C++ 소스 정적 분석 도구들

소스 정적 분석 도구

1. PC-Lint (유료)
1.1 PC-Lint/PC-Lint Plus 유료 구매
1.2 Visual Lint(GUI Intergrations) - PC-Lint 별도 구매 필요
1.3 ALOA(A Lint Output Analyzer) - PC-Lint 별도 구매 필요

2. PC-Lint 유사 도구
2.1. CppCheck (OpenSourrce) - http://sourceforge.net/projects/cppcheck/?source=typ_redirect
2.1.1. 참고링크
2.1.1.1 위키 링크 https://en.wikipedia.org/wiki/Cppcheck
2.1.1.2. 설정 참고용 링크 http://del4u.tistory.com/28

2.1.2. CppCheckUi.exe - WindowUI App

UI 프로그램도 별도로 있는데, 프로젝트 파일을 make 파일과 c, cpp 소스 파일들만 지원해서 사용하지 않았음.

2.1.3 VS2010 설정 화면

2.1.3.1 메뉴에서 Tools > External Tools 선택,

화면에서 “Add” 추가후 아래 항목 입력

Title: CppCheck

Command: C:\Program Files\Cppcheck\cppcheck.exe

Argument: --enable=* -q --template vs $(ProjectDir)

Initial Directory: $(ProjectDir)

2.1.3.2. 참고로, MSVCP14.DLL 오류가 발생하면 CS2015 재배포패키지가 설치해야 합니다.

2.1.3.3 CppCheck.exe 파라메터 설명

C:\Program Files\Cppcheck>cppcheck.exe

Cppcheck - A tool for static C/C++ code analysis

Syntax:

    cppcheck [OPTIONS] [files or paths]

If a directory is given instead of a filename, *.cpp, *.cxx, *.cc, *.c++, *.c,

*.tpp, and *.txx files are checked recursively from the given directory.

Options:

    --append=<file>      This allows you to provide information about functions

                         by providing an implementation for them.

    --check-config       Check cppcheck configuration. The normal code

                         analysis is disabled by this flag.

    --check-library      Show information messages when library files have

                         incomplete info.

    --config-exclude=<dir>

                         Path (prefix) to be excluded from configuration

                         checking. Preprocessor configurations defined in

                         headers (but not sources) matching the prefix will not

                         be considered for evaluation.

    --config-excludes-file=<file>

                         A file that contains a list of config-excludes

    --dump               Dump xml data for each translation unit. The dump

                         files have the extension .dump and contain ast,

                         tokenlist, symboldatabase, valueflow.

    -D<ID>               Define preprocessor symbol. Unless --max-configs or

                         --force is used, Cppcheck will only check the given

                         configuration when -D is used.

                         Example: '-DDEBUG=1 -D__cplusplus'.

    -U<ID>               Undefine preprocessor symbol. Use -U to explicitly

                         hide certain #ifdef <ID> code paths from checking.

                         Example: '-UDEBUG'

    -E                   Print preprocessor output on stdout and don't do any

                         further processing.

    --enable=<id>        Enable additional checks. The available ids are:

                          * all

                                  Enable all checks. It is recommended to only

                                  use --enable=all when the whole program is

                                  scanned, because this enables unusedFunction.

                          * warning

                                  Enable warning messages

                          * style

                                  Enable all coding style checks. All messages

                                  with the severities 'style', 'performance' and

                                  'portability' are enabled.

                          * performance

                                  Enable performance messages

                          * portability

                                  Enable portability messages

                          * information

                                  Enable information messages

                          * unusedFunction

                                  Check for unused functions. It is recommend

                                  to only enable this when the whole program is

                                  scanned.

                          * missingInclude

                                  Warn if there are missing includes. For

                                  detailed information, use '--check-config'.

                         Several ids can be given if you separate them with

                         commas. See also --std

    --error-exitcode=<n> If errors are found, integer [n] is returned instead of

                         the default '0'. '1' is returned

                         if arguments are not valid or if no input files are

                         provided. Note that your operating system can modify

                         this value, e.g. '256' can become '0'.

    --errorlist          Print a list of all the error messages in XML format.

    --exitcode-suppressions=<file>

                         Used when certain messages should be displayed but

                         should not cause a non-zero exitcode.

    --file-list=<file>   Specify the files to check in a text file. Add one

                         filename per line. When file is '-,' the file list will

                         be read from standard input.

    -f, --force          Force checking of all configurations in files. If used

                         together with '--max-configs=', the last option is the

                         one that is effective.

    -h, --help           Print this help.

    -I <dir>             Give path to search for include files. Give several -I

                         parameters to give several paths. First given path is

                         searched for contained header files first. If paths are

                         relative to source files, this is not needed.

    --includes-file=<file>

                         Specify directory paths to search for included header

                         files in a text file. Add one include path per line.

                         First given path is searched for contained header

                         files first. If paths are relative to source files,

                         this is not needed.

    --include=<file>

                         Force inclusion of a file before the checked file. Can

                         be used for example when checking the Linux kernel,

                         where autoconf.h needs to be included for every file

                         compiled. Works the same way as the GCC -include

                         option.

    -i <dir or file>     Give a source file or source file directory to exclude

                         from the check. This applies only to source files so

                         header files included by source files are not matched.

                         Directory name is matched to all parts of the path.

    --inconclusive       Allow that Cppcheck reports even though the analysis is

                         inconclusive.

                         There are false positives with this option. Each result

                         must be carefully investigated before you know if it is

                         good or bad.

    --inline-suppr       Enable inline suppressions. Use them by placing one or

                         more comments, like: '// cppcheck-suppress warningId'

                         on the lines before the warning to suppress.

    -j <jobs>            Start <jobs> threads to do the checking simultaneously.

    --language=<language>, -x <language>

                         Forces cppcheck to check all files as the given

                         language. Valid values are: c, c++

    --library=<cfg>

                         Load file <cfg> that contains information about types

                         and functions. With such information Cppcheck

                         understands your your code better and therefore you

                         get better results. The std.cfg file that is

                         distributed with Cppcheck is loaded automatically.

                         For more information about library files, read the

                         manual.

    --max-configs=<limit>

                         Maximum number of configurations to check in a file

                         before skipping it. Default is '12'. If used together

                         with '--force', the last option is the one that is

                         effective.

    --platform=<type>, --platform=<file>

                         Specifies platform specific types and sizes. The

                         available builtin platforms are:

                          * unix32

                                 32 bit unix variant

                          * unix64

                                 64 bit unix variant

                          * win32A

                                 32 bit Windows ASCII character encoding

                          * win32W

                                 32 bit Windows UNICODE character encoding

                          * win64

                                 64 bit Windows

                          * native

                                 Unspecified platform. Type sizes of host system

                                 are assumed, but no further assumptions.

    -q, --quiet          Do not show progress reports.

    -rp, --relative-paths

    -rp=<paths>, --relative-paths=<paths>

                         Use relative paths in output. When given, <paths> are

                         used as base. You can separate multiple paths by ';'.

                         Otherwise path where source files are searched is used.

                         We use string comparison to create relative paths, so

                         using e.g. ~ for home folder does not work. It is

                         currently only possible to apply the base paths to

                         files that are on a lower level in the directory tree.

    --report-progress    Report progress messages while checking a file.

    --rule=<rule>        Match regular expression.

    --rule-file=<file>   Use given rule file. For more information, see:

                         http://sourceforge.net/projects/cppcheck/files/Articles

/

    --std=<id>           Set standard.

                         The available options are:

                          * posix

                                 POSIX compatible code

                          * c89

                                 C code is C89 compatible

                          * c99

                                 C code is C99 compatible

                          * c11

                                 C code is C11 compatible (default)

                          * c++03

                                 C++ code is C++03 compatible

                          * c++11

                                 C++ code is C++11 compatible (default)

                         More than one --std can be used:

                           'cppcheck --std=c99 --std=posix file.c'

    --suppress=<spec>    Suppress warnings that match <spec>. The format of

                         <spec> is:

                         [error id]:[filename]:[line]

                         The [filename] and [line] are optional. If [error id]

                         is a wildcard '*', all error ids match.

    --suppressions-list=<file>

                         Suppress warnings listed in the file. Each suppression

                         is in the same format as <spec> above.

    --template='<text>'  Format the error messages. E.g.

                         '{file}:{line},{severity},{id},{message}' or

                         '{file}({line}):({severity}) {message}' or

                         '{callstack} {message}'

                         Pre-defined templates: gcc, vs, edit.

    -v, --verbose        Output more detailed error information.

    --version            Print out version number.

    --xml                Write results in xml format to error stream (stderr).

    --xml-version=<version>

                         Select the XML file version. Currently versions 1 and

                         2 are available. The default version is 1.

Example usage:

  # Recursively check the current folder. Print the progress on the screen and

  # write errors to a file:

  cppcheck . 2> err.txt

  # Recursively check ../myproject/ and don't print progress:

  cppcheck --quiet ../myproject/

  # Check test.cpp, enable all checks:

  cppcheck --enable=all --inconclusive --std=posix test.cpp

  # Check f.cpp and search include files from inc1/ and inc2/:

  cppcheck -I inc1/ -I inc2/ f.cpp

For more information:

    http://cppcheck.sourceforge.net/manual.pdf

C:\Program Files\Cppcheck>

2.2.Vera++(OpenSource) - https://bitbucket.org/verateam/vera/wiki/Introduction
- c++ 를 위한 검증, 분석, 변환 프로그래밍 도구
- Code formatter 로 많이 사용 하는 것으로 보임.
- Boost Software License
- QtCreator, Microsoft Visual C++ 2010, XCode, CDash 에서 사용한 스크린 샷 있음
- Mac 설정 방법은 존제
- 윈도우 관련 설명 찾기