From dcedc260bc21b0bf7a3ff66d6b0bd846cdbcd09a Mon Sep 17 00:00:00 2001
From: guwirth
Date: Sun, 23 Aug 2020 12:29:30 +0200
Subject: [PATCH] support cppcheck v2.1 rules - add missing constParameter
(close #1912) - use CWE List Version 4.2
---
cxx-sensors/src/main/resources/cppcheck.xml | 2147 ++++++++++++++---
.../CxxCppCheckRuleRepositoryTest.java | 2 +-
cxx-sensors/src/tools/cwec_latest.xml.zip | Bin 0 -> 1263614 bytes
cxx-sensors/src/tools/cwec_v3.2.xml.zip | Bin 1091945 -> 0 bytes
.../src/tools/generate_cppcheck_resources.cmd | 10 +-
.../src/tools/generate_cppcheck_resources.sh | 4 +-
6 files changed, 1819 insertions(+), 344 deletions(-)
create mode 100644 cxx-sensors/src/tools/cwec_latest.xml.zip
delete mode 100644 cxx-sensors/src/tools/cwec_v3.2.xml.zip
diff --git a/cxx-sensors/src/main/resources/cppcheck.xml b/cxx-sensors/src/main/resources/cppcheck.xml
index cfe3ad5559..f78b9c665d 100644
--- a/cxx-sensors/src/main/resources/cppcheck.xml
+++ b/cxx-sensors/src/main/resources/cppcheck.xml
@@ -1,4 +1,4 @@
-
+
CustomRuleTemplate
@@ -26,9 +26,19 @@ Follow these steps to make your custom Custom rules available in SonarQube:
Assigning a pointer to an integer is not portable
+Assigning a pointer to an integer (int/long/etc) is not portable
+across different platforms and compilers. For example in 32-bit
+Windows and linux they are same width, but in 64-bit Windows and linux
+they are of different width. In worst case you end up assigning 64-bit
+address to 32-bit integer. The safe way is to store addresses only in
+pointer types (or typedefs like uintptr_t).
+
+References
+CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
]]>
+ cwe
bug
AssignmentAddressToInteger
MINOR
@@ -41,9 +51,19 @@ Assigning a pointer to an integer (int/long/etc) is not portable across differen
Assigning an integer to a pointer is not portable
+Assigning an integer (int/long/etc) to a pointer is not portable
+across different platforms and compilers. For example in 32-bit
+Windows and linux they are same width, but in 64-bit Windows and linux
+they are of different width. In worst case you end up assigning 64-bit
+integer to 32-bit pointer. The safe way is to store addresses only in
+pointer types (or typedefs like uintptr_t).
+
+References
+CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
]]>
+ cwe
bug
AssignmentIntegerToAddress
MINOR
@@ -56,9 +76,19 @@ Assigning an integer (int/long/etc) to a pointer is not portable across differen
Returning an address value in a function with integer return type is not portable
+Returning an address value in a function with integer (int/long/etc)
+return type is not portable across different platforms and compilers.
+For example in 32-bit Windows and Linux they are same width, but in
+64-bit Windows and Linux they are of different width. In worst case
+you end up casting 64-bit address down to 32-bit integer. The safe way
+is to always return an integer.
+
+References
+CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
]]>
+ cwe
bug
CastAddressToIntegerAtReturn
MINOR
@@ -71,9 +101,19 @@ Returning an address value in a function with integer (int/long/etc) return type
Returning an integer in a function with pointer return type is not portable
+Returning an integer (int/long/etc) in a function with pointer return
+type is not portable across different platforms and compilers. For
+example in 32-bit Windows and Linux they are same width, but in 64-bit
+Windows and Linux they are of different width. In worst case you end
+up casting 64-bit integer down to 32-bit pointer. The safe way is to
+always return a pointer.
+
+References
+CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
]]>
+ cwe
bug
CastIntegerToAddressAtReturn
MINOR
@@ -100,9 +140,16 @@ Skipping configuration 'X' since the value of 'X' is unknown. Use -D if you want
Read and write operations without a call to a positioning function (fseek, fsetpos or rewind) or fflush in between result in undefined behaviour
+Read and write operations without a call to a positioning function
+(fseek, fsetpos or rewind) or fflush in between result in undefined
+behaviour.
+
+References
+CWE-664: Improper Control of a Resource Through its Lifetime
]]>
+ cwe
bug
IOWithoutPositioning
MAJOR
@@ -115,9 +162,17 @@ Read and write operations without a call to a positioning function (fseek, fsetp
Missing bounds check for extra iterator increment in loop
+The iterator incrementing is suspicious - it is incremented at line
+and then at line . The loop might unintentionally skip an element in
+the container. There is no comparison between these increments to
+prevent that the iterator is incremented beyond the end.
+
+References
+CWE-834: Excessive Iteration
]]>
+ cwe
bug
StlMissingComparison
MINOR
@@ -145,9 +200,17 @@ The array 'array' is too small, the function 'function' expects a bigger one.
'varname' is of type 'vartype'. When using void pointers in calculations, the behaviour is undefined
+'varname' is of type 'vartype'. When using void pointers in
+calculations, the behaviour is undefined. Arithmetic operations on
+'void *' is a GNU C extension, which defines the 'sizeof(void)' to be
+1.
+
+References
+CWE-467: Use of sizeof() on a Pointer Type
]]>
+ cwe
bug
arithOperationsOnVoidPointer
MINOR
@@ -157,12 +220,17 @@ The array 'array' is too small, the function 'function' expects a bigger one.
arrayIndexOutOfBounds
- Array 'array[2]' accessed at index 2, which is out of bounds
+ Array 'arr[16]' accessed at index 16, which is out of bounds
+Array 'arr[16]' accessed at index 16, which is out of bounds.
+
+References
+CWE-788: Access of Memory Location After End of Buffer
]]>
+ cwe
bug
arrayIndexOutOfBounds
MAJOR
@@ -172,12 +240,17 @@ Array 'array[2]' accessed at index 2, which is out of bounds.
arrayIndexOutOfBoundsCond
- Array 'x[10]' accessed at index 20, which is out of bounds. Otherwise condition 'y==20' is redundant
+ Array 'arr[16]' accessed at index 16, which is out of bounds
+Array 'arr[16]' accessed at index 16, which is out of bounds.
+
+References
+CWE-788: Access of Memory Location After End of Buffer
]]>
+ cwe
bug
arrayIndexOutOfBoundsCond
MINOR
@@ -187,12 +260,21 @@ Array 'x[10]' accessed at index 20, which is out of bounds. Otherwise condition
arrayIndexThenCheck
- Array index 'index' is used before limits check
+ Array index 'i' is used before limits check
+Defensive programming: The variable 'i' is used as an array index
+before it is checked that is within limits. This can mean that the
+array might be accessed out of bounds. Reorder conditions such as
+'(a[i] && i < 10)' to '(i < 10 && a[i])'. That way the array will not
+be accessed if the index is out of limits.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
arrayIndexThenCheck
MINOR
CODE_SMELL
@@ -204,9 +286,17 @@ Defensive programming: The variable 'index' is used as an array index before it
Assert statement calls a function which may have desired side effects: 'function'
+Non-pure function: 'function' is called inside assert statement.
+Assert statements are removed from release builds so the code inside
+assert statement is not executed. If the code is needed also in
+release builds, this is a bug.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
assertWithSideEffect
MINOR
@@ -219,9 +309,14 @@ Non-pure function: 'function' is called inside assert statement. Assert statemen
Boolean value assigned to pointer
Boolean value assigned to pointer.
+
+References
+CWE-587: Assignment of a Fixed Address to a Pointer
]]>
+ cwe
bug
assignBoolToPointer
MAJOR
@@ -234,9 +329,14 @@ Boolean value assigned to pointer.
Mismatching assignment and comparison, comparison '' is always false
Mismatching assignment and comparison, comparison '' is always false.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
assignIfError
MINOR
CODE_SMELL
@@ -248,9 +348,17 @@ Mismatching assignment and comparison, comparison '' is always false.
Assert statement modifies 'var'
+Variable 'var' is modified inside assert statement. Assert statements
+are removed from release builds so the code inside assert statement is
+not executed. If the code is needed also in release builds, this is a
+bug.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
assignmentInAssert
MINOR
@@ -263,9 +371,17 @@ Variable 'var' is modified insert assert statement. Assert statements are remove
Address of local auto-variable assigned to a function parameter
+Dangerous assignment - the function parameter is assigned the address
+of a local auto-variable. Local auto-variables are reserved from the
+stack which is freed when the function ends. So the pointer to a local
+variable is invalid after the function ends.
+
+References
+CWE-562: Return of Stack Variable Address
]]>
+ cwe
bug
autoVariables
MAJOR
@@ -278,9 +394,15 @@ Dangerous assignment - the function parameter is assigned the address of a local
Deallocation of an auto-variable results in undefined behaviour
+The deallocation of an auto-variable results in undefined behaviour.
+You should only free memory that has been allocated dynamically.
+
+References
+CWE-590: Free of Memory not on the Heap
]]>
+ cwe
bug
autovarInvalidDeallocation
MAJOR
@@ -290,12 +412,18 @@ The deallocation of an auto-variable results in undefined behaviour. You should
bitwiseOnBoolean
- Boolean variable 'varname' is used in bitwise operation. Did you mean '&&'?
+ Boolean expression 'expression' is used in bitwise operation. Did you mean '&&'?
+Boolean expression 'expression' is used in bitwise operation. Did you
+mean '&&'?
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bitwiseOnBoolean
MINOR
CODE_SMELL
@@ -307,9 +435,15 @@ Boolean variable 'varname' is used in bitwise operation. Did you mean '&&
BOOST_FOREACH caches the end() iterator. It's undefined behavior if you modify the container inside
+BOOST_FOREACH caches the end() iterator. It's undefined behavior if
+you modify the container inside.
+
+References
+CWE-664: Improper Control of a Resource Through its Lifetime
]]>
+ cwe
bug
boostForeachError
MAJOR
@@ -319,12 +453,17 @@ BOOST_FOREACH caches the end() iterator. It's undefined behavior if you modify t
bufferAccessOutOfBounds
- Buffer is accessed out of bounds: buffer
+ Buffer is accessed out of bounds: buf
+Buffer is accessed out of bounds: buf
+
+References
+CWE-788: Access of Memory Location After End of Buffer
]]>
+ cwe
bug
bufferAccessOutOfBounds
MAJOR
@@ -352,9 +491,15 @@ The buffer 'buffer' is not null-terminated after the call to strncpy(). This wil
Exception should be caught by reference
+The exception is caught by value. It could be caught as a (const)
+reference which is usually recommended in C++.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
catchExceptionByValue
MINOR
CODE_SMELL
@@ -381,9 +526,22 @@ Signed 'char' type used as array index. If the value can be greater than 127 the
When using 'char' variables in bit operations, sign extension can generate unexpected results
+When using 'char' variables in bit operations, sign extension can
+generate unexpected results. For example:
+ char c = 0x80;
+
+int i = 0 | c;
+ if (i & 0x8000)
+ printf("not
+expected");
+The "not expected" will be printed on the screen.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
charBitOp
MINOR
@@ -396,9 +554,15 @@ When using 'char' variables in bit operations, sign extension can generate unexp
Char literal compared with pointer 'foo'. Did you intend to dereference it?
+Char literal compared with pointer 'foo'. Did you intend to
+dereference it?
+
+References
+CWE-595: Comparison of Object References Instead of Object Contents
]]>
+ cwe
bug
charLiteralWithCharPtrCompare
MINOR
@@ -411,9 +575,19 @@ Char literal compared with pointer 'foo'. Did you intend to dereference it?
Storing func_name() return value in char variable and then comparing with EOF
+When saving func_name() return value in char variable there is loss of
+precision. When func_name() returns EOF this value is truncated.
+Comparing the char variable with EOF can have unexpected results. For
+instance a loop "while (EOF != (c = func_name());" loops forever on
+some compilers/platforms and on other compilers/platforms it will stop
+when the file contains a matching character.
+
+References
+CWE-197: Numeric Truncation Error
]]>
+ cwe
bug
checkCastIntToCharAndBack
MINOR
@@ -426,9 +600,16 @@ When saving func_name() return value in char variable there is loss of precision
Clarify calculation precedence for '+' and '?'
+Suspicious calculation. Please use parentheses to clarify the code.
+The code ''a+b?c:d'' should be written as either ''(a+b)?c:d'' or
+''a+(b?c:d)''.
+
+References
+CWE-783: Operator Precedence Logic Error
]]>
+ cwe
clarifyCalculation
MINOR
CODE_SMELL
@@ -440,9 +621,15 @@ Suspicious calculation. Please use parentheses to clarify the code. The code ''a
Suspicious condition (assignment + comparison); Clarify expression with parentheses
+Suspicious condition (assignment + comparison); Clarify expression
+with parentheses.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
clarifyCondition
MINOR
CODE_SMELL
@@ -451,12 +638,19 @@ Suspicious condition (assignment + comparison); Clarify expression with parenthe
clarifyStatement
- Ineffective statement similar to '*A++;'. Did you intend to write '(*A)++;'?
+ In expression like '*A++' the result of '*' is unused. Did you intend to write '(*A)++;'?
+A statement like '*A++;' might not do what you intended. Postfix
+'operator++' is executed before 'operator*'. Thus, the dereference is
+meaningless. Did you intend to write '(*A)++;'?
+
+References
+CWE-783: Operator Precedence Logic Error
]]>
+ cwe
bug
clarifyStatement
MINOR
@@ -469,9 +663,24 @@ A statement like '*A++;' might not do what you intended. Postfix 'operator++' is
Comma is used in return statement. The comma can easily be misread as a ';'
+Comma is used in return statement. When comma is used in a return
+statement it can easily be misread as a semicolon. For example in the
+code below the value of 'b' is returned if the condition is true, but
+it is easy to think that 'a+1' is returned:
+ if (x)
+
+return a + 1,
+ b++;
+However it can be useful to use comma in
+macros. Cppcheck does not warn when such a macro is then used in a
+return statement, it is less likely such code is misunderstood.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
commaSeparatedReturn
MINOR
CODE_SMELL
@@ -483,9 +692,14 @@ Comma is used in return statement. When comma is used in a return statement it c
Comparison of a boolean expression with an integer other than 0 or 1
Comparison of a boolean expression with an integer other than 0 or 1.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
compareBoolExpressionWithInt
MINOR
@@ -498,9 +712,17 @@ Comparison of a boolean expression with an integer other than 0 or 1.
Expression '(X & 0x6) == 0x1' is always false
+The expression '(X & 0x6) == 0x1' is always false. Check carefully
+constants and operators used, these errors might be hard to spot
+sometimes. In case of complex expression it might help to split it to
+separate expressions.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
comparisonError
MINOR
CODE_SMELL
@@ -509,12 +731,19 @@ The expression '(X & 0x6) == 0x1' is always false. Check carefully constants
comparisonFunctionIsAlwaysTrueOrFalse
- Comparison of two identical variables with isless(varName,varName) evaluates always to false
+ Comparison of two identical variables with isless(varName,varName) always evaluates to false
+The function isless is designed to compare two variables. Calling this
+function with one variable (varName) for both parameters leads to a
+statement which is always false.
+
+References
+CWE-570: Expression is Always False
]]>
+ cwe
bug
comparisonFunctionIsAlwaysTrueOrFalse
MINOR
@@ -527,9 +756,16 @@ The function isless is designed to compare two variables. Calling this function
Comparison of a variable having boolean value using relational (<, >, <= or >=) operator
+The variable 'var_name' is of type 'bool' and comparing 'bool' value
+using relational (<, >, <= or >=) operator could cause unexpected
+results.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
comparisonOfBoolWithBoolError
MINOR
CODE_SMELL
@@ -556,9 +792,16 @@ The expression 'varname' is of type 'bool' and it is compared against an integer
Comparison of a function returning boolean value using relational (<, >, <= or >=) operator
+The return type of function 'func_name' is 'bool' and result is of
+type 'bool'. Comparing 'bool' value using relational (<, >, <= or >=)
+operator could cause unexpected results.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
comparisonOfFuncReturningBoolError
MINOR
CODE_SMELL
@@ -570,9 +813,16 @@ The return type of function 'func_name' is 'bool' and result is of type 'bool'.
Comparison of two functions returning boolean value using relational (<, >, <= or >=) operator
+The return type of function 'func_name1' and function 'func_name2' is
+'bool' and result is of type 'bool'. Comparing 'bool' value using
+relational (<, >, <= or >=) operator could cause unexpected results.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
comparisonOfTwoFuncsReturningBoolError
MINOR
CODE_SMELL
@@ -584,9 +834,14 @@ The return type of function 'func_name1' and function 'func_name2' is 'bool' and
Redundant code: Found a statement that begins with type constant
Redundant code: Found a statement that begins with type constant.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
constStatement
MINOR
@@ -599,12 +854,19 @@ Redundant code: Found a statement that begins with type constant.
Value of pointer 'var', which points to allocated memory, is copied in copy constructor instead of allocating new memory
+Value of pointer 'var', which points to allocated memory, is copied in
+copy constructor instead of allocating new memory.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
+ bug
copyCtorPointerCopying
MINOR
- CODE_SMELL
+ BUG
LINEAR
5min
@@ -613,9 +875,14 @@ Value of pointer 'var', which points to allocated memory, is copied in copy cons
Invalid usage of output stream: '<< std::cout'
+Invalid usage of output stream: '<< std::cout'.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
coutCerrMisusage
MAJOR
@@ -628,9 +895,20 @@ Invalid usage of output stream: '<< std::cout'.
C-style pointer casting
+C-style pointer casting detected. C++ offers four different kinds of
+casts as replacements: static_cast, const_cast, dynamic_cast and
+reinterpret_cast. A C-style cast could evaluate to any of those
+automatically, thus it is considered safer if the programmer
+explicitly states which kind of cast is expected. See also: https://ww
+w.securecoding.cert.org/confluence/display/cplusplus/EXP05-CPP.+Do+not
++use+C-style+casts.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
cstyleCast
MINOR
CODE_SMELL
@@ -657,9 +935,14 @@ Dead pointer usage. Pointer 'pointer' is dead if it has been assigned '&x' a
Deallocating a deallocated pointer: varname
Deallocating a deallocated pointer: varname
+
+References
+CWE-415: Double Free
]]>
+ cwe
bug
deallocDealloc
MAJOR
@@ -672,9 +955,14 @@ Deallocating a deallocated pointer: varname
Returning/dereferencing 'p' after it is deallocated / released
Returning/dereferencing 'p' after it is deallocated / released
+
+References
+CWE-672: Operation on a Resource after Expiration or Release
]]>
+ cwe
bug
deallocret
MAJOR
@@ -687,9 +975,14 @@ Returning/dereferencing 'p' after it is deallocated / released
Dereferencing 'varname' after it is deallocated / released
Dereferencing 'varname' after it is deallocated / released
+
+References
+CWE-416: Use After Free
]]>
+ cwe
bug
deallocuse
MAJOR
@@ -702,9 +995,15 @@ Dereferencing 'varname' after it is deallocated / released
Possible dereference of an invalid iterator: i
+Possible dereference of an invalid iterator: i. Make sure to check
+that the iterator is valid before dereferencing it - not after.
+
+References
+CWE-825: Expired Pointer Dereference
]]>
+ cwe
bug
derefInvalidIterator
MINOR
@@ -717,9 +1016,14 @@ Make sure to check that the iterator is valid before dereferencing it - not afte
Memory pointed to by 'varname' is freed twice
Memory pointed to by 'varname' is freed twice.
+
+References
+CWE-415: Double Free
]]>
+ cwe
bug
doubleFree
MAJOR
@@ -732,9 +1036,15 @@ Memory pointed to by 'varname' is freed twice.
The class 'class' defines member variable with name 'variable' also defined in its parent class 'class'
+The class 'class' defines member variable with name 'variable' also
+defined in its parent class 'class'.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
duplInheritedMember
MINOR
@@ -747,9 +1057,16 @@ The class 'class' defines member variable with name 'variable' also defined in i
Found duplicate branches for 'if' and 'else'
+Finding the same code in an 'if' and related 'else' branch is
+suspicious and might indicate a cut and paste or logic error. Please
+examine this code carefully to determine if it is correct.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
duplicateBranch
MINOR
CODE_SMELL
@@ -761,9 +1078,16 @@ Finding the same code in an 'if' and related 'else' branch is suspicious and mig
Consecutive return, break, continue, goto or throw statements are unnecessary
+Consecutive return, break, continue, goto or throw statements are
+unnecessary. The second statement can never be executed, and so should
+be removed.
+
+References
+CWE-561: Dead Code
]]>
+ cwe
duplicateBreak
MINOR
CODE_SMELL
@@ -775,9 +1099,16 @@ Consecutive return, break, continue, goto or throw statements are unnecessary. T
Same expression on both sides of '&&'
+Finding the same expression on both sides of an operator is suspicious
+and might indicate a cut and paste or logic error. Please examine this
+code carefully to determine if it is correct.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
duplicateExpression
MINOR
CODE_SMELL
@@ -789,9 +1120,15 @@ Finding the same expression on both sides of an operator is suspicious and might
Invalid iterator 'iter' used
+The iterator 'iter' is invalid before being assigned. Dereferencing or
+comparing it with another iterator is invalid operation.
+
+References
+CWE-664: Improper Control of a Resource Through its Lifetime
]]>
+ cwe
bug
eraseDereference
MAJOR
@@ -804,9 +1141,14 @@ The iterator 'iter' is invalid before being assigned. Dereferencing or comparing
Exception thrown in invalid state, 'p' points at deallocated memory
Exception thrown in invalid state, 'p' points at deallocated memory.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
exceptDeallocThrow
MINOR
@@ -819,9 +1161,16 @@ Exception thrown in invalid state, 'p' points at deallocated memory.
Throwing a copy of the caught exception instead of rethrowing the original exception
+Rethrowing an exception with 'throw varname;' creates an unnecessary
+copy of 'varname'. To rethrow the caught exception without unnecessary
+copying or slicing, use a bare 'throw;'.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
exceptRethrowCopy
MINOR
CODE_SMELL
@@ -833,9 +1182,16 @@ Rethrowing an exception with 'throw varname;' creates an unnecessary copy of 'va
Class Class is not safe, destructor throws exception
+The class Class is not safe because its destructor throws an
+exception. If Class is used and an exception is thrown that is caught
+in an outer scope the program will terminate.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
exceptThrowInDestructor
MINOR
@@ -848,9 +1204,15 @@ The class Class is not safe because its destructor throws an exception. If Class
fflush() called on input stream 'stdin' may result in undefined behaviour on non-linux systems
+fflush() called on input stream 'stdin' may result in undefined
+behaviour on non-linux systems.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
fflushOnInputStream
MINOR
@@ -863,9 +1225,19 @@ fflush() called on input stream 'stdin' may result in undefined behaviour on non
Technically the member function 'class::function' can be const
+The member function 'class::function' can be made a const function.
+Making this function 'const' should not cause compiler errors. Even
+though the function can be made const function technically it may not
+make sense conceptually. Think about your design and the task of the
+function first - is it a function that must not change object internal
+state?
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
functionConst
MINOR
CODE_SMELL
@@ -874,12 +1246,24 @@ The member function 'class::function' can be made a const function. Making this
functionStatic
- Technically the member function 'class::function' can be static
+ Technically the member function 'class::function' can be static (but you may consider moving to unnamed namespace)
+The member function 'class::function' can be made a static function.
+Making a function static can bring a performance benefit since no
+'this' instance is passed to the function. This change should not
+cause compiler errors but it does not necessarily make sense
+conceptually. Think about your design and the task of the function
+first - is it a function that must not access members of class
+instances? And maybe it is more appropriate to move this function to a
+unnamed namespace.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
functionStatic
MINOR
@@ -892,9 +1276,14 @@ The member function 'class::function' can be made a static function. Making a fu
Return value of function malloc() is not used
Return value of function malloc() is not used.
+
+References
+CWE-252: Unchecked Return Value
]]>
+ cwe
bug
ignoredReturnValue
MINOR
@@ -907,9 +1296,17 @@ Return value of function malloc() is not used.
Array 'buffer' is filled incompletely. Did you forget to multiply the size given to 'memset()' with 'sizeof(*buffer)'?
+The array 'buffer' is filled incompletely. The function 'memset()'
+needs the size given in bytes, but an element of the given array is
+larger than one byte. Did you forget to multiply the size with
+'sizeof(*buffer)'?
+
+References
+CWE-131: Incorrect Calculation of Buffer Size
]]>
+ cwe
bug
incompleteArrayFill
MINOR
@@ -922,9 +1319,16 @@ The array 'buffer' is filled incompletely. The function 'memset()' needs the siz
Logical disjunction always evaluates to true: foo > 3 && foo < 4
+Logical disjunction always evaluates to true: foo > 3 && foo < 4. Are
+these conditions necessary? Did you intend to use && instead? Are the
+numbers correct? Are you comparing the correct variables?
+
+References
+CWE-571: Expression is Always True
]]>
+ cwe
bug
incorrectLogicOperator
MINOR
@@ -937,9 +1341,15 @@ Logical disjunction always evaluates to true: foo > 3 && foo < 4.
Conversion of string literal "Hello World" to bool always evaluates to true
+Conversion of string literal "Hello World" to bool always evaluates to
+true.
+
+References
+CWE-571: Expression is Always True
]]>
+ cwe
bug
incorrectStringBooleanError
MINOR
@@ -952,9 +1362,15 @@ Conversion of string literal "Hello World" to bool always evaluates to true.
String literal "Hello World" doesn't match length argument for substr()
+String literal "Hello World" doesn't match length argument for
+substr().
+
+References
+CWE-570: Expression is Always False
]]>
+ cwe
bug
incorrectStringCompare
MINOR
@@ -967,9 +1383,16 @@ String literal "Hello World" doesn't match length argument for substr().
Incrementing a variable of type 'bool' with postfix operator++ is deprecated by the C++ Standard. You should assign it the value 'true' instead
+The operand of a postfix increment operator may be of type bool but it
+is deprecated by C++ Standard (Annex D-1) and the operand is always
+set to true. You should assign it the value 'true' instead.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
incrementboolean
MINOR
CODE_SMELL
@@ -981,9 +1404,18 @@ The operand of a postfix increment operator may be of type bool but it is deprec
Member variable 'class::variable' is in the wrong place in the initializer list
+Member variable 'class::variable' is in the wrong place in the
+initializer list. Members are initialized in the order they are
+declared, not in the order they are in the initializer list. Keeping
+the initializer list in the same order that the members were declared
+prevents order dependent initialization errors.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
initializerList
MINOR
CODE_SMELL
@@ -1010,9 +1442,14 @@ Buffer overrun possible for long command line arguments.
Signed integer overflow for expression ''
+Signed integer overflow for expression ''.
+
+References
+CWE-190: Integer Overflow or Wraparound
]]>
+ cwe
bug
integerOverflow
MAJOR
@@ -1022,12 +1459,18 @@ Signed integer overflow for expression ''
invalidFunctionArg
- Invalid func_name() argument nr 1
+ Invalid func_name() argument nr 1. The value is 0 or 1 (boolean) but the valid values are '1:4'
+Invalid func_name() argument nr 1. The value is 0 or 1 (boolean) but
+the valid values are '1:4'.
+
+References
+CWE-628: Function Call with Incorrectly Specified Arguments
]]>
+ cwe
bug
invalidFunctionArg
MAJOR
@@ -1040,9 +1483,14 @@ Invalid func_name() argument nr 1
Invalid func_name() argument nr 1. A non-boolean value is required
Invalid func_name() argument nr 1. A non-boolean value is required.
+
+References
+CWE-628: Function Call with Incorrectly Specified Arguments
]]>
+ cwe
bug
invalidFunctionArgBool
MAJOR
@@ -1055,9 +1503,14 @@ Invalid func_name() argument nr 1. A non-boolean value is required.
Invalid iterator: iterator
Invalid iterator: iterator
+
+References
+CWE-664: Improper Control of a Resource Through its Lifetime
]]>
+ cwe
bug
invalidIterator1
MAJOR
@@ -1085,9 +1538,15 @@ After push_back|push_front|insert(), the iterator 'iterator' may be invalid.
'I' in format string (no. 1) is a length modifier and cannot be used without a conversion specifier
+'I' in format string (no. 1) is a length modifier and cannot be used
+without a conversion specifier.
+
+References
+CWE-704: Incorrect Type Conversion or Cast
]]>
+ cwe
bug
invalidLengthModifierError
MINOR
@@ -1115,9 +1574,15 @@ Invalid pointer 'pointer' after push_back().
Casting between float* and double* which have an incompatible binary data representation
+Casting between float * and double * which have an incompatible binary
+data representation.
+
+References
+CWE-704: Incorrect Type Conversion or Cast
]]>
+ cwe
bug
invalidPointerCast
MINOR
@@ -1130,9 +1595,15 @@ Casting between float* and double* which have an incompatible binary data repres
%f in format string (no. 1) requires 'double' but the argument type is Unknown
+%f in format string (no. 1) requires 'double' but the argument type is
+Unknown.
+
+References
+CWE-686: Function Call With Incorrect Argument Type
]]>
+ cwe
bug
invalidPrintfArgType_float
MINOR
@@ -1160,9 +1631,15 @@ Casting between float* and double* which have an incompatible binary data repres
%n in format string (no. 1) requires 'int *' but the argument type is Unknown
+%n in format string (no. 1) requires 'int *' but the argument type is
+Unknown.
+
+References
+CWE-686: Function Call With Incorrect Argument Type
]]>
+ cwe
bug
invalidPrintfArgType_n
MINOR
@@ -1175,9 +1652,15 @@ Casting between float* and double* which have an incompatible binary data repres
%p in format string (no. 1) requires an address but the argument type is Unknown
+%p in format string (no. 1) requires an address but the argument type
+is Unknown.
+
+References
+CWE-686: Function Call With Incorrect Argument Type
]]>
+ cwe
bug
invalidPrintfArgType_p
MINOR
@@ -1190,9 +1673,15 @@ Casting between float* and double* which have an incompatible binary data repres
%s in format string (no. 1) requires 'char *' but the argument type is Unknown
+%s in format string (no. 1) requires 'char *' but the argument type is
+Unknown.
+
+References
+CWE-686: Function Call With Incorrect Argument Type
]]>
+ cwe
bug
invalidPrintfArgType_s
MINOR
@@ -1205,9 +1694,15 @@ Casting between float* and double* which have an incompatible binary data repres
%i in format string (no. 1) requires 'int' but the argument type is Unknown
+%i in format string (no. 1) requires 'int' but the argument type is
+Unknown.
+
+References
+CWE-686: Function Call With Incorrect Argument Type
]]>
+ cwe
bug
invalidPrintfArgType_sint
MINOR
@@ -1220,9 +1715,15 @@ Casting between float* and double* which have an incompatible binary data repres
%u in format string (no. 1) requires 'unsigned int' but the argument type is Unknown
+%u in format string (no. 1) requires 'unsigned int' but the argument
+type is Unknown.
+
+References
+CWE-686: Function Call With Incorrect Argument Type
]]>
+ cwe
bug
invalidPrintfArgType_uint
MINOR
@@ -1235,9 +1736,15 @@ Casting between float* and double* which have an incompatible binary data repres
%f in format string (no. 1) requires 'float *' but the argument type is Unknown
+%f in format string (no. 1) requires 'float *' but the argument type
+is Unknown.
+
+References
+CWE-686: Function Call With Incorrect Argument Type
]]>
+ cwe
bug
invalidScanfArgType_float
MINOR
@@ -1250,9 +1757,15 @@ Casting between float* and double* which have an incompatible binary data repres
%d in format string (no. 1) requires 'int *' but the argument type is Unknown
+%d in format string (no. 1) requires 'int *' but the argument type is
+Unknown.
+
+References
+CWE-686: Function Call With Incorrect Argument Type
]]>
+ cwe
bug
invalidScanfArgType_int
MINOR
@@ -1265,9 +1778,15 @@ Casting between float* and double* which have an incompatible binary data repres
%s in format string (no. 1) requires a 'char *' but the argument type is Unknown
+%s in format string (no. 1) requires a 'char *' but the argument type
+is Unknown.
+
+References
+CWE-686: Function Call With Incorrect Argument Type
]]>
+ cwe
bug
invalidScanfArgType_s
MINOR
@@ -1280,9 +1799,15 @@ Casting between float* and double* which have an incompatible binary data repres
Width 5 given in format string (no. 10) is larger than destination buffer '[0]', use %-1s to prevent overflowing it
+Width 5 given in format string (no. 10) is larger than destination
+buffer '[0]', use %-1s to prevent overflowing it.
+
+References
+CWE-687: Function Call With Incorrectly Specified Argument Value
]]>
+ cwe
bug
invalidScanfFormatWidth
MAJOR
@@ -1292,12 +1817,36 @@ Width 5 given in format string (no. 10) is larger than destination buffer '[0]',
invalidscanf
- scanf without field width limits can crash with huge input data
+ scanf() without field width limits can crash with huge input data
%20s\012\012Sample program that can crash:\012\012#include <stdio.h>\012int main()\012{\012 char c[5];\012 scanf("%s", c);\012 return 0;\012}\012\012Typing in 5 or more characters may make the program crash. The correct usage here is 'scanf("%4s", c);', as the maximum field width does not include the terminating null byte.\012Source: http://linux.die.net/man/3/scanf\012Source: http://www.opensource.apple.com/source/xnu/xnu-1456.1.26/libkern/stdio/scanf.c
+
+scanf() without field width limits can crash with huge input data. Add
+a field width specifier to fix this problem.
+
+Sample program
+that can crash:
+#include <stdio.h>
+int main()
+{
+char c[5];
+ scanf("%s", c);
+ return 0;
+}
+Typing
+in 5 or more characters may make the program crash. The correct usage
+here is 'scanf("%4s", c);', as the maximum field width does not
+include the terminating null byte.
+Source:
+http://linux.die.net/man/3/scanf
+Source: http://www.opensource.appl
+e.com/source/xnu/xnu-1456.1.26/libkern/stdio/scanf.c
+
+References
+CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
]]>
+ cwe
bug
invalidscanf
MINOR
@@ -1340,9 +1889,14 @@ Same iterator is used with different containers 'container1' and 'container2'.
Allocation with funcName, funcName doesn't release it
Allocation with funcName, funcName doesn't release it.
+
+References
+CWE-772: Missing Release of Resource after Effective Lifetime
]]>
+ cwe
bug
leakNoVarFunctionCall
MAJOR
@@ -1352,12 +1906,17 @@ Allocation with funcName, funcName doesn't release it.
leakReturnValNotUsed
- Return value of allocation function funcName is not stored
+ Return value of allocation function 'funcName' is not stored
+Return value of allocation function 'funcName' is not stored.
+
+References
+CWE-771: Missing Reference to Active Allocated Resource
]]>
+ cwe
bug
leakReturnValNotUsed
MAJOR
@@ -1370,9 +1929,15 @@ Return value of allocation function funcName is not stored.
String literal compared with variable 'foo'. Did you intend to use strcmp() instead?
+String literal compared with variable 'foo'. Did you intend to use
+strcmp() instead?
+
+References
+CWE-595: Comparison of Object References Instead of Object Contents
]]>
+ cwe
bug
literalWithCharPtrCompare
MINOR
@@ -1385,9 +1950,16 @@ String literal compared with variable 'foo'. Did you intend to use strcmp() inst
Memory for class instance allocated with malloc(), but class contains a std::string
+Memory for class instance allocated with malloc(), but class a
+std::string. This is unsafe, since no constructor is called and class
+members remain uninitialized. Consider using 'new' instead.
+
+References
+CWE-665: Improper Initialization
]]>
+ cwe
bug
mallocOnClassError
MAJOR
@@ -1400,9 +1972,16 @@ Memory for class instance allocated with malloc(), but class a std::string. This
Memory for class instance allocated with malloc(), but class provides constructors
+Memory for class instance allocated with malloc(), but class provides
+constructors. This is unsafe, since no constructor is called and class
+members remain uninitialized. Consider using 'new' instead.
+
+References
+CWE-762: Mismatched Memory Management Routines
]]>
+ cwe
bug
mallocOnClassWarning
MINOR
@@ -1415,9 +1994,14 @@ Memory for class instance allocated with malloc(), but class provides constructo
Memory leak: varname
Memory leak: varname
+
+References
+CWE-401: Missing Release of Memory after Effective Lifetime
]]>
+ cwe
bug
memleak
MAJOR
@@ -1430,9 +2014,14 @@ Memory leak: varname
Common realloc mistake: 'varname' nulled but not freed upon failure
Common realloc mistake: 'varname' nulled but not freed upon failure
+
+References
+CWE-401: Missing Release of Memory after Effective Lifetime
]]>
+ cwe
bug
memleakOnRealloc
MAJOR
@@ -1445,9 +2034,17 @@ Common realloc mistake: 'varname' nulled but not freed upon failure
Using 'memfunc' on class that contains a classname
+Using 'memfunc' on class that contains a classname is unsafe, because
+constructor, destructor and copy operator calls are omitted. These are
+necessary for this non-POD type to ensure that a valid object is
+created.
+
+References
+CWE-762: Mismatched Memory Management Routines
]]>
+ cwe
bug
memsetClass
MAJOR
@@ -1460,10 +2057,19 @@ Using 'memfunc' on class that contains a classname is unsafe, because constructo
Using memset() on class which contains a floating point number
+Using memset() on class which contains a floating point number. This
+is not portable because memset() sets each byte of a block of memory
+to a specific value and the actual representation of a floating-point
+value is implementation defined. Note: In case of an IEEE754-1985
+compatible implementation setting all bits to zero results in the
+value 0.0.
+
+References
+CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
]]>
+ cwe
bug
memsetClassFloat
MINOR
@@ -1476,9 +2082,14 @@ Note: In case of an IEEE754-1985 compatible implementation setting all bits to z
Using 'memfunc' on class that contains a reference
Using 'memfunc' on class that contains a reference.
+
+References
+CWE-665: Improper Initialization
]]>
+ cwe
bug
memsetClassReference
MAJOR
@@ -1491,9 +2102,17 @@ Using 'memfunc' on class that contains a reference.
The 2nd memset() argument 'varname' is a float, its representation is implementation defined
+The 2nd memset() argument 'varname' is a float, its representation is
+implementation defined. memset() is used to set each byte of a block
+of memory to a specific value and the actual representation of a
+floating-point value is implementation defined.
+
+References
+CWE-688: Function Call With Incorrect Variable or Reference as Argument
]]>
+ cwe
bug
memsetFloat
MINOR
@@ -1506,9 +2125,17 @@ The 2nd memset() argument 'varname' is a float, its representation is implementa
The 2nd memset() argument 'varname' doesn't fit into an 'unsigned char'
+The 2nd memset() argument 'varname' doesn't fit into an 'unsigned
+char'. The 2nd parameter is passed as an 'int', but the function fills
+the block of memory using the 'unsigned char' conversion of this
+value.
+
+References
+CWE-686: Function Call With Incorrect Argument Type
]]>
+ cwe
bug
memsetValueOutOfRange
MINOR
@@ -1518,12 +2145,20 @@ The 2nd memset() argument 'varname' doesn't fit into an 'unsigned char'. The 2nd
memsetZeroBytes
- memset() called to fill 0 bytes of 'varname'
+ memset() called to fill 0 bytes
+memset() called to fill 0 bytes. The second and third arguments might
+be inverted. The function memset ( void * ptr, int value, size_t num )
+sets the first num bytes of the block of memory pointed by ptr to the
+specified value.
+
+References
+CWE-687: Function Call With Incorrectly Specified Argument Value
]]>
+ cwe
bug
memsetZeroBytes
MINOR
@@ -1536,9 +2171,14 @@ memset() called to fill 0 bytes of 'varname'. The second and third arguments mig
Mismatching allocation and deallocation: varname
Mismatching allocation and deallocation: varname
+
+References
+CWE-762: Mismatched Memory Management Routines
]]>
+ cwe
bug
mismatchAllocDealloc
MAJOR
@@ -1551,9 +2191,14 @@ Mismatching allocation and deallocation: varname
The allocated size sz is not a multiple of the underlying type's size
The allocated size sz is not a multiple of the underlying type's size.
+
+References
+CWE-131: Incorrect Calculation of Buffer Size
]]>
+ cwe
bug
mismatchSize
MAJOR
@@ -1566,9 +2211,15 @@ The allocated size sz is not a multiple of the underlying type's size.
Mismatching bitmasks. Result is always 0 (X = Y & 0xf0; Z = X & 0x1; => Z=0)
+Mismatching bitmasks. Result is always 0 (X = Y & 0xf0; Z = X & 0x1;
+=> Z=0).
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
mismatchingBitAnd
MINOR
CODE_SMELL
@@ -1577,12 +2228,17 @@ Mismatching bitmasks. Result is always 0 (X = Y & 0xf0; Z = X & 0x1; =&g
mismatchingContainers
- Iterators of different containers are used together
+ Iterators of different containers 'v1' and 'v2' are used together
+Iterators of different containers 'v1' and 'v2' are used together.
+
+References
+CWE-664: Improper Control of a Resource Through its Lifetime
]]>
+ cwe
bug
mismatchingContainers
MAJOR
@@ -1609,8 +2265,7 @@ Include file: "" not found.
Include file: <> not found. Please note: Cppcheck does not need standard library headers to get proper results
not found. Please note: Cppcheck does not need standard library headers to get proper results.
]]>
missingIncludeSystem
@@ -1624,9 +2279,15 @@ Please note: Cppcheck does not need standard library headers to get proper resul
Comparison of modulo result is predetermined, because it is always less than 1
+Comparison of modulo result is predetermined, because it is always
+less than 1.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
moduloAlwaysTrueFalse
MINOR
@@ -1639,9 +2300,15 @@ Comparison of modulo result is predetermined, because it is always less than 1.
Expression is always false because 'else if' condition matches previous condition at line 1
+Expression is always false because 'else if' condition matches
+previous condition at line 1.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
multiCondition
MINOR
CODE_SMELL
@@ -1653,9 +2320,15 @@ Expression is always false because 'else if' condition matches previous conditio
Using NaN/Inf in a computation
+Using NaN/Inf in a computation. Although nothing bad really happens,
+it is suspicious.
+
+References
+CWE-369: Divide By Zero
]]>
+ cwe
nanInArithmeticExpression
MINOR
CODE_SMELL
@@ -1664,12 +2337,17 @@ Using NaN/Inf in a computation. Although nothing bad really happens, it is suspi
negativeIndex
- Array index -1 is out of bounds
+ Negative array index
+Negative array index
+
+References
+CWE-786: Access of Memory Location Before Start of Buffer
]]>
+ cwe
bug
negativeIndex
MAJOR
@@ -1694,12 +2372,20 @@ Memory allocation size is negative.Negative allocation size has no specified beh
noConstructor
- The class 'classname' does not have a constructor
+ The class 'classname' does not have a constructor although it has private member variables
+The class 'classname' does not have a constructor although it has
+private member variables. Member variables of builtin types are left
+uninitialized when the class is instantiated. That may cause bugs or
+undefined behavior.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
noConstructor
MINOR
CODE_SMELL
@@ -1708,7 +2394,7 @@ The class 'classname' does not have a constructor although it has private member
noCopyConstructor
- 'class class' does not have a copy constructor which is recommended since the class contains a pointer to allocated memory
+ Class 'class' does not have a copy constructor which is recommended since it has dynamic memory/resource allocation(s)
nullPointer
- Possible null pointer dereference: pointer
+ Null pointer dereference
+Null pointer dereference
+
+References
+CWE-476: NULL Pointer Dereference
]]>
+ cwe
bug
nullPointer
MAJOR
@@ -2701,9 +3392,20 @@ Obsolete function 'wcswcs' called. It is recommended to use the function 'wcsstr
'class::operator=' should return 'class &'
+The class::operator= does not conform to standard C/C++ behaviour. To
+conform to standard C/C++ behaviour, return a reference to self (such
+as: 'class &class::operator=(..) { .. return *this; }'. For safety
+reasons it might be better to not fix this message. If you think that
+safety is always more important than conformance then please
+ignore/suppress this message. For more details about this topic, see
+the book "Effective C++" by Scott Meyers.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
operatorEq
MINOR
CODE_SMELL
@@ -2715,9 +3417,14 @@ The class::operator= does not conform to standard C/C++ behaviour. To conform to
'operator=' should return reference to 'this' instance
'operator=' should return reference to 'this' instance.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
operatorEqRetRefThis
MINOR
CODE_SMELL
@@ -2729,9 +3436,16 @@ The class::operator= does not conform to standard C/C++ behaviour. To conform to
'operator=' should check for assignment to self to avoid problems with dynamic memory
+'operator=' should check for assignment to self to ensure that each
+block of dynamically allocated memory is owned and managed by only one
+instance of the class.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
operatorEqToSelf
MINOR
@@ -2744,9 +3458,15 @@ The class::operator= does not conform to standard C/C++ behaviour. To conform to
Member variable 'classname::' is not assigned a value in 'classname::operator='
+Member variable 'classname::' is not assigned a value in
+'classname::operator='.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
operatorEqVarError
MINOR
@@ -2756,12 +3476,18 @@ Member variable 'classname::' is not assigned a value in 'classname::operator='.
oppositeInnerCondition
- Opposite conditions in nested 'if' blocks lead to a dead code block
+ Opposite inner 'if' condition leads to a dead code block
+Opposite inner 'if' condition leads to a dead code block (outer
+condition is 'x' and inner condition is '!x').
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
oppositeInnerCondition
MINOR
@@ -2786,12 +3512,18 @@ index is out of bounds: Supplied size 2 is larger than actual size 1.
passedByValue
- Function parameter 'parametername' should be passed by reference
+ Function parameter 'parametername' should be passed by const reference
+Parameter 'parametername' is passed by value. It could be passed as a
+const reference which is usually faster and recommended in C++.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
passedByValue
MINOR
@@ -2804,9 +3536,16 @@ Parameter 'parametername' is passed by value. It could be passed as a (const) re
Converting pointer arithmetic result to bool. The bool is always true unless there is undefined behaviour
+Converting pointer arithmetic result to bool. The boolean result is
+always true unless there is pointer arithmetic overflow, and overflow
+is undefined behaviour. Probably a dereference is forgotten.
+
+References
+CWE-571: Expression is Always True
]]>
+ cwe
bug
pointerArithBool
MAJOR
@@ -2819,9 +3558,15 @@ Converting pointer arithmetic result to bool. The boolean result is always true
A pointer can not be negative so it is either pointless or an error to check if it is
+A pointer can not be negative so it is either pointless or an error to
+check if it is.
+
+References
+CWE-570: Expression is Always False
]]>
+ cwe
pointerLessThanZero
MINOR
CODE_SMELL
@@ -2830,12 +3575,17 @@ A pointer can not be negative so it is either pointless or an error to check if
pointerOutOfBounds
- Undefined behaviour, pointer arithmetic '' is out of bounds
+ Pointer arithmetic overflow
+Pointer arithmetic overflow.
+
+References
+CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
]]>
+ cwe
bug
pointerOutOfBounds
MINOR
@@ -2848,9 +3598,15 @@ Undefined behaviour, pointer arithmetic '' is out of bounds. From chapter 6.5.6
A pointer can not be negative so it is either pointless or an error to check if it is not
+A pointer can not be negative so it is either pointless or an error to
+check if it is not.
+
+References
+CWE-570: Expression is Always False
]]>
+ cwe
pointerPositive
MINOR
CODE_SMELL
@@ -2862,9 +3618,16 @@ A pointer can not be negative so it is either pointless or an error to check if
Size of pointer 'varname' used instead of size of its data
+Size of pointer 'varname' used instead of size of its data. This is
+likely to lead to a buffer overflow. You probably intend to write
+'sizeof(*varname)'.
+
+References
+CWE-467: Use of sizeof() on a Pointer Type
]]>
+ cwe
bug
pointerSize
MINOR
@@ -2892,9 +3655,17 @@ Possible buffer overflow if strlen(source) is larger than or equal to sizeof(des
Prefer prefix ++/-- operators for non-primitive types
+Prefix ++/-- operators should be preferred for non-primitive types.
+Pre-increment/decrement can be more efficient than post-
+increment/decrement. Post-increment/decrement usually involves keeping
+a copy of the previous value around and adds a little extra code.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
postfixOperator
MINOR
@@ -2922,9 +3693,15 @@ Prefix ++/-- operators should be preferred for non-primitive types. Pre-incremen
Possible leak in public function. The pointer 'varname' is not deallocated before it is allocated
+Possible leak in public function. The pointer 'varname' is not
+deallocated before it is allocated.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
publicAllocationError
MINOR
@@ -2937,9 +3714,14 @@ Possible leak in public function. The pointer 'varname' is not deallocated befor
Read operation on a file that was opened only for writing
Read operation on a file that was opened only for writing.
+
+References
+CWE-664: Improper Control of a Resource Through its Lifetime
]]>
+ cwe
bug
readWriteOnlyFile
MAJOR
@@ -2952,9 +3734,15 @@ Read operation on a file that was opened only for writing.
Variable 'var' is reassigned a value before the old one has been used. 'break;' missing?
+Variable 'var' is reassigned a value before the old one has been used.
+'break;' missing?
+
+References
+CWE-563: Assignment to Variable without Use
]]>
+ cwe
bug
redundantAssignInSwitch
MINOR
@@ -2967,13 +3755,17 @@ Variable 'var' is reassigned a value before the old one has been used. 'break;'
Variable 'var' is reassigned a value before the old one has been used
Variable 'var' is reassigned a value before the old one has been used.
+
+References
+CWE-563: Assignment to Variable without Use
]]>
- bug
+ cwe
redundantAssignment
MINOR
- BUG
+ CODE_SMELL
LINEAR
5min
@@ -2982,9 +3774,14 @@ Variable 'var' is reassigned a value before the old one has been used.
Redundant condition: If x > 11 the condition x > 10 is always true
+Redundant condition: If x > 11 the condition x > 10 is always true.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
redundantCondition
MINOR
CODE_SMELL
@@ -2996,9 +3793,14 @@ Redundant condition: If x > 11 the condition x > 10 is always true.
Buffer 'var' is being written before its old content has been used
Buffer 'var' is being written before its old content has been used.
+
+References
+CWE-563: Assignment to Variable without Use
]]>
+ cwe
bug
redundantCopy
MINOR
@@ -3011,9 +3813,15 @@ Buffer 'var' is being written before its old content has been used.
Buffer 'var' is being written before its old content has been used. 'break;' missing?
+Buffer 'var' is being written before its old content has been used.
+'break;' missing?
+
+References
+CWE-563: Assignment to Variable without Use
]]>
+ cwe
bug
redundantCopyInSwitch
MINOR
@@ -3026,9 +3834,16 @@ Buffer 'var' is being written before its old content has been used. 'break;' mis
Use const reference for 'varname' to avoid unnecessary data copying
+The const variable 'varname' is assigned a copy of the data. You can
+avoid the unnecessary data copying by converting 'varname' to const
+reference.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
redundantCopyLocalConst
MINOR
@@ -3041,9 +3856,15 @@ The const variable 'varname' is assigned a copy of the data. You can avoid the u
Redundant checking of STL container element existence before removing it
+Redundant checking of STL container element existence before removing
+it. It is safe to call the remove method on a non-existing element.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
redundantIfRemove
MINOR
CODE_SMELL
@@ -3075,9 +3896,14 @@ Resource leak: varname
Address of an auto-variable returned
Address of an auto-variable returned.
+
+References
+CWE-562: Return of Stack Variable Address
]]>
+ cwe
bug
returnAddressOfAutoVariable
MAJOR
@@ -3090,9 +3916,17 @@ Address of an auto-variable returned.
Address of function parameter 'parameter' returned
+Address of the function parameter 'parameter' becomes invalid after
+the function exits because function parameters are stored on the stack
+which is freed when the function exits. Thus the returned value is
+invalid.
+
+References
+CWE-562: Return of Stack Variable Address
]]>
+ cwe
bug
returnAddressOfFunctionParameter
MAJOR
@@ -3105,9 +3939,14 @@ Address of the function parameter 'parameter' becomes invalid after the function
Pointer to local array variable returned
Pointer to local array variable returned.
+
+References
+CWE-562: Return of Stack Variable Address
]]>
+ cwe
bug
returnLocalVariable
MAJOR
@@ -3117,12 +3956,17 @@ Pointer to local array variable returned.
returnReference
- Reference to auto variable returned
+ Reference to local variable returned
+Reference to local variable returned.
+
+References
+CWE-562: Return of Stack Variable Address
]]>
+ cwe
bug
returnReference
MAJOR
@@ -3135,9 +3979,14 @@ Reference to auto variable returned.
Reference to temporary returned
Reference to temporary returned.
+
+References
+CWE-562: Return of Stack Variable Address
]]>
+ cwe
bug
returnTempReference
MAJOR
@@ -3150,9 +3999,15 @@ Reference to temporary returned.
Repositioning operation performed on a file opened in append mode has no effect
+Repositioning operation performed on a file opened in append mode has
+no effect.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
seekOnAppendedFile
MINOR
@@ -3165,9 +4020,14 @@ Repositioning operation performed on a file opened in append mode has no effect.
Redundant assignment of 'varname' to itself
Redundant assignment of 'varname' to itself.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
selfAssignment
MINOR
@@ -3180,9 +4040,14 @@ Redundant assignment of 'varname' to itself.
Member variable 'var' is initialized by itself
Member variable 'var' is initialized by itself.
+
+References
+CWE-665: Improper Initialization
]]>
+ cwe
bug
selfInitialization
MAJOR
@@ -3195,9 +4060,14 @@ Member variable 'var' is initialized by itself.
Shifting by a negative value is undefined behaviour
Shifting by a negative value is undefined behaviour
+
+References
+CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
]]>
+ cwe
bug
shiftNegative
MAJOR
@@ -3207,12 +4077,17 @@ Shifting by a negative value is undefined behaviour
shiftTooManyBits
- Shifting 32-bit value by 64 bits is undefined behaviour
+ Shifting 32-bit value by 40 bits is undefined behaviour
+Shifting 32-bit value by 40 bits is undefined behaviour
+
+References
+CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
]]>
+ cwe
bug
shiftTooManyBits
MAJOR
@@ -3222,12 +4097,18 @@ Shifting 32-bit value by 64 bits is undefined behaviour
signConversion
- Suspicious code: sign conversion of var in calculation, even though var can have a negative value
+ Expression 'var' can have a negative value. That is converted to an unsigned value and used in an unsigned calculation
+Expression 'var' can have a negative value. That is converted to an
+unsigned value and used in an unsigned calculation.
+
+References
+CWE-195: Signed to Unsigned Conversion Error
]]>
+ cwe
bug
signConversion
MINOR
@@ -3255,9 +4136,14 @@ The size argument is given as a char constant.
Found calculation inside sizeof()
Found calculation inside sizeof().
+
+References
+CWE-682: Incorrect Calculation
]]>
+ cwe
bug
sizeofCalculation
MINOR
@@ -3270,9 +4156,17 @@ Found calculation inside sizeof().
'*varname' is of type 'void', the behaviour of 'sizeof(void)' is not covered by the ISO C standard
+'*varname' is of type 'void', the behaviour of 'sizeof(void)' is not
+covered by the ISO C standard. A value for 'sizeof(void)' is defined
+only as part of a GNU C extension, which defines 'sizeof(void)' to be
+1.
+
+References
+CWE-682: Incorrect Calculation
]]>
+ cwe
bug
sizeofDereferencedVoidPointer
MINOR
@@ -3285,9 +4179,15 @@ Found calculation inside sizeof().
Division by result of sizeof(). memset() expects a size in bytes, did you intend to multiply instead?
+Division by result of sizeof(). memset() expects a size in bytes, did
+you intend to multiply instead?
+
+References
+CWE-682: Incorrect Calculation
]]>
+ cwe
bug
sizeofDivisionMemfunc
MINOR
@@ -3300,9 +4200,16 @@ Division by result of sizeof(). memset() expects a size in bytes, did you intend
Behaviour of 'sizeof(void)' is not covered by the ISO C standard
+Behaviour of 'sizeof(void)' is not covered by the ISO C standard. A
+value for 'sizeof(void)' is defined only as part of a GNU C extension,
+which defines 'sizeof(void)' to be 1.
+
+References
+CWE-682: Incorrect Calculation
]]>
+ cwe
bug
sizeofVoid
MINOR
@@ -3315,9 +4222,16 @@ Behaviour of 'sizeof(void)' is not covered by the ISO C standard. A value for 's
Calling 'sizeof' on 'sizeof'
+Calling sizeof for 'sizeof looks like a suspicious code and most
+likely there should be just one 'sizeof'. The current code is
+equivalent to 'sizeof(size_t)'
+
+References
+CWE-682: Incorrect Calculation
]]>
+ cwe
bug
sizeofsizeof
MINOR
@@ -3330,9 +4244,17 @@ Calling sizeof for 'sizeof looks like a suspicious code and most likely there sh
Suspicious usage of 'sizeof' with a numeric constant as parameter
+It is unusual to use a constant value with sizeof. For example,
+'sizeof(10)' returns 4 (in 32-bit systems) or 8 (in 64-bit systems)
+instead of 10. 'sizeof('A')' and 'sizeof(char)' can return different
+results.
+
+References
+CWE-682: Incorrect Calculation
]]>
+ cwe
bug
sizeofwithnumericparameter
MINOR
@@ -3345,9 +4267,23 @@ It is unusual to use a constant value with sizeof. For example, 'sizeof(10)' ret
Using 'sizeof' on array given as function argument returns size of a pointer
+Using 'sizeof' for array given as function argument returns the size
+of a pointer. It does not return the size of the whole array in bytes
+as might be expected. For example, this code:
+ int f(char
+a[100]) {
+ return sizeof(a);
+ }
+returns 4 (in
+32-bit systems) or 8 (in 64-bit systems) instead of 100 (the size of
+the array in bytes).
+
+References
+CWE-467: Use of sizeof() on a Pointer Type
]]>
+ cwe
bug
sizeofwithsilentarraypointer
MINOR
@@ -3360,9 +4296,20 @@ Using 'sizeof' for array given as function argument returns the size of a pointe
Undefined behavior: Variable 'varname' is used as parameter and destination in s[n]printf()
+The variable 'varname' is used both as a parameter and as destination
+in s[n]printf(). The origin and destination buffers overlap. Quote
+from glibc (C-library) documentation
+(http://www.gnu.org/software/libc/manual/html_mono/libc.html
+#Formatted-Output-Functions): "If copying takes place between objects
+that overlap as a result of a call to sprintf() or snprintf(), the
+results are undefined."
+
+References
+CWE-628: Function Call with Incorrectly Specified Arguments
]]>
+ cwe
bug
sprintfOverlappingData
MAJOR
@@ -3375,9 +4322,15 @@ The variable 'varname' is used both as a parameter and as destination in s[n]pri
Unnecessary comparison of static strings
+The compared strings, 'str1' and 'str2', are always unequal. Therefore
+the comparison is unnecessary and looks suspicious.
+
+References
+CWE-570: Expression is Always False
]]>
+ cwe
bug
staticStringCompare
MINOR
@@ -3387,12 +4340,19 @@ The compared strings, 'str1' and 'str2', are always unequal. Therefore the compa
stlBoundaries
- Dangerous iterator comparison using operator< on 'std::container'
+ Dangerous comparison using operator< on iterator
+Iterator compared with operator<. This is dangerous since the order of
+items in the container is not guaranteed. One should use operator!=
+instead to compare iterators.
+
+References
+CWE-664: Improper Control of a Resource Through its Lifetime
]]>
+ cwe
bug
stlBoundaries
MAJOR
@@ -3405,9 +4365,15 @@ Iterator of container 'std::container' compared with operator<. This is dange
Suspicious condition. The result of find() is an iterator, but it is not properly checked
+Suspicious condition. The result of find() is an iterator, but it is
+not properly checked.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
stlIfFind
MINOR
@@ -3417,12 +4383,21 @@ Suspicious condition. The result of find() is an iterator, but it is not properl
stlIfStrFind
- Inefficient usage of string::find() in condition; string::compare() would be faster
+ Inefficient usage of string::find() in condition; string::starts_with() could be faster
+Either inefficient or wrong usage of string::find().
+string::starts_with() will be faster if string::find's result is
+compared with 0, because it will not scan the whole string. If your
+intention is to check that there are no findings in the string, you
+should compare with std::string::npos.
+
+References
+CWE-597: Use of Wrong Operator in String Comparison
]]>
+ cwe
bug
stlIfStrFind
MINOR
@@ -3435,9 +4410,14 @@ Either inefficient or wrong usage of string::find(). string::compare() will be f
When i==foo.size(), foo[i] is out of bounds
When i==foo.size(), foo[i] is out of bounds.
+
+References
+CWE-788: Access of Memory Location After End of Buffer
]]>
+ cwe
bug
stlOutOfBounds
MAJOR
@@ -3450,9 +4430,16 @@ When i==foo.size(), foo[i] is out of bounds.
Possible inefficient checking for 'list' emptiness
+Checking for 'list' emptiness might be inefficient. Using list.empty()
+instead of list.size() can be faster. list.size() can take linear time
+but list.empty() is guaranteed to take constant time.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
stlSize
MINOR
@@ -3465,9 +4452,15 @@ Checking for 'list' emptiness might be inefficient. Using list.empty() instead o
Dangerous usage of c_str(). The value returned by c_str() is invalid after this call
+Dangerous usage of c_str(). The c_str() return value is only valid
+until its string is deleted.
+
+References
+CWE-664: Improper Control of a Resource Through its Lifetime
]]>
+ cwe
bug
stlcstr
MAJOR
@@ -3480,9 +4473,16 @@ Dangerous usage of c_str(). The c_str() return value is only valid until its str
Passing the result of c_str() to a function that takes std::string as argument no. 0 is slow and redundant
+The conversion from const char* as returned by c_str() to std::string
+creates an unnecessary string copy. Solve that by directly passing the
+string.
+
+References
+CWE-704: Incorrect Type Conversion or Cast
]]>
+ cwe
bug
stlcstrParam
MINOR
@@ -3495,9 +4495,16 @@ The conversion from const char* as returned by c_str() to std::string creates an
Returning the result of c_str() in a function that returns std::string is slow and redundant
+The conversion from const char* as returned by c_str() to std::string
+creates an unnecessary string copy. Solve that by directly returning
+the string.
+
+References
+CWE-704: Incorrect Type Conversion or Cast
]]>
+ cwe
bug
stlcstrReturn
MINOR
@@ -3510,9 +4517,15 @@ The conversion from const char* as returned by c_str() to std::string creates an
Unusual pointer arithmetic. A value of type 'char' is added to a string literal
+Unusual pointer arithmetic. A value of type 'char' is added to a
+string literal.
+
+References
+CWE-665: Improper Initialization
]]>
+ cwe
bug
strPlusChar
MAJOR
@@ -3525,9 +4538,15 @@ Unusual pointer arithmetic. A value of type 'char' is added to a string literal.
Comparison of identical string variables
+The compared strings, 'varname1' and 'varname2', are identical. This
+could be a logic bug.
+
+References
+CWE-571: Expression is Always True
]]>
+ cwe
bug
stringCompare
MINOR
@@ -3555,9 +4574,14 @@ At most, strncat appends the 3rd parameter's amount of characters and adds a ter
Suspicious use of ; at the end of '' statement
Suspicious use of ; at the end of '' statement.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
suspiciousSemicolon
MINOR
@@ -3599,9 +4623,14 @@ If the source string's size fits or exceeds the given size, strncpy() does not a
Suspicious pointer subtraction. Did you intend to write '->'?
+Suspicious pointer subtraction. Did you intend to write '->'?
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
thisSubtraction
MINOR
@@ -3614,9 +4643,18 @@ Suspicious pointer subtraction. Did you intend to write '->'?
Too many #ifdef configurations - cppcheck only checks 12 configurations. Use --force to check all configurations. For more details, use --enable=information
+The checking of the file will be interrupted because there are too
+many #ifdef configurations. Checking of all #ifdef configurations can
+be forced by --force command line option or from GUI preferences.
+However that may increase the checking time. For more details, use
+--enable=information.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
toomanyconfigs
MINOR
CODE_SMELL
@@ -3628,9 +4666,14 @@ The checking of the file will be interrupted because there are too many #ifdef c
Variable 'varname' is not assigned a value
Variable 'varname' is not assigned a value.
+
+References
+CWE-665: Improper Initialization
]]>
+ cwe
unassignedVariable
MINOR
CODE_SMELL
@@ -3642,9 +4685,15 @@ Variable 'varname' is not assigned a value.
Member variable 'classname::varname' is not initialized in the constructor
+Member variable 'classname::varname' is not initialized in the
+constructor.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
uninitMemberVar
MINOR
@@ -3657,9 +4706,14 @@ Member variable 'classname::varname' is not initialized in the constructor.
Uninitialized struct member: a.b
Uninitialized struct member: a.b
+
+References
+CWE-457: Use of Uninitialized Variable
]]>
+ cwe
bug
uninitStructMember
MAJOR
@@ -3672,9 +4726,14 @@ Uninitialized struct member: a.b
Memory is allocated but not initialized: varname
Memory is allocated but not initialized: varname
+
+References
+CWE-457: Use of Uninitialized Variable
]]>
+ cwe
bug
uninitdata
MAJOR
@@ -3687,9 +4746,15 @@ Memory is allocated but not initialized: varname
Dangerous usage of 'varname' (strncpy doesn't always null-terminate it)
+Dangerous usage of 'varname' (strncpy doesn't always null-terminate
+it).
+
+References
+CWE-676: Use of Potentially Dangerous Function
]]>
+ cwe
bug
uninitstring
MAJOR
@@ -3702,9 +4767,14 @@ Dangerous usage of 'varname' (strncpy doesn't always null-terminate it).
Uninitialized variable: varname
Uninitialized variable: varname
+
+References
+CWE-457: Use of Uninitialized Variable
]]>
+ cwe
bug
uninitvar
MAJOR
@@ -3746,9 +4816,15 @@ The extra qualification 'type' is unnecessary and is considered an error by many
Expression '1 - erf(x)' can be replaced by 'erfc(x)' to avoid loss of precision
+Expression '1 - erf(x)' can be replaced by 'erfc(x)' to avoid loss of
+precision.
+
+References
+CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
]]>
+ cwe
unpreciseMathCall
MINOR
CODE_SMELL
@@ -3760,9 +4836,15 @@ Expression '1 - erf(x)' can be replaced by 'erfc(x)' to avoid loss of precision.
Statements following return, break, continue, goto or throw will never be executed
+Statements following return, break, continue, goto or throw will never
+be executed.
+
+References
+CWE-561: Dead Code
]]>
+ cwe
unreachableCode
MINOR
CODE_SMELL
@@ -3774,9 +4856,14 @@ Statements following return, break, continue, goto or throw will never be execut
Variable 'varname' is assigned a value that is never used
Variable 'varname' is assigned a value that is never used.
+
+References
+CWE-563: Assignment to Variable without Use
]]>
+ cwe
unreadVariable
MINOR
CODE_SMELL
@@ -3788,9 +4875,16 @@ Variable 'varname' is assigned a value that is never used.
Class 'class' is unsafe, 'class::varname' can leak by wrong usage
+The class 'class' is unsafe, wrong usage can cause memory/resource
+leaks for 'class::varname'. This can for instance be fixed by adding
+proper cleanup in the destructor.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
unsafeClassCanLeak
MINOR
CODE_SMELL
@@ -3799,12 +4893,18 @@ The class 'class' is unsafe, wrong usage can cause memory/resource leaks for 'cl
unsignedLessThanZero
- Checking if unsigned variable 'varname' is less than zero
+ Checking if unsigned expression 'varname' is less than zero
+The unsigned expression 'varname' will never be negative so it is
+either pointless or an error to check if it is.
+
+References
+CWE-570: Expression is Always False
]]>
+ cwe
unsignedLessThanZero
MINOR
CODE_SMELL
@@ -3813,12 +4913,18 @@ The unsigned variable 'varname' will never be negative so it is either pointless
unsignedPositive
- Unsigned variable 'varname' can't be negative so it is unnecessary to test it
+ Unsigned expression 'varname' can't be negative so it is unnecessary to test it
+Unsigned expression 'varname' can't be negative so it is unnecessary
+to test it.
+
+References
+CWE-570: Expression is Always False
]]>
+ cwe
unsignedPositive
MINOR
CODE_SMELL
@@ -3830,9 +4936,14 @@ Unsigned variable 'varname' can't be negative so it is unnecessary to test it.
Variable 'varname' is allocated memory that is never used
Variable 'varname' is allocated memory that is never used.
+
+References
+CWE-563: Assignment to Variable without Use
]]>
+ cwe
unusedAllocatedMemory
MINOR
CODE_SMELL
@@ -3844,9 +4955,14 @@ Variable 'varname' is allocated memory that is never used.
The function 'funcName' is never used
The function 'funcName' is never used.
+
+References
+CWE-561: Dead Code
]]>
+ cwe
unusedFunction
MINOR
CODE_SMELL
@@ -3858,9 +4974,14 @@ The function 'funcName' is never used.
Unused private function: 'classname::funcname'
Unused private function: 'classname::funcname'
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
unusedPrivateFunction
MINOR
CODE_SMELL
@@ -3872,24 +4993,33 @@ Unused private function: 'classname::funcname'
Instance of 'varname' object is destroyed immediately
Instance of 'varname' object is destroyed immediately.
+
+References
+CWE-563: Assignment to Variable without Use
]]>
- bug
+ cwe
unusedScopedObject
- MAJOR
- BUG
+ MINOR
+ CODE_SMELL
LINEAR
5min
unusedStructMember
- struct or union member 'structname::variable' is never used
+ struct member 'structname::variable' is never used
+struct member 'structname::variable' is never used.
+
+References
+CWE-563: Assignment to Variable without Use
]]>
+ cwe
unusedStructMember
MINOR
CODE_SMELL
@@ -3901,9 +5031,14 @@ struct or union member 'structname::variable' is never used.
Unused variable: varname
Unused variable: varname
+
+References
+CWE-563: Assignment to Variable without Use
]]>
+ cwe
unusedVariable
MINOR
CODE_SMELL
@@ -3959,9 +5094,14 @@ An element of container must be able to be copied but 'auto_ptr' does not fulfil
Used file that is not opened
Used file that is not opened.
+
+References
+CWE-910: Use of Expired File Descriptor
]]>
+ cwe
bug
useClosedFile
MAJOR
@@ -3974,9 +5114,18 @@ Used file that is not opened.
Variable 'variable' is assigned in constructor body. Consider performing initialization in initialization list
+When an object of a class is created, the constructors of all member
+variables are called consecutively in the order the variables are
+declared, even if you don't explicitly write them to the
+initialization list. You could avoid assigning 'variable' a value by
+passing the value to the constructor in the initialization list.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
useInitializationList
MINOR
@@ -3989,9 +5138,14 @@ When an object of a class is created, the constructors of all member variables a
Assignment of function parameter has no effect outside the function
Assignment of function parameter has no effect outside the function.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
uselessAssignmentArg
MINOR
CODE_SMELL
@@ -4003,9 +5157,15 @@ Assignment of function parameter has no effect outside the function.
Assignment of function parameter has no effect outside the function. Did you forget dereferencing it?
+Assignment of function parameter has no effect outside the function.
+Did you forget dereferencing it?
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
uselessAssignmentPtrArg
MINOR
@@ -4018,9 +5178,17 @@ Assignment of function parameter has no effect outside the function. Did you for
It is inefficient to call 'str.find(str)' as it always returns 0
+'std::string::find()' returns zero when given itself as parameter
+(str.find(str)). As it is currently the code is inefficient. It is
+possible either the string searched ('str') or searched for ('str') is
+wrong.
+
+References
+CWE-628: Function Call with Incorrectly Specified Arguments
]]>
+ cwe
bug
uselessCallsCompare
MINOR
@@ -4033,9 +5201,15 @@ Assignment of function parameter has no effect outside the function. Did you for
Ineffective call of function 'empty()'. Did you intend to call 'clear()' instead?
+Ineffective call of function 'empty()'. Did you intend to call
+'clear()' instead?
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
uselessCallsEmpty
MINOR
@@ -4048,9 +5222,17 @@ Ineffective call of function 'empty()'. Did you intend to call 'clear()' instead
Return value of std::remove() ignored. Elements remain in container
+The return value of std::remove() is ignored. This function returns an
+iterator to the end of the range containing those elements that should
+be kept. Elements past new end remain valid but with unspecified
+values. Use the erase method of the container to delete them.
+
+References
+CWE-762: Mismatched Memory Management Routines
]]>
+ cwe
bug
uselessCallsRemove
MINOR
@@ -4063,9 +5245,15 @@ The return value of std::remove() is ignored. This function returns an iterator
Ineffective call of function 'substr' because it returns a copy of the object. Use operator= instead
+Ineffective call of function 'substr' because it returns a copy of the
+object. Use operator= instead.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
bug
uselessCallsSubstr
MINOR
@@ -4078,9 +5266,16 @@ Ineffective call of function 'substr' because it returns a copy of the object. U
It is inefficient to swap a object with itself by calling 'str.swap(str)'
+The 'swap()' function has no logical effect when given itself as
+parameter (str.swap(str)). As it is currently the code is inefficient.
+Is the object or the parameter wrong here?
+
+References
+CWE-628: Function Call with Incorrectly Specified Arguments
]]>
+ cwe
bug
uselessCallsSwap
MINOR
@@ -4093,9 +5288,14 @@ The 'swap()' function has no logical effect when given itself as parameter (str.
va_list 'vl' was opened but not closed by va_end()
va_list 'vl' was opened but not closed by va_end().
+
+References
+CWE-664: Improper Control of a Resource Through its Lifetime
]]>
+ cwe
bug
va_end_missing
MAJOR
@@ -4108,9 +5308,14 @@ va_list 'vl' was opened but not closed by va_end().
va_list 'vl' used before va_start() was called
va_list 'vl' used before va_start() was called.
+
+References
+CWE-664: Improper Control of a Resource Through its Lifetime
]]>
+ cwe
bug
va_list_usedBeforeStarted
MAJOR
@@ -4123,9 +5328,15 @@ va_list 'vl' used before va_start() was called.
Using reference 'arg1' as parameter for va_start() results in undefined behaviour
+Using reference 'arg1' as parameter for va_start() results in
+undefined behaviour.
+
+References
+CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
]]>
+ cwe
bug
va_start_referencePassed
MAJOR
@@ -4135,12 +5346,18 @@ Using reference 'arg1' as parameter for va_start() results in undefined behaviou
va_start_subsequentCalls
- va_start() or va_copy() called subsequently on 'vl' without va_end() inbetween
+ va_start() or va_copy() called subsequently on 'vl' without va_end() in between
+va_start() or va_copy() called subsequently on 'vl' without va_end()
+in between.
+
+References
+CWE-664: Improper Control of a Resource Through its Lifetime
]]>
+ cwe
bug
va_start_subsequentCalls
MAJOR
@@ -4153,9 +5370,15 @@ va_start() or va_copy() called subsequently on 'vl' without va_end() inbetween.
'arg1' given to va_start() is not last named argument of the function. Did you intend to pass 'arg2'?
+'arg1' given to va_start() is not last named argument of the function.
+Did you intend to pass 'arg2'?
+
+References
+CWE-688: Function Call With Incorrect Variable or Reference as Argument
]]>
+ cwe
bug
va_start_wrongParameter
MINOR
@@ -4168,9 +5391,71 @@ va_start() or va_copy() called subsequently on 'vl' without va_end() inbetween.
Passing NULL after the last typed argument to a variadic function leads to undefined behaviour
+Passing NULL after the last typed argument to a variadic function
+leads to undefined behaviour.
+The C99 standard, in section
+7.15.1.1, states that if the type used by va_arg() is not compatible
+with the type of the actual next argument (as promoted according to
+the default argument promotions), the behavior is undefined.
+The
+value of the NULL macro is an implementation-defined null pointer
+constant (7.17), which can be any integer constant expression with the
+value 0, or such an expression casted to (void*) (6.3.2.3). This
+includes values like 0, 0L, or even 0LL.
+In practice on common
+architectures, this will cause real crashes if sizeof(int) !=
+sizeof(void*), and NULL is defined to 0 or any other null pointer
+constant that promotes to int.
+To reproduce you might be able to
+use this little code example on 64bit platforms. If the output
+includes "ERROR", the sentinel had only 4 out of 8 bytes initialized
+to zero and was not detected as the final argument to stop argument
+processing via va_arg(). Changing the 0 to (void*)0 or 0L will make
+the "ERROR" output go away.
+#include <stdarg.h>
+#include <stdio.h>
+
+void f(char *s, ...) {
+ va_list ap;
+va_start(ap,s);
+ for (;;) {
+ char *p =
+va_arg(ap,char*);
+ printf("%018p, %s\n", p, (long)p & 255 ?
+p : "");
+ if(!p) break;
+ }
+va_end(ap);
+}
+void g() {
+ char *s2 = "x";
+ char
+*s3 = "ERROR";
+ // changing 0 to 0L for the 7th argument
+(which is intended to act as sentinel) makes the error go away on
+x86_64
+ f("first", s2, s2, s2, s2, s2, 0, s3,
+(char*)0);
+}
+void h() {
+ int i;
+ volatile
+unsigned char a[1000];
+ for (i = 0; i<sizeof(a); i++)
+a[i] = -1;
+}
+int main() {
+ h();
+ g();
+return 0;
+}
+
+References
+CWE-475: Undefined Behavior for Input to API
]]>
+ cwe
bug
varFuncNullUB
MINOR
@@ -4211,9 +5496,34 @@ The variable 'name' hides a typedef with the same name.
The scope of the variable 'varname' can be reduced
+The scope of the variable 'varname' can be reduced. Warning: Be
+careful when fixing this message, especially when there are inner
+loops. Here is an example where cppcheck will write that the scope for
+'i' can be reduced:
+void f(int x)
+{
+ int i = 0;
+ if
+(x) {
+ // it's safe to move 'int i = 0;' here
+ for
+(int n = 0; n < 10; ++n) {
+ // it is possible but not
+safe to move 'int i = 0;' here
+ do_something(&i);
+
+}
+ }
+}
+When you see this message it is always safe to
+reduce the variable scope 1 level.
+
+References
+CWE-398: 7PK - Code Quality
]]>
+ cwe
variableScope
MINOR
CODE_SMELL
@@ -4225,9 +5535,19 @@ The scope of the variable 'varname' can be reduced. Warning: Be careful when fix
Class 'Base' which is inherited by class 'Derived' does not have a virtual destructor
+Class 'Base' which is inherited by class 'Derived' does not have a
+virtual destructor. If you destroy instances of the derived class by
+deleting a pointer that points to the base class, only the destructor
+of the base class is executed. Thus, dynamic memory that is managed by
+the derived class could leak. This can be avoided by adding a virtual
+destructor to the base class.
+
+References
+CWE-404: Improper Resource Shutdown or Release
]]>
+ cwe
bug
virtualDestructor
MAJOR
@@ -4240,9 +5560,14 @@ Class 'Base' which is inherited by class 'Derived' does not have a virtual destr
Write operation on a file that was opened only for reading
Write operation on a file that was opened only for reading.
+
+References
+CWE-664: Improper Control of a Resource Through its Lifetime
]]>
+ cwe
bug
writeReadOnlyFile
MAJOR
@@ -4255,9 +5580,17 @@ Write operation on a file that was opened only for reading.
Buffer 'varname' must have size of 2 integers if used as parameter of pipe()
+The pipe()/pipe2() system command takes an argument, which is an array
+of exactly two integers.
+The variable 'varname' is an array of size
+dimension, which does not match.
+
+References
+CWE-686: Function Call With Incorrect Argument Type
]]>
+ cwe
bug
wrongPipeParameterSize
MAJOR
@@ -4270,9 +5603,14 @@ The pipe()/pipe2() system command takes an argument, which is an array of exactl
printf format string requires 3 parameters but only 2 are given
printf format string requires 3 parameters but only 2 are given.
+
+References
+CWE-685: Function Call With Incorrect Number of Arguments
]]>
+ cwe
bug
wrongPrintfScanfArgNum
MAJOR
@@ -4285,9 +5623,14 @@ printf format string requires 3 parameters but only 2 are given.
printf: referencing parameter 2 while 1 arguments given
printf: referencing parameter 2 while 1 arguments given
+
+References
+CWE-685: Function Call With Incorrect Number of Arguments
]]>
+ cwe
bug
wrongPrintfScanfParameterPositionError
MINOR
@@ -4300,9 +5643,14 @@ printf: referencing parameter 2 while 1 arguments given
Passing value '#' to #() leads to implementation-defined result
Passing value '#' to #() leads to implementation-defined result.
+
+References
+CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
]]>
+ cwe
bug
wrongmathcall
MINOR
@@ -4315,9 +5663,14 @@ Passing value '#' to #() leads to implementation-defined result.
Division by zero
Division by zero.
+
+References
+CWE-369: Divide By Zero
]]>
+ cwe
bug
zerodiv
MAJOR
@@ -4327,15 +5680,20 @@ Division by zero.
zerodivcond
- Either the condition '' is useless or there is division by zero at line 0
+ Either the condition is redundant or there is division by zero
+Either the condition is redundant or there is division by zero.
+
+References
+CWE-369: Divide By Zero
]]>
+ cwe
bug
zerodivcond
- MINOR
+ MAJOR
BUG
LINEAR
5min
@@ -4345,7 +5703,7 @@ Either the condition '' is useless or there is division by zero at line 0.
Comparison of a boolean value using relational operator (<, >, <= or >=)
, <= or >=) operator could cause unexpected results.
]]>
bug
@@ -4455,17 +5813,16 @@ suspicious as the same code is executed regardless of the condition.
CWE-398: 7PK - Code Quality
]]>
- bug
cwe
duplicateExpressionTernary
- MAJOR
- BUG
+ MINOR
+ CODE_SMELL
LINEAR
5min
noExplicitConstructor
- Class has a constructor with 1 argument that is not explicit
+ Class 'classname' has a constructor with 1 argument that is not explicit
@@ -4480,7 +5837,7 @@ some mistakes when using the class can be avoided.
cwe
noExplicitConstructor
- MAJOR
+ MINOR
CODE_SMELL
LINEAR
5min
@@ -4503,23 +5860,23 @@ some mistakes when using the class can be avoided.
-No return
statement in non-void function causes undefined behavior.
+No 'return' statement in non-void function causes undefined behavior.
References
-CWE-398: Indicator of Poor Code Quality
+CWE-398: 7PK - Code Quality
]]>
cwe
bug
operatorEqMissingReturnStatement
MAJOR
- CODE_SMELL
+ BUG
LINEAR
5min
operatorEqShouldBeLeftUnimplemented
- 'operator=' should either return reference to 'this'
+ 'operator=' should either return reference to 'this' instance or be declared private and left unimplemented
@@ -4527,19 +5884,19 @@ No return
statement in non-void function causes undefined behavior.
declared private and left unimplemented.
References
-CWE-398: Indicator of Poor Code Quality
+CWE-398: 7PK - Code Quality
]]>
cwe
operatorEqShouldBeLeftUnimplemented
- MAJOR
+ MINOR
CODE_SMELL
LINEAR
5min
redundantPointerOp
- Redundant pointer operation on varname
+ Redundant pointer operation on 'varname' - it's already a pointer
@@ -4551,7 +5908,7 @@ Redundant pointer operation on 'varname' - it's already a pointer.
cwe
redundantPointerOp
- MAJOR
+ MINOR
CODE_SMELL
LINEAR
5min
@@ -4627,14 +5984,14 @@ Declaration of array with negative size is undefined behaviour
Result of operator '|' is always true if one operand is non-zero. Did
-you intend to use '&'?
+you intend to use '&'?
References
CWE-571: Expression is Always True
]]>
- bug
cwe
+ bug
badBitmaskCheck
MINOR
BUG
@@ -4643,20 +6000,20 @@ you intend to use '&'?
knownConditionTrueFalse
- Condition is always true/false
+ Condition 'x' is always false
-
-Condition 'x' is always true/false.
-References
+
+Condition 'x' is always false
+
+References
CWE-570: Expression is Always False
-CWE-571: Expression is Always True
]]>
- bug
cwe
knownConditionTrueFalse
MINOR
- BUG
+ CODE_SMELL
LINEAR
5min
@@ -4667,7 +6024,7 @@ Condition 'x' is always true/false.
Possible null pointer dereference if the default parameter value is
-used
+used: pointer
References
CWE-476: NULL Pointer Dereference
@@ -4675,7 +6032,6 @@ used
cwe
bug
- cert
nullPointerDefaultArg
MINOR
BUG
@@ -4689,15 +6045,14 @@ used
Either the condition is redundant or there is possible null pointer
-dereference
+dereference: pointer.
References
CWE-476: NULL Pointer Dereference
]]>
- bug
- cert
cwe
+ bug
nullPointerRedundantCheck
MINOR
BUG
@@ -4719,7 +6074,7 @@ dereference
raceAfterInterlockedDecrement
- Race condition: non-interlocked access after InterlockedDecrement()
+ Race condition: non-interlocked access after InterlockedDecrement(). Use InterlockedDecrement() return value instead
@@ -4731,19 +6086,20 @@ Use InterlockedDecrement() return value instead.
]]>
cwe
+ bug
raceAfterInterlockedDecrement
- CRITICAL
- CODE_SMELL
+ MAJOR
+ BUG
LINEAR
5min
unusedLabel
- Label is not used
+ Label '' is not used
-Label is not used.
+Label '' is not used.
References
CWE-398: 7PK - Code Quality
@@ -4769,17 +6125,17 @@ behaviour.
CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
]]>
- bug
cwe
+ bug
stringLiteralWrite
- CRITICAL
+ MAJOR
BUG
LINEAR
5min
truncLongCastAssignment
- int result is assigned to long variable (potential truncation)
+ int result is assigned to long variable. If the variable is long to avoid loss of information, then you have loss of information
@@ -4801,7 +6157,7 @@ example 'l = a * b;' => 'l = (long)a * b;'.
truncLongCastReturn
- int result is returned as long value (potential truncation)
+ int result is returned as long value. If the return value is long to avoid loss of information, then you have loss of information
@@ -4826,22 +6182,24 @@ example 'return a*b;' => 'return (long)a*b'.
assignBoolToFloat
Boolean value assigned to floating point variable
-
+
Boolean value assigned to floating point variable.
-References
+
+References
CWE-704: Incorrect Type Conversion or Cast
]]>
cwe
assignBoolToFloat
- MAJOR
- BUG
+ MINOR
+ CODE_SMELL
LINEAR
5min
invalidTestForOverflow
- Invalid test for overflow (undefined behavior)
+ Invalid test for overflow 'x + u < x'. Condition is always false unless there is overflow, and overflow is undefined behaviour
@@ -4853,15 +6211,16 @@ unless there is overflow, and overflow is undefined behaviour.
]]>
cwe
+ bug
invalidTestForOverflow
- MAJOR
+ MINOR
BUG
LINEAR
5min
unknownEvaluationOrder
- Expression depends on order of evaluation (side effects)
+ Expression 'x = x++;' depends on order of evaluation of side effects
@@ -4872,9 +6231,10 @@ Expression 'x = x++;' depends on order of evaluation of side effects
]]>
cwe
+ bug
unknownEvaluationOrder
MAJOR
- CODE_SMELL
+ BUG
LINEAR
5min
@@ -4893,9 +6253,10 @@ than 127 there will be a buffer underflow because of sign extension.
]]>
cwe
+ bug
signedCharArrayIndex
- MAJOR
- CODE_SMELL
+ MINOR
+ BUG
LINEAR
5min
@@ -4905,7 +6266,7 @@ than 127 there will be a buffer underflow because of sign extension.
-'char' type used as array index. Values greater that 127 will be
+'char' type used as array index. Values greater than 127 will be
treated depending on whether 'char' is signed or unsigned on target
platform.
@@ -4914,19 +6275,20 @@ platform.
]]>
cwe
+ bug
unknownSignCharArrayIndex
- MAJOR
- CODE_SMELL
+ MINOR
+ BUG
LINEAR
5min
unusedLabelSwitch
- Label is not used.
+ Label '' is not used. Should this be a 'case' of the enclosing switch()?
-Label is not used. Should this be a 'case' of the enclosing
+Label '' is not used. Should this be a 'case' of the enclosing
switch()?
References
@@ -4934,9 +6296,10 @@ switch()?
]]>
cwe
+ bug
unusedLabelSwitch
MINOR
- CODE_SMELL
+ BUG
LINEAR
5min
@@ -4944,27 +6307,28 @@ switch()?
leakUnsafeArgAlloc
- Unsafe allocation. If 'funcName()' throws, memory could be leaked
+ Unsafe allocation. If funcName() throws, memory could be leaked. Use make_shared<int>() instead
Unsafe allocation. If funcName() throws, memory could be leaked. Use
-make_shared<T>() / make_unique<T>() instead.
+make_shared<int>() instead.
References
-CWE-401: Improper Release of Memory Before Removing Last Reference
+CWE-401: Missing Release of Memory after Effective Lifetime
]]>
cwe
+ bug
leakUnsafeArgAlloc
- MAJOR
- CODE_SMELL
+ MINOR
+ BUG
LINEAR
5min
suspiciousCase
- Found suspicious case label in switch()
+ Found suspicious case label in switch(). Operator '||' probably doesn't work as intended
@@ -4977,46 +6341,30 @@ instead?
]]>
cwe
+ bug
suspiciousCase
- MAJOR
- CODE_SMELL
+ MINOR
+ BUG
LINEAR
5min
- suspiciousEqualityComparison
- Found suspicious equality comparison
+ multiplySizeof
+ Multiplying sizeof() with sizeof() indicates a logic error
-Found suspicious equality comparison. Did you intend to assign a value
-instead?
+
+Multiplying sizeof() with sizeof() indicates a logic error.
References
-CWE-482: Comparing instead of Assigning
-]]>
-
- cwe
- suspiciousEqualityComparison
- MAJOR
- CODE_SMELL
- LINEAR
- 5min
-
-
- multiplySizeof
- Multiplying sizeof() with sizeof()
-
-
-Multiplying sizeof() with sizeof() indicates a logic error.
-References
CWE-682: Incorrect Calculation
-]]>
+ ]]>
cwe
+ bug
multiplySizeof
- MAJOR
- CODE_SMELL
+ MINOR
+ BUG
LINEAR
5min
@@ -5034,25 +6382,28 @@ size of the pointer, not the size of the memory area it points to.
]]>
cwe
+ bug
divideSizeof
- MAJOR
- CODE_SMELL
+ MINOR
+ BUG
LINEAR
5min
reademptycontainer
- Reading from empty STL container
+ Reading from empty STL container 'var'
-
-Reading from empty STL container.
-References
-CWE-398: Indicator of Poor Code Quality
+
+Reading from empty STL container 'var'
+
+References
+CWE-398: 7PK - Code Quality
]]>
cwe
reademptycontainer
- MAJOR
+ MINOR
CODE_SMELL
LINEAR
5min
@@ -5091,61 +6442,67 @@ Shifting a negative value is technically undefined behaviour
]]>
cwe
+ bug
shiftNegativeLHS
- MAJOR
+ MINOR
BUG
LINEAR
5min
accessMoved
- Access of moved variable 'name'
+ Access of moved variable 'v'
-Access of moved variable 'name'.
+Access of moved variable 'v'.
References
CWE-672: Operation on a Resource after Expiration or Release
]]>
cwe
+ bug
accessMoved
MINOR
- CODE_SMELL
+ BUG
LINEAR
5min
accessForwarded
- Access of forwarded variable 'name'
+ Access of forwarded variable 'v'
-
-Access of forwarded variable 'name'.
-References
+
+Access of forwarded variable 'v'.
+
+References
CWE-672: Operation on a Resource after Expiration or Release
]]>
cwe
+ bug
accessForwarded
MINOR
- CODE_SMELL
+ BUG
LINEAR
5min
floatConversionOverflow
- Undefined behaviour: float to integer conversion overflow
+ Undefined behaviour: float (1e+100) to integer conversion overflow
-Undefined behaviour: float to integer conversion overflow.
+Undefined behaviour: float (1e+100) to integer conversion overflow.
References
CWE-190: Integer Overflow or Wraparound
]]>
cwe
+ bug
floatConversionOverflow
MAJOR
BUG
@@ -5155,11 +6512,12 @@ Undefined behaviour: float to integer conversion overflow.
funcArgNamesDifferent
- Different argument name in function declaration and definition
+ Function 'function' argument 2 names different: declaration 'A' definition 'B'
-Different argument name in function declaration and function definition.
+Function 'function' argument 2 names different: declaration 'A'
+definition 'B'.
References
CWE-628: Function Call with Incorrectly Specified Arguments
@@ -5174,11 +6532,12 @@ Different argument name in function declaration and function definition.
funcArgOrderDifferent
- Different argument order in function declaration and definition
+ Function 'function' argument order different: declaration '' definition ''
-Different argument order in function declaration and function definition
+Function 'function' argument order different: declaration ''
+definition ''
References
CWE-683: Function Call With Incorrect Order of Arguments
@@ -5187,7 +6546,7 @@ Different argument order in function declaration and function definition
cwe
bug
funcArgOrderDifferent
- MAJOR
+ MINOR
BUG
LINEAR
5min
@@ -5200,9 +6559,10 @@ Different argument order in function declaration and function definition
The class 'class' has 'operator=' but lack of 'copy constructor'.
]]>
+ bug
copyCtorAndEqOperator
MINOR
- CODE_SMELL
+ BUG
LINEAR
5min
@@ -5223,25 +6583,25 @@ Public interface of Class is not safe. When calling Class::dostuff(), if paramet
pointerAdditionResultNotNull
- Comparison is wrong. Result of can be 0
+ Comparison is wrong. Result of 'ptr+1' can't be 0 unless there is pointer overflow, and pointer overflow is undefined behaviour
+ bug
pointerAdditionResultNotNull
- MAJOR
- CODE_SMELL
+ MINOR
+ BUG
LINEAR
5min
overlappingStrcmp
- Multiple suspicious overlapping strcmp
+ The expression 'strcmp(x,"def") != 0' is suspicious. It overlaps 'strcmp(x,"abc") == 0'
-
+
]]>
overlappingStrcmp
@@ -7204,7 +8564,7 @@ Obsolescent function 'tmpnam' called. It is recommended to use
unhandledExceptionSpecification
- Unhandled exception specification
+ Unhandled exception specification when calling function foo()
@@ -7225,10 +8585,10 @@ specification for funcname() also.
purgedConfiguration
- The configuration 'define' was not checked because its code equals another one
+ The configuration '' was not checked because its code equals another one
purgedConfiguration
@@ -7315,12 +8675,12 @@ suspicious as the same code is executed regardless of the condition.
identicalInnerCondition
- Identical inner 'if' condition
+ Identical inner 'if' condition is always true
-Identical inner 'if' condition is always true/false (outer condition is equal to the
-inner condition).
+Identical inner 'if' condition is always true (outer condition is 'x'
+and inner condition is 'x').
References
CWE-398: 7PK - Code Quality
@@ -7336,10 +8696,10 @@ inner condition).
missingOverride
- Missing override
+ The function '' overrides a function in a base class but is not marked with a 'override' specifier
missingOverride
@@ -7350,7 +8710,7 @@ The function overrides a function in a base class but is not marked with a 'over
noDestructor
- Missing destructor
+ Class 'class' does not have a destructor which is recommended since it has dynamic memory/resource allocation(s)
@@ -7362,15 +8722,16 @@ has dynamic memory/resource allocation(s).
]]>
cwe
+ bug
noDestructor
MINOR
- CODE_SMELL
+ BUG
LINEAR
5min
noOperatorEq
- Missing assignment operator
+ Class 'class' does not have a operator= which is recommended since it has dynamic memory/resource allocation(s)
@@ -7382,15 +8743,16 @@ has dynamic memory/resource allocation(s).
]]>
cwe
+ bug
noOperatorEq
MINOR
- CODE_SMELL
+ BUG
LINEAR
5min
oppositeExpression
- Opposite expression on both sides of logical operator
+ Opposite expression on both sides of '&&'
@@ -7411,10 +8773,10 @@ examine this code carefully to determine if it is correct.
pureVirtualCall
- Call of pure virtual function in constructor
+ Call of pure virtual function 'f' in constructor
bug
@@ -7526,10 +8888,10 @@ instead.
virtualCallInConstructor
- Virtual function is called from constructor
+ Virtual function 'f' is called from constructor '' at line 1. Dynamic binding is not used
bug
@@ -7561,11 +8923,11 @@ Obsolete function 'QString::sprintf' called. It is recommended to use
containerOutOfBounds
- Out of bounds access of item in container 'var'
+ Out of bounds access in expression 'container[x]'
-Out of bounds access of item in container 'var'
+Out of bounds access in expression 'container[x]'
References
CWE-398: 7PK - Code Quality
@@ -7681,7 +9043,7 @@ should not use it in new code.
danglingLifetime
- Non-local variable will use object
+ Non-local variable 'x' will use object
@@ -7701,7 +9063,7 @@ Non-local variable 'x' will use object.
duplicateAssignExpression
- Same expression used in consecutive assignments
+ Same expression used in consecutive assignments of 'x' and 'x'
@@ -7722,11 +9084,11 @@ examine this code carefully to determine if it is correct.
invalidFunctionArgStr
- Invalid function argument. A nul-terminated string is required
+ Invalid func_name() argument nr 1. A nul-terminated string is required
-Invalid function argument. A nul-terminated string is
+Invalid func_name() argument nr 1. A nul-terminated string is
required.
References
@@ -7763,7 +9125,7 @@ Using object that is out of scope.
iterators1
- Same iterator is used with different containers
+ Same iterator is used with different containers 'container1' and 'container2'
@@ -7880,11 +9242,11 @@ Non-boolean value returned from function returning bool
shadowFunction
- Local variable shadows outer function
+ Local variable 'function' shadows outer function
-Local variable shadows outer function
+Local variable 'function' shadows outer function
References
CWE-398: 7PK - Code Quality
@@ -7937,7 +9299,7 @@ Argument 'x' to function f is always 0
danglingReference
- Dangling reference
+ Non-local reference variable 'x' to local variable 'y'
@@ -7957,7 +9319,7 @@ Non-local reference variable 'x' to local variable 'y'
duplicateCondition
- Duplicate condition
+ The if condition is the same as the previous if condition
@@ -7976,10 +9338,10 @@ The if condition is the same as the previous if condition
invalidScanfFormatWidth_smaller
- Wrong width for scanf parameter (too small)
+ Width -1 given in format string (no. 99) is smaller than destination buffer '[0]'
bug
@@ -7991,7 +9353,7 @@ Width 'w0' given in format string is smaller than destination buffer '[w1]'.
iterators2
- Same iterator is used with different containers
+ Same iterator is used with different containers 'container0' and 'container1'
@@ -8012,7 +9374,7 @@ Same iterator is used with different containers 'container0' and
nullPointerArithmeticRedundantCheck
- Redundant condition or NULL pointer arithmetic
+ Either the condition is redundant or there is pointer arithmetic with NULL pointer
@@ -8191,6 +9553,25 @@ Variable 'x' can be declared with const
LINEAR
5min
+
+ constParameter
+ Variable 'x' can be declared with const
+
+
+Parameter 'x' can be declared with const
+
+References
+CWE-398: 7PK - Code Quality
+]]>
+
+ cwe
+ constParameter
+ MINOR
+ CODE_SMELL
+ LINEAR
+ 5min
+
danglingTemporaryLifetime
Using object to temporary
@@ -8304,4 +9685,98 @@ Unsafe class checking: The const reference member 'UnsafeClass::var' is initiali
LINEAR
5min
+
+
+ invalidContainerLoop
+ Calling 'erase' while iterating the container is invalid
+
+
+Calling 'erase' while iterating the container is invalid.
+
+References
+CWE-664: Improper Control of a Resource Through its Lifetime
+ ]]>
+
+
+ cwe
+ bug
+ invalidContainerLoop
+ MAJOR
+ BUG
+ LINEAR
+ 5min
+
+
+ knownArgument
+ Argument 'x' to function f is always 0
+
+
+Argument 'x' to function f is always 0
+
+References
+CWE-570: Expression is Always False
+ ]]>
+
+
+ cwe
+ knownArgument
+ MINOR
+ CODE_SMELL
+ LINEAR
+ 5min
+
+
+ mismatchingContainerIterator
+ Iterator 'it' from different container 'v1' are used together
+
+
+Iterator 'it' from different container 'v1' are used together.
+
+References
+CWE-664: Improper Control of a Resource Through its Lifetime
+ ]]>
+
+
+ cwe
+ bug
+ mismatchingContainerIterator
+ MAJOR
+ BUG
+ LINEAR
+ 5min
+
+
+ moduloofone
+ Modulo of one is always equal to zero
+
+
+
+
+ moduloofone
+ MINOR
+ CODE_SMELL
+ LINEAR
+ 5min
+
+
+ thisUseAfterFree
+ Using member 'x' when 'this' might be invalid
+
+
+
+
+ bug
+ thisUseAfterFree
+ MINOR
+ BUG
+ LINEAR
+ 5min
+
diff --git a/cxx-sensors/src/test/java/org/sonar/cxx/sensors/cppcheck/CxxCppCheckRuleRepositoryTest.java b/cxx-sensors/src/test/java/org/sonar/cxx/sensors/cppcheck/CxxCppCheckRuleRepositoryTest.java
index d19a0ff3d0..3c349208cf 100644
--- a/cxx-sensors/src/test/java/org/sonar/cxx/sensors/cppcheck/CxxCppCheckRuleRepositoryTest.java
+++ b/cxx-sensors/src/test/java/org/sonar/cxx/sensors/cppcheck/CxxCppCheckRuleRepositoryTest.java
@@ -37,7 +37,7 @@ public void createRulesTest() {
def.define(context);
RulesDefinition.Repository repo = context.repository(CxxCppCheckRuleRepository.KEY);
- assertEquals(494, repo.rules().size());
+ assertEquals(499, repo.rules().size());
}
}
diff --git a/cxx-sensors/src/tools/cwec_latest.xml.zip b/cxx-sensors/src/tools/cwec_latest.xml.zip
new file mode 100644
index 0000000000000000000000000000000000000000..0d22b90fc1f9388ebb36b2381aa7ea1e1e59fcc7
GIT binary patch
literal 1263614
zcmV)7K*zsOO9KQH0000806aDnQL%;Pk4{Gu0NB=`01W^f0AqJ$V_$YOE;257ZERIk
z2>=6ARX$%+RX$&Jcnbgl1c(;^00f2?008V=klFPWB;3*BxX~gja2E&px@~QOr)WTWIBEsyt{nWeja>tu>V2u>r@zXb;NTX
zt1~QI1`;j=2~==
z9^+r_XRgWajge)u*=*LCZBm;-uh;MXcz$*fPDH}nGBr6*Ljk>v+%@#@OocqBHLRb7
zHNJ{qKiwM>;o~bi*wyq|XR`y(%5_chByL(+|HX?JU3wcF{NbyTNWvWafziM65j#Bw
z;`Vx5fur1oNR7XpPTJkgx
z*hQ|3FfTL?C6g=`_=x8P5c(9351-^B@aw>(919a_nc+AGmlMH^8s#&t1uI~|jI+?L
zBUjAi3Lcwsg)$u}oe+UrYzS-2p}T7?4NFzd60WaB#AdJwdh0jAMzDv@ez!h(ZA~XP
zxkw`sT`ezep+AeH7GZ7}?hBSNj0GENH8a3?xZX^QsYr7c#u9$Cjf`ORG#ndgl`tNL
za0I~6ZqcU0fJSkFJifYG*e*T15P933&G(m=Z