# List of potential checkers

This page contains a list of potential checkers to implement in the static analyzer. If you are interested in contributing to the analyzer's development, this is a good resource to help you get started. The specific names of the checkers are subject to review, and are provided here as suggestions.

### memory

Name, Description | Example | Progress
memory.LeakEvalOrder (C, C++) Potential memory leaks caused by an undefined argument evaluation order. Source: boost docs: shared_ptr. |
    void f(int, int);
    int g(void *);
    int h() __attribute__((noreturn));

    void test() {
      // It is possible that 'malloc(1)' is called first,
      // then 'h()', that is (or calls) noreturn and eventually
      // 'g()' is never called.
      f(g(malloc(1)), h()); // warn: 'g()' may never be called.
    }
    void f(int, int);
    int g(int *);
    int h() { throw 1; };

    void test() {
      // It is possible that 'new int' is called first,
      // then 'h()', that throws an exception and eventually
      // 'g()' is never called.
      f(g(new int), h()); // warn: 'g()' may never be called.
    }
memory.DstBufferTooSmall (C, C++) Destination buffer passed to memory function is too small. Note: security.insecureAPI.strcpy currently warns on usage of `strcpy` and suggests to replace it. Note: alpha.unix.CStringChecker contains some similar checks.

Source: CWE-120.

    void test() {
      const char* s1 = "abc";
      char *s2 = new char;
      strcpy(s2, s1); // warn
    }

    void test() {
      int* p1 = new int[3];
      int* p2 = new int;
      memcpy(p2, p1, 3); // warn
    }

memory.NegativeArraySize (C, C++) 'n' is used to specify the buffer size may be negative. Note: possibly an enhancement to alpha.security.MallocOverflow. Source: CWE-20, Example 2. |
    void test() {
      int *p;
      int n1 = -1;
      p = new int[n1]; // warn
    }
memory.ZeroAlloc (C, C++) Allocation of zero bytes. Note: an enhancement to unix.Malloc. Note: unix.API perform C-checks for zero allocation. This should be moved to unix.Malloc. Source: C++03 3.7.3.1p2; C++11 3.7.4.1p2. |
    #include <stdlib.h>

    void test() {
      int *p = malloc(0); // warn
      free(p);
    }
    void test() {
      int *p = new int[0]; // warn
      delete[] p;
    }
| D6178

### constructors/destructors

Name, Description | Example | Progress
ctordtor.ExptInsideDtor (C++) It is dangerous to let an exception leave a destructor. Using `try..catch` solves the problem. Source: Scott Meyers "More Effective C++", item 11: Prevent exceptions from leaving destructors. |
    class A {
      A() {}
      ~A() { throw 1; } // warn
    };
    void f() throw(int);

    class A {
      A() {}
      ~A() { f(); } // warn
    };
ctordtor.PlacementSelfCopy (C++11) For a placement copy or move, it is almost certainly an error if the constructed object is also the object being copied from. |
    class A {};

    void test(A *dst, A *src) {
      ::new (dst) A(*dst); // warn (should be 'src')
    }

### va_list

Name, Description | Example | Progress
valist.Uninitialized (C) Calls to the `va_arg`, `va_copy`, or `va_end` macro must happen after calling `va_start` and before calling `va_end`. |
    #include <stdarg.h>

    void test(int x, ...) {
      va_list args;
      int y = va_arg(args, int); // warn
    }
    #include <stdarg.h>

    void test(int x, ...) {
      va_list args;
      va_start(args, x);
      va_end(args);
      int z = va_arg(args, int); // warn
    }
| PR16811
valist.Unterminated (C) Every `va_start` must be matched by a `va_end`. A va_list can only be ended once. This should be folded into the generalized "ownership checker" described on the Open Projects page. |
    #include <stdarg.h>

    void test(int x, ...) {
      va_list args;
      va_start(args, x);
      int y = x + va_arg(args, int);
    } // warn: missing va_end
| PR16812

### exceptions

Name, Description | Example | Progress
exceptions.ThrowSpecButNotThrow (C++) Function declaration has a `throw(type)` specifier but the function do not throw exceptions. |
    void test() throw(int) {
    } // warn
exceptions.NoThrowSpecButThrows (C++) An exception is throw from a function having a `throw()` specifier. |
    void test() throw() {
      throw(1); // warn
    }
exceptions.ThrownTypeDiffersSpec (C++) The type of a thrown exception differs from those specified in a `throw(type)` specifier. |
    struct S{};

    void test() throw(int) {
      S s;
      throw (s); // warn
    }

### smart pointers

Name, Description | Example | Progress
smartptr.SmartPtrInit (C++) C++03: `auto_ptr` should store a pointer to an object obtained via new as allocated memory will be cleaned using `delete`. C++11: one should use `unique_ptr<type[]>` to keep a pointer to memory allocated by `new[]`. C++11: to keep a pointer to memory allocated by `new[]` in a `shared_ptr` one should use a custom deleter that calls `delete[].`.

Source: C++03 20.4.5p1; C++11 `auto_ptr` is deprecated (D.10).

    #include <stdlib.h>
    #include <memory>

    void test() {
      std::auto_ptr<int> p1(new int); // Ok
      std::auto_ptr<int> p2(new int[3]); // warn
    }

    #include <stdlib.h>
    #include <memory>

    void test() {
      std::auto_ptr<int> p((int *)malloc(sizeof(int))); // warn
    }

### dead code

Name, Description | Example | Progress
deadcode.UnmodifiedVariable (C, C++) A variable is never modified but was not declared const and is not a reference. (opt-in checker) |
    extern int computeDelta();

    int test(bool cond) {
      int i = 0;
      if (cond) {
        const int delta = computeDelta();
        // warn: forgot to modify 'i'
      }
      return i;
    }
| PR16890
deadcode.IdempotentOperations (C) Warn about idempotent operations. |
    void test() {
      int x = 7;
      x = x; // warn: value is always the same
    }
    void test() {
      int x = 7;
      x /= x; // warn: value is always 1
    }
    void test() {
      int x = 7, one = 1;
      x *= one; // warn: right op is always 1
    }
    void test() {
      int x = 7, zero = 0;
      x = x - zero;
       // warn: the right operand to '-' is always 0
    }
| removed from alpha.deadcode.* at r198476

### POSIX

Name, Description | Example | Progress
posix.Errno (C) Record that `errno` is non-zero when certain functions fail. |
    #include <stdlib.h>

    int readWrapper(int fd, int *count) {
      int lcount = read(fd, globalBuf, sizeof(globalBuf));
      if (lcount < 0)
        return errno;
      *count = lcount;
      return 0;
    }

    void use(int fd) {
      int count;
      if (!readWrapper(fd, &count))
        print("%d", count); // should not warn
    }
| PR18701

### undefined behavior

Name, Description | Example | Progress
undefbehavior.ExitInDtor (C++) Undefined behavior: `std::exit()` is called to end the program during the destruction of an object with static storage duration. Source: C++11 3.6.1p4. |
    #include <cstdlib>

    class A {
    public:
      ~A() {
        std::exit(1); // warn
      }
    };
undefbehavior.LocalStaticDestroyed (C++) Undefined behavior: function containing a definition of static local object is called during the destruction of an object with static storage duration so that flow of control passes through the definition of the previously destroyed static local object.

Source: C++11 3.6.3p2.

    void f();

    class A {
    public:
      ~A() {
        f(); // warn
      }
    };

    class B {};

    A a;

    void f() {
      static B b;
    }

undefbehavior.ZeroAllocDereference (C, C++) The effect of dereferencing a pointer returned as a request for zero size is undefined. Note: possibly an enhancement to unix.Malloc. Source: C++03 3.7.3.1p2; C++11 3.7.4.1p2. |
    #include <stdlib.h>

    void test() {
      int *p = (int *)malloc(0);
      *p = 1; // warn
      free(p);
    }
    void f(int);

    void test() {
      int *p = new int[0];
      f(*p); // warn
      delete[] p;
    }
| D8273
undefbehavior.DeadReferenced (C++) Undefined behavior: the following usage of the pointer to the object whose lifetime has ended can result in undefined behavior: The object will be or was of a class type with a non-trivial destructor and

- the pointer is used as the operand of a delete-expression

The object will be or was of a non-POD class type (C++11: any class type) and

- the pointer is used to access a non-static data member or call a non-static member function of the object
- the pointer is implicitly converted to a pointer to a base class type
- the pointer is used as the operand of a `static_cast` (except when the conversion is to `void*`, or to `void*` and subsequently to `char*`, or `unsigned char*`)
- the pointer is used as the operand of a `dynamic_cast`

Source: C++03 3.8p5, p7; C++11 3.8p5, p7.

    #include <new>

    class A {
    public:
      ~A();
    };

    class B : public A {};

    void test() {
      A *a = new A;
      new(a) B;
      delete a; // warn
    }

    #include <new>

    class A {
    public:
      ~A();
    };

    class B {};

    void test() {
      A *a = new A;
      new(a) B;
      a->~A();
    }

    #include <new>

    class A {
    public:
      ~A();
    };

    class B : public A {};

    class C {};

    void f(A*);

    void test() {
      B *b = new B;
      new(b) C;
      f(b); // warn
    }

    #include <new>

    class A {
    public:
      ~A();
    };

    class B : public A {};

    class C {};

    A* test() {
      B *b = new B;
      new(b) C;
      return static_cast<A*>(b); // warn
    }

    #include <new>

    class A {
    public:
      ~A();
    };

    class B : public A {};

    class C {};

    A* test() {
      B *b = new B;
      new(b) C;
      return dynamic_cast<A*>(b); // warn
    }

undefbehavior.ObjLocChanges (C++) Undefined behavior: the program must ensure that an object occupies the same storage location when the implicit or explicit destructor call takes place. Source: C++11 3.8p8. |
    #include <new>

    class A {};

    class B {
    public:
      ~B();
    };

    void test() {
      B b;
      new (&b) A;
    } // warn
    #include <new>

    class A {};

    class B {
    public:
      ~B();
    };

    void test() {
      B *b = new B;
      new (b) A;
      delete b; // warn
    }
undefbehavior.ExprEvalOrderUndef (C, C++03) Undefined behavior: a scalar object shall have its stored value modified at most once by the evaluation of an expression. Note: most cases are currently handled by the Clang core (search for 'multiple unsequenced modifications' warning in Clang tests).

Source: C++03 5p4.

    int test () {
      int i = 0;
      i = ++i + 1; // warn
      return i;
    }

undefbehavior.StaticInitReentered (C++) Undefined behavior: static declaration is re-entered while the object is being initialized. Source: C++11 6.7p4. |
    int test(int i) {
      static int s = test(2 * i); // warn
      return i + 1;
    }
undefbehavior.ConstModified (C, C++) Undefined behavior: const object is being modified. Source: C++03 7.1.5.1p4, C++11 7.1.6.1p4. |
    void test() {
      const int *cp = new const int (0);
      int *p = const_cast<int *>(cp);
      *p = 1; // warn
      delete p;
    }
    class C {
    public :
      int i;
      C();
    };

    void test() {
      const C cb;

      C* cp = const_cast<C *>(&cb);
      cp->i = 1; // warn
    }
undefbehavior.DeadDestructed (C++) Undefined behavior: the destructor is invoked for an object whose lifetime has ended. Source: C++11 12.4p14. |
    class A {
    public:
      void f();
      A();
      ~A();
    };

    void test() {
      A a;
      a.~A();
    } // warn
undefbehavior.MethodCallBeforeBaseInit (C++) Undefined behavior: calls member function but base not yet initialized. Source: C++03 12.6.2p8; C++11 12.6.2p13. |
    class A {
    public :
      A(int);
    };

    class B : public A {
    public :
      int f();
      B() : A(f()) {} // warn
    };
undefbehavior.MemberOrBaseRefBeforeCtor (C++) C++ Undefined behavior: non-static member or base class of non-POD class type is referred before constructor begins execution. C++11 Undefined behavior: non-static member or base class of a class with a non-trivial constructor is referred before constructor begins execution.

Source: C++03 12.7p1; C++11 12.7p1.

    struct non_POD {
      int i;
      non_POD();
    };

    extern non_POD non_pod;

    int *p = &non_pod.i; // warn

    struct POD {
      int i;
    };

    struct non_POD : public POD {
      POD pod;
    };

    extern non_POD non_pod;

    int *p = &non_pod.pod.i; // warn

    struct POD {
      int i;
    };

    struct non_POD : public POD {};

    extern non_POD non_pod;

    POD *p = &non_pod; // warn

    struct non_POD {
      int i;
      non_POD();
    };

    struct S {
      int *k;
      non_POD non_pod;
      S() : k(&non_pod.i) {} // warn
    };

undefbehavior.MemberRefAfterDtor (C++) C++03: Undefined behavior: non-static member of non-POD class type is referred after destructor ends execution. C++11: Undefined behavior: non-static member of a class with a non-trivial destructor is referred after destructor ends execution.

Source: C++03 12.7p1; C++11 12.7p1.

    class C {
    public:
      C();
      void f();
    };

    void test() {
      C *c = new C();
      c->~C();
      c->f(); // warn
    }

undefbehavior.CtorForeignCall (C++) Undefined behavior: call to virtual function of an object under construction whose type is neither the constructors own class or one of its bases. Source: C++11 12.7p4. |
    class A {
    public:
      virtual void f() {};
    };

    class B {
    public:
      B(A* a) { a->f(); } // warn
    };

    class C : public A, B {
    public:
      C() : B((A*)this) {}
    };
undefbehavior.CtorForeignTypeid (C++) Undefined behavior: the operand of `typeid` is an object under construction whose type is neither the constructors own class or one of its bases. Source: C++11 12.7p5. |
    #include <typeinfo>

    class A {};

    class B {
    public:
      B(A* a) {
        (void)typeid(*a); // warn
      }
    };

    class C : public A, B {
    public:
      C() : B((A*)this) {}
    };
undefbehavior.CtorForeignCast (C++) Undefined behavior: the operand of `dynamic_cast` is an object under construction whose type is neither the constructors own class or one of its bases. Source: C++11 12.7p6. |
    #include <typeinfo>

    class A {
    public:
      virtual void f() {};
    };

    class B {
    public:
      B(A* a) {
        (void)dynamic_cast<B*>(a); //warn
      }
    };

    class C : public A, B {
    public:
      C() : B((A*)this) {}
    };
undefbehavior.MemberOrBaseRefInCatch (C++) Undefined behavior: referring to any non-static member or base class of an object in the handler for a function-try-block of a constructor or destructor for that object results in undefined behavior. Source: C++11 15.3p10. |
    void f() { throw 1; }

    class C {
      int i;
    public :
      C()
      try {
        f();
      }
      catch (...) {
        i=2; // warn
      }
    };
    void f() { throw 1; }

    class Base {
    public:
      int i;
    };

    class C: public Base {
    public :
      ~C() try {
        f();
      }
      catch (...) {
        i=2; // warn
      }
    };
undefbehavior.ReturnAtCatchEnd (C++) Undefined behavior: a function returns when control reaches the end of a handler. This results in undefined behavior in a value-returning function. Source: C++11 15.3p10. |
    void f() { throw 1; }

    int test() try {
      f();
      return 1;
    }
    catch(int) {
    } // warn
undefbehavior.AutoptrsOwnSameObj (C++03) Undefined behavior: if more than one `auto_ptr` owns the same object at the same time the behavior of the program is undefined. Source: C++03 20.4.5p3; C++11 `auto_ptr` is deprecated (D.10). |
    #include <memory>

    void test() {
      int *data = new int;
      std::auto_ptr<int> p(data);
      std::auto_ptr<int> q(data); // warn
    }
undefbehavior.BasicStringOutOfBound (C++03) Undefined behavior: out-of-bound `basic_string` access/modification. Note: possibly an enhancement to alpha.security.ArrayBoundV2. Source: C++03 21.3.4p1; C++11 behavior is defined (21.4.5p2). |
    #include <string>

    void test() {
      std::basic_string<char> s;
      char c = s[10]; // warn
    }
    #include <string>

    void test() {
      std::basic_string<char> s;
      s[10] = 0; // warn
    }
undefbehavior.EosDereference (C++) Undefined behavior: the result of `operator*()` on an end of a stream is undefined. Source: C++03 24.5.3p2; C++11 24.6.3p2. |
    #include <vector>

    int test() {
      std::vector<int> v;
      return *v.end(); // warn
    }
undefbehavior.QsortNonPODNonTrivial (C++) C++03: Undefined behavior: the objects in the array passed to qsort are of non-POD type. C++11: Undefined behavior: the objects in the array passed to qsort are of non-trivial type. Source: C++03 25.4p4; C++11 25.5p4. |
    // C++03
    #include <cstdlib>

    struct non_POD {
      non_POD();
    };

    non_POD values[] = { non_POD(), non_POD() };

    int compare(const void *a, const void *b);

    void test() {
      qsort(values, 2, sizeof(non_POD), compare); // warn
    }
    // C++11
    #include <cstdlib>

    struct S {};

    struct trivial_non_POD : public S {
      int i;
    };

    struct non_trivial {
      int i;
      non_trivial();
    };

    trivial_non_POD tnp[2];
    non_trivial nt[2];

    int compare1(const void *a, const void *b);

    int compare2(const void *a, const void *b);

    void test() {
      qsort(tnp, 2, sizeof(trivial_non_POD), compare1); // ok
      qsort(nt, 2, sizeof(non_trivial), compare2); // warn
    }
undefbehavior.ThrowWhileCopy (C++) Undefined behavior: copy constructor/assignment operator can throw an exception. The effects are undefined if an exception is thrown. |
    class C {
    public:
      int i, j;
      C (const C &c) {
        i = c.i;
        throw 1; // warn
        j = c.j;
      };
    };
    class C {
    public:
      int i, j;
      C &operator=(const C &c) {
        i = c.i;
        throw 1; // warn
        j = c.j;
      };
    };
undefbehavior.ValarrayArgBound (C++) Undefined behavior: the value of the `n` argument passed to `valarray` constructor is greater than the number of values pointed to by the first argument (source). Source: C++03 26.3.2.1p4; C++11 26.6.2.2p4. |
    #include <valarray>

    struct S {
      int i;
      S(int ii) : i(ii) {};
    };

    void test(void) {
      S s[] = { S(1), S(2) };
      std::valarray<S> v(s,3); // warn
    }
undefbehavior.ValarrayLengthDiffer (C++) Undefined behavior: `valarray` operands are of different length. Source: C++03 26.3.2.2p1, 26.3.2.6p3, 26.3.3.1p3, 26.3.3.2p3; C++11 defined (26.6.2.3p1), 26.6.2.7p3, 26.6.3.1p3, 26.6.3.2p3. |
    // C++03
    #include <valarray>

    void test(void) {
      std::valarray<int> a(0, 1), b(0, 2);
      a = b; // warn
      b.resize(1);
      a = b; // ok
    }
    // C++03, C++11
    #include <valarray>

    void test(void) {
      std::valarray<int> a(0, 1), b(0, 2);
      a *= b; // warn
    }
    // C++03, C++11
    #include <valarray>

    void test(void) {
      std::valarray<int> a(0, 1), b(0, 2);
      a = a + b; // warn
    }
    // C++03, C++11
    #include <valarray>

    void test(void) {
      std::valarray<int> a(0, 1), b(0, 2);
      std::valarray<bool> c(false, 1);
      c = a == b; // warn
    }
undefbehavior.ValarrayZeroLength (C++) Undefined behavior: calling `sum()`/`min()`/`max()` methods of a zero length `valarray`the behavior is undefined. Source: C++03 26.3.2.7p2, p3, p4; C++11 26.6.2.8p5, p6, p7.`` |
    #include <valarray>

    void test(void) {
      std::valarray<int> v(0, 0);
      v.sum(); // warn
    }
undefbehavior.ValarrayBadIndirection (C++) Undefined behavior: element is specified more than once in an indirection. Source: C++03 26.3.9.2p2, 26.3.9.3p2; C++11 26.6.9.2p2, 26.6.9.3p2. |
    #include <valarray>

    void test() {
      // '1' is specified more then once
      size_t addr[] = {0, 1, 1};
      std::valarray<size_t>indirect(addr, 3);
      std::valarray<int> a(0, 5), b(1, 3);
      a[indirect] = b; //warn
    }
    #include <valarray>

    void test() {
      // '1' is specified more then once
      size_t addr[] = {0, 1, 1};
      std::valarray<size_t>indirect(addr, 3);
      std::valarray<int> a(0, 5), b(1, 3);
      a[indirect] *= b; //warn
    }
undefbehavior.IosBaseDestroyedBeforeInit (C++) Undefined behavior: `ios_base` object is destroyed before initialization have taken place. `basic_ios::init` should be call to initialize `ios_base` members. Source: C++03 27.4.2.7p1, 27.4.4.1p2; C++11 27.5.3.7p1, 27.5.5.2p2. |
    #include <ios>

    using namespace std;
    template <class T, class Traits = std::char_traits<T> >
    class my_stream1 : public std::basic_ios<T, Traits> {
    };

    template <class T, class Traits = std::char_traits<T> >
    class my_stream2 : public std::basic_ios<T, Traits> {
      class my_streambuf
      : public std::basic_streambuf<T, Traits> {
      };
    public:
      my_stream2() {
        this->init(new my_streambuf);
      }
    };

    void test() {
      my_stream1<char> *p1 = new my_stream1<char>;
      my_stream2<char> *p2 = new my_stream2<char>;
      delete p1; // warn
      delete p2; // ok
    }
undefbehavior.IosBaseUsedBeforeInit (C++11) Undefined behavior: `ios_base` object is used before initialization have taken place. `basic_ios::init` should be call to initialize `ios_base` members. Source: C++11 27.5.3.7p1, 27.5.5.2p2. |
    #include <ios>

    using namespace std;
    template <class T, class Traits = std::char_traits<T> >
    class my_stream1 : public std::basic_ios<T, Traits> {
    };

    template <class T, class Traits = std::char_traits<T> >
    class my_stream2 : public std::basic_ios<T, Traits> {
      class my_streambuf
      : public std::basic_streambuf<T, Traits> {
      };
    public:
      my_stream2() {
        this->init(new my_streambuf);
      }
    };

    void test() {
      my_stream1<char> *p1 = new my_stream1<char>;
      my_stream2<char> *p2 = new my_stream2<char>;
      p1->narrow('a', 'b'); // warn
      p2->narrow('a', 'b'); // ok
    }
undefbehavior.MinusOnePosType (C++) Undefined behavior: passing -1 to any `streambuf`/`istream`/`ostream` member that accepts a value of type `traits::pos_type` result in undefined behavior. Source: C++03 27.4.3.2p3; C++11 27.5.4.2p3. |
    #include <fstream>

    class my_streambuf : public std::streambuf {
      void f() {
        seekpos(-1); // warn
      }
    };
    #include <fstream>

    void test() {
      std::filebuf fb;
      std::istream in(&fb);
      std::filebuf::off_type pos(-1);
      in.seekg(pos); // warn
    }

### different

Name, Description | Example | Progress
different.SuccessiveAssign (C) Successive assign to a variable. |
    int test() {
      int i;
      i=1;
      i=2; // warn
      return i;
    }
different.NullDerefStmtOrder (C) Dereferencing of the null pointer might take place. Checking the pointer for null should be performed first. Note: possibly an enhancement to core.NullDereference. |
    struct S {
      int x;
    };

    struct S* f();

    void test() {
      struct S *p1 = f();
      int x1 = p1->x; // warn
      if (p1) {};

      struct S *p2 = f();
      int x2 = p2->x; // ok
    }
different.NullDerefCondOrder (C) Dereferencing of the null pointer might take place. Checking the pointer for null should be performed first. Note: possibly an enhancement to core.NullDereference. |
    struct S {int i;};

    struct S* f();

    void test() {
      struct S *p = f();
      if (p->i && p) {}; // warn
    }
different.MultipleAccessors (C++) Identical accessor bodies. Possibly a misprint. |
    class A {
      int i;
      int j;
    public:
      int getI() { return i; }
      int getJ() { return i; } // warn
    };
    class A {
      int i;
      int j;
    public:
      void setI(int& ii) { i = ii; }
      void setJ(int& jj) { i = jj; } // warn
    };
different.AccessorsForPublic (C++) Accessors exist for a public class field. Should this field really be public? |
    class A {
    public:
      int i; // warn
      int getI() { return i; }
      void setI(int& ii) { i = ii; }
    };
different.LibFuncResultUnised (C, C++) Calling a function ignoring its return value is of no use (create the list of known system/library/API functions falling into this category). |
    #include <vector>

    void test() {
      std::vector<int> v;
      v.empty(); // warn
    }
different.WrongVarForStmt (C, C++) Wrong variable is possibly used in the loop/cond-expression of the `for` statement. Did you mean 'proper_variable_name'? |
    void test() {
      int i = 0;
      int j = 0;
      for (i = 0; i < 3; j += 1); // warn
    }
    void test() {
      int i = 0;
      int j = 0;
      for (int j = 0; i < 3; ++j); // warn
    }
different.FloatingCompare (C) Comparing floating point numbers may be not precise. |
    #include <math.h>

    double test() {
      double b = sin(M_PI / 6.0);
      if (b == 0.5) // warn
        b = 0;
      return b;
    }
different.BitwiseOpBoolArg (C, C++) Boolean value met at the left/right part of the bitwise `&` or `|` operator. Did you mean `&&` (`||`) ? |
    int f();

    void test() {
      bool b = true;
      if (b & f()) {} // warn
    }
different.LabelInsideSwitch (C) Possibly a misprint: label found inside a `switch()` statement. |
    void test(int c) {
      switch(c){
      case 1:
        c += 1; break;
      defalt: // warn (did you mean 'default'?)
        c -= 1; break;
      }
    }
different.IdenticalCondIfIf (C) The conditions of two subsequent `if` statements are identical. |
    int test(int c) {
      if (c > 5)
        c += 1;
      if (c > 5) // warn
        c -= 1;
      return c;
    }
different.LogicalOpUselessArg (C) The second operand of a `&&` operator has no impact on expression result. |
    void test(unsigned a) {
      if (a<7 && a<10) {}; // warn
    }
different.SameResLogicalExpr (C) An expression is always evaluated to true/false. |
    void test() {
      int i = 0;
      if (i != 0) {}; // warn
    }
    void test(int i) {
      if (i == 0 && i == 1) {}; // warn
    }
    void test(int i) {
      if (i < 0 || i >= 0) {}; // warn
    }
different.OpPrecedenceAssignCmp (C, C++) Comparison operation has higher precedence then assignment. Boolean value is assigned to a variable of other type. Parenthesis may bee required around an assignment. |
    int f();

    void test(int x, int y) {
      bool b;
      if((b = x != y)) {} // ok
      if((x = f() != y)) {} // warn
    }
different.OpPrecedenceIifShift (C, C++) `?:` has lower precedence then `<<`. Source: Stephen C. Dewhurst "C++ Gotchas: Avoiding Common Problems in Coding and Design", advise 15. |
    #include <iostream>

    void test(int a) {
      std::cout << a ? "a" : "b"; // warn
    }
    void test(int a) {
      a << a > 7 ? 1 : 2; // warn
    }
different.ObjectUnused (C++) The object was created but is not being used. |
    struct S {
      int x, y;
      S(int xx, int yy) : x(xx), y(yy) {}
      S(int xx) {
        S(xx, 0); // warn
      }
    };
    #include <exception>

    void test() {
      std::exception();
        // warn (did you mean 'throw std::exception()'?)
    }
different.StaticArrayPtrCompare (C) Pointer to static array is being compared to NULL. May the subscripting is missing. |
    void test() {
      int a[1][1];
      if (a[0] == 0) {}; // warn
    }
different.ConversionToBool (C, C++) Odd implicit conversion to boolean. Note: possibly merge with alpha.core.BoolAssignment. |
    bool test() {
      return 1.; // warn
    }
    bool test() {
      return ""; // warn
    }
different.ArrayBound (C++) Out-of-bound dynamic array access. Note: possibly an enhancement to alpha.security.ArrayBoundV2. |
    void test() {
      int *p = new int[1];
      int i = 1;
      if(p[i]) {}; // warn
      delete[] p;
    }
different.StrcpyInputSize (C) Buffer copy without checking the size of input. Note: possibly an enhancement to alpha.unix.cstring.OutOfBounds. |
    void test(char* string) {
      char buf[24];
      strcpy(buf, string); // warn
    }
different.IntegerOverflow (C) Integer overflow. Note: partially handled by Clang core (search for 'overflow in expression' warning in Clang tests). Source: CWE-190. |
    #include <limits.h>

    int f(int x);

    void test() {
      f(INT_MAX + 1); // warn
    }
    #include <limits.h>

    int test() {
      int x = INT_MAX / 2 + 1;
      return x * 2; // warn
    }
different.SignExtension (C) Unexpected sign extension might take place. Source: CWE-194. |
    unsigned long long test(long long sll) {
      unsigned long long ull = sll; // warn
      return ull;
    }
    void f(unsigned int i);

    void test(int si) {
      f(si); // warn
    }
    unsigned int test(int i) {
      return i;
    }
different.NumericTruncation (C) Numeric truncation might take place. Source: CWE-197. |
    unsigned long test(unsigned long long ull) {
      unsigned long ul = ull; // warn
      return ul;
    }
    void f(int i);

    void test(long long sll) {
      f(sll); // warn
    }
    int f();

    short test(long long sll) {
      short ss = f();
      return ss;
    }
different.MissingCopyCtorAssignOp (C++) A class has dynamically allocated data members but do not define a copy constructor/assignment operator. Source: Scott Meyers "Effective C++", item 11: Prevent exceptions from leaving destructors. |
    class C {
      int *p; // warn
    public:
      C() { p = new int; }
      ~C() { delete p; }
    };

### WinAPI

Name, Description | Example | Progress
WinAPI.CreateProcess (C) `CreateProcess()`: if the first parameter `lpApplicationName` is NULL then the executable name must be in the white space-delimited string pointed to by `lpCommandLine`. If the executable or path name has a space in it, there is a risk that a different executable could be run because of the way the function parses spaces.

Source: MSDN: CreateProcess function, Security Remarks.

    #include <windows.h>

    void test() {
      STARTUPINFO si;
      PROCESS_INFORMATION pi;
      CreateProcess(NULL, TEXT("C:\\Program Files\\App -L -S"),
                    NULL, NULL, TRUE, 0, NULL, NULL, &si, &pi);
        // warn
    }

WinAPI.LoadLibrary (C) The `SearchPath()` function is used to retrieve a path to a DLL for a subsequent `LoadLibrary()` call. Source: MSDN: LoadLibrary function, Security Remarks. |
    #include <windows.h>

    HINSTANCE test() {
      char filePath[100];
      SearchPath(NULL, "file.dll", NULL, 100, filePath, NULL);
      return LoadLibrary(filePath); // warn
    }
WinAPI.WideCharToMultiByte (C) Buffer overrun while calling `WideCharToMultiByte()`. The size of the input buffer equals the number of characters in the Unicode string, while the size of the output buffer equals the number of bytes. Source: MSDN: WideCharToMultiByte function. |
    #include <windows.h>

    void test() {
      wchar_t ws[] = L"abc";
      char s[3];
      WideCharToMultiByte(CP_UTF8, 0, ws, -1, s,
                          3, NULL, NULL); // warn
    }

### optimization

Name, Description | Example | Progress
optimization.PassConstObjByValue (C, C++) Optimization: It is more effective to pass constant parameter by reference to avoid unnecessary object copying. |
    struct A {};

    void f(const struct A a); // warn
optimization.PostfixIncIter (C++) Optimization: It is more effective to use prefix increment operator with iterator. Source: Scott Meyers "More Effective C++", item 6: Distinguish between prefix and postfix forms of increment and decrement operators. |
    #include <vector>

    void test() {
      std::vector<int> v;
      std::vector<int>::const_iterator it;
      for(it = v.begin();
          it != v.end(); it++) {}; // warn
    }
optimization.MultipleCallsStrlen (C) Optimization: multiple calls to `strlen()` for a string in an expression. It is more effective to hold a value returned from `strlen()` in a temporary variable. |
    #include <string.h>

    void test(const char* s) {
      if (strlen(s) > 0 &&
          strlen(s) < 7) {}; // warn
    }
optimization.StrLengthCalculation (C++) Optimization: it is more efficient to use `string::length()` to calculate the length of an `std::string`. |
    #include <string>
    #include <string.h>

    void test() {
      std::string s;
      if (strlen(s.c_str()) != 0) {}; // warn
    }
optimization.EmptyContainerDetect (C++) Optimization: It is more efficient to use containers `empty()` method to identify an empty container. |
    #include <list>

    void test() {
      std::list<int> l;
      if (l.size() != 0) {}; // warn
    }