Cppcheck is an analysis tool for C/C++ code. Unlike C/C++ compilers and many other analysis tools, it doesn't detect syntax errors. Cppcheck only detects the types of bugs that the compilers normally fail to detect. The goal is no false positives.

Supported code and platforms:

Accuracy

Please understand that there are limits of Cppcheck. Cppcheck is rarely wrong about reported errors. But there are many bugs that it doesn't detect.

You will find more bugs in your software by testing your software carefully, than by using Cppcheck. You will find more bugs in your software by instrumenting your software, than by using Cppcheck. But Cppcheck can still detect some of the bugs that you miss when testing and instrumenting your software.

By default Cppcheck will check all preprocessor configurations (except those that have #error in them).

You can use -D to change this. When you use -D, cppcheck will by default only check the given configuration and nothing else. This is how compilers work. But you can use --force or --max-configs to override the number of configurations.

# check all configurations
cppcheck file.c

# only check the configuration A
cppcheck -DA file.c

# check all configurations when macro A is defined
cppcheck -DA --force file.c

Another useful flag might be -U. It undefines a symbol. Example usage:

cppcheck -UX file.c

That will mean that X is not defined. Cppcheck will not check what happens when X is defined.

Cppcheck can generate the output in XML format. There is an old XML format (version 1) and a new XML format (version 2). Please use the new version if you can.

The old version is kept for backwards compatibility only. It will not be changed. But it will likely be removed someday. Use --xml to enable this format.

The new version fixes a few problems with the old format. The new format will probably be updated in future versions of cppcheck with new attributes and elements. A sample command to check a file and output errors in the new XML format:

cppcheck --xml-version=2 file1.cpp

Here is a sample version 2 report:

<?xml version="1.0" encoding="UTF-8"?>
<results version="2">
  <cppcheck version="1.53">
  <errors>
    <error id="someError" severity="error" msg="short error text"
           verbose="long error text" inconclusive="true">
      <location file="file.c" line="1"/>
    </error>
  </errors>
</results>

If you want to reformat the output so it looks different you can use templates.

To get Visual Studio compatible output you can use --template=vs:

cppcheck --template=vs gui/test.cpp

This output will look like this:

Checking gui/test.cpp...
gui/test.cpp(31): error: Memory leak: b
gui/test.cpp(16): error: Mismatching allocation and deallocation: k

To get gcc compatible output you can use --template=gcc:

cppcheck --template=gcc gui/test.cpp

The output will look like this:

Checking gui/test.cpp...
gui/test.cpp:31: error: Memory leak: b
gui/test.cpp:16: error: Mismatching allocation and deallocation: k

You can write your own pattern (for example a comma-separated format):

cppcheck --template="{file},{line},{severity},{id},{message}" gui/test.cpp

The output will look like this:

Checking gui/test.cpp...
gui/test.cpp,31,error,memleak,Memory leak: b
gui/test.cpp,16,error,mismatchAllocDealloc,Mismatching allocation and deallocation: k

The following format specifiers are supported:

The escape sequences \b (backspace), \n (newline), \r (formfeed) and \t (horizontal tab) are supported.

If you want to filter out certain errors you can suppress these.

[error id]:[filename]:[line]
[error id]:[filename2]
[error id]

cppcheck --suppress=memleak:src/file1.cpp src/

// suppress memleak and exceptNew errors in the file src/file1.cpp
memleak:src/file1.cpp
exceptNew:src/file1.cpp

// suppress all uninitvar errors in all files
uninitvar

cppcheck --suppressions suppressions.txt src/

void f() {
    char arr[5];
    arr[10] = 0;
}

# cppcheck test.c
Checking test.c...
[test.c:3]: (error) Array 'arr[5]' index 10 out of bounds

void f() {
    char arr[5];

    // cppcheck-suppress arrayIndexOutOfBounds
    arr[10] = 0;
}

cppcheck --inline-suppr test.c

You can define custom rules using regular expressions.

These rules can not perform sophisticated analysis of the code. But they give you an easy way to check for various simple patterns in the code.

To get started writing rules, see the related articles here:

http://sourceforge.net/projects/cppcheck/files/Articles/

The file format for rules is:

<?xml version="1.0"?>
<rule>
  <tokenlist>LIST</tokenlist>
  <pattern>PATTERN</pattern>
  <message>
    <id>ID</id>
    <severity>SEVERITY</severity>
    <summary>SUMMARY</summary>
  </message>
</rule>

Cppcheck has internal knowledge about how standard C/C++ functions work. There is no internal knowledge about how all libraries and environments work, and there can't be. Cppcheck can be told how libraries and environments work by using configuration files.

The idea is that users will be able to download library configuration files for all popular libraries and environments here:

http://cppcheck.sourceforge.net/archive

Ideally, all you need to do is choose and download the configuration files you need.

The archive is not complete however. If you can't find the configuration file you need in the archive, you can wait - maybe somebody else will write it and share it. Or you can write your own configuration file (and then it's possible to share your configuration file with others).

A minimal configuration file looks like this:

<?xml version="1.0"?>
<def>
</def>

This configuration file is filled up with various options:

<?xml version="1.0"?>
<def>
  <memory>
    <alloc>CreateFred</alloc>
    <dealloc>CloseFred</dealloc>

    <use>AppendFred</use>
  </memory>

  <memory>
    <alloc init="false">AllocWilma</alloc>
    <alloc init="true">CAllocWilma</alloc>
    <dealloc>CloseWilma</dealloc>
  </memory>

  <resource>
    <alloc>Lock</alloc>
    <dealloc>Unlock</dealloc>
  </resource>

  <function name="IsEqual">
    <leak-ignore/>
  </function>

  <function name="AssignFred">
    <noreturn>false</noreturn>
    <arg nr="1">
      <not-null/>
    </arg>
    <arg nr="2">
      <not-uninit/>
    </arg>
    <arg nr="3">
      <strz/>
    </arg>
    <arg nr="4">
      <formatstr/>
    </arg>
  </function>
</def>

In the <memory> and <resource> the allocation and deallocation functions are configured. Putting allocation and deallocation functions in different <memory> and <resource> blocks means they are mismatching - you'll get a warning message if you allocate memory with CreateFred and try to close it with CloseWilma.

The <use> and <leak-ignore> elements are used to control the leaks checking. If it should be ignored that a function is called, use <leak-ignore>. If there is no leak whenever the memory is passed to a function, use <use>.

In the <function> block some useful info is added about function behaviour. The <noreturn> tells Cppcheck if the function is a no return function. The <arg> is used to validate arguments. If it's invalid to pass NULL, use <not-null>. If it's invalid to pass uninitialized data, use <not-uninit>. If the argument is a zero-terminated string, use <strz>. If the argument is a formatstring, use <formatstr>.

  <function name="strcpy">
    <leak-ignore/>
    <noreturn>false</noreturn>
    <arg nr="1">
      <not-null/>
    </arg>
    <arg nr="2">
      <not-null/>
      <not-uninit/>
    </arg>
  </function>

You can convert the XML output from cppcheck into a HTML report. You'll need Python and the pygments module (http://pygments.org/) for this to work. In the Cppcheck source tree there is a folder htmlreport that contains a script that transforms a Cppcheck XML file into HTML output.

This command generates the help screen:

htmlreport/cppcheck-htmlreport -h

The output screen says:

Usage: cppcheck-htmlreport [options]

Options:
  -h, --help      show this help message and exit
  --file=FILE     The cppcheck xml output file to read defects from.
                  Default is reading from stdin.
  --report-dir=REPORT_DIR
                  The directory where the html report content is written.
  --source-dir=SOURCE_DIR
                  Base directory where source code files can be found.

An example usage:

./cppcheck gui/test.cpp --xml 2> err.xml
htmlreport/cppcheck-htmlreport --file=err.xml --report-dir=test1 --source-dir=.