Cppcheck Code Analysis (2)

Function

Possible code execution flow in an analytic function

Only one stream in the code flow is executed in the actual execution of the function

Analysis: Branch statement If-else, Switch-case

Loop statement while, Do-while, for

Code Flow Example

int main (int argc,char * * argv)
{
std::string p_str= new std::string ();
if (std::string = = NULL)
{
return 0;
}
Else
{
Delete p_str;
}
return 0;
}

Execution Path 1

int main ()
{
String *p_str;
P_str= new String ();
(p_str= = NULL);
{
return 0;
}
}

Execution Path 2

int main ()
{
String *p_str;
P_str= new String ();
(p_str= = NULL);
{
Delete p_str;
}
return 0;
}

Retention condition Information

#conditon ()

#conditon_contrary ()

int main ()
{
String *p_str;
P_str= new String ();
#conditon (p_str= = NULL);
{
return 0;
}
}
int main ()
{
String *p_str;
P_str= new String ();
#conditon_contrary (p_str= = NULL);
{
Delete p_str;
}
return 0;
}

equivalent substitution -if

If
if (condition)
{
...
}

2 paths

1-> (condition)
2-> (condition) {...}
If Else
if (condition)
{
...
}
Else
{
......
}

2 paths

1-> (condition) {...}
2-> (condition) {...}

equivalent substitution -switch

Swtich (int_condition)
{
Case 1:
Codes_1
Case 2:
Codes_2
Default
Codes_df
}

N paths

1-> Swith (int_condition) {codes_1 codes_2 CODES_DF}
2-> switch (int_condition) {codes_2 CODES_DF}
3-> switch (int_condition) {CODES_DF}

equivalent substitution -while

while (condition)

{
Codes
}
2 paths
1-> (condition); loop{codes;(condition);}
2-> (condition); No loop statement entered

equivalent substitution -do while

Do
{
Codes
}
while (condition)
1 path
1-> loop{Codes;(condition);}

equivalent substitution -for

for (Initial;condition;iterate)

{
Codes
}

2 path

1-> initial; condition; loop{codes; iterate; condition;}
2-> initial; condition;

Algorithmic thinking

Nesting issues

Complex code nesting relationships

Solution, Recursive algorithm

Space issues

Path is more, and will repeat

Solution-Codeblock

Codeblock

The parts of the code that are executed sequentially are combined in a code block manner.

Multiple paths share duplicate blocks of code

Codepath<-codeblock<-token

Codeblock Reuse

Memory leak Check

Memory leak Check in function

Find all the functions related to memory allocation

Find out related pointers to memory allocation addresses (transitivity)

Whether the address is passed to the external space

Path State judgment

Memory leak characteristics

Memory Request succeeded && No free space on code path && address not delivered to external space

Address values are passed to the external space method:

1. Function parameters (pointer parameters pointing to pointers)

2. When calling other functions when the parameter

3. Return value

4. Class member variables

5. Global Variables

Other checks

Hazardous use

Using pointers money does not determine whether the value of the pointer is empty

Repeat release

Application release function inconsistent

Malloc-free

New-delete

New[]-delete[]

......

Algorithm

Pointerset A pointer that stores the address of the allocated memory

Join a new collection member when pointer delivery occurs

Removed from the collection when the pointer is re-assigned

Check the pointer in the collection

1. Use as a function parameter

2. As the return value

3. Assigning to (parameters pointing to pointers)

The memory state on the path

Unsure request Memory result unknown

NULL Request Memory Failure

OK to request memory success

Deallocate Memory is released

Passout memory addresses are passed to other windows

Conditional Judgment Analysis

parsing #condition ( .....) )

OK NULL unsure never

Common logical symbols in conditional statements && | | and parentheses ()

((ptr>0) &&other&&other) = OK

((ptr>0) &&other| | Other) = Unsure

((ptr>0) && (other| | Other) = = OK

From left to right, deep traversal

Conditional Judgment Analytic algorithm

OK NULL unsure never

(any) && unsure = any

(Any) | | Unsure = unsure

(any) && never = Never

(Any) | | never = any

OK && NULL = Never

OK | | NULL = Unsure

(A && B | | C

PTR is a pointer in Pointerset

(PTR) Ok

(|PTR) Null

(0 < PTR)        (PTR > 0) Ok

(0! = PTR)       (ptr! = 0) Ok

(0 = = ptr) Null

Other unsure

If (A && b| | C

Cppcheck Code Analysis (2)