find bugs due to dependencies in c files

[tal]

hi,

does cppcheck support finding bugs between c files functions?
for example:
a.c:
void func1(void) {
void * p = malloc(1024);
if(p)
func2(p);
}

b.c:
void func2(void *p) {
printf("%p\n",p);
}

in this example we have a memleak of p.
running cppcheck on this files doesnt report anything.
is there a way to find this kind of bugs?

thanks,
tal

[Daniel Marjamäki]

we have some functionality for such fully automatic multi-file checking. but it's not used much. the unused functions uses it. And the CheckBufferOverrun uses it to check external buffers.

If you want to detect that memory leak now you should use a cfg file. If you provide some configuration Cppcheck will detect the leak in your code.

Start by using the --check-library flag:

$ cppcheck a.c b.c --check-library --enable=information
[a.c:3]: (information) --check-library: There is no matching configuration for function if()
[a.c:4]: (information) --check-library: There is no matching configuration for function func2()
[a.c:4]: (information) --check-library: Function func2() should have <noreturn> configuration
[a.c:5]: (information) --check-library: Function func2() should have <use>/<ignore> configuration

I recommend that you fix all messages about <noreturn>, that will help lots of checkers. You could find many additional types of bugs if you configure this properly.

Fixing the <use> / <ignore> message will help Cppcheck detect leaks.

For some information about how cfg files are written see chapter 7 in the manual http://cppcheck.sourceforge.net/manual.html. I am afraid the manual is not very good.

Here is an example configuration:

<?xml version="1.0"?>
<def>
  <function name="func2">
    <noreturn>false</noreturn>
    <leak-ignore/>
    <arg nr="1">
      <not-null/>
      <not-uninit/>
    </arg>
  </function>
</def>

Put that configuration in the file ab.cfg. Then when you use that the result is:

$ cppcheck a.c b.c --library=ab.cfg
Checking a.c...
[a.c:5]: (error) Memory leak: p
1/2 files checked 60% done
Checking b.c...
2/2 files checked 100% done

I even expected that it would also write this:

[a.c:4]: (error) Memory is allocated but not initialized: p

However the condition on line 3 in a.c somehow prevents that... I'll investigate if that can be fixed.