<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
          "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
  <title>List of potential checkers</title>
  <link type="text/css" rel="stylesheet" href="content.css">
  <link type="text/css" rel="stylesheet" href="menu.css">
  <script type="text/javascript" src="scripts/menu.js"></script>
  <script type="text/javascript" src="scripts/dbtree.js"></script>
</head>
<body>

<div id="page">

<!-- menu -->
<!--#include virtual="menu.html.incl"-->
<!-- page content -->
<div id="content">
<h1>List of potential checkers</h1>

<p>This page contains a list of potential checkers to implement in the static analyzer.  If you are interested in contributing to the analyzer's development, this is a good resource to help you get started.  The specific names of the checkers are subject to review, and are provided here as suggestions.</p>

<!-- ========================= allocation/deallocation ======================= -->
<h3>allocation/deallocation</h3>
<table class="checkers">
<col class="namedescr"><col class="example"><col class="progress">
<thead><tr><td>Name, Description</td><td>Example</td><td>Progress</td></tr></thead>

<tr><td><span class="name">memory.LeakNeverReleased<br>
(C, C++)</span><br><br>
Memory may be never released, potential leak of memory
</td><td>
<pre>
#include &lt;stdlib.h&gt;

int f() {};

void test() { 
  int *p1 = (int*)malloc(sizeof(int)); // warn
  int *p2 = new int; // warn
  int x = f();
  if (x==1)
    return;
  delete p2;
}
</pre></td><td class="aligned"><a href="http://llvm.org/bugs/show_bug.cgi?id=15237">PR15237</a>
</td></tr>

<tr><td><span class="name">memory.MismatchedFree
<br>enhancement to unix.Malloc<br>(C, C++)</span><br><br>
Mismatched deallocation function is used
</td><td><pre>
#include &lt;stdlib.h&gt;

void test() {
  int *p1 = new int;
  int *p2 = new int[1];

  free(p1); // warn
  free(p2); // warn
}
</pre></td><td class="aligned"><a href="http://llvm.org/bugs/show_bug.cgi?id=15238">PR15238</a>
</td></tr>

<tr><td><span class="name">memory.MismatchedDelete
<br>(C, C++)</span><br><br>
Mismatched deallocation function is used
</td><td><pre>
#include &lt;stdlib.h&gt;

void test() {
  int *p1 = new int;
  int *p2 = new int[1];
  int *p3 = (int*)malloc(sizeof(int));

  delete[] p1; // warn
  delete p2; // warn
  delete p3; // warn
}
</pre></td><td class="aligned"><a href="http://llvm.org/bugs/show_bug.cgi?id=15238">PR15238</a>
</td></tr>

<tr><td><span class="name">memory.MultipleDelete
<br>(C++)</span><br><br>
Attempt to deallocate released memory
</td><td><pre>
#include &lt;new&gt;

void test() {
  int *p1 = new int;
  int *p2 = new(p1) int;
  int *p3 = p1;
  delete p1;
  delete p1; // warn
  delete p2; // warn
  delete p3; // warn
}
</pre></td><td class="aligned"><a href="http://llvm.org/bugs/show_bug.cgi?id=15237">PR15237</a>
</td></tr>


<tr><td><span class="name">memory.LeakPtrValChanged
<br>enhancement to unix.Malloc<br>(C, C++)</span><br><br>
Potential memory leak: a pointer to newly allocated data loses its original 
value
</td><td><pre>
#include &lt;stdlib.h&gt;

void f(const int *);
void g(int *);

void test() {
  int *p1 = new int;
  p1++; // warn
  int *p2 = (int *)malloc(sizeof(int));
  p2 = p1; // warn
  int *p3 = new int;
  f(p3);
  p3++; // warn
  int *p4 = new int;
  f(p4);
  p4++; // ok
}
</pre></td><td class="aligned">done at r174678 (C case)
</td></tr>


<tr><td><span class="name">memory.DeallocateNonPtr
<br>enhancement to unix.Malloc<br>(C, C++)</span><br><br>
Deallocation function is applied to non-pointer
</td><td><pre>
#include &lt;stdlib.h&gt;

class A {
  int *p;
public:
  operator int *() { return p; }  
};

void test() {
  A a;
  delete a; // warn
  free(a); // warn
  const char *s = "text";
  delete s; // warn
  free(s); // warn
}
</pre></td><td class="aligned"><a href="http://llvm.org/bugs/show_bug.cgi?id=15237">PR15237</a>
</td></tr>


<tr><td><span class="name">memory.LeakEvalOrder<br>
(C, C++)</span><br><br>
Potential memory leak: argument evaluation order is undefined, g() may never be called
</td><td><pre>
#include &lt;stdlib.h&gt;

void f1(int, int);
void f2(int*, int*);
int g(int *) { throw 1; };
int h();

void test() {
  f1(g(new int), h()); // warn
  f1(g((int *)malloc(sizeof(int))), h()); // warn
  f2(new int, new int);
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">memory.DstBufferTooSmall
<br>(C, C++)</span><br><br>
Destination buffer too small
</td><td><pre>
#include &lt;string.h&gt;

void test() {
  const char* s1 = "abc";
  char *s2 = new char;
  strcpy(s2, s1); // warn

  int* p1 = new int[3];
  int* p2 = new int;
  memcpy(p2, p1, 3); // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">memory.NegativeArraySize
<br>enhancement to experimental.security.MallocOverflow<br>(C, C++)
</span><br><br>
'n' is used to specify the buffer size may be negative
</td><td><pre>
#include &lt;stdlib.h&gt;

void test() {
  int *p;
  int n1 = -1;
  p = new int[n1]; // warn
}
</pre></td><td class="aligned"></td></tr>

</table>

<!-- ======================= constructors/destructors ====================== -->
<h3>constructors/destructors</h3>
<table class="checkers">
<col class="namedescr"><col class="example"><col class="progress">
<thead><tr><td>Name, Description</td><td>Example</td><td>Progress</td></tr></thead>

<tr><td><span class="name">ctordtor.ExptInsideDtorExplicit<br>
(C++)</span><br><br>
It is dangerous to let an exception leave a destructor. Using try..catch will 
solve the problem.
</td><td><pre>
void f();

class A {
  A() {}
  ~A() { throw 1; } // warn
};
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">ctordtor.ExptInsideDtorImplicit<br>
(C++)</span><br><br>
Calls to functions inside a destructor that are known to throw exceptions is 
dangerous. Using try..catch will solve the problem.
</td><td><pre>
void f() { throw 1; };

class A {
  A() {}
  ~A() { f(); } // warn
};
</pre></td><td class="aligned"></td></tr>

</table>

<!-- ============================== exceptions ============================= -->
<h3>exceptions</h3>
<table class="checkers">
<col class="namedescr"><col class="example"><col class="progress">
<thead><tr><td>Name, Description</td><td>Example</td><td>Progress</td></tr></thead>

<tr><td><span class="name">exceptions.ThrowSpecButNotThrow
<br>(C++)</span><br><br>
Function prototype has throw(T) specifier but the function do not throw
</td><td><pre>
void f() throw(int) { // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">exceptions.NoThrowSpecButThrows
<br>(C++)</span><br><br>
An exception is throw from a function having the throw() specifier
</td><td><pre>
void f() throw() {
  throw(1); // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">exceptions.ThrownTypeDiffersSpec
<br>(C++)</span><br><br>
The type of a thrown exception differs from those specified in the throw(T) 
specifier
</td><td><pre>
struct S{};
void f() throw(int) {
  S s;
  throw (s); // warn
}
</pre></td><td class="aligned"></td></tr>

</table>

<!-- ========================= smart pointers ============================== -->
<h3>smart pointers</h3>
<table class="checkers">
<col class="namedescr"><col class="example"><col class="progress">
<thead><tr><td>Name, Description</td><td>Example</td><td>Progress</td></tr></thead>

<tr><td><span class="name">smartptr.SmartPtrInit<br>
(C++)</span><br><br>
C++03: auto_ptr should store a pointer to an object obtained via new as allocated
memory will be cleaned using delete<br>
C++11: one should use unique_ptr&lt;T[]&gt; to keep a pointer to memory
allocated by new[]<br>
C++11: to keep a pointer to memory allocated by new[] in a shared_ptr one
should use a custom deleter that calls delete[]
</td><td><pre>
#include &lt;stdlib.h&gt;
#include &lt;memory&gt;

void test() {
  std::auto_ptr&lt;int&gt; p1(new int); // Ok
  std::auto_ptr&lt;int&gt; p2(new int[3]); // warn
  std::auto_ptr&lt;int&gt; 
         p3((int *)malloc(sizeof(int))); // warn
}
</pre></td><td class="aligned"></td></tr>

</table>

<!-- ========================= undefined behavior ========================== -->
<h3>undefined behavior</h3>
<table class="checkers">
<col class="namedescr"><col class="example"><col class="progress">
<thead><tr><td>Name, Description</td><td>Example</td><td>Progress</td></tr></thead>

<tr><td><span class="name">undefbehavior.ExitInDtor
<br>(C++)</span><br><br>
Undefined behavior: std::exit is called to end the program during the 
destruction of an object with static storage duration
</td><td><pre>
#include &lt;cstdlib&gt;

class A {
public:
  ~A() {
    std::exit(1); // warn
  }
};

A a;
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.LocalStaticDestroyed
<br>(C++)</span><br><br>
Undefined behavior: function containing a definition of static local object is 
called during the destruction of an object with static storage duration so that 
flow of control passes through the definition of the previously destroyed 
static local object
</td><td><pre>
void f();

class A {
public:
  ~A() {
    f(); // warn
  }
};

class B {};

A a;

void f() {
  static B b; // &lt;-
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.UseAfterRelease
<br>enhancement to unix.Malloc<br>(C, C++)</span><br><br>
Pointer to deleted object is referenced (The effect of using an invalid pointer 
value is undefined)
</td><td><pre>
#include &lt;stdlib.h&gt;

void test() {
  int *p = new int;
  delete p;
  int i = *p; // warn
}

</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.ZeroAllocDereference
<br>enhancement to unix.Malloc<br>(C, C++)</span><br><br>
The effect of dereferencing a pointer returned as a request for zero size is 
undefined
</td><td><pre>
#include &lt;stdlib.h&gt;

int *p = new int[0];
int i = p[0]; // warn
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.DeadReferenced
<br>(C++)</span><br><br>
Undefined behavior: the following usage of the pointer to the object whose 
lifetime has ended can result in undefined behavior
</td><td><pre>
// C++03
#include &lt;new&gt;

class A {
public:
  int i;
  void f() {};
};

class B : public A {
};

void test() {
  B *b = new B;
  new(b) A;
  b->i; // warn
  b->f(); // warn
  static_cast&lt;A*&gt;(b); // warn
  dynamic_cast&lt;A*&gt;(b); // warn
  delete b; // warn
}

// C++11
#include &lt;new&gt;

class A {
public:
  int i;
  void f() {};
};

class B : public A {
public:
  ~B() {};
};

void test() {
  A *a = new A;
  new(a) B;
  a->i; // warn
  a->f(); // warn
  B *b = new B;
  new(b) A;
  b->i; // warn
  b->f(); // warn
  static_cast&lt;A*&gt;(b); // warn
  dynamic_cast&lt;A*&gt;(b); // warn
  delete b; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.ObjLocChanges
<br>(C++)</span><br><br>
Undefined behavior: the program must ensure that an object occupies the same 
storage location when the implicit or explicit destructor call takes place
</td><td><pre>
#include &lt;new&gt;

class T { };
struct B {
  ~B();
};

void test() {
  B *b1 = new B;
  B b2;
  new (b1) T;
  new (&amp;b2) T;
  delete b1; // warn
} // warn
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.ExprEvalOrderUndef
<br>(C, C++03)</span><br><br>
Undefined behavior: a scalar object shall have its stored value modified at 
most once by the evaluation of an expression
</td><td><pre>
void test () {
  int i = 0;
  int v[1] = {0};
  i = v[i++]; // warn
  i = ++i + 1; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.StaticInitReentered
<br>(C)</span><br><br>
Undefined behavior: static declaration is re-entered while the object is being 
initialized
</td><td><pre>
int test(int i) {
  static int s = test(2*i); // warn
  return i+1;
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.ConstModified
<br>(C, C++)</span><br><br>
Undefined behavior: const object is being modified
</td><td><pre>
#include &lt;stdlib.h&gt;

class X {
public :
  mutable int i;
  int j;
};
class Y {
public :
  X x;
  Y();
};

void test() {
  const int *ciq = 
    (int *)malloc(sizeof(int));
  int *iq = const_cast&lt;int *&gt;(ciq);
  *iq = 1; // warn

  const Y y;
  Y* p = const_cast&lt;Y*&gt;(&amp;y);
  p-&gt;x.i = 1; // ok
  p-&gt;x.j = 1; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.DeadDestructed
<br>(C++)</span><br><br>
Undefined behavior: the destructor is invoked for an object whose lifetime 
has ended
</td><td><pre>
class A {
public:
  void f() {};
  A() {};
  ~A() {};
};

void test() {
  A a;
  a.~A();
} // warn
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.MethodCallBeforeBaseInit
<br>(C++)</span><br><br>
Undefined behavior: calls member function but base not yet initialized
</td><td><pre>
class A {
public :
  A(int );
};
class B : public A {
public :
  int f();
  B() : A(f()) {} // warn
};
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.MemberOrBaseRefBeforeCtor
<br>(C++)</span><br><br>
C++ Undefined behavior: non-static member or base class of non-POD class type 
is referred before constructor begins execution<br>
C++11 Undefined behavior: non-static member or base class of a class with a 
non-trivial constructor is referred before constructor begins execution
</td><td><pre>
// C++03
struct POD { 
  int i; 
};

struct non_POD : public POD { 
  int j; 
  POD pod;
};

extern POD pod;
extern non_POD non_pod;

int *p1 = &amp;non_pod.j; // warn
int *p2 = &amp;non_pod.pod.i; // warn
int *p3 = &amp;pod.i; // ok
POD *p4 = &amp;non_pod; // warn

POD a;
non_POD b;

struct S {
  int *k;
  non_POD non_pod;
  S() : k(&amp;non_pod.j) {} // warn
};

// C++11
struct trivial { 
  int i; 
};

struct non_trivial: public trivial { 
  non_trivial() {};
  int j; 
  trivial pod;
};

extern trivial t;
extern non_trivial nt;

int *p1 = &amp;nt.j; // warn
int *p2 = &amp;nt.i; // warn
int *p3 = &amp;t.i; // ok
trivial *p4 = &amp;nt;

trivial t;
non_trivial nt;

struct S {
  int *k;
  non_trivial nt;
  S() : k(&amp;nt.j) {} // warn
};
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.MemberRefAfterDtor
<br>(C++)</span><br><br>
C++03: Undefined behavior: non-static member of non-POD class type is referred 
after destructor ends execution<br>
C++11: Undefined behavior: non-static member of a class with a non-trivial 
destructor is referred after destructor ends execution
</td><td><pre>
// C++03
struct non_POD {
  virtual void f() {};
};

void test() {
  non_POD *non_pod = new non_POD();
  non_pod->~non_POD();  
  non_pod->f(); // warn
}

// C++11
struct S {
  ~S() {};
  void f() {};
};

void test() {
  S *s = new S();
  s->~S();  
  s->f(); // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.CtorForeignCall
<br>(C++)</span><br><br>
Undefined behavior: call to virtual function of an object under construction 
whose type is neither the constructors own class or one of its bases
</td><td><pre>
class A {
public:
  virtual void f() {};
};

class B {
public:
  B(A* a) { a-&gt;f(); } // warn
};

class C : public A, B {
public:
  C() : B((A*)this) {}
};
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.CtorForeignCast 
undefbehavior.CtorForeignTypeid
<br>(C++)</span><br><br>
Undefined behavior: the operand of typeid/dynamic_cast is an object under 
construction whose type is neither the constructors own class or one of its 
bases
</td><td><pre>
#include &lt;typeinfo&gt;

class A {
public:
  virtual void f() {};
};

class B {
public:
  B(A* a) { 
    typeid(*a); // warn
    dynamic_cast&lt;B*&gt;(a); //warn
  }
};

class C : public A, B {
public:
  C() : B((A*)this) {}
};
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.MemberRefInCatch 
undefbehavior.BaseRefInCatch
<br>(C++)</span><br><br>
Undefined behavior: referring to any non-static member or base class of an 
object in the handler for a function-try-block of a constructor or destructor 
for that object results in undefined behavior
</td><td><pre>
class C {
  int i;
public :
  C()
  try
  : i(1) {}
  catch (...)
  {
    i=2; // warn
  }
};
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.ReturnAtCatchEnd
<br>(C++)</span><br><br>
Undefined behavior: a function returns when control reaches the end of a 
handler. This results in undefined behavior in a value-returning 
function
</td><td><pre>
int test() try {
}
catch(int) {
} // warn
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.AutoptrsOwnSameObj
<br>(C++03)</span><br><br>
Undefined behavior: if more than one auto_ptr owns the same object at the same 
time the behavior of the program is undefined.
</td><td><pre>
#include &lt;memory&gt;

void test() {
  int *data = new int;
  std::auto_ptr&lt;int&gt; p(data);
  std::auto_ptr&lt;int&gt; q(data); // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.BasicStringBoundAccess
<br>(C++03)</span><br><br>
Undefined behavior: out-of-bound basic_string access
</td><td><pre>
void test() {
  std::basic_string&lt;char&gt; s;
  char c = s[10]; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.BasicStringBoundModification
<br>(C++)</span><br><br>
Undefined behavior: out-of-bound basic_string modification
</td><td><pre>
void test() {
  std::basic_string&lt;char&gt; s;
  s[10] = 0; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.EosDereference
<br>(C++)</span><br><br>
Undefined behavior: the result of operator*() on an end of stream is 
undefined
</td><td><pre>
#include &lt;vector&gt;

void test() {
  std::vector&lt;int&gt; v;
  int i = *v.end(); // warn
  *v.end() = 0; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.QsortNonPOD 
undefbehavior.QsortNonTrivial
<br>C++</span><br><br>
C++03: Undefined behavior: the objects in the array passed to qsort are of 
non-POD type<br>
C++11: Undefined behavior: the objects in the array passed to qsort are of 
non-trivial type
</td><td><pre>
// C++03
#include &lt;cstdlib&gt;

struct non_POD {
  int i;
  non_POD(int ii) : i(ii) {}
};

non_POD values[] = { non_POD(2), non_POD(1) };

int compare(const void *a, 
            const void *b) {
  return ( (*(non_POD*)a).i -
           (*(non_POD*)b).i );
}

void test() {
  qsort(values, 2, sizeof(non_POD), 
        compare); // warn
}

// C++11
#include &lt;cstdlib&gt;

struct S {};

struct trivial_non_POD : public S {
  int i;
};

struct non_trivial {
  int i;
  non_trivial() {}
};

trivial_non_POD tnp[2];
non_trivial nt[2];

int compare1(const void *a, 
             const void *b) {
  return ( (*(trivial_non_POD *)a).i -
           (*(trivial_non_POD *)b).i );
}

int compare2(const void *a, 
             const void *b) {
  return ( (*(non_trivial *)a).i -
           (*(non_trivial *)b).i );
}

void test() {
  qsort(tnp, 2, sizeof(trivial_non_POD), 
        compare1); // ok
  qsort(nt, 2, sizeof(non_trivial), 
        compare2); // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.ThrowWhileCopy
<br>C++</span><br><br>
Undefined behavior: copy constructor/assignment operator can throw an exception.
The effects are undefined if an exception is thrown.
</td><td><pre>
struct S {
  int i, j;
  S (const S &amp;s) {
    i = s.i;
    throw 1; // warn
    j = s.j;
  };
  S &amp;operator=(const S &amp;s) {
    i = s.i;
    throw 1; // warn
    j = s.j;
  }
};
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.ValarrayArgBound
<br>(C++)</span><br><br>
Undefined behavior: the value of the second argument is greater than the number 
of values pointed to by the first argument
</td><td><pre>
#include &lt;valarray&gt;

struct S {
  int i;
  S(int ii) : i(ii) {};
};

void test(void) {
  S s[] = { S(1), S(2) };
  std::valarray&lt;S&gt; v(s,3); // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.ValarrayLengthDiffer
<br>(C++)</span><br><br>
Undefined behavior: valarray operands are of different length
</td><td><pre>
// C++03
#include &lt;valarray&gt;

void test(void) {
  std::valarray&lt;int&gt; a(0, 1), b(0, 2);
  std::valarray&lt;bool&gt; c(false, 1);
  a = b; // warn
  a *= b; // warn
  a = a * b; // warn
  c = a == b; // warn
  b.resize(1);
  a = b; // OK
}

// C++11
#include &lt;valarray&gt;

void test(void) {
  std::valarray&lt;int&gt; a(0, 1), b(0, 2);
  std::valarray&lt;bool&gt; c(false, 1);
  a = b; // ok
  a *= b; // ok
  a = a * b; // warn
  c = a == b; // warn
  b.resize(1);
  a = b; // OK
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.ValarrayZeroLength
<br>(C++)</span><br><br>
Undefined behavior: calling sum()/min()/max() method of an array having zero 
length, the behavior is undefined
</td><td><pre>
#include &lt;valarray&gt;

void test(void) {
  std::valarray&lt;int&gt; v(0, 0);
  v.sum(); // warn
  v.min(); // warn
  v.max(); // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.ValarrayBadIndirection
<br>(C++)</span><br><br>
Undefined behavior: element N is specified more than once in the 
indirection
</td><td><pre>
#include &lt;valarray&gt;

void test() {
  size_t addr[] = {0, 1, 1}; // N is 1
  std::valarray&lt;size_t&gt;indirect(addr, 3);
  std::valarray&lt;int&gt; a(0, 5), b(1, 3);
  a[indirect] = b; //warn
  a[indirect] *= b; //warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.IosBaseDestroyedBeforeInit
<br>(C++)</span><br>
<br>Undefined behavior: ios_base object is destroyed before initialization have 
taken place. basic_ios::init should be call to initialize ios_base 
members
</td><td><pre>
#include &lt;ios&gt;

using namespace std;
template &lt;class T, class Traits = std::char_traits&lt;T&gt;&gt;
class my_stream1 : public std::basic_ios&lt;T, Traits&gt; {
};

template &lt;class T, class Traits = std::char_traits&lt;T&gt;&gt;
class my_stream2 : public std::basic_ios&lt;T, Traits&gt; {
  class my_streambuf : public std::basic_streambuf&lt;T, Traits&gt; {
  };
public:
  my_stream2() {
    this->init(new my_streambuf);
  }
};

void test() {
  my_stream1&lt;char&gt; *p1 = new my_stream1&lt;char&gt;
  my_stream2&lt;char&gt; *p2 = new my_stream2&lt;char&gt;
  delete p1; // warn
  delete p2; // ok
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.IosBaseUsedBeforeInit
<br>(C++11)</span><br><br>
Undefined behavior: ios_base object is used before initialization have taken 
place. basic_ios::init should be call to initialize ios_base members
</td><td><pre>
#include &lt;ios&gt;

using namespace std;
template &lt;class T, class Traits = std::char_traits&lt;T&gt;&gt;
class my_stream1 : public std::basic_ios&lt;T, Traits&gt; {
};

template &lt;class T, class Traits = std::char_traits&lt;T&gt;&gt;
class my_stream2 : public std::basic_ios&lt;T, Traits&gt; {
  class my_streambuf : public std::basic_streambuf&lt;T, Traits&gt; {
  };
public:
  my_stream2() {
    this->init(new my_streambuf);
  }
};

void test() {
  my_stream1&lt;char&gt; *p1 = new my_stream1&lt;char&gt;
  my_stream2&lt;char&gt; *p2 = new my_stream2&lt;char&gt;
  p1->narrow('a', 'b'); // warn
  p2->narrow('a', 'b'); // ok
  delete p1; // warn
  delete p2; // ok
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">undefbehavior.MinusOnePosType
<br>(C++)</span><br><br>
Undefined behavior: passing -1 to any streambuf/istream/ostream member that 
accepts a value of type traits::pos_type result in undefined behavior
</td><td><pre>
#include &lt;fstream&gt;

class my_streambuf : public std::streambuf {
  void f() {
    seekpos(-1); // warn
  }
};

void test() {
  std::filebuf fb;
  std::istream in(&amp;fb);
  std::ostream out(&amp;fb);
  std::filebuf::off_type pos(-1);
  in.seekg(pos); // warn
  out.seekp(-1); // warn
}
</pre></td><td class="aligned"></td></tr>
</table>

<!-- ============================ different ================================ -->
<h3>different</h3>
<table class="checkers">
<col class="namedescr"><col class="example"><col class="progress">
<thead><tr><td>Name, Description</td><td>Example</td><td>Progress</td></tr>
</thead>

<tr><td><span class="name">different.ArgEvalOrderUndef
<br>(C)</span><br><br>
Errors because of the order of evaluation of function arguments is undefined
</td><td><pre>
void f(int, int);

void test() {
  int i = 0;
  int v[1] = {0};
  f(v[i], i++); // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.IdenticalExprBinOp
<br>(C)</span><br><br>
There are identical sub-expressions to the left and to the right of the 
operator
</td><td><pre>
#define A 1
#define B 1

bool isNan(double d) { 
  return d != d; // ok
}

int f();

void test() {
  int i = 0;
  if (i != 0 && i != 0) {} // warn

  if(i == A || i == B) {} // ok

  if (++i != 0 && ++i != 0) {} // ok

  if (f() && f()) {} // ok
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.FuncPtrInsteadOfCall
<br>(C)</span><br><br>
Possibly a function call should be used instead of a pointer to function
</td><td><pre>
int f();

void test() {
  if (f == 0) {} // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.IdenticalCondIfElseIf
<br>(C)</span><br><br>
The use of 'if (A) {...} else if (A) {...}' pattern was detected. There is a 
probability of logical error presence
</td><td><pre>
void test() { 
  int i = 7;
  if (i == 1) {}
  else if (i == 1) {} // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">SuccessiveAssign
<br>(C)</span><br><br>
Successive assign to a variable
</td><td><pre>
void test() { 
  int i=0;
  i=1;
  i=2; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.NullDerefStmtOrder
<br>enhancement to core.NullDereference<br>(C)</span><br><br>
Dereferencing of the null pointer might take place. Checking the pointer for 
null should be performed first
</td><td><pre>
struct S {
  int x;
};

S* f();

void test() {
  S *p1 = f();
  int x1 = p1-&gt;x; // warn
  if (p1) {};

  S *p2 = f();
  int x2 = p2-&gt;x; // ok
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.NullDerefCondOrder
<br>enhancement to core.NullDereference<br>(C)</span><br><br>
Dereferencing of the null pointer might take place. Checking the pointer for 
null should be performed first
</td><td><pre>
struct S{bool b;};

S* f();

void test() {
  S *p = f();
  if (p-&gt;b && p) {}; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.IdenticalStmtThenElse
<br>(C)</span><br><br>
The 'else' statement is equivalent to the 'then' statement
</td><td><pre>
void test() {
  int i;
  if (i==1) {
    i++;
  }
  else { // warn
    i++;
  }
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.MultipleAccessors
<br>(C++)</span><br><br>
multiple accessors met for 'class::field'
</td><td><pre>
class A {
  int i;
  int j;
public:
  int getI() { return i; }
  int getJ() { return i; } // warn
  void setI(int& ii) { i = ii; }
  void setJ(int& jj) { i = jj; } // warn
};
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.AccessorsForPublic
<br>(C++)</span><br><br>
Accessors exist for 'class::field'. Should this field really be public?
</td><td><pre>
class A {
public:
  int i; // warn
  int getI() { return i; }
  void setI(int& ii) { i = ii; }
};
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.LibFuncResultUnised
<br>(C, C++)</span><br><br>
Calling 'f' ignoring its return value is of no use (* create the list of known 
system/library/API functions falling into this category)
</td><td><pre>
#include &lt;vector&gt;

void test() {
  std::vector&lt;int&gt; v;
  v.empty(); // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.WrongVarForStmt
<br>(C, C++)</span><br><br>
Possibly wrong variable is used in the loop/cond-expression of the 'for'
statement. Did you mean 'proper_variable_name'?
</td><td><pre>
void test() {
  int i;
  int j;
  for (j=0; j&lt;3; ++i); // warn
  for (int j=0; i&lt;3; ++j); // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.FloatingCompare
<br>(C)</span><br><br>
Comparing floating point numbers may be not precise
</td><td><pre>
#include &lt;math.h&gt;

void test() {
  double b = sin(M_PI / 6.0);
  if (b == 0.5) // warn
    b = 0;
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.BoolCompare
<br>maybe merge with experimental.core.BoolAssignment<br>(C, C++)</span><br><br>
Comparing boolean to a value other then 0 or 1
</td><td><pre>
void test() {
  int i;
  if (0 < i < 3) {}; // warn
  bool b;
  if (b == 3) {}; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.BitwiseOpBoolArg
<br>maybe join with experimental.core.BoolAssignment<br>(C, C++)</span><br><br>
bool value is used at the left/right part of the &amp; (|) operator. Did you mean 
&amp;&amp; (||) ?
</td><td><pre>
int f();

void test() {
  bool b = true;
  if (b &amp; f()) {} // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.LabelInsideSwitch
<br>(C)</span><br><br>
Possible misprint: label found inside the switch() statement. (* did you mean 
'default'?)
</td><td><pre>
void test() {
  int c = 7;
  switch(c){
  case 1:
    c += 1; break;
  defalt: // warn
    c -= 1; break;
  }
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.IdenticalCondIfIf
<br>(C)</span><br><br>
The conditions of two subsequent 'if' statements are identical
</td><td><pre>
void test() {
  int c = 7;
  if (c &gt; 5) // &lt;-
    c += 1;
  if (c &gt; 5) // warn
    c -= 1;
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.CondOpIdenticalReturn
<br>(C)</span><br><br>
The return expressions of the '?:' operator are identical
</td><td><pre>
void test() {
  unsigned a;
  a = a > 5 ? a : a; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.UnaryPlusWithUnsigned
<br>(C)</span><br><br>
Using 'unary +' with unsigned is meaningless
</td><td><pre>
void test() {
  unsigned a;
  a = +a; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.LogicalOpUselessArg
<br>(C)</span><br><br>
The second operand of the &amp;&amp; operator has no impact on expression result
</td><td><pre>
void test() {
  unsigned a;
  if (a&lt;7 &amp;&amp; a&lt;10) {}; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.SameResLogicalExpr
<br>(C)</span><br><br>
The expression always evaluates to true/false
</td><td><pre>
void test() {
  int i=0;
  if (i!=0) {}; // warn
  if (i==0 &amp;&amp; i==1) {}; // warn
  if (i<0 || i>=0) {}; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.SameResUnsignedCmp
<br>(C)</span><br><br>
Comparison of unsigned expression 'op expr' is always true/false
</td><td><pre>
void test() {
  unsigned u;
  if (u &lt; -1) {}; // warn
  if (u &gt;= 0) {}; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.OpPrecedenceAssignCmp
<br>(C)</span><br><br>
Comparison operation has higher precedence then assignment. Bool value is 
assigned to variable of type 'type'. Parenthesis may bee required around an 
assignment
</td><td><pre>
int f();

void test() {
  bool b;
  int x, y;
  if((b = x != y)) {} // ok
  if((x = f() != y)) {} // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.OpPrecedenceIifShift
<br>(C)</span><br><br>
?: has lower precedence then &lt;&lt;
</td><td><pre>
#include &lt;iostream&gt;

void test() {
  int a;
  std::cout &lt;&lt; a ? "a" : "b"; // warn
  a &lt;&lt; a&gt;7 ? 1 : 2; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.ObjectUnused
<br>(C++)</span><br><br>
The object was created but is not being used<br><br>
The exception object was created but is not being used. Did you mean 
'throw std::exception();'?
</td><td><pre>
#include &lt;exception&gt;

struct S {
  int x, y;
  S(int xx, int yy) : x(xx), y(yy) {
  }
  S(int xx) {
    S(xx, 0); // warn
  }
};

void test() {
  S(0, 0); // warn
  std::exception(); // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.StaticArrayPtrCompare
<br>(C)</span><br><br>
Pointer to static array is being compared to NULL. May the subscripting is 
missing
</td><td><pre>
void test() {
  int a1[1];
  if (a1 == 0) {}; // warn

  int a2[1][1];
  if (a2[0]) {}; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.ConversionToBool
<br>maybe join with experimental.core.BoolAssignment<br>(C, C++)</span><br><br>
Odd implicit conversion from 'type' to 'bool'
</td><td><pre>
bool test() {
  return 1.; // warn
  return ""; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.ArrayBound
<br>enhancement to experimental.security.ArrayBound[v2]<br>(C, C++)</span><br><br>
Out-of-bound dynamic array access
</td><td><pre>
#include &lt;stdlib.h&gt;

void test() {
  int *p2 = new int[1];
  if(p2[1]) {}; // warn
  int i = 1;
  if(p2[i]) {}; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.StrcpyInputSize
<BR>enhancement to experimental.unix.cstring.OutOfBounds<br>(C)</span><br><br>
Buffer copy without checking size of input
</td><td><pre>
void test(char* string) {
  char buf[24];
  strcpy(buf, string); // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.IntegerOverflow
<br>(C)</span><br><br>
Integer overflow
</td><td><pre>
#include &lt;limits.h&gt;

int f(int x) {
  return INT_MAX+1; // warn
}

void test() {
  int x = INT_MAX+1; // warn
  f(INT_MAX+1); // warn

  int y = INT_MAX/2+1; // warn
  x = y*2; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.SignExtension
<br>(C)</span><br><br>
Unexpected sign extension might take place
</td><td><pre>
void f(unsigned int i);
int g();

unsigned int test() {
  long long sll;
  unsigned long long ull = sll; // warn
  long sl;
  unsigned long ul = sl; // warn
  int si;
  unsigned int ui = si; // warn
  short ss;
  unsigned short us = ss; // warn
  signed char sc;
  unsigned char uc = sc; // warn
  f(si); // warn
  ui = g(); // warn
  return si; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.NumericTruncation
<br>(C)</span><br><br>
Numeric truncation might take place
</td><td><pre>
void f(int i);
int g();

int test() {
  unsigned long long ull;
  long long sll;
  unsigned long ul = ull; // warn
  long sl = sll; // warn
  unsigned int ui = ul; // warn
  int si = sl; // warn
  unsigned short us = ui; // warn
  short ss = si; // warn
  unsigned char uc = us; // warn
  signed char sc = uc; // warn
  f(sll); // warn
  ss = g(); // warn
  return sll; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">different.MissingCopyCtorAssignOp
<br>(C, C++)</span><br><br>
The class has dynamically allocated data members but do not define a copy 
constructor/assignment operator
</td><td><pre>
class C { // warn
  int *p; // &lt;-
public:
  C() { p = new int; }
  ~C() { delete p; }
};
</pre></td><td class="aligned"></td></tr>

</table>

<!-- ============================ WinAPI =================================== -->
<h3>WinAPI</h3>
<table class="checkers">
<col class="namedescr"><col class="example"><col class="progress">
<thead><tr><td>Name, Description</td><td>Example</td><td>Progress</td></tr></thead>

<tr><td><span class="name">WinAPI.CreateProcess
<br>(C)</span><br><br>
After calling CreateProcess(), ensure that process and thread handles get closed
(* for the given example: examine data flow from pi, pi.hProcess and pi.hThread)
</td><td><pre>
#include &lt;windows.h&gt;

void test() {
  STARTUPINFO si;
  PROCESS_INFORMATION pi;
  BOOL fSuccess;
  fSuccess = CreateProcess(
    NULL, TEXT("MyProgram.exe"), NULL, NULL, 
    TRUE, 0, NULL, NULL, &amp;si, &amp;pi);
} // warn
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">WinAPI.LoadLibrary
<br>(C)</span><br><br>
Calling LoadLibrary without a fully qualified path may allow to load a DLL from 
arbitrary location
</td><td><pre>
#include &lt;windows.h&gt;

void test() {
  HINSTANCE h = LoadLibrary("X.dll"); // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">WinAPI.WideCharToMultiByte
<br>(C)</span><br><br>
Buffer overrun while calling WideCharToMultiByte
</td><td><pre>
#include &lt;windows.h&gt;

void test() 
{
  wchar_t ws[] = L"abc";
  char s[3];
  int res1 = WideCharToMultiByte(
               CP_UTF8, 0, ws, -1, s, 
               3, NULL, NULL); // warn
  int res2 = WideCharToMultiByte(
               CP_UTF8, 0, ws, -1, s, 
               3, NULL, NULL); // ok
  if (res2 == sizeof(s))
    s[res2-1] = 0;
  else
   s[res2] = 0;
}
</pre></td><td class="aligned"></td></tr>

</table>

<!-- =========================== optimization ============================== -->
<h3>optimization</h3>
<table class="checkers">
<col class="namedescr"><col class="example"><col class="progress">
<thead><tr><td>Name, Description</td><td>Example</td><td>Progress</td></tr></thead>

<tr><td><span class="name">optimization.PassConstObjByValue
<br>(C, C++)</span><br><br>
Optimization: It is more effective to pass const n-th parameter by reference to 
avoid unnecessary object copying
</td><td><pre>
struct A {
  int a[20];
  int b;
};

bool FirstIsZero(const struct A a) { // warn
  return a.a[0] == 0;
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">optimization.PostfixIncIter
<br>(C++)</span><br><br>
Optimization: It is more effective to use prefix ++ with iterator here
</td><td><pre>
#include &lt;vector&gt;

void test() {
  std::vector&lt;int&gt; v;
  std::vector&lt;int&gt;::const_iterator it;
  for(it = v.begin(); 
      it != v.end(); it++) {}; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">optimization.MultipleCallsStrlen
<br>(C)</span><br><br>
Optimization: multiple calls to strlen for a given string in the given 
expression. It is more effective to hold strlen result in a temporary 
variable
</td><td><pre>
#include &lt;string.h&gt;

void test() {
  const char* s = "abc";
  if (strlen(s) &gt; 0 &amp;&amp;
      strlen(s) &lt; 7) {}; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">optimization.EmptyCstrDetect
<br>(C)</span><br><br>
Optimization: it is more efficient to use "str[0] != '\0'" to identify an empty 
string
</td><td><pre>
#include &lt;string.h&gt;

void test() {
  const char* s = "abc";
  if (strlen(s) &gt; 0) {}; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">optimization.StrLengthCalculation
<br>(C, C++)</span><br><br>
Optimization: it is more efficient to use string::length() method to calculate 
string length
</td><td><pre>
#include &lt;string&gt;
#include &lt;string.h&gt;

void test() {
  std::string s;
  if (strlen(s.c_str()) != 0) {}; // warn
}
</pre></td><td class="aligned"></td></tr>

<tr><td><span class="name">optimization.EmptyContainerDetect
<br>(C, C++)</span><br><br>
Optimization: It is more efficient to use container.empty() to identify an 
empty container
</td><td><pre>
#include &lt;list&gt;

void test() {
  std::list&lt;int&gt; l;
  if (l.size() != 0) {}; // warn
}
</pre></td><td class="aligned"></td></tr>

</table>

<br>
</div> <!-- page -->
</div> <!-- content -->
</body>
</html>