C++: Prepare Decision: code analysis tool

[AlexanderLanin]

Evaluation of Alternatives: Identify and evaluate free tools for MISRA compliance. Assess whether standard open-source C++ checkers (e.g., cppcheck, Clang-Tidy) can be configured or extended for MISRA rules and whether they provide reasonable coverage (e.g., >20% of the MISRA C++17 standard).

[dcalavrezo-qorix]

One things that needs to be clarified is whether referencing rules and directive from the MISRA C++:2023 document poses any copyright infringements.

[dcalavrezo-qorix]

Polyspace lists the summary of the rules & directives on their website

https://www.mathworks.com/help/bugfinder/misra-cpp-2023-rules-and-directives.html?s_tid=CRUX_lftnav

[AlexanderLanin]

Polyspace lists the summary of the rules & directives on their website

https://www.mathworks.com/help/bugfinder/misra-cpp-2023-rules-and-directives.html?s_tid=CRUX_lftnav

It's not only a summary. You can click each rule for more details and examples.

However, I would refrain from a formal mapping of tools to rules just yet. That's a lot of work.

[dcalavrezo-qorix]

The first option to analyze is cppchecker.

The tool is straightforward to install:

sudo apt-get install cppcheck

... and is also very easy to execute

dcalavrezo@DC-QORIX:~/qor$ cppcheck --addon=misra  -I include --checkers-report=misra_checkers.txt src/
Checking src/bson_generator.cpp ...
src/bson_generator.cpp:29:17: error: Variable 'qor' is unknown [misra-config]
  if constexpr (qor::core::endian::native == qor::core::endian::little)
                ^
src/bson_generator.cpp:29:22: error: Variable 'core' is unknown [misra-config]
  if constexpr (qor::core::endian::native == qor::core::endian::little)
                     ^
src/bson_generator.cpp:29:28: error: Variable 'endian' is unknown [misra-config]
  if constexpr (qor::core::endian::native == qor::core::endian::little)
                           ^
src/bson_generator.cpp:44:17: error: Variable 'qor' is unknown [misra-config]
  if constexpr (qor::core::endian::native == qor::core::endian::little)

[dcalavrezo-qorix]

According to the cppcheck documentation, the MISRA checks are part of an add-on named misra.

The documentation states the following:

misra.py Used to verify compliance with MISRA C 2012 - a proprietary set of guidelines to avoid such questionable code, developed for embedded systems. Since this standard is proprietary, cppcheck does not display error text by specifying only the number of violated rules (for example, [c2012-21.3]). If you want to display full texts for violated rules, you will need to create a text file containing MISRA rules, which you will have to pass when calling the script with --rule-texts key. Some examples of rule texts files available in tests directory.

Apparently, depending on our organization, MISRA can provide us with a license to use the rules internally in this way ( have rules.txt file with the rule set).

We do offer a license to use the headline rule text in conjunction with a tool such as CPPcheck where the tool vendor has not licensed the rules themselves, please use the contact form (on the main website) if you would like to discuss this further.

Later edit : cppcheck only has support for MISRA C 2012 ( so that's just C code)

[dcalavrezo-qorix]

Polyspace lists the summary of the rules & directives on their website
https://www.mathworks.com/help/bugfinder/misra-cpp-2023-rules-and-directives.html?s_tid=CRUX_lftnav

It's not only a summary. You can click each rule for more details and examples.

However, I would refrain from a formal mapping of tools to rules just yet. That's a lot of work.

... and a breach of their licensing apparently. Check the comment from above

[dcalavrezo-qorix]

The second option would be clang-tidy, which is also very straightforward to install and run

apt install clang-tidy

Clang-Tidy does not natively support checking against the full set of MISRA C++:2023 rules. However, it can help enforce many of the best practices and guidelines that overlap with MISRA standards. With some configuration, Clang-Tidy can provide partial compliance with MISRA rules.

Common checks include:

• cppcoreguidelines-*: Enforces core C++ best practices.
• modernize-*: Encourages the use of modern C++ features.
• performance-*: Detects performance issues.
• readability-*: Ensures code readability.
• bugprone-*: Identifies potential bugs.

Doing a mapping between the available checks and the ruleset of MISRA is not a trivial task.

Add Custom Rules for MISRA

For deeper MISRA compliance, we could implement custom checks using Clang-Tidy’s extensible framework:

1. Write a custom Clang-Tidy plugin to implement MISRA-specific Guide

2. Integrate the plugin into our Clang-Tidy setup.

There are some attempts available on GitHub, that add MISRA C++:2008 checkers for clang-tidy
https://github.com/rettichschnidi/clang-tidy-misra

This proves that in theory we could right our own plug-in to match to the MISRA ruleset. And the plugin could be developed in such a way that a rules.txt could be given as a parameter - with the actual rule names and descriptions ( which would require paying a license fee).

[dcalavrezo-qorix]

Created a table with the set of rules checked by clang-tidy:

Rule	Short Description
bugprone-argument-comment	Checks that argument comments match parameter names.The check understands argument comments in the...
bugprone-assert-side-effect	Findsassert()with side effect.The condition ofassert()is evaluated only in debug builds so a condi...
bugprone-assignment-in-if-condition	Finds assignments within conditions ofifstatements. Such assignments are bug-prone because they ma...
bugprone-bad-signal-to-kill-thread	Findspthread_killfunction calls when a thread is terminated by raisingSIGTERMsignal and the signal...
bugprone-bool-pointer-implicit-conversion	Checks for conditions based on implicit conversion from aboolpointer tobool.Example:bool*p;if(p){/...
bugprone-branch-clone	Checks for repeated branches inif/elseif/elsechains, consecutive repeated branches inswitchstateme...
bugprone-casting-through-void	Detects unsafe or redundant two-step casting operations involvingvoid*, which is equivalent torein...
bugprone-chained-comparison	Check detects chained comparison operators that can lead to unintended behavior or logical errors....
bugprone-compare-pointer-to-member-virtual-function	Detects unspecified behavior about equality comparison between pointer to member virtual function ...
bugprone-copy-constructor-init	Finds copy constructors where the constructor doesn�t call the copy constructor of the base clas...
bugprone-dangling-handle	Detect dangling references in value handles likestd::string_view. These dangling references can be...
bugprone-dynamic-static-initializers	Finds instances of static variables that are dynamically initialized in header files.This can pose...
bugprone-easily-swappable-parameters	Finds function definitions where parameters of convertible types follow each other directly, makin...
bugprone-empty-catch	Detects and suggests addressing issues with empty catch statements.try{// Some code that can throw...
bugprone-exception-escape	Finds functions which may throw an exception directly or indirectly, but they should not. The func...
bugprone-fold-init-type	The check flags type mismatches infoldslikestd::accumulatethat might result in loss of precision.s...
bugprone-forward-declaration-namespace	Checks if an unused forward declaration is in a wrong namespace.The check inspects all unused forw...
bugprone-forwarding-reference-overload	The check looks for perfect forwarding constructors that can hide copy or move constructors. If a ...
bugprone-implicit-widening-of-multiplication-result	The check diagnoses instances where a result of a multiplication is implicitly widened, and sugges...
bugprone-inaccurate-erase	Checks for inaccurate use of theerase()method.Algorithms likeremove()do not actually remove any el...
bugprone-inc-dec-in-conditions	Detects when a variable is both incremented/decremented and referenced inside a complex condition ...
bugprone-incorrect-enable-if	Detects incorrect usages ofstd::enable_ifthat don�t name the nestedtypetype.In C++11 introduceds...
bugprone-incorrect-roundings	Checks the usage of patterns known to produce incorrect rounding. Programmers often use:(int)(doub...
bugprone-infinite-loop	Finds obvious infinite loops (loops where the condition variable is not changed at all).Finding in...
bugprone-integer-division	Finds cases where integer division in a floating point context is likely to cause unintended loss ...
bugprone-lambda-function-name	Checks for attempts to get the name of a function from within a lambda expression. The name of a l...
bugprone-macro-parentheses	Finds macros that can have unexpected behavior due to missing parentheses.Macros are expanded by t...
bugprone-macro-repeated-side-effects	Checks for repeated argument with side effects in macros.
bugprone-misplaced-operator-in-strlen-in-alloc	Finds cases where1is added to the string in the argument tostrlen(),strnlen(),strnlen_s(),wcslen()...
bugprone-misplaced-pointer-arithmetic-in-alloc	Finds cases where an integer expression is added to or subtracted from the result of a memory allo...
bugprone-misplaced-widening-cast	This check will warn when there is a cast of a calculation result to a bigger type. If the intenti...
bugprone-move-forwarding-reference	Warns ifstd::moveis called on a forwarding reference, for example:templatevoidfoo(T&&t)...
bugprone-multi-level-implicit-pointer-conversion	Detects implicit conversions between pointers of different levels of indirection.Conversions betwe...
bugprone-multiple-new-in-one-expression	Finds multiplenewoperator calls in a single expression, where the allocated memory by the firstnew...
bugprone-multiple-statement-macro	Detect multiple statement macros that are used in unbraced conditionals. Only the first statement ...
bugprone-narrowing-conversions	cppcoreguidelines-narrowing-conversionsredirects here as an alias for this check.Checks for silent...
bugprone-no-escape	Finds pointers with thenoescapeattribute that are captured by an asynchronously-executed block. Th...
bugprone-non-zero-enum-to-bool-conversion	Detect implicit and explicit casts ofenumtype intoboolwhereenumtype doesn�t have a zero-value en...
bugprone-not-null-terminated-result	Finds function calls where it is possible to cause a not null-terminated result. Usually the prope...
bugprone-optional-value-conversion	Detects potentially unintentional and redundant conversions where a value is extracted from an opt...
bugprone-parent-virtual-call	Detects and fixes calls to grand-â�¦parent virtual methods instead of calls to overridden parentâ�...
bugprone-posix-return	Checks if any calls topthread_*orposix_*functions (exceptposix_openpt) expect negative return valu...
bugprone-redundant-branch-condition	Finds condition variables in nestedifstatements that were also checked in the outerifstatement and...
bugprone-reserved-identifier	cert-dcl37-candcert-dcl51-cppredirect here as an alias for this check.Checks for usages of identif...
bugprone-shared-ptr-array-mismatch	Finds initializations of C++ shared pointers to non-array type that are initialized with an array....
bugprone-signal-handler	Finds specific constructs in signal handler functions that can cause undefined behavior. The rules...
bugprone-signed-char-misuse	cert-str34-credirects here as an alias for this check. For the CERT alias, theDiagnoseSignedUnsign...
bugprone-sizeof-container	The check finds usages ofsizeofon expressions of STL container types. Most likely the user wanted ...
bugprone-sizeof-expression	The check finds usages ofsizeofexpressions which are most likely errors.Thesizeofoperator yields t...
bugprone-spuriously-wake-up-functions	Findscnd_wait,cnd_timedwait,wait,wait_for, orwait_untilfunction calls when the function is not inv...
bugprone-standalone-empty	Warns whenempty()is used on a range and the result is ignored. Suggestsclear()if it is an existing...
bugprone-string-constructor	Finds string constructors that are suspicious and probably errors.A common mistake is to swap para...
bugprone-string-integer-assignment	The check finds assignments of an integer tostd::basic_string(std::string,std::wstring, etc...
bugprone-string-literal-with-embedded-nul	Finds occurrences of string literal with embedded NUL character and validates their usage.Invalid ...
bugprone-stringview-nullptr	Checks for various ways that theconstCharT*constructor ofstd::basic_string_viewcan be passed a nul...
bugprone-suspicious-enum-usage	The checker detects various cases when an enum is probably misused (as a bitmask ).When �ADD� ...
bugprone-suspicious-include	The check detects various cases when an include refers to what appears to be an implementation fil...
bugprone-suspicious-memory-comparison	Finds potentially incorrect calls tomemcmp()based on properties of the arguments. The following ca...
bugprone-suspicious-memset-usage	This check findsmemset()calls with potential mistakes in their arguments. Considering the function...
bugprone-suspicious-missing-comma	String literals placed side-by-side are concatenated at translation phase 6 (after the preprocesso...
bugprone-suspicious-realloc-usage	This check finds usages ofreallocwhere the return value is assigned to the same expression as pass...
bugprone-suspicious-semicolon	Finds most instances of stray semicolons that unexpectedly alter the meaning of the code. More spe...
bugprone-suspicious-string-compare	Find suspicious usage of runtime string comparison functions. This check is valid in C and C++.Che...
bugprone-swapped-arguments	Finds potentially swapped arguments by examining implicit conversions. It analyzes the types of th...
bugprone-switch-missing-default-case	Ensures that switch statements without default cases are flagged, focuses only on covering cases w...
bugprone-terminating-continue	Detectsdowhileloops with a condition always evaluating to false that have acontinuestatement, as t...
bugprone-throw-keyword-missing	Warns about a potentially missingthrowkeyword. If a temporary object is created, but the object�...
bugprone-too-small-loop-variable	Detects thoseforloops that have a loop variable with a �too small� type which means this type ...
bugprone-unchecked-optional-access	Note: This check uses a flow-sensitive static analysis to produce its results. Therefore, it may b...
bugprone-undefined-memory-manipulation	Finds calls of memory manipulation functionsmemset(),memcpy()andmemmove()on non-TriviallyCopyable ...
bugprone-undelegated-constructor	Finds creation of temporary objects in constructors that look like a function call to another cons...
bugprone-unhandled-exception-at-new	Finds calls tonewwith missing exception handler forstd::bad_alloc.Calls tonewmay throw exceptions ...
bugprone-unhandled-self-assignment	cert-oop54-cppredirects here as an alias for this check. For the CERT alias, theWarnOnlyIfThisHasS...
bugprone-unique-ptr-array-mismatch	Finds initializations of C++ unique pointers to non-array type that are initialized with an array....
bugprone-unsafe-functions	Checks for functions that have safer, more secure replacements available, or are considered deprec...
bugprone-unused-local-non-trivial-variable	Warns when a local non trivial variable is unused within a function. The following types of variab...
bugprone-unused-raii	Finds temporaries that look like RAII objects.The canonical example for this is a scoped lock.{sco...
bugprone-unused-return-value	Warns on unused function return values. The checked functions can be configured.Operator overloadi...
bugprone-use-after-move	Warns if an object is used after it has been moved, for example:std::stringstr="Hello, world!\n";s...
bugprone-virtual-near-miss	Warn if a function is a near miss (i.e. the name is very similar and the function signature is the...
cppcoreguidelines-avoid-c-arrays	The cppcoreguidelines-avoid-c-arrays check is an alias, please seemodernize-avoid-c-arraysfor more...
cppcoreguidelines-avoid-capturing-lambda-coroutines	Flags C++20 coroutine lambdas with non-empty capture lists that may cause use-after-free errors an...
cppcoreguidelines-avoid-const-or-ref-data-members	This check warns when structs or classes that are copyable or movable, and have const-qualified or...
cppcoreguidelines-avoid-do-while	Warns when usingdo-whileloops. They are less readable than plainwhileloops, since the termination ...
cppcoreguidelines-avoid-goto	The usage ofgotofor control flow is error prone and should be replaced with looping constructs. On...
cppcoreguidelines-avoid-magic-numbers	The cppcoreguidelines-avoid-magic-numbers check is an alias, please seereadability-magic-numbersfo...
cppcoreguidelines-avoid-non-const-global-variables	Finds non-const global variables as described inI.2of C++ Core Guidelines. AsR.6of C++ Core Guidel...
cppcoreguidelines-avoid-reference-coroutine-parameters	Warns when a coroutine accepts reference parameters. After a coroutine suspend point, references c...
cppcoreguidelines-c-copy-assignment-signature	Thecppcoreguidelines-c-copy-assignment-signaturecheck is an alias, please seemisc-unconventional-a...
cppcoreguidelines-explicit-virtual-functions	Thecppcoreguidelines-explicit-virtual-functionscheck is an alias, please seemodernize-use-override...
cppcoreguidelines-init-variables	Checks whether there are local variables that are declared without an initial value. These may lea...
cppcoreguidelines-interfaces-global-init	This check flags initializers of globals that access extern objects, and therefore can lead to ord...
cppcoreguidelines-macro-to-enum	The cppcoreguidelines-macro-to-enum check is an alias, please seemodernize-macro-to-enumfor more i...
cppcoreguidelines-macro-usage	Finds macro usage that is considered problematic because better language constructs exist for the ...
cppcoreguidelines-misleading-capture-default-by-value	Warns when lambda specify a by-value capture default and capturethis.By-value capture defaults in ...
cppcoreguidelines-missing-std-forward	Warns when a forwarding reference parameter is not forwarded inside the function body.Example:temp...
cppcoreguidelines-narrowing-conversions	This check implements part ofES.46from the C++ Core Guidelines.The cppcoreguidelines-narrowing-con...
cppcoreguidelines-no-malloc	This check handles C-Style memory management usingmalloc(),realloc(),calloc()andfree(). It warns a...
cppcoreguidelines-no-suspend-with-lock	Flags coroutines that suspend while a lock guard is in scope at the suspension point.When a corout...
cppcoreguidelines-noexcept-destructor	This check implementsC.37from the C++ Core Guidelines.Thecppcoreguidelines-noexcept-destructorchec...
cppcoreguidelines-noexcept-move-operations	This check implementsC.66from the C++ Core Guidelines.Thecppcoreguidelines-noexcept-move-operation...
cppcoreguidelines-noexcept-swap	This check implementsC.83,C.84andC.85from the C++ Core Guidelines.Thecppcoreguidelines-noexcept-sw...
cppcoreguidelines-non-private-member-variables-in-classes	The cppcoreguidelines-non-private-member-variables-in-classes check is an alias, please seemisc-no...
cppcoreguidelines-owning-memory	This check implements the type-based semantics ofgsl::owner<T*>, which allows static analysis on c...
cppcoreguidelines-prefer-member-initializer	Finds member initializations in the constructor body which can be converted into member initializ...
cppcoreguidelines-pro-bounds-array-to-pointer-decay	This check flags all array to pointer decays.Pointers should not be used as arrays.spanis a bou...
cppcoreguidelines-pro-bounds-constant-array-index	This check flags all array subscript expressions on static arrays andstd::arraysthat either do not...
cppcoreguidelines-pro-bounds-pointer-arithmetic	This check flags all usage of pointer arithmetic, because it could lead to an invalid pointer. Sub...
cppcoreguidelines-pro-type-const-cast	Imposes limitations on the use ofconst_castwithin C++ code. It depends on theStrictModeoption sett...
cppcoreguidelines-pro-type-cstyle-cast	This check flags all use of C-style casts that perform astatic_castdowncast,const_cast, orreinterp...
cppcoreguidelines-pro-type-member-init	The check flags user-provided constructor definitions that do not initialize all fields that would...
cppcoreguidelines-pro-type-reinterpret-cast	This check flags all uses ofreinterpret_castin C++ code.Use of these casts can violate type safety...
cppcoreguidelines-pro-type-static-cast-downcast	This check flags all usages ofstatic_cast, where a base class is casted to a derived class. In tho...
cppcoreguidelines-pro-type-union-access	This check flags all access to members of unions. Passing unions as a whole is not flagged.Reading...
cppcoreguidelines-pro-type-vararg	This check flags all calls to c-style vararg functions and all use ofva_arg.To allow for SFINAE us...
cppcoreguidelines-rvalue-reference-param-not-moved	Warns when an rvalue reference function parameter is never moved within the function body.Rvalue r...
cppcoreguidelines-slicing	Flags slicing of member variables or vtable. Slicing happens when copying a derived object into a ...
cppcoreguidelines-special-member-functions	The check finds classes where some but not all of the special member functions are defined.By defa...
cppcoreguidelines-use-default-member-init	This check implementsC.48from the C++ Core Guidelines.Thecppcoreguidelines-use-default-member-init...
cppcoreguidelines-virtual-class-destructor	Finds virtual classes whose destructor is neither public and virtual nor protected and non-virtual...
google-build-explicit-make-pair	Check thatmake_pair�s template arguments are deduced.G++ 4.6 in C++11 mode fails badly ifmake_pa...
google-build-namespaces	cert-dcl59-cppredirects here as an alias for this check.fuchsia-header-anon-namespacesredirects he...
google-build-using-namespace	Findsusingnamespacedirectives.The check implements the following rule of theGoogle C++ Style Guide...
google-default-arguments	Checks that default arguments are not given for virtual methods.Seehttps://google.github.io/styleg...
google-explicit-constructor	Checks that constructors callable with a single argument and conversion operators are marked expli...
google-global-names-in-headers	Flag global namespace pollution in header files. Right now it only triggers onusingdeclarations an...
google-objc-avoid-nsobject-new	Finds calls to+newor overrides of it, which are prohibited by the Google Objective-C style guide.T...
google-objc-avoid-throwing-exception	Finds uses of throwing exceptions usages in Objective-C files.For the same reason as the Google C+...
google-objc-function-naming	Finds function declarations in Objective-C files that do not follow the pattern described in the G...
google-objc-global-variable-declaration	Finds global variable declarations in Objective-C files that do not follow the pattern of variable...
google-readability-avoid-underscore-in-googletest-name	Checks whether there are underscores in googletest test suite names and test names in test macros:...
google-readability-braces-around-statements	Thegoogle-readability-braces-around-statementscheck is an alias, please seereadability-braces-arou...
google-readability-casting	Finds usages of C-style casts.https://google.github.io/styleguide/cppguide.html#CastingCorrespondi...
google-readability-function-size	Thegoogle-readability-function-sizecheck is an alias, please seereadability-function-sizefor more ...
google-readability-namespace-comments	Thegoogle-readability-namespace-comments checkis an alias, please seellvm-namespace-commentfor mor...
google-readability-todo	Finds TODO comments without a username or bug number.The relevant style guide section ishttps://go...
google-runtime-int	Finds uses ofshort,longandlonglongand suggest replacing them withu?intXX(_t)?.The corresponding st...
google-runtime-operator	Finds overloads of unaryoperator&.https://google.github.io/styleguide/cppguide.html#Operator_Overl...
google-upgrade-googletest-case	Finds uses of deprecated Google Test version 1.9 APIs with names containingcaseand replaces them w...
performance-avoid-endl	Checks for uses ofstd::endlon streams and suggests using the newline character'\n'instead.Rational...
performance-enum-size	Recommends the smallest possible underlying type for anenumorenumclass based on the range of its e...
performance-faster-string-find	Optimize calls tostd::string::find()and friends when the needle passed is a single character strin...
performance-for-range-copy	Finds C++11 for ranges where the loop variable is copied in each iteration but it would suffice to...
performance-implicit-conversion-in-loop	This warning appears in a range-based loop with a loop variable of const ref type where the type o...
performance-inefficient-algorithm	Warns on inefficient use of STL algorithms on associative containers.Associative containers implem...
performance-inefficient-string-concatenation	This check warns about the performance overhead arising from concatenating strings using theoperat...
performance-inefficient-vector-operation	Finds possible inefficientstd::vectoroperations (e.g.push_back,emplace_back) that may cause unnece...
performance-move-const-arg	The check warnsifstd::move()is called with a constant argument,ifstd::move()is called with an argu...
performance-move-constructor-init	�cert-oop11-cpp� redirects here as an alias for this check.The check flags user-defined move c...
performance-no-automatic-move	Finds local variables that cannot be automatically moved due to constness.Undercertain conditions,...
performance-no-int-to-ptr	Diagnoses every integer to pointer cast.While casting an (integral) pointer to an integer is obvio...
performance-noexcept-destructor	The check flags user-defined destructors marked withnoexcept(expr)whereexprevaluates tofalse(but i...
performance-noexcept-move-constructor	The check flags user-defined move constructors and assignment operators not marked withnoexceptor ...
performance-noexcept-swap	The check flags user-defined swap and iter_swap functions not marked withnoexceptor marked withnoe...
performance-trivially-destructible	Finds types that could be made trivially-destructible by removing out-of-line defaulted destructor...
performance-type-promotion-in-math-fn	Finds calls to C math library functions (frommath.hor, in C++,cmath) with implicitfloattodoublepro...
performance-unnecessary-copy-initialization	Finds local variable declarations that are initialized using the copy constructor of a non-trivial...
performance-unnecessary-value-param	Flags value parameter declarations of expensive to copy types that are copied for each invocation ...