Code check and html-report with cppcheck.
Cppcheck is a static analysis tool for C/C++ code. Project’s home on sourceforge: http://cppcheck.sourceforge.net/. Small description from the site:
Unlike C/C++ compilers and many other analysis tools it does not detect syntax errors in the code. Cppcheck primarily detects the types of bugs that the compilers normally do not detect. The goal is to detect only real errors in the code (i.e. have zero false positives).
So let’s check some code with cppcheck and generate a html report with CWE-links in it.
At first you need to install cppcheck. Official site provides a source-code, but you may install it wuth your favorite package manager. For example (in fedora 25):
# dnf install cppcheck
Now, let’s clone one famous project (also known as “A novices’ nightmare”) - vim
$ git clone https://github.com/vim/vim.git $ cd vim
Assume, that we need to check files in ./src directory. For that you need to run something like this:
$ cppcheck --xml --xml-version=2 ./src 2>report-src.xml
As you see, I redirect stderr to the file report-src.xml. That’s it, our report in XML-output. Let’s see what’s inside:
$ cat report-src.xml
Following the manual, you can tune messages, that will be shown during check. Default is ‘error’. To enable all the messages type
$ cppcheck --enable=all
“But it’s just an ugly text file, what should I post on our internal wiki?”
Calm down! Cppcheck provides an awesome feature, that allows us to generate pretty nice HTML-reports.
For that we need to get
cppcheck-htmlreport script. I found it HERE.
Now run something like this in vim’s source directory:
$ mkdir VIMs_SRC && /path/to/htmlreport/cppcheck-htmlreport --source-dir=. --title=VIMs_SRC --file=report-src.xml --report-dir=VIMs_SRC
Let me explain arguments:
- ’–source-dir’ - directory with explored source
- ’–title’ - just title, which will be shown on html page
- ’–file’ - previously generated XML-report
- ’–report-dir’ - where to store HTML-report
When it’s done, see what’s in VIMs_SRC:
$ cd VIMs_SRC/ $ ls 0.html 12.html 15.html 1.html 4.html 7.html index.html 10.html 13.html 16.html 2.html 5.html 8.html stats.html 11.html 14.html 17.html 3.html 6.html 9.html style.css
There is it! Open index.html with your favorite browser and you’ll see the beautiful HTML-report with details and links to CWE-base! The results will be as following:
Index page of HTML-report:
Page with details:
As a conclusion, I want to say, that cppcheck is a very nice and useful tool. I use it as part of code quality check cycle at work.