I really don’t understand why you don’t want to integrate my modification… It drops down execution timings… I already send 2 mails… Can you please take my request into account! Cédric From: discussion@cppcheck.p.re.sourceforge.net discussion@cppcheck.p.re.sourceforge.net On Behalf Of Daniel Marjamäki Sent: 06 September 2026 13:03 To: [cppcheck:discussion] development@discussion.cppcheck.p.re.sourceforge.net Subject: [EXTERNAL EMAIL] [cppcheck:discussion] Cppcheck 2.22 EXPÉDITEUR EXTERNE /...
-
Daniel Marjamäki posted a comment on discussion Development
Let's start preparing for Cppcheck 2.22 release. My goal is to tag in ~ 14 days. If it looks stable enough. Let's try to focus on bug fixes for a while. Features I want to finish before the release: the "warning hash" related functionality to make it possible to create a baseline, to speedup cppcheck integration speedups in simplecpp, errorlogger, suppressions etc
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/15005
-
Hello malloc() initializes buf, but not buf[0]. The following is valid because buf is never dereferenced void f() { char *buf = (char *)malloc(1); if (!buf) return NULL; buf += 1; free(buf - 1); } however, cppcheck throws examples/buf.c:5:5: error: Memory is allocated but not initialized: buf [uninitdata] buf += 1; ^ For this similar code, cppcheck correctly throws no errors void f() { char *buf = (char *)malloc(1); if (!buf) return NULL; buf = buf + 1; free(buf - 1); } I think this is because checkuninitvar...
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/15003
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/15002
-
Looks like an instance of https://trac.cppcheck.net/ticket/14969 There already is a condition attached to the error message.
-
Hi, I found a false positive in Cppcheck 2.21.0 when a helper either calls a noreturn function or returns zero. Affected tool Cppcheck 2.21.0 Affected checker Cppcheck zerodiv Minimal reproducer void stop(void) __attribute__((noreturn)); int zero_or_stop(int condition) { if (condition) stop(); return 0; } int unreachable_division(int condition) { int zero = 0; if (zero_or_stop(condition)) return 1 / zero; return 0; } Reproduction command cppcheck --version cppcheck --enable=warning --std=c11 --checkers-report=checkers.txt...
-
Hi, I found a false positive in Cppcheck 2.21.0 when a division is guarded by an infeasible pointer equality. Affected tool Cppcheck 2.21.0 Affected checker Cppcheck zerodiv Minimal reproducer int divide_on_impossible_pointer_equality(char *pointer) { int zero = 0; if (pointer == pointer + 1) return 1 / zero; return 0; } Reproduction command cppcheck --version cppcheck --enable=warning --std=c11 --checkers-report=checkers.txt --template='{file}:{line}:{column}: [{id}] {message}' cppcheck-zerodiv-fp-impossible-pointer-equality.c...
-
Hi, I found a false positive in Cppcheck 2.21.0 when equivalent pointer expressions constrain an aliased divisor to be nonzero. Affected tool Cppcheck 2.21.0 Affected checker Cppcheck zerodiv Minimal reproducer int divide_after_alias_check(void *data) { int *value = (int *)data; *value = 0; if (*(int *)data == 0) return 0; return 1 / *value; } Reproduction command cppcheck --version cppcheck --enable=warning --std=c11 --checkers-report=checkers.txt --template='{file}:{line}:{column}: [{id}] {message}'...
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/14996
-
See https://trac.cppcheck.net/ticket/1025, https://trac.cppcheck.net/ticket/6294
-
See https://trac.cppcheck.net/ticket/8832, https://trac.cppcheck.net/ticket/14049
-
Hi, I found a false negative in Cppcheck 2.21.0 when the most-derived class default-initializes a virtual base member to zero. Affected checker Cppcheck zerodiv Minimal reproducer struct Base { int value; Base() : value(0) {} Base(int input) : value(input) {} }; struct Derived : virtual Base { int result; Derived() : Base(1), result(1 / value) {} }; struct MostDerived : Derived {}; void construct() { MostDerived object; } Reproduction command cppcheck --version cppcheck --enable=warning --std=c++11...
-
FALSE NEGATIVE: zerodiv misses a zero-initialized object member Hi, I found a false negative in Cppcheck 2.21.0 when a zero stored in an aggregate member is used as the divisor. Affected checker Cppcheck zerodiv Minimal reproducer struct Value { int number; }; int divide_by_zero_initialized_member() { Value value{0}; return 1 / value.number; } Reproduction command cppcheck --version cppcheck --enable=warning --std=c++11 --checkers-report=checkers.txt --template='{file}:{line}:{column}: [{id}] {message}'...
-
Hi, I found a false negative in Cppcheck 2.21.0 when a lambda captures a known zero value used as the divisor. Affected checker Cppcheck zerodiv Minimal reproducer int divide_by_lambda_capture() { int value = 0; return [=] { return 1 / value; }(); } Reproduction command cppcheck --version cppcheck --enable=warning --std=c++11 --checkers-report=checkers.txt --template='{file}:{line}:{column}: [{id}] {message}' cppcheck-zerodiv-fn-lambda-capture.cpp Current behavior Cppcheck produces neither a zerodiv...
-
Thanks, pr is here: https://github.com/cppcheck-opensource/cppcheck/pull/8813
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/14991
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/14990
-
Hello When analyzing this function with ./cppcheck test.c void f(void (*fptr)(void *)) { void *buf = malloc(1); (*fptr)(buf); } I get test.c:4:1: error: Memory leak: buf [memleak] } ^ even though the call to whatever fptr points to might free or take ownership of buf. However, this similar function correctly reports no errors. void f() { void *buf = malloc(1); g(buf); } It is because in lib/checkleakautovar.cpp the "do we call a function" code only matches functions that are called with the standard...
-
Fraser posted a comment on discussion General Discussion
With the following code when there is failure to allocate memory std::bad_alloc is thrown. The following test of the pointer is useless. This is from C++ Gotchas P172. I think it would be worthwhile to catch this with CPPCheck. int * ip = new int; if (ip) std::cout << "Always executed"; else std::cout << "Never executed";
-
this sort of code is analyzed properly and throws no errors typedef char ** STR; void f() { void *buf; STR s = (STR) &buf; } however, if the typedefs are not present and cppcheck doesn't know what STR is void f() { void *buf; STR s = (STR) &buf; } iscast() in tokenlist.cpp returns false for (STR) and the & is parsed as a bitwise AND, instead of the address-of operator. Because the & is a binary operator on unitialized data, this example throws a false positive: examples/uninit.c:3:19: error: Uninitialized...
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/14973
-
correctmost posted a comment on discussion General Discussion
I am seeing a false positive assertWithSideEffect warning when an assert contains a function pointer comparison. Here is sample code based on code from glib-networking: #include <assert.h> typedef struct { bool field; } st; static bool handshake () { st *priv; priv->field = true; return true; } int main() { bool (*fptr)() = handshake; assert (handshake == fptr); # warning: Assert statement calls a function which may have desired side effects: 'handshake'. [assertWithSideEffect] return 0; } I don't...
-
in cli/filelister.cpp:addFiles2 there is struct stat file_stat; if (stat(path.c_str(), &file_stat) == -1) return ""; // TODO: return error? if we returned an error here we could help users who are in this situation. I don't know what situation there would be for a user to specify the analysis of a nonexistent file. The most common thing would probably be people mistyping the name of a file or something similar, in which case proceeding as usual is probably an annoying behavior.
-
See https://github.com/cppcheck-opensource/cppcheck/pull/7893
-
gruenich posted a comment on discussion Development
Hi! PCRE is no longer maintained [1]. It is used for regular expression in the "HAVE_RULES" feature. Cppcheck should move away from using it, as more and more distributions remove its packages and it might break with every new compiler version. This would replace an external dependency by an already required C++ language standard. The idea is not new, Daniel posted the idea 8 years ago. It would be an answer to ticket #14902, too. It will be some work but will reduce the project complexity. [1] https://www.pcre.org...
-
What version of cppcheck did you use to create this bug? I tried to reproduce this using the current master branch and this issue you describe didn't happen, even with --library=qt with --debug it looks like its working properly now: using the first namespace Checking examples/namespace.cpp ... ##file examples/namespace.cpp 3: namespace TetheringState 4: { 5: constexpr int NUMBER_OF_RESPONSE_FIELDS@var1 = 2 ; 6: } 7: 8: namespace TetheringStateV2 9: { 10: constexpr int NUMBER_OF_RESPONSE_FIELDS@var2...
-
10) functionStatic doesn't detect that a member function requires an instance when its only "member use" is an unqualified call to a non-static sibling overload The provided example does not compile.
-
Long Huang posted a comment on discussion General Discussion
containerOutOfBounds flags container accesses gated by a same-named constant from a different namespace, pulled in via using namespace Minimal reproduction: #include <QStringList> namespace TetheringState { constexpr int NUMBER_OF_RESPONSE_FIELDS = 2; } namespace TetheringStateV2 { constexpr int NUMBER_OF_RESPONSE_FIELDS = 5; } void Parse(const QStringList& message) { using namespace TetheringStateV2; if(NUMBER_OF_RESPONSE_FIELDS == message.count()) { auto a = message.at(0); auto b = message.at(1);...
-
Thank you, there're a few more in the initial and 2nd posts that are still awaiting sourceforge moderator approval in this thread.
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/14958
-
9) danglingLifetime doesn't account for ownership being transferred to a longer-lived owner via std::move immediately after capturing a raw pointer Minimal reproduction: #include <memory> class Bar { public: virtual ~Bar() = default; }; class Consumer { public: explicit Consumer(std::unique_ptr<Bar> bar) : Owned(std::move(bar)) { } private: std::unique_ptr<Bar> Owned; }; class Foo { public: void CreateConsumer() { std::unique_ptr<Bar> tmp = std::make_unique<Bar>(); RawPtr = tmp.get(); ConsumerInstance.reset(new...
-
danglingLifetime doesn't account for ownership being transferred to a longer-lived owner via std::move immediately after capturing a raw pointer Minimal reproduction: #include <memory> class Bar { public: virtual ~Bar() = default; }; class Consumer { public: explicit Consumer(std::unique_ptr<Bar> bar) : Owned(std::move(bar)) { } private: std::unique_ptr<Bar> Owned; }; class Foo { public: void CreateConsumer() { std::unique_ptr<Bar> tmp = std::make_unique<Bar>(); RawPtr = tmp.get(); ConsumerInstance.reset(new...
-
danglingLifetime doesn't account for ownership being transferred to a longer-lived owner via std::move immediately after capturing a raw pointer Minimal reproduction: #include <memory> class Bar { public: virtual ~Bar() = default; }; class Consumer { public: explicit Consumer(std::unique_ptr<Bar> bar) : Owned(std::move(bar)) { } private: std::unique_ptr<Bar> Owned; }; class Foo { public: void CreateConsumer() { std::unique_ptr<Bar> tmp = std::make_unique<Bar>(); RawPtr = tmp.get(); ConsumerInstance.reset(new...
-
danglingLifetime doesn't account for ownership being transferred to a longer-lived owner via std::move immediately after capturing a raw pointer Minimal reproduction: #include <memory> class Bar { public: virtual ~Bar() = default; }; class Consumer { public: explicit Consumer(std::unique_ptr<Bar> bar) : Owned(std::move(bar)) { } private: std::unique_ptr<Bar> Owned; }; class Foo { public: void CreateConsumer() { std::unique_ptr<Bar> tmp = std::make_unique<Bar>(); RawPtr = tmp.get(); ConsumerInstance.reset(new...
-
Hah I was just trying to make a minimal example for the dangling lifetime issue. Here is what I have right now: class A {}; std::unique_ptr<A> saved; A *f(int x) { std::unique_ptr<A> tmp = std::make_unique<A>(); A *ptr = tmp.get(); saved = std::move(tmp); return ptr; } expected result: no errors actual result: error: Returning pointer to local variable 'tmp' that will be invalid when returning. [returnDanglingLifetime]
-
danglingLifetime doesn't account for ownership being transferred to a longer-lived owner via std::move immediately after capturing a raw pointer Minimal reproduction: #include <memory> class Bar { public: virtual ~Bar() = default; }; class Consumer { public: explicit Consumer(std::unique_ptr<Bar> bar) : Owned(std::move(bar)) { } private: std::unique_ptr<Bar> Owned; }; class Foo { public: void CreateConsumer() { std::unique_ptr<Bar> tmp = std::make_unique<Bar>(); RawPtr = tmp.get(); ConsumerInstance.reset(new...
-
Torsten Rupp posted a comment on discussion General Discussion
It seems non existing files are silently ignored if a least one source file is found. Reproduce: touch a.cpp cppcheck a.cpp missing.cpp echo $? Result: 0 Expected behavior: some error message like cppcheck: error: could not find 'missing.cpp' However this produce an error message as expected: cppcheck missing.cpp cppcheck: error: could not find or open any of the paths given. Thus if at least one source file is found all not existing other source files are silently ignored.
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/14957
-
Looks like an instance of https://trac.cppcheck.net/ticket/2565
-
Hi, I found a false negative regarding the rule resourceLeak. Cppcheck reports resourceLeak for the first program, but it misses the second program, which leaks file resources through a loop and early-return paths. First program #include <stdio.h> int main() { const FILE *a = fopen("good.c", "r"); if (!a) return 0; return 0; } Cppcheck reports: <error id="resourceLeak" severity="error" msg="Resource leak: a" ...> Second program #include <stdio.h> int main() { const FILE *a = fopen("good.c", "r");...
-
Hi, I found a false positive regarding the rule uninitvar. In the following C++ program, cppcheck reports that array a is uninitialized when a[0] is returned. However, a[0] is always initialized before the return statement. int main() { int a[2]; int i; for (i = 0; i < 3; i++) { if (i >= 0 && i < 2) a[i] = 0; } return a[0]; } The loop executes with i == 0, i == 1, and i == 2. For i == 0 and i == 1, the guard i >= 0 && i < 2 is true, so both a[0] and a[1] are assigned. The final iteration with i ==...
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/14956
-
Hi all, Aaron again :) on the code: void f() { int idx; int arr[3]; for (idx = 0; idx < 3; idx++) { break; } arr[idx] = 0; } cppcheck reports examples/breakfor.c:7:8: error: Array 'arr[3]' accessed at index 3, which is out of bounds. [arrayIndexOutOfBounds] arr[idx] = 0; ^ examples/breakfor.c:4:23: note: Assuming that condition 'idx<3' is not redundant for (idx = 0; idx < 3; idx++) { ^ examples/breakfor.c:7:8: note: Array index out of bounds arr[idx] = 0; ^ This is a false positive because in the...
-
The warnings appear with --inconclusive.
-
Hi, I found false negatives regarding the rule accessMoved. Cppcheck misses accesses through member-function calls after moving standard-library objects in the following programs. Case 1: moved vector queried with empty() #include <iostream> #include <utility> #include <vector> void foo(std::vector<int>); int main() { std::vector<int> v = {1, 2, 3}; foo(std::move(v)); if (!v.empty()) { std::cout << "Error: Vector not empty"; } } The vector v is moved into foo, then accessed by calling v.empty()....
-
Hi, I found a false negative regarding the rule resourceLeak. Cppcheck reports resourceLeak for the original program, but it misses a semantically similar case when the control flow reaches the return statement through a goto label. Original seed program #include <stdio.h> int main() { const FILE *a = fopen("good.c", "r"); if (!a) return 0; return 0; } Cppcheck reports: <error id="resourceLeak" severity="error" msg="Resource leak: a" ...> Reproducing program #include <stdio.h> int main() { const...
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/14950
-
wy163 posted a comment on discussion General Discussion
Hi, Below code will be checked as null pointer dereference. But with the function call replaced with a function pointer, no error message will be reported. Seems cppcheck will not recognize a function pointer as a function. char * func(){return 0;} int main() { char * (*f_p)(); f_p = func; char * p = func(); *p = 'a'; return 0; } Nothing reported. char * func(){return 0;} int main() { char * (*f_p)(); f_p = func; char * p = f_p(); *p = 'a'; return 0; }
-
I made a PR: https://github.com/cppcheck-opensource/cppcheck/pull/8765 Thanks! Aaron
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/14949 Feel free to open a PR, you seem to have the problem figured out already.
-
Hi all This is my first time posting here so apologies if I mess something up. Also I am very junior (first internship) so I am sorry if I make silly mistakes! I was using cppcheck on a codebase and found a recurring issue where if memory or a resource is stored in a class/struct, cppcheck will throw a memory leak error even if its deallocated in the objects destructor. #include <cstdlib> #include <unistd.h> class TempFile { public: TempFile(int fd) { m_fd = fd; } ~TempFile() { if (m_fd >= 0) close(m_fd);...
-
Thanks for checking. My report was based on cppcheck 2.21.0. Since HEAD reports the memleak warning correctly, this appears to have already been fixed.
-
I have filed https://trac.cppcheck.net/ticket/14944 about the inconsistency.
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/14943
-
With head: test.cpp:8:3: error: Memory leak: a [memleak] return result; ^
-
Thanks for checking. No, I did not pass --inconclusive. The command I used was: cppcheck --output-format=xmlv2 --enable=all test.cpp With cppcheck 2.21.0 this produces no accessMoved warning for me. If I add --inconclusive, then I do see the warning you pasted, at if (s.empty()), with inconclusive=true. So the issue is specifically about the default run without --inconclusive: the access is only reported as inconclusive in this case, while similar variants are reported as a regular accessMoved warning....
-
Hi, I found a false negative regarding the rule memleak. In the following C++ program, cppcheck should report a memleak warning because memory allocated by malloc is never released. However, cppcheck reports no such warning. #include <stdlib.h> auto main() -> int { int result = 0; auto a = static_cast<char *>(malloc(10)); if (a) { a[0] = 0; result = a[0]; } return result; } If malloc(10) succeeds, a is returned from main without being passed to free(a), so the allocation is leaked. The false negative...
-
Hi, I found a false negative regarding the rule incorrectLogicOperator. Cppcheck reports incorrectLogicOperator for the direct condition x >= 0 || x <= 10, because the disjunction is always true. However, if the two comparisons are stored in boolean temporaries first, cppcheck reports no warning even though the condition is semantically equivalent. Original seed program static void foo(int x) { if (x >= 0 || x <= 10) {} } Reproducing program #include <stdbool.h> static void foo(int x) { bool b1 =...
-
I'm getting a warning. Are you passing --inconclusive? test.cpp:5:7: warning: inconclusive: Access of moved variable 's'. [accessMoved] if (s.empty()) { ^
-
Thanks for reporting, ticket is here: https://trac.cppcheck.net/ticket/14934
-
Hi, I found a false negative regarding the rule arrayIndexOutOfBounds. In the following C++ program, cppcheck should report an arrayIndexOutOfBounds warning because a dynamic array of size 2 is accessed at index 2. However, cppcheck reports no such warning. int *a = new int[2]; int main() { a[0] = 0; a[1] = 0; a[2] = 0; return a[0]; } Actual result Cppcheck reports no arrayIndexOutOfBounds warning. Expected result Cppcheck should report arrayIndexOutOfBounds for the write to a[2]. Verification The...
-
Hi, I found a false negative regarding the rule accessMoved. Cppcheck reports accessMoved when a moved std::string declared through decltype(std::string{"test"}) is accessed directly. However, if that moved-from object is first queried with empty(), cppcheck misses the later access. #include <iostream> #include <string> #include <utility> int main() { decltype(std::string{"test"}) s = "test"; std::string n = std::move(s); if (s.empty()) { } std::cout << s << '\n' << std::flush; return 0; } Here,...
-
The second example is covered by https://trac.cppcheck.net/ticket/13774
-
For the first example, I'm getting two warnings: test.cpp:10:7: warning: inconclusive: Access of moved variable 's'. [accessMoved] if (s.empty()) { ^ test.cpp:8:5: note: Calling std::move(s) f(std::move(s)); ^ test.cpp:10:7: note: Access of moved variable 's'. if (s.empty()) { ^ test.cpp:13:16: warning: Access of moved variable 's'. [accessMoved] std::cout << s << '\n' << std::flush; ^ test.cpp:8:5: note: Calling std::move(s) f(std::move(s)); ^ test.cpp:13:16: note: Access of moved variable 's'....
1 >
