Re: [RFC/PATCH] Makefile: add cppcheck target

From: Jeff King <peff@peff.net>
Date: Dec 13, 2016, 12:15 UTC
Message-ID: <20161213121510.5o5axuwzztbxcvfd@sigill.intra.peff.net>
In-Reply-To: <20161213092225.15299-1-judge.packham@gmail.com>

On Tue, Dec 13, 2016 at 10:22:25PM +1300, Chris Packham wrote:

Show 17 quoted lines

> $ make cppcheck
> cppcheck --force --quiet --inline-suppr  .
> [compat/nedmalloc/malloc.c.h:4093]: (error) Possible null pointer dereference: sp
> [compat/nedmalloc/malloc.c.h:4106]: (error) Possible null pointer dereference: sp
> [compat/nedmalloc/nedmalloc.c:551]: (error) Expression '*(&p.mycache)=TlsAlloc(),TLS_OUT_OF_INDEXES==*(&p.mycache)' depends on order of evaluation of side effects
> [compat/regex/regcomp.c:3086]: (error) Memory leak: sbcset
> [compat/regex/regcomp.c:3634]: (error) Memory leak: sbcset
> [compat/regex/regcomp.c:3086]: (error) Memory leak: mbcset
> [compat/regex/regcomp.c:3634]: (error) Memory leak: mbcset
> [compat/regex/regcomp.c:2802]: (error) Uninitialized variable: table_size
> [compat/regex/regcomp.c:2805]: (error) Uninitialized variable: table_size
> [compat/regex/regcomp.c:532]: (error) Memory leak: fastmap
> [t/t4051/appended1.c:3]: (error) Invalid number of character '{' when these macros are defined: ''.
> [t/t4051/appended2.c:35]: (error) Invalid number of character '{' when these macros are defined: ''.
> 
> The last 2 are just false positives from test data. I haven't looked
> into any of the others.

I think these last two are a good sign that we need to be feeding the list of source files to cppcheck. I tried your patch and it also started looking in t/perf/build, which are old versions of git built to serve the performance-testing suite.

See the way that the "tags" target is handled for a possible approach.

My main complaint with any static checker is how we can handle false positives. I think our use of "-Wall -Werror" is successful because it's not too hard to keep the normal state to zero warnings. Looking at the output of cppcheck on my system (which is different than on yours!), I do see a few real problems, but many false positives, too. Unfortunately, one of the false positives is:

  int foo = foo;

to silence -Wuninitialized, which causes cppcheck to complain that "foo" is uninitialized. I'm worried we will end up with two static checkers fighting each other, and no good way to please both.

-Peff