CppCast - Cppcheck

Episode Date: November 16, 2016

Rob and Jason are joined by Daniel Marjamäki to talk about developing the CppCheck static analysis tool. Daniel lives in Stockholm, Sweden with his wife and son. He has a degree in electronics but has never worked as an electronics engineer. Daniel works as a consultant at Evidente in Sweden which provides consultants and contractors for embedded software development and static analysis. Daniel started Cppcheck almost 10 years ago as a hobby project that he works on in his spare time. Daniel sometimes works on other hobby projects such as an open source retro mobile phone with a rotary dial plate instead of buttons or a screen. News Hacker-Proof Code Confirmed Cheatsheet of modern C++ language and library features Compiler Explorer Beta now with early support for MSVC WebAssembly Browser Preview Trip report: Fall ISO C++ standards meeting Daniel Marjamäki Daniel Marjamäki on GitHub Links Cppcheck Sponsor Backtrace

This episode of CppCast is sponsored by Backtrace, the turnkey debugging platform that helps you spend less time debugging and more time building. Get to the root cause quickly with detailed information at your fingertips. Start your free trial at backtrace.io slash cppcast. And by Meeting C++, the leading European C++ event for everyone in the programming community. Meeting C++ offers five tracks with seven sessions and two great keynotes. This year, the conference is on the 18th and 19th of November in Berlin. Episode 79 of CppCast with guest Danielle Mariamachi recorded November 16th, 2016. In this episode, we discuss updates from the

ISAQUA ISO C++ meeting. Then we talk to Daniel Mariomaki. Daniel talks to us about the CPP Check St C++ developers. I'm your host, Rob Irving, joined by my co-host, Jason Turner. Jason, how are you doing today? Good, Rob. You have fun at the MVP Summit? I did. There should be a lot of big announcements coming out today,

which maybe we can talk on about next episode. Cool. Coming from the Visual Studio Connect event in New York. And they'll probably release some of the things that I heard about last week. Which is going on while we're recording this. Right now, right? Yeah, it's going on right now. New Visual Studio announcements. Some announcements probably pertaining to C++ developers. Yep.

Cool. Very cool. Well, at the top of every episode, I'd like to read a piece of feedback. This week, James writes in saying, I've recently been reading about formal verification of code. For example, see this article. And there's a link to Quanta magazine. I'll make sure to put this article

in the show notes. Then I started looking for formal verification articles relating specifically to C++. I found blog author David Crocker, who might make a good guess since this topic has not yet been covered on the show. Keep up the great work. So I'm not too familiar with formal verification of code. How about you, Jason? I am not. It's like words that I've heard before, but I've never put into practice. Yeah, I looked a little bit at that first article, and it's basically

guaranteeing code execution. It's going to do exactly what you expect it to. So, definitely sounds like an interesting topic, right? Yeah, it does. If we could get someone to talk about that, it'd be cool. You'll have to look into David Crocker. So we'd love to hear your thoughts about the show. You can always reach out to us on Facebook, Twitter, or email us at feedback at cpcast.com.

And don't forget to leave us a review on iTunes. Joining us today is Daniel Mariamaki. Daniel lives in Stockholm, Sweden with his wife and son. He has a degree in electronics but has never worked as an electronics engineer. Daniel works as a consultant at Evidente in Sweden, which provides consultants and contractors for embedded software development and static analysis. Daniel started CPP Check almost 10 years ago as a hobby project that he works on in his spare time. Daniel sometimes works on other hobby projects such as an open source retro mobile phone

with a rotary dial plate instead of buttons or a screen. Daniel, welcome to the show. Thank you very much. Nice to be here. Thanks for joining us, but you're gonna have to give us some details on this retro open source mobile phone project. Yes, the mobile phone, I wanted to make a simple mobile phone from scratch. I didn't do all programming for G SMS and so on. And it had an AT command interface, so I could communicate with the ship with serial communication. So I plugged that into a microcontroller,

and from that I sent commands to call and to hang up and to hang up and so on. And then I attached a rotary dial to it and my microcontroller checked what the user input. It was a simple potentiometer. Don't know how that is pronounced. Sorry. Potentiometer. Yeah.

Yeah. So it could read where the location is. You didn't get the motion as old rotary dial. You had to force it forward and backward. Oh, okay. So when somebody called, then I had attached a buzzer. So it would beep, beep, beep, beep. And then you move the rotary dial all the way forward and backward a few times. And then it och bakåt några gånger. Och sen skulle det ta en kall och sen kunde man prata. Och jag måste säga

att audiotekniken var mycket bättre än jag hade förväntat mig. Och sen när man var slut med att prata så kunde man vända rotatorn hela vägen bakåt och framåt några gånger. Och det skulle hänga upp.

Så, det fungerade, men det var inte rocksolid. a few times and it would hang up so well it worked but it was not rock solid it maybe was it connected to the gsm network and then maybe five ten ten minutes later it stopped working i think the antenna was not very well mounted so there was a gap somewhere there. That's really a lot of fun. But I've got to ask Rob now. Did you completely skip the BBS era and having to use modems, Rob? No, I had to use modems.

Okay. Have you ever had to use a rotary phone? I think so. I think we probably had one growing up. Yeah. This makes me think it'd be kind of cool to combine the rotary phone with a touchscreen phone it'd look kind of steam punky that sort of thing yes yeah that's awesome very cool well uh we're gonna go through a couple news articles daniel and then we'll start talking to you about CppCheck, okay?

Yes. Okay. So this first one is pretty cool. It's a cheat sheet of modern C++ language and library features. And it just lists everything from C++ 11, 14, and 17 features and has a link to where you can get a brief explanation of the feature and a nice succinct code block explaining how the feature can be used yeah it looks pretty darn complete yeah it's extremely complete um and i must say for me that will be very interesting to read later i uh i am not very good at latest c++, so I can learn a lot there.

Yes. Yeah, it's definitely a good entry point if you want to get up to speed with the new language or just want a refresher in something. This next one, Jason, we're talking about Compiler Explorer yet again. Yes. They are now, or MacGobble is now supporting Visual C++. Yes. c++ yes well mostly the command line cl.exe i mean not right let's be clear it's not all a visual studio or something like that yeah but it's that's fun another tool to play with yeah um i actually was thinking about this at the Microsoft Summit last week,

and I actually reached out to Matt to ask, have you thought about working with Visual C++? I'm here at the Summit. Maybe I could ask someone for help. And he replied to me that Herb Sutter and Andrew Porto were already helping him out, so he was on top of it. Yeah, so just if any of our listeners go to play with it, there's a minor kind of nitpicky thing in that the way the CL toolchain works, you're not getting unused symbols stripped.

So if you play with some complex code snippet, you're going to see a bunch of extra code in there that's it's dead code so you actually like need to scroll down to the main and see what it's actually doing just as an fyi because on the surface of it you can do a comparison and be like what the heck visual studio does a hundred times more work but it's no just because the other compilers strip out like the lambdas and stuff that have been in uh in lined okay okay uh next we have uh we have two things there's an article there's a reddit live stream about the 2016 issaquah isoc plus plus committee meeting which is probably pretty interesting to read if you were uh paying attention to it uh last week but it's a little hard to look through this and figure out exactly what they achieved.

But luckily, just this morning, or was this last night, Herb Sutter came out with a trip report for the ISO C++ meeting. So Rob, I saw that the MVPs did a field trip to the ISAQUA meeting. Did you go? I did not make it. I had stuff already on my schedule and I saw the same thing that some people were going on Thursday and I didn't have a chance to make it over there, unfortunately. Yeah, I really wanted to. I was actually thinking about going later in the day and I actually reached out to Eric Kneebler to see if the meetings were still going on, but I would have gotten there with like a half hour left and it didn't seem worthwhile all right it's unfortunate yeah another time another time um but what else what really happened in this uh meeting it looks like they're getting close to finalizing c++ 17 and a lot of ts's are uh are becoming official and done right there uh it looks that way i think the thing that stood out to me the most from my own personal interest because we've heard a lot about networking and modules and co-routines and whatever but the reflection study group is what does it say has the reviewed the

latest merged static reflection proposal so it looks like we might start to get somewhere with reflection very cool and it says here that there will be a march meeting and they expect c++ 17 to be finalized there right okay okay well daniel let's start talking about cpp check can you give us an intro to what CppCheck is? Yes, it's a simple static analysis tool for C and C++ code. I designed it with the hope to achieve no false positives, but that is really not happening. And I designed it to be very simple to use

so you can just point out the folder and start checking code in that folder. I wanted it to be able to check all code even if there are various compiler extensions and so on.

It doesn't have to be compilable by GCC or Clang. You can still check it with CBP Check. So maybe just to give our listeners an overview, what kinds of things does CBP Check or static analysis tools look for? I focus on severe bugs, really, like undefined behavior. And I try not to check for possible bugs. That is, for instance, if you pass a null pointer to a function, then that function might dereference it and there might be a null pointer dereference.

But instead, I look very carefully en nulpunkt i referensen. Men i stället tittar jag väldigt försiktigt om funktionen referensar den. Så det är för att undvika falska positiva, falska förvånningar. Och jag vill se till stränga koder som är fel också.

Men stränga koder, är det av mistake or is it by design or by intention? That is hard for a tool to say. So mostly if there is strange code, then CppCheck will not warn. Och målet är att normalt, välskrivet kod inte skriver några förvånningar. Så du behöver inte göra tweaker som assertioner eller annoteringar och så vidare. Cpp-check gör säkra förutsättningar om funktioner. Men om du gör annoteringar så kan du undvika några falska negativ. functions. But if you make annotations then you can avoid some false negatives. That is, CppCheck will

detect more errors. So you said in your bio that CppCheck started about 10 years ago as a hobby project. Do you want to give us a little more details on what motivated you to start a new Stalk Analysis tool? Well, I think

it's a quite funny story, actually. In 2007, I had a long way to work. And I went to work by train. So every day I sat four hours on the train. Oh, wow. I brought my computer with me to have something to do. And I wrote some small scripts and programs. And then one day I had an idea to write a tool that would find some bugs in my code.

I thought that my code had many bugs and it would be very easy to find it. Min kod hade många buggar och det skulle vara väldigt lätt att hitta den. I min erfarenhet, när jag har gjort många hobbyprojekt innan, i min erfarenhet skulle jag arbeta hårt i ungefär två veckor och sen förlora intresset. Och sen kan jag inte arbeta mer om jag förlorar intresset. and then I would lose interest. And then I can't work more if I lose interest. So I made a deadline. In two weeks I will finish this tool. So four hours a day I will work. That makes about 40 hours. So I had to make a very simple design for that first CPP check.

And after roughly two weeks I had a useful tool Så jag fick göra ett väldigt enkelt design för det första CppCheck. Och efter ungefär två veckor hade jag en användbar tool som faktiskt hittade några buggar i min kod. Så, oerhört så var det fortfarande kul att utveckla CppCheck och jag ville hitta fler buggar. Så jag stoppade att arbeta med CppCheck. Om jag inte trodde att det var kul så hade jag stoppat där. working on cpp check if i hadn't thought it was fun then i would have stopped there now it has grown very much and it's totally unexpected unexpected i would not have thought about this from the start so after a few years i moved closer to work so I have less travel time now and that means less time to develop cpp check I still work actively on it in your bio you say that you work for a company that does consulting and contracting with embedded tool software development and static analysis so I was curious if if your company uses CPP check or how that relates

to your day job at all. At first when I got this job it was purely as an embedded systems programmer so static analysis was not interesting. But in recent years I have worked with static analysis Men i de senaste åren har jag jobbat med statisk analys för kunder. Och för att svara på ditt fråga, Evidenti använder CppCheck lite. I olika kunderprojekt kan vi använda det för att se om det finns fel. Men det är oftast gjort som en fin favorit. various customer projects, we can use it to check if there are errors, but it's mostly done as a nice favor. Okay. So where do you see CPP Check in the ecosystem of other analysis tools

like Clang Tidy, the built-in analyzer in Visual C++, PVS Studio? Well, I think you should use as many tools as possible for static analysis. I know many agree, but I've seen some companies that only want to use one tool. That is very unfortunate. I think that CPP Check is a complement mostly. If you write a tool, Jag tror att CppCheck är en komplement. Om man skriver ett verktyg kan man ändå försöka skriva alla funktioner som kan vara intressanta eller skriva några funktioner och fokusera på dem. CppCheck är mer som att fokusera på några funktioner.

Det betyder att det finns många intressanta funktioner som inte finns där. I focus on some features And that means There are many interesting features That is not there By design Stylistic Checks are not It's not a good place To put in CPP check So if you want

Stylistic checks then you should Use other tools For instance Clang Tidy I think Via a code And if you want coding standards så ska man använda andra verktyg. Till exempel Clang Tidy, jag tror. Via Code. Och om man vill ha kodingsstandard så finns det också många olika verktyg. Men CppCheck har inte så mycket av det. Jag vet inte...

Jag kan inte jämföra CppCheck med andra analyser. Jag har bara använt två analyser. compare cpp check well against other analyzers i have only used two analyzers a lot and most i don't know okay i wanted to interrupt this discussion for just a moment to bring you a word from our sponsors backtrace is a debugging platform that improves software quality reliability and support by bringing deep introspection and automation throughout the software error lifecycle. Spend less time debugging and reduce your mean time to resolution by using the first and only platform to combine symbolic debugging, error aggregation, and state analysis. At the time of error, Bactrace jumps

into action, capturing detailed dumps of application and environmental state. Bactrace then performs automated analysis on process memory and executable code to classify errors and highlight important Thank you. Join industry leaders like Fastly, Message Systems, and AppNexus that use Backtrace to modernize their debugging infrastructure. It's free to try, minutes to set up, fully featured with no commitment necessary. Check them out at backtrace.io.cppcast. I just looked at Git and CppCheck has 131 contributors and over 15,000 commits. So what's it like managing a project like this and handling these contributions? I think that I am clearly motivated

when people use CppCheck and when they contribute. So it's nice. Project management itself is not fun. But I try to avoid blocking people. So it's better that I am blocked than that contributors are blocked. They say that there are different types of open source projects. There are Bazaar and cathedral. And I think overall cathedral is a bit better.

I tried to run CPP-check. There should be good goals in CPP-check and other open source projects. So mismatching suggestions that doesn't match the file philosophy, they should be rejected as soon as quickly as possible. And I don't think I am not like a super pope in CPP Check, but I really listen to what others say and so on but there are there is a goals that we have to follow okay how easy is it to to add a new static analysis check to cpp check if you want to contribute to the repository we have a list with simple suggestions that I think are very nice for new submitters.

But in general, if you want to do some simple matching in the AST, then it's very simple to write a check. And if you need some value flow analysis and you want to combine that with AST checking then it's still very simple. CPP check

has a built in value flow that is context sensitive and it provides some values. But if the value flow is not enough, if you want to extend it, or if you want to write your special handling, then it's not very simple. So that's interesting. You actually build an AST as you parse the C++? Yes. Okay.

I didn't do that from the start, but in the last, I'd say, four years, perhaps. In the beginning, it was just based on the operator precedence and didn't say anything about types and so on. But since about one or two years we have type information also. But still, CPP-check is designed to be simple to use. And there's not always all headers available. So all types are not available. So the AST doesn't always have all the information that you have in Clang or

GCC. So C++ is kind of notoriously difficult to parse. Are you able to handle everything that modern C++ can do? Unfortunately not. I think templates, for instance, is very hard when you don't know if X is a type or if it's a variable. And you pass it as an argument to a template and you don't even see the template perhaps. So yes, it's very hard. I make some assumptions that code is well written and so on. But I think it works quite good. Yes. What is one of your favorite checks that CPVCheck makes?

When I check a project, I always look for errors first. That is the best things that are found. But some other checks have found very nice subtle bugs. For example, mutually exclusive comparisons. If you have a if and then in it there are many comparisons, then CppCheck will look at the comparisons. And if they are mutually exclusive and so on, then CppCheck will warn. And usually that will turn up very nice bugs. It means that it's a useless condition or it will always be true or something. I have to say, I'm a fan of CPP check

and I'm a fan of using tools. Like you said, you may as well use as many tools as you can. And I'd just like to say my favorite personal check is that CPP check has found duplicate branches and if statements. And I'm like, oh my goodness, you're right. Why am I returning the same value from both branches? I have no idea how the code got this way in the first place.

Nice to hear, yeah. That can also cause some false positives I have seen. For instance, if you have not completed the code properly, then you think you return true in one branch and then you intend to write some condition in the next but you for the moment you return true there

also but yes in my case it was an if statement that should just simply have been removed yeah okay is cpp check an if statement that should just simply have been removed. Yeah, okay. Is CppCheck written in C++? And do you run CppCheck through CppCheck?

Yes, it's written in C++. I want it to be compatible with old compilers. There are some users that use, I know, at least GCC 4.4. So I can't move on to C++ 11 unless I want to upset users. So therefore it's C++ 03 mostly. I run CppCheck on cppcheck a lot. It's done every commit. It found some nice bugs.

For instance, it has crashed when it checks itself. And I have seen null pointer dereferences, and I've seen the same conditions on both sides of operators. Jag har sett no-pointer-referenser och jag har sett samma förhållanden på båda sidorna av operatörerna. Jag har sett redundant förhållanden, jag har sett för inte några bugar just nu så det finns många falska negativ. Men jag tror att det finns många bugar som är utan skåp. Vi kan uttrycka några bugar med falsk testning och med att CPP-check garbage code and so on, it's very hard to find such bugs automatically

and CPP-check, we don't only run CPP-check on CPP-check we also run CPP-check on all Debian source code, I think it's about 100 gigabytes of source code, So that is a good place to find hangs and crashes.

That's very good. There are real code and we should not hang or crash on that, really. Interesting. So what's your... Since you've written these checks, is there

any feature of C++ that you just wish would go away because it causes too much problems for you? No, I think C++ has good features, actually. I want code to be well written and easy to understand, and then it will be easy to check it. And with C++, all the new features, it will be more expressive. And right now, CppCheck doesn't handle all new features. But in time, when we add knowledge, it will make checking better. So it's mostly a technical problem for me, but I like it. But of course all C++ features can be misused and mislead C++.

I have seen for instance overloaded operators that are not consistent with standard behavior. For instance if you overload a plus, then CppCheck will assume that there is some kind of addition. If you don't have an addition, then it's strange. Go ahead, Jason. I don't know what I was going to ask. Okay. Do you have a roadmap of new features

that you plan to work on for ZPP Check? ZPP Check is a hobby project, so we don't have a roadmap or plan, really. But I, of course, have ideas. People will work on things that they want to implement. So I don't know and can't tell people to work on specific things. But I think that better support for C++ and latest features are very important.

People will start to use all those features very soon and have started. I think that one approach that I have an idea about is to make it possibleortera Clang AST till CppCheck-analys. Det blir en ganska stor jobb, men jag tror att det blir mycket bättre att göra CppCheck. Om du som användare har ett projekt som kan kompileras med klang, så det skulle vara en bra

option. Och jag tror att vi behöver mycket bättre och bättre semantisk visshet om olika algoritmer och funktioner som finns tillgängliga i C++. Vi behöver träff track containers, etc. much better. So there is a huge potential for improvements in CppCheck. So you said you would like to import the AST from Clang. Are you imagining they would compile with Clang and have Clang dump the AST, then you would read that back in? Or would you work like a libclang kind of thing? Actually, right now I think more like they

will compile with Clang and dump AST. And then we will read that. I knew that was possible I've never tried that. Yeah, if I would use the libclang as far as I know, then it will be a pretty big dependency.

And I don't want to have any C++11 and so on in my code. So I don't want to reuse their headers and so on. Okay. What platforms does CppCheck run on? Since it's C++03, I know it has been run on many platforms. For instance, old, what's it called? IBM OS 2.

And Linux, of course. Windows CE. Windows 3.1 i heard a few years ago not sure if that works anymore that's cool yeah i'm looking at the the website right now and it's nice how you have a lot of plugins uh you can get a cpp check plugin for sea lion visual studio a cute creator and also some of the popular source control like getting svn plugins yes i highly appreciate that it's done by third-party engineers who needed to have the plugins. I really think that's nice. You made an interesting point a few minutes ago. I had been noticing personally recently that simpler code that's easier to read

is also easier on the optimizer. It seems that it compiles to faster code. I never considered that I could be helping my static analyzer also by making good, clean to faster code. I never considered that I could be helping my static analyzer also by making good, clean, readable code. Yes, that is true. I actually thought in the start that some of my colleagues was writing so bad and ugly code, so I would find much bug there. But that code was harder to parse and read so i found less bugs there interesting and i don't write many stylistic warnings so such code just pass through okay well where can people

go to uh keep an eye out for updates coming from you or maybe new updates coming from CppCheck? I would only recommend the SourceForge site has news. Every release I write the news there. So I would recommend that. I don't have a blog or Twitter and so on. That would be nice, but it takes time. It does take time. I would recommend that. I don't have a blog or Twitter and so on. That would be nice, but it takes time. It does take time.

Yeah. Okay, Jason, do you have any more questions? Well, I guess I was a little curious if you have a timeline for when you expect to start checking some of these new things like C++17, new constructs of like infinite expressions and whatever. I can't give a

timeline. My wildest guess right now is it will be at least a year. Before I... Okay. Well, thank you so much for your time today, Daniel. Thank you.

Thanks for joining us. Thank you. Yes, thanks for joining us. Thank you. Thanks so much for listening in as we chat about C++. I'd love to hear what you think of the podcast. Please let me know if we're discussing the stuff you're interested in. Or if you have a suggestion for a topic, I'd love to hear about that too. You can email all your thoughts to feedback at cppcast.com. I'd also appreciate if you like CppCast on Facebook and follow CppCast on Twitter.

You can also follow me at Rob W. Irving and Jason at Leftkiss on Twitter. And of course, you can find all that info and the show notes on the podcast website at cppcast.com. Theme music for this episode is provided by podcastthemes.com.