A new version of the static code analyzer cppcheck 2.7 has been released, allowing the identification of various classes of errors in C and C++ code, including when using non-standard syntax typical for embedded systems. A collection of plugins is provided, ensuring integration of cppcheck with various development, continuous integration, and testing systems, as well as offering features such as code style compliance checking. The analysis can utilize either its own parser or an external parser from Clang. It also includes the donate-cpu.py script to provide local resources for collaborative code review tasks for Debian packages. The project's source code is distributed under the GPLv3 license.
The development of cppcheck focuses on identifying issues related to undefined behavior and the use of constructs that are potentially dangerous from a safety perspective. The goal is also to minimize false positives. Among the identified issues are: pointers to non-existent objects, division by zero, integer overflows, invalid bit shift operations, incorrect type conversions, memory-related problems, improper use of STL, dereferencing null pointers, performing checks after actual buffer access, buffer overflows, and the use of uninitialized variables.
At the same time, the Swedish company Cppcheck Solutions AB is developing an extended version, Cppcheck Premium, which provides analysis for the presence of infinite loops, improved detection of uninitialized variables, and enhanced buffer overflow analysis.
In the new version:
- Support for container views has been added — a view attribute has been added to the library tag, indicating that the class is a view. The lifetime analysis code has been updated to use this attribute when searching for 'dangling' containers;
- Checks have been improved;
- Accumulated bugs have been fixed and shortcomings of the analyzer have been addressed.
Source: opennet.ru
