{5} Accepted, Active Tickets by Owner (Full Description) (41 matches)

rnp-0.18.1/src/librepgp/stream-ctx.h:

typedef struct S {
    S& operator=(const S&) = delete;
} S;

test.cpp:2:5: error: recursive typedef encountered [internalError]
    S& operator=(const S&) = delete;
    ^

Example output:

$ cppcheck --enable=information -E file.c 

nofile:0:0: information: Active checkers: 3/592 (use --checkers-report=<filename> to see details) [checkersReport]

We use popen to execute addons. Even though I believe Cppcheck should only be used in trusted/safe environments, we could be careful about the commands that is executed to not leave a door open for some kind of remote execution vulnerabilities.

We should escape or reject certain characters in the command line that the shell could treat in unwanted ways. I.e. a ";" in a filename could be treated as a command separator.

Filenames are quoted if they contain spaces but not tabs.

Example code:

typedef uint16_t ftype (void);
typedef const ftype cftype;

uint16_t foo(void);

cftype* fp = foo;

We do not simplify this well. But it's not clear to me what the output should be.

According to Misra C rule 17.3 in amendment #3, the "const" is undefined behavior.

Make it possible to activate custom addons in the GUI.

If we need to capture the output of a process we invoke we are using files to redirect the output into.

If the filenames are not unique (it happened before) that code cannot be run into parallel. It might also leave files if we exited prematurely.

So we should try to redirect the pipes in code instead of the shell.

Use of deallocated buffer (ticket #3730 split).

#include <cstring>
#include <iostream>

#define BUFFER_SIZE 10

void overrun(char * integers) {
	for (int i = 0; i != BUFFER_SIZE + 1; ++i) {
		integers[i] = i * 10;
	}
}

void corrupt_deallocated() {
	// write on freed memory
	char * integers = new char[BUFFER_SIZE];
	delete [] integers;
	overrun(integers);
}


int main() {
	corrupt_deallocated();
	return -1;
}

struct str {
  int a;
  int b;
};

void foo()
{
  str *s = new str();
  char *v = (char *) s;
  for (int i = 0; i < sizeof(str); i++)
    v[i] = 0;
  // memory leak
}

$ cppcheck --debug MemLeak27.cpp 
Checking MemLeak27.cpp...


##file MemLeak27.cpp
1: struct str {
2: int a@1 ;
3: int b@2 ;
4: } ;
5:
6: void foo ( )
7: {
8: str * s@3 ; s@3 = new str ( ) ;
9: char * v@4 ; v@4 = s@3 ;
10: for ( int i@5 = 0 ; i@5 < 100 ; i@5 ++ ) {
11: v@4 [ i@5 ] = 0 ; }
12: }

It is possible to detect infinite loops caused by unsigned integer overflow during loop iteration. Following loop is infinite for Limit = 255

for ( unsigned char i = 0; i < Limit; i += 2 )
{
  printf( "%i\n", i );
}

In case the variable Limit comes from unknown source, and there is no check for value 255 beforehand, cppcheck should report warning about infinite loop.

This is a bit of a silly style issue, but I actually saw this, so I'm interested in whether it is a common issue.

if (condition)
{
}
if (!condition)
{
}

Should be:

if (condition)
{
}
else
{
}

From the forum: ​https://sourceforge.net/p/cppcheck/discussion/development/thread/c52f0f2efd/

template <class T, int M, int N>
struct Matrix;

template <class T, int N>
struct Matrix<T, 1, N> {
    std::array<T, N> x;
private:
    static constexpr decltype(&Matrix::x) members[] = {&Matrix::x};
};

template <class T, int N>
struct Matrix<T, 2, N> {
    std::array<T, N> x;
    std::array<T, N> y;
private:
    static constexpr decltype(&Matrix::x) members[] = {&Matrix::x, &Matrix::y};
};

template <class T>
Matrix<T, 2, 2> O() {
    return { {}, {} };
}

Matrix.cpp:22:12: error: Returning object that will be invalid when returning. [returnDanglingLifetime]
    return { {}, {} };
           ^
Matrix.cpp:22:18: note: Passed to constructor of 'Matrix'.
    return { {}, {} };
                 ^
Matrix.cpp:22:12: note: Returning object that will be invalid when returning.
    return { {}, {} };
           ^

Tested with ​https://github.com/danmar/cppcheck/commit/89c33b41756be8c8a6a78b1430b2bd18d7a384f8

Running clang -E and gcc -E expands the following to nothing:

#define a(b, c) c
#define d() a
#define g(e) h(e, ) h(e, )
#define h(e, b) d()(, e)()
#define i()
g(i)

However, cppcheck incorrectly expands this to i ( ) i ( ).

Hi friends,

i have an idea for a new check, consider the following code

#include <iostream>
void vShowGUI(const bool &bState)
{
	std::cout << (bState?("enabled"):("disabled")) << std::endl;
	// ... manage to show gui
}

void vSetState(const bool &bState)
{
	if(bState)
	{	
		// ...
		vShowGUI(bState);
	}
	else
	{ 
		// ...
		vShowGUI(!bState);
	}
}


int main()
{
	vSetState(true);
	vSetState(false);
}

it prints the following output:

$ ./test
enabled
enabled

Here the else-body part does exactly the same as the if-body. Maybe cppcheck could warn about such issues. What do you think about this?

Cppcheck fails to detect following potential null pointer dereference:

void f(bool a, bool b)
{
    int *i = a ? new int [10] : 0;
    if(b)
    {
        *i = 0;
    }
}

$ cppcheck --enable=all --debug nullptrderef3.cpp 
Checking nullptrderef3.cpp...


##file nullptrderef3.cpp
1: void f ( bool a@1 , bool b@2 )
2: {
3: int * i@3 ; i@3 = a@1 ? new int [ 10 ] : 0 ;
4: if ( b@2 )
5: {
6: * i@3 = 0 ;
7: }
8: }



##AST
 f a b , (
 int i *
 i a int 10 [ new 0 : ? =
 if b (
 i * 0 =


##Value flow
Line 3
  10:{10}
  0:{0}
Line 6
  0:{0}
[nullptrderef3.cpp:1]: (style) The function 'f' is never used.

not found with cppcheck 1.74:

struct bar
{
     int f;
};

int divbyzero11(struct bar* a, struct bar* b)
{
    b = a;
    a->f = 0;

    return 42 / b->f;
}

Coverity detected an issue in Cppcheck.

Here: ​https://github.com/danmar/cppcheck/blob/1.80/lib/checkstl.cpp#L1056

If the condition (!tok2 && j == i->second - 1) is false, tok2 is dereferenced.

Cppcheck should detect this issue also.

Reduced code:

void f()
{
    const Token* tok2 = tok->tokAt(2);
    unsigned int j;
    for (j = 0; tok2 && j < i->second-1; j++)
        tok2 = tok2->nextArgument();
    if (!tok2 && j == i->second-1) {}
    else
        tok2 = tok2->previous;
}

We had a uninitialized variable in Cppcheck that we did not detect.

Revision: e98a4a6f1475db03473d544d576827e49f9a9575 File: lib/checkbufferoverrun.cpp Line: 257

Reduced example code:

void f() {

        unsigned int dimensions = 0;

        bool mightBeLarger;

        if (a) {
            dimensions = array->variable()->dimensions();
            if (dimensions >= 1 && b) {
                mightBeLarger = false;
            }
        } else {
            mightBeLarger = false;
        }

        if (dimensions == 0)
            return;

        // Positive index
        if (!mightBeLarger) { } // Error!
}

Reduced from template<class ValueOrValues> static Analyzer::Result valueFlowForward() in valueflow.cpp

#include <list>
#include <string>

class C {};

static int f2(std::string, const C&);
static int f2(std::list<std::string>, const C&);

template<class T>
static int f1(T t, C& c)
{
    return f2(t, c);
}

void f()
{
    std::string s;
    std::list<std::string> l;
    C c;
    f1(s, c);
    f1(l, c);
}

Looks related to #11856.

template <typename Char>
void f0(Char c)
{
    if (c <= 0) return;
    if (c >= 1) {;} // FN known condition always true
}

void f1(char c)
{
    if (c <= 0) return;
    if (c >= 1) {;} // TP known condition always true
}

int main()
{
    {
        char c = 'A';
        f0(c);
    }
    {
        char c = 'A';
        f1(c);
    }
    return 0;
}

$ g++ -c test.cpp && cppcheck --enable=all --debug-warnings --check-level=exhaustive --suppress=checkersReport --inconclusive --check-library  test.cpp
Checking test.cpp ...
test.cpp:11:11: style: Condition 'c>=1' is always true [knownConditionTrueFalse]
    if (c >= 1) {;} // TP known condition always true
          ^
test.cpp:10:11: note: Assuming that condition 'c<=0' is not redundant
    if (c <= 0) return;
          ^
test.cpp:11:11: note: Condition 'c>=1' is always true
    if (c >= 1) {;} // TP known condition always true
          ^

Tested with ​https://github.com/danmar/cppcheck/commit/f4475217021a25d4d3b86cf443f3fbe8a20fd01e

Example code:

template <typename T>
void f(T b) { *b = 0; }

void bar(std::vector<int>::iterator b) {
  f(b);
}

The --debug output is:

1: template < typename T >
2: void f ( T b@var1 ) { *@exprUNIQUE b@var1 = 0 ; }
3:
4: void bar ( std :: vector < int > :: iterator b@var2 ) {
5: f (@exprUNIQUE b@var2 ) ;
6: }