What open source C++ static analysis tools are ava

Question

Java has some very good open source static analysis tools such as FindBugs, Checkstyle and PMD. Those tools are easy to use, very helpful, runs on multiple operating systems and free.

Commercial C++ static analysis products are available. Although having such products are great, the cost is just way too much for students and it is usually rather hard to get trial version.

The alternative is to find open source C++ static analysis tools that will run on multiple platforms (Windows and Unix). By using an open source tool, it could be modified to fit certain needs. Finding the tools has not been easy task.

Below is a short list of C++ static analysis tools that were found or suggested by others.

• C++ Check http://sf.net/projects/cppcheck/
• Oink http://danielwilkerson.com/oink/index.html
• C and C++ Code Counter http://sourceforge.net/projects/cccc/
• Splint (from answers)
• Mozilla's Pork (from answers) (This is now part of Oink)
• Mozilla's Dehydra (from answers)
• Use option -Weffc++ for GNU g++ (from answers)

What are some other portable open source C++ static analysis tools that anyone knows of and can be recommended?

Some related links.

• https://stackoverflow.com/questions/97454/c-static-code-analysis-tool-on-windows
• http://en.wikipedia.org/wiki/List_of_tools_for_static_code_analysis
• http://www.chris-lott.org/resources/cmetrics/
• A free tool to check C/C++ source code against a set of coding standards?
• http://spinroot.com/static/
• Choosing a static code analysis tool

Answer 1

We have been working on an Eclipse CDT plug-in called metriculator. Its still under development but some major metrics (e.g. LSLOC, McCabe, EfferentCoupling) are already implemented.

See http://sinv-56013.edu.hsr.ch/redmine/projects/metricular/wiki/Documentation for more details like video demonstration and documentation.

The latest nightly build is available for installation via update site at: http://sinv-56013.edu.hsr.ch/metriculator/updatesite-nightly/site/

Further Description

Metriculator statically analysis C++ source code and generates software metrics. Metrics are implemented as Codan checkers. The analysis results can be explored in a separate view. Each metric has configurable properties (e.g. a threshold for 'max lines of code per function'). Exceeding these threshold will report a problem and create a marker in the source code editor.

with metriculator you can:

• analyse C++ files / folders / projects
• define metric thresholds and enable / disable metric using Codans preference page
• have problem markers in source code editors
• explore metric results
• export metric results as tag cloud (available as optional feature via update site)

Currently metriculator comes with the following metrics:

• McCabe (Cyclomatic Complexity)
• EfferentCoupling per Type
• Logical Source Lines of Code
• Number of Members per Type
• Number of Parameters per Function

Answer 2

Concerning the GNU compiler, gcc has already a builtin option that enables additional warning to those of -Wall. The option is -Weffc++ and it's about the violations of some guidelines of Scott Meyers published in his books "Effective and More Effective C++".

In particular the option detects the following items:

• Define a copy constructor and an assignment operator for classes with dynamically allocated memory.
• Prefer initialization to assignment in constructors.
• Make destructors virtual in base classes.
• Have "operator=" return a reference to *this.
• Don’t try to return a reference when you must return an object.
• Distinguish between prefix and postfix forms of increment and decrement operators.
• Never overload "&&", "||", or ",".

Answer 3

Oink is a tool built on top of the Elsa C++ front-end. Mozilla's Pork is a fork of Elsa/Oink.

See: http://danielwilkerson.com/oink/index.html

Answer 4

Under development for now, but clang does C analysis and is targeted to handle C++ over time. It's part of the LLVM project.

Update: While the landing page says "The analyzer is a continuous work-in-progress", it is nevertheless now documented as a static analyzer for both C and C++.

Question: How can I run GCC/Clang for static analysis? (warnings only)

Compiler option: -fsyntax-only

Answer 5

Someone else mentioned -Weffc++, but that is actually one of the only GCC warnings I do not turn on by default. However, the set of warnings that I do turn on is the most important static analysis tool in my kit. You can see the complete list of recommended warnings.

In summary:

-pedantic -Wall -Wextra -Wcast-align -Wcast-qual -Wctor-dtor-privacy -Wdisabled-optimization -Wformat=2 -Winit-self -Wlogical-op -Wmissing-declarations -Wmissing-include-dirs -Wnoexcept -Wold-style-cast -Woverloaded-virtual -Wredundant-decls -Wshadow -Wsign-conversion -Wsign-promo -Wstrict-null-sentinel -Wstrict-overflow=5 -Wswitch-default -Wundef -Werror -Wno-unused

Note that some of these require a new version of gcc, so you may need to eliminate them from your list if you are stuck back on 4.5 or something.

Answer 6

Microsoft's PREFast is also available in the Windows Driver Kit. Version 7.0 is downloadable here.

The Microsoft docs state that it should only be run against driver code but this (old) blog post lays out steps to run it. Perhaps it can be integrated into a normal build process?