cppcheck
cppcheck documentation
- Version in MegaLinter: 2.14.2
- Visit Official Web Site
- See Index of problems detected by cppcheck
Configuration in MegaLinter
- Enable cppcheck by adding
C_CPPCHECKin ENABLE_LINTERS variable - Disable cppcheck by adding
C_CPPCHECKin DISABLE_LINTERS variable
| Variable | Description | Default value |
|---|---|---|
| C_CPPCHECK_ARGUMENTS | User custom arguments to add in linter CLI call Ex: -s --foo "bar" |
|
| C_CPPCHECK_COMMAND_REMOVE_ARGUMENTS | User custom arguments to remove from command line before calling the linter Ex: -s --foo "bar" |
|
| C_CPPCHECK_FILTER_REGEX_INCLUDE | Custom regex including filter Ex: (src\|lib) |
Include every file |
| C_CPPCHECK_FILTER_REGEX_EXCLUDE | Custom regex excluding filter Ex: (test\|examples) |
Exclude no file |
| C_CPPCHECK_CLI_LINT_MODE | Override default CLI lint mode - file: Calls the linter for each file- project: Call the linter from the root of the project |
file |
| C_CPPCHECK_FILE_EXTENSIONS | Allowed file extensions. "*" matches any extension, "" matches empty extension. Empty list excludes all filesEx: [".py", ""] |
[".c", ".h"] |
| C_CPPCHECK_FILE_NAMES_REGEX | File name regex filters. Regular expression list for filtering files by their base names using regex full match. Empty list includes all files Ex: ["Dockerfile(-.+)?", "Jenkinsfile"] |
Include every file |
| C_CPPCHECK_PRE_COMMANDS | List of bash commands to run before the linter | None |
| C_CPPCHECK_POST_COMMANDS | List of bash commands to run after the linter | None |
| C_CPPCHECK_UNSECURED_ENV_VARIABLES | List of env variables explicitly not filtered before calling C_CPPCHECK and its pre/post commands | None |
| C_CPPCHECK_DISABLE_ERRORS | Run linter but consider errors as warnings | false |
| C_CPPCHECK_DISABLE_ERRORS_IF_LESS_THAN | Maximum number of errors allowed | 0 |
| C_CPPCHECK_CLI_EXECUTABLE | Override CLI executable | ['cppcheck'] |
MegaLinter Flavors
This linter is available in the following flavors
| Flavor | Description | Embedded linters | Info | |
|---|---|---|---|---|
 |
all | Default MegaLinter Flavor | 127 |   |
| c_cpp | Optimized for pure C/C++ projects | 56 |   |
|
| cupcake | MegaLinter for the most commonly used languages | 88 |   |
|
| dotnet | Optimized for C, C++, C# or VB based projects | 64 |   |
|
| dotnetweb | Optimized for C, C++, C# or VB based projects with JS/TS | 73 |   |
|
| python | Optimized for PYTHON based projects | 65 |   |
Behind the scenes
How are identified applicable files
- File extensions:
.c,.h
How the linting is performed
- cppcheck is called one time by identified file (
fileCLI lint mode)
Example calls
cppcheck myfile.cpp
Help content
Cppcheck - A tool for static C/C++ code analysis
Syntax:
cppcheck [OPTIONS] [files or paths]
If a directory is given instead of a filename, *.cpp, *.cxx, *.cc, *.c++, *.c, *.ipp,
*.ixx, *.tpp, and *.txx files are checked recursively from the given directory.
Options:
--addon=<addon>
Execute addon. i.e. --addon=misra. If options must be
provided a json configuration is needed.
--addon-python=<python interpreter>
You can specify the python interpreter either in the
addon json files or through this command line option.
If not present, Cppcheck will try "python3" first and
then "python".
--cppcheck-build-dir=<dir>
Cppcheck work folder. Advantages:
* whole program analysis
* faster analysis; Cppcheck will reuse the results if
the hash for a file is unchanged.
* some useful debug information, i.e. commands used to
execute clang/clang-tidy/addons.
--check-config Check cppcheck configuration. The normal code
analysis is disabled by this flag.
--check-level=<level>
Configure how much checking you want:
* normal: Cppcheck uses some compromises in the checking so
the checking will finish in reasonable time.
* exhaustive: deeper analysis that you choose when you can
wait.
The default choice is 'normal'.
--check-library Show information messages when library files have
incomplete info.
--checkers-report=<file>
Write a report of all the active checkers to the given file.
--clang=<path> Experimental: Use Clang parser instead of the builtin Cppcheck
parser. Takes the executable as optional parameter and
defaults to `clang`. Cppcheck will run the given Clang
executable, import the Clang AST and convert it into
Cppcheck data. After that the normal Cppcheck analysis is
used. You must have the executable in PATH if no path is
given.
--config-exclude=<dir>
Path (prefix) to be excluded from configuration
checking. Preprocessor configurations defined in
headers (but not sources) matching the prefix will not
be considered for evaluation.
--config-excludes-file=<file>
A file that contains a list of config-excludes
--disable=<id> Disable individual checks.
Please refer to the documentation of --enable=<id>
for further details.
--dump Dump xml data for each translation unit. The dump
files have the extension .dump and contain ast,
tokenlist, symboldatabase, valueflow.
-D<ID> Define preprocessor symbol. Unless --max-configs or
--force is used, Cppcheck will only check the given
configuration when -D is used.
Example: '-DDEBUG=1 -D__cplusplus'.
-E Print preprocessor output on stdout and don't do any
further processing.
--enable=<id> Enable additional checks. The available ids are:
* all
Enable all checks. It is recommended to only
use --enable=all when the whole program is
scanned, because this enables unusedFunction.
* warning
Enable warning messages
* style
Enable all coding style checks. All messages
with the severities 'style', 'warning',
'performance' and 'portability' are enabled.
* performance
Enable performance messages
* portability
Enable portability messages
* information
Enable information messages
* unusedFunction
Check for unused functions. It is recommended
to only enable this when the whole program is
scanned.
* missingInclude
Warn if there are missing includes.
Several ids can be given if you separate them with
commas. See also --std
--error-exitcode=<n> If errors are found, integer [n] is returned instead of
the default '0'. '1' is returned
if arguments are not valid or if no input files are
provided. Note that your operating system can modify
this value, e.g. '256' can become '0'.
--errorlist Print a list of all the error messages in XML format.
--exitcode-suppressions=<file>
Used when certain messages should be displayed but
should not cause a non-zero exitcode.
--file-filter=<str> Analyze only those files matching the given filter str
Can be used multiple times
Example: --file-filter=*bar.cpp analyzes only files
that end with bar.cpp.
--file-list=<file> Specify the files to check in a text file. Add one
filename per line. When file is '-,' the file list will
be read from standard input.
-f, --force Force checking of all configurations in files. If used
together with '--max-configs=', the last option is the
one that is effective.
--fsigned-char Treat char type as signed.
--funsigned-char Treat char type as unsigned.
-h, --help Print this help.
-I <dir> Give path to search for include files. Give several -I
parameters to give several paths. First given path is
searched for contained header files first. If paths are
relative to source files, this is not needed.
--includes-file=<file>
Specify directory paths to search for included header
files in a text file. Add one include path per line.
First given path is searched for contained header
files first. If paths are relative to source files,
this is not needed.
--include=<file>
Force inclusion of a file before the checked file.
-i <dir or file> Give a source file or source file directory to exclude
from the check. This applies only to source files so
header files included by source files are not matched.
Directory name is matched to all parts of the path.
--inconclusive Allow that Cppcheck reports even though the analysis is
inconclusive.
There are false positives with this option. Each result
must be carefully investigated before you know if it is
good or bad.
--inline-suppr Enable inline suppressions. Use them by placing one or
more comments, like: '// cppcheck-suppress warningId'
on the lines before the warning to suppress.
-j <jobs> Start <jobs> threads to do the checking simultaneously.
-l <load> Specifies that no new threads should be started if
there are other threads running and the load average is
at least <load>.
--language=<language>, -x <language>
Forces cppcheck to check all files as the given
language. Valid values are: c, c++
--library=<cfg> Load file <cfg> that contains information about types
and functions. With such information Cppcheck
understands your code better and therefore you
get better results. The std.cfg file that is
distributed with Cppcheck is loaded automatically.
For more information about library files, read the
manual.
--max-configs=<limit>
Maximum number of configurations to check in a file
before skipping it. Default is '12'. If used together
with '--force', the last option is the one that is
effective.
--max-ctu-depth=N Max depth in whole program analysis. The default value
is 2. A larger value will mean more errors can be found
but also means the analysis will be slower.
--output-file=<file> Write results to file, rather than standard error.
--platform=<type>, --platform=<file>
Specifies platform specific types and sizes. The
available builtin platforms are:
* unix32
32 bit unix variant
* unix64
64 bit unix variant
* win32A
32 bit Windows ASCII character encoding
* win32W
32 bit Windows UNICODE character encoding
* win64
64 bit Windows
* avr8
8 bit AVR microcontrollers
* elbrus-e1cp
Elbrus e1c+ architecture
* pic8
8 bit PIC microcontrollers
Baseline and mid-range architectures
* pic8-enhanced
8 bit PIC microcontrollers
Enhanced mid-range and high end (PIC18) architectures
* pic16
16 bit PIC microcontrollers
* mips32
32 bit MIPS microcontrollers
* native
Type sizes of host system are assumed, but no
further assumptions.
* unspecified
Unknown type sizes
--plist-output=<path>
Generate Clang-plist output files in folder.
--project=<file> Run Cppcheck on project. The <file> can be a Visual
Studio Solution (*.sln), Visual Studio Project
(*.vcxproj), compile database (compile_commands.json),
or Borland C++ Builder 6 (*.bpr). The files to analyse,
include paths, defines, platform and undefines in
the specified file will be used.
--project-configuration=<config>
If used together with a Visual Studio Solution (*.sln)
or Visual Studio Project (*.vcxproj) you can limit
the configuration cppcheck should check.
For example: '--project-configuration=Release|Win32'
-q, --quiet Do not show progress reports.
Note that this option is not mutually exclusive with --verbose.
-rp=<paths>, --relative-paths=<paths>
Use relative paths in output. When given, <paths> are
used as base. You can separate multiple paths by ';'.
Otherwise path where source files are searched is used.
We use string comparison to create relative paths, so
using e.g. ~ for home folder does not work. It is
currently only possible to apply the base paths to
files that are on a lower level in the directory tree.
--report-progress Report progress messages while checking a file (single job only).
--rule=<rule> Match regular expression.
--rule-file=<file> Use given rule file. For more information, see:
http://sourceforge.net/projects/cppcheck/files/Articles/
--showtime=<mode> Show timing information.
The available modes are:
* none
Show nothing (default)
* file
Show for each processed file
* file-total
Show total time only for each processed file
* summary
Show a summary at the end
* top5_file
Show the top 5 for each processed file
* top5_summary
Show the top 5 summary at the end
* top5
Alias for top5_file (deprecated)
--std=<id> Set standard.
The available options are:
* c89
C code is C89 compatible
* c99
C code is C99 compatible
* c11
C code is C11 compatible (default)
* c++03
C++ code is C++03 compatible
* c++11
C++ code is C++11 compatible
* c++14
C++ code is C++14 compatible
* c++17
C++ code is C++17 compatible
* c++20
C++ code is C++20 compatible (default)
--suppress=<spec> Suppress warnings that match <spec>. The format of
<spec> is:
[error id]:[filename]:[line]
The [filename] and [line] are optional. If [error id]
is a wildcard '*', all error ids match.
--suppressions-list=<file>
Suppress warnings listed in the file. Each suppression
is in the same format as <spec> above.
--suppress-xml=<file>
Suppress warnings listed in a xml file. XML file should
follow the manual.pdf format specified in section.
`6.4 XML suppressions` .
--template='<text>' Format the error messages. Available fields:
{file} file name
{line} line number
{column} column number
{callstack} show a callstack. Example:
[file.c:1] -> [file.c:100]
{inconclusive:text} if warning is inconclusive, text
is written
{severity} severity
{message} warning message
{id} warning id
{cwe} CWE id (Common Weakness Enumeration)
{code} show the real code
insert tab
\n insert newline
insert carriage return
Example formats:
'{file}:{line},{severity},{id},{message}' or
'{file}({line}):({severity}) {message}' or
'{callstack} {message}'
Pre-defined templates: gcc (default), cppcheck1 (old default), vs, edit.
--template-location='<text>'
Format error message location. If this is not provided
then no extra location info is shown.
Available fields:
{file} file name
{line} line number
{column} column number
{info} location info
{code} show the real code
insert tab
\n insert newline
insert carriage return
Example format (gcc-like):
'{file}:{line}:{column}: note: {info}\n{code}'
-U<ID> Undefine preprocessor symbol. Use -U to explicitly
hide certain #ifdef <ID> code paths from checking.
Example: '-UDEBUG'
-v, --verbose Output more detailed error information.
Note that this option is not mutually exclusive with --quiet.
--version Print out version number.
--xml Write results in xml format to error stream (stderr).
Example usage:
# Recursively check the current folder. Print the progress on the screen and
# write errors to a file:
cppcheck . 2> err.txt
# Recursively check ../myproject/ and don't print progress:
cppcheck --quiet ../myproject/
# Check test.cpp, enable all checks:
cppcheck --enable=all --inconclusive --library=posix test.cpp
# Check f.cpp and search include files from inc1/ and inc2/:
cppcheck -I inc1/ -I inc2/ f.cpp
For more information:
https://files.cppchecksolutions.com/manual.pdf
Many thanks to the 3rd party libraries we use:
* tinyxml2 -- loading project/library/ctu files.
* picojson -- loading compile database.
* pcre -- rules.
* qt -- used in GUI
Installation on mega-linter Docker image
- APK packages (Linux):