Many C\/C++\u00a0static analysis tools exist right there, each one focus on a specific area and has its advantages, we can enumerate:<\/p>\n
- \n
- CppCheck\u00a0<\/strong><\/li>\n
- Clang Analyzer<\/strong><\/li>\n
- Visual C++ Analyzer<\/strong><\/li>\n
- VERA++<\/strong><\/li>\n
- Goanna<\/strong><\/li>\n
- Viva64<\/strong><\/li>\n
- PCLint<\/strong><\/li>\n<\/ul>\n
Many ways exist to explore the results of these tools:<\/p>\n
- \n
- XML format<\/b>: XML files could be generated from each of these tools, and it can be used to create an HTML report or used by another tool to explore the analysis result.<\/li>\n
- HTML format<\/b>: HTML report is the prefered way to generate reports and share them between the team, and you can create your custom report by using an xsl stylesheet.<\/li>\n
- IDE Plugins<\/b>: almost all known IDE provides plugins for these tools, which gives the possibility to discover all violations from the source code.<\/li>\n<\/ul>\n
One of the problems with code quality tools is that they tend to overwhelm developers with problems that aren\u2019t really problems \u2014 that is, false positives. When false positives occur, developers learn to ignore the output of the tool or abandon it altogether.<\/p>\n
To explore better their result, it\u2019s interesting\u00a0to have a way to focus only on what we want and gives to developers a useful view.<\/p>\n
CppDepend\u00a0and CQLinq<\/h2>\n
CppDepend<\/a>\u00a0is another static analysis tool which complements the other ones, it uses a code query langage based on Linq ( CQLinq) to query the code base like a database.<\/p>\n
CppDepend embedd by default cppcheck, Vera++ and clang analyzer and It could be easily extensible to support other static analysis tools using its API. The visual Studio Analyzer plugin code source is available to show how to\u00a0integrate other tools.<\/p>\n
Let\u2019s take as example the source code of Clang\u00a0and discover how we can explore the analysis result of these tools from CppDepend.<\/p>\n
Get all issues:<\/strong><\/p>\n
The request to get all issues is very simple. However, as you can see it\u2019s not very interesting, indeed it\u2019s a challenge to treat\u00a0a result with 331\u00a0417 issues.<\/p>\n
![\"static1\"](\"http:\/\/www.codergears.com\/Blog\/wp-content\/uploads\/static1.png\")
<\/a><\/p>\nTo treat\u00a0better the result of these tools we can filter it \u00a0and focus only on what we want.<\/p>\n
Request by tool<\/h3>\n
We can modify the first request and add a criteria about the tool concerned.<\/p>\n
![\"static2\"](\"http:\/\/www.codergears.com\/Blog\/wp-content\/uploads\/static2.png\")
<\/a><\/p>\n<\/h3>\n
Most recurrent issues<\/h3>\n
It\u2019s interesting to know which issues are the most reported by these tools.<\/p>\n
![\"static3\"](\"http:\/\/www.codergears.com\/Blog\/wp-content\/uploads\/static3.png\")
<\/a>The most reccurent ones concern the style issues reported by Vera++, we can exclude them from the query if there are not relevant in your case.<\/p>\nClasses having most issues<\/h3>\n
It\u2019s very interesting to know the classes which contains many violations<\/p>\n
![\"static4\"](\"http:\/\/www.codergears.com\/Blog\/wp-content\/uploads\/static4.png\")
<\/a><\/p>\nThe previous query is interesting, but it\u2019s not give us exactly the classes with lack of quality, another useful metric to take into account is the NBLinesOfCode. We can modify the previous request and\u00a0calculate the ratio between the Issues count and the NBLinesofCode.<\/p>\n
![\"static5\"](\"http:\/\/www.codergears.com\/Blog\/wp-content\/uploads\/static5.png\")
<\/a><\/p>\nMost popular methods having issues<\/h3>\n
When the static analysis tools report the issues, it\u2019s useful to locate which the prioritary issues to resolve? specially if it concerns bugs.
\nA bug could exist in a specific method, but what interesting to know is how many methods are impacted by the bug. The popular methods are the most used ones and it\u2019s better to resolve them quickly.<\/p>\n![\"static6\"](\"http:\/\/www.codergears.com\/Blog\/wp-content\/uploads\/static6.png\")
<\/a><\/p>\nUsing CQLinq we can combine the result of all these tools and also the result of CppDepend\u00a0to create more elaborated queries, and add these checks to the build process.<\/p>\n
Issues Trend<\/h2>\n
Having issues in a project is not an exception; any project could have many problems to resolve. However, we have to check the quality trend of the project. Indeed it\u2019s a bad indicator if the number of issues grows after changes and evolutions. CppDepend\u00a0provides the Trend Monitoring feature to create trend charts.<\/p>\n
Trend charts are made of trend metrics values logged over time at analysis time. More than 50 trend metrics are available per default and it is easy to create your own trend metrics.<\/p>\n
With this trend chart we can monitor the evolution of the Cppcheck issues:<\/p>\n
![\"cppcheck7\"](\"http:\/\/www.codergears.com\/Blog\/wp-content\/uploads\/cppcheck7.png\")
<\/a><\/p>\nIntegrate static analysis tools result into the HTML report<\/h2>\n
CppDepend\u00a0makes possible appending extra report sections in the HTML report that lists some CQLinq queries.<\/span>
In the CQLinq Query Explorer panel, a particular CQLinq reported group \u00a0is bordered with an orange rectangle.<\/span><\/p>\n![\"cppcheck10\"](\"http:\/\/www.codergears.com\/Blog\/wp-content\/uploads\/cppcheck10.png\")
<\/a><\/p>\nAnd in the HTML report these added sections are accessible from the menu:<\/p>\n
![\"cppcheck11\"](\"http:\/\/www.codergears.com\/Blog\/wp-content\/uploads\/cppcheck11.png\")
<\/a><\/p>\nIntegrate static analysis tools result\u00a0into the build process<\/h2>\n
CppDepend comes with the notion of\u00a0Critical CQLinq Rule<\/span>. Critical rules represent a mean to define high priority rules that must never be violated. With critical rules, it is possible to break the Build Process when a critical rule violation occurs.<\/p>\n
A critical rule is just a CQLinq rule with the flag\u00a0Critical Rule<\/i>\u00a0checked:<\/p>\n
![\"\"](\"http:\/\/cppdepend.com\/Doc\/CI_CriticalRule\/CriticalRuleDef.png\")
\nAt Build Process time, when a critical rule is violated the process\u00a0CppDepend.Console.exe<\/a>\u00a0returns a non-zero exit code.\u00a0This behavior can be used to break the Build Process if a critical rule is violated.
\n<\/span><\/span><\/p>\nWe can easily define a cppcheck critical rule to break the build if \u00a0kinds of cppcheck issues are found.<\/p>\n
Conclusion<\/strong><\/p>\n
CppDepend\u00a0is open to other static analysis tools, and you can also plug your customized tool easily . This way you can use all the CppDepend\u00a0features to explore\u00a0better the result from the known java static analysis tools.<\/p>\n","protected":false},"excerpt":{"rendered":"
Static code analysis is the process of detecting flaws in software\u2019s source code. \u00a0The static analysis tools are useful to detect common coding mistakes; here are some benefits from using them: Make the code source more readable and maintainable. Prevent unexpected behavior in execution. Optimize the execution. Make the code more secure. Many C\/C++\u00a0static analysis … Continue reading “Make the most of the C\/C++ static analysis tools”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[7,3,9],"class_list":["post-9","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-c","tag-cplusplus","tag-static-analysis-tool"],"_links":{"self":[{"href":"https:\/\/cppdepend.com\/blog\/wp-json\/wp\/v2\/posts\/9","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cppdepend.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cppdepend.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cppdepend.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cppdepend.com\/blog\/wp-json\/wp\/v2\/comments?post=9"}],"version-history":[{"count":1,"href":"https:\/\/cppdepend.com\/blog\/wp-json\/wp\/v2\/posts\/9\/revisions"}],"predecessor-version":[{"id":10,"href":"https:\/\/cppdepend.com\/blog\/wp-json\/wp\/v2\/posts\/9\/revisions\/10"}],"wp:attachment":[{"href":"https:\/\/cppdepend.com\/blog\/wp-json\/wp\/v2\/media?parent=9"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cppdepend.com\/blog\/wp-json\/wp\/v2\/categories?post=9"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cppdepend.com\/blog\/wp-json\/wp\/v2\/tags?post=9"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- HTML format<\/b>: HTML report is the prefered way to generate reports and share them between the team, and you can create your custom report by using an xsl stylesheet.<\/li>\n
- Clang Analyzer<\/strong><\/li>\n