代码缺陷检测规则知识库

文档说明

本知识库面向开源社区三维基础几何引擎的代码缺陷检测场景，整理了项目平台所采用的 Cppcheck 静态分析工具的严重级别体系、检查项（error id）分类、与 CWE 的对应关系，以及对应的违规知识条目。§3（速查表）与 §5.2（标准条目）收录全部 342 项代码缺陷检查规则；§5.3 另对高频重点检查给出深度解析（成因/示例/修复/案例）。

检测器边界：cppcheck 是静态分析工具，强调低误报（宁可漏报也不轻易报错），与编译器告警（-Wall）和 clang-tidy 互补而非替代。它不需要完整编译环境即可分析，但提供 --project=compile_commands.json 后分析更准确。本文聚焦通用 C/C++ 缺陷检测，是缺陷检测维度的主干。

规则结构概览

严重级别（severity）	含义	代表 error id	条目数	--enable 归属
error	执行时必然为未定义行为/泄漏等错误	nullPointer、arrayIndexOutOfBounds、memleak、doubleFree、mismatchAllocDealloc	93	默认开启
warning	执行时可能为未定义行为	uninitMemberVar、nullPointerRedundantCheck、missingReturn	110	--enable=warning
style	风格/冗余/常量性/可疑写法	unusedVariable、redundantAssignment、cstyleCast、constParameter	95	--enable=style
performance	运行时性能建议	passedByValue、useInitializationList、stlSize	19	--enable=performance
portability	可移植性/实现定义行为/64 位	pointerSize、memsetFloat、AssignmentIntegerToAddress	20	--enable=portability
information	配置类信息（非语法错误）	missingInclude、toomanyconfigs、checkersReport	5	--enable=information
合计	代码缺陷检查规则	—	342	--enable=all（含全部，外加 unusedFunction）

上表为各严重级别的规则条目数；逐条清单见 §3，深度知识条目见 §5。

目录

• 1 工具链与流水线
• 2 严重级别体系与 --enable
• 3 全部检查项清单
• 4 附加能力（MISRA/规则文件/抑制/CWE）
• 5 标准知识条目列表

---

1 工具链与流水线

环节	命令（示例）	说明
全量分析	cppcheck --enable=all --inconclusive --std=c++17 --project=compile_commands.json	以编译数据库为输入，覆盖全部宏分支
CI 失败门禁	cppcheck --enable=warning,style,performance,portability --error-exitcode=1 ...	命中即非零退出，阻断流水线
机器可读输出	--xml --xml-version=2 2> cppcheck.xml	供看板/SonarQube 摄取
增量分析	--cppcheck-build-dir=.cppcheck-cache	缓存结果，加速重复扫描
抑制误报	--suppress=<id>:<file>:<line> 或 --suppressions-list=suppr.txt	集中管理已知误报
查看检查说明	cppcheck --doc	列出各检查项的文档说明

• 唯一事实来源：仓库内 .cppcheck/cppcheck.cfg、suppressions.txt 与 CI 调用参数共同固定，本地与 CI 一致。
• 日志特征统一格式：<file>:<line>:<col>: <severity>: <message> [<errorId>]，方括号内即规则编号，可直接映射本文条目。

2 严重级别体系与 --enable

级别	是否默认开启	作为门禁建议	说明
error	是	必须阻断	真实缺陷，几乎无误报容忍
warning	--enable=warning	建议阻断	潜在未定义行为
style	--enable=style	建议阻断（可分级）	冗余/常量性/可疑写法
performance	--enable=performance	提示或阻断	性能改进建议
portability	--enable=portability	跨平台项目建议阻断	实现定义行为/64 位
information	--enable=information	仅提示	配置类信息（如缺少 include 导致分析不全）
unusedFunction	仅 --enable=all 或单独指定	提示	需全程序视角，单文件不报

检查级别（check level）：新版 cppcheck 引入 --check-level=normal|exhaustive。exhaustive 启用更深的数据流（ValueFlow）分析，发现更多 error/warning，但更耗时；CI 夜间构建可用 exhaustive，PR 快检用 normal。

3 全部检查项清单

下表为代码缺陷检查规则清单，按严重级别分组。

说明：此处为通用缺陷检查规则；--addon 引入的 MISRA / CERT / y2038 等编码规范规则不在此列，另见 §4。各 Error ID 的深度知识条目（成因/案例/修复）见 §5。

代码缺陷检查规则列表，共 342 项，按严重级别分组。Error ID 即检测日志方括号内的标识；CWE 为对应弱点编号（部分项无 CWE）。

严重级别	条目数
error（错误）	93
warning（警告）	110
style（风格）	95
performance（性能）	19
portability（可移植性）	20
information（信息）	5
合计	342

error（错误）（93 项）

Error ID	CWE	说明（cppcheck 原始消息）
arrayIndexOutOfBounds	788	Array 'arr[16]' accessed at index 16, which is out of bounds.
assignBoolToPointer	587	Boolean value assigned to pointer.
autoVariables	562	Address of local auto-variable assigned to a function parameter.
autovarInvalidDeallocation	590	Deallocation of an auto-variable results in undefined behaviour.
bufferAccessOutOfBounds	788	Buffer is accessed out of bounds: buf
comparePointers	758	Comparing pointers that point to different objects
containerOutOfBounds	398	Out of bounds access in expression 'container[x]'
containerOutOfBoundsIndexExpression	398	Out of bounds access of var, index 'var.size()' is out of bounds.
coutCerrMisusage	398	Invalid usage of output stream: '<< std::cout'.
danglingLifetime	562	Non-local variable 'x' will use object.
danglingReference	562	Non-local reference variable 'x' to local variable 'y'
danglingTemporaryLifetime	562	Using object that is a temporary.
danglingTempReference	562	Using reference to dangling temporary.
deallocret	672	Returning/dereferencing 'p' after it is deallocated / released
deallocuse	416	Dereferencing 'varname' after it is deallocated / released
doubleFree	415	Memory pointed to by 'varname' is freed twice.
eraseDereference	664	Invalid iterator 'iter' used.
eraseIteratorOutOfBounds	628	Calling function 'erase()' on the iterator 'iter' which is out of bounds.
floatConversionOverflow	190	Undefined behaviour: float (1e+100) to integer conversion overflow.
includeNestedTooDeeply	—	message
integerOverflow	190	Signed integer overflow for expression ''.
invalidContainer	664	Using object that may be invalid.
invalidContainerLoop	664	Calling 'erase' while iterating the container is invalid.
invalidContainerReference	664	Reference to x that may be invalid.
invalidFree	—	Mismatching address is freed. The address you get from malloc() must be freed without offset.
invalidFunctionArg	628	Invalid func_name() argument nr 1. The value is 0 or 1 (boolean) but the valid values are '1:4'.
invalidFunctionArgBool	628	Invalid func_name() argument nr 1. A non-boolean value is required.
invalidFunctionArgStr	628	Invalid func_name() argument nr 1. A nul-terminated string is required.
invalidIterator1	664	Invalid iterator: iterator
invalidLifetime	562	Using object that is out of scope.
invalidScanfFormatWidth	687	Width 5 given in format string (no. 10) is larger than destination buffer '[0]', use %-1s to prevent overflowing it.
invalidSuppression	—	message
IOWithoutPositioning	664	Read and write operations without a call to a positioning function (fseek, fsetpos or rewind) or fflush in between result in undefined behaviour.
iterators1	664	Same iterator is used with different containers 'container1' and 'container2'.
iterators3	664	Same iterator is used with containers 'container' that are temporaries or defined in different scopes.
leakNoVarFunctionCall	772	Allocation with funcName, funcName doesn't release it.
leakReturnValNotUsed	771	Return value of allocation function 'funcName' is not stored.
mallocOnClassError	665	Memory for class instance allocated with malloc(), but class contains a std::string.
memleak	401	Memory leak: varname
memleakOnRealloc	401	Common realloc mistake: 'varname' nulled but not freed upon failure
memsetClass	762	Using 'memfunc' on class that contains a classname.
memsetClassReference	665	Using 'memfunc' on class that contains a reference.
mismatchAllocDealloc	762	Mismatching allocation and deallocation: varname
mismatchingContainerIterator	664	Iterator 'it' referring to container 'v2' is used with container 'v1'.
mismatchingContainers	664	Iterators of different containers 'v1' and 'v2' are used together.
missingFile	—	message
missingIncludeExplicit	—	message
missingReturn	758	Found an exit path from function with non-void return type that has missing return statement
negativeArraySize	758	Declaration of array '' with negative size is undefined behaviour
negativeIndex	786	Negative array index
negativeMemoryAllocationSize	131	Memory allocation size is negative.
nullPointer	476	Null pointer dereference
nullPointerArithmetic	682	Pointer arithmetic with NULL pointer.
objectIndex	758	The address of variable '' is accessed at non-zero index.
operatorEqMissingReturnStatement	398	No 'return' statement in non-void function causes undefined behavior.
overlappingWriteFunction	—	Overlapping read/write in funcname() is undefined behavior
overlappingWriteUnion	—	Overlapping read/write of union is undefined behavior
pointerArithBool	571	Converting pointer arithmetic result to bool. The bool is always true unless there is undefined behaviour.
preprocessorErrorDirective	—	message
raceAfterInterlockedDecrement	362	Race condition: non-interlocked access after InterlockedDecrement(). Use InterlockedDecrement() return value instead.
readWriteOnlyFile	664	Read operation on a file that was opened only for writing.
resourceLeak	775	Resource leak: varname
rethrowNoCurrentException	480	Rethrowing current exception with 'throw;', it seems there is no current exception to rethrow. If there is no current exception this calls std::terminate(). More: https://isocpp.org/wiki/faq/exceptions#throw-without-an-object
returnDanglingLifetime	562	Returning object that will be invalid when returning.
returnReference	562	Reference to local variable returned.
returnTempReference	562	Reference to temporary returned.
selfInitialization	665	Member variable 'var' is initialized by itself.
shiftNegative	758	Shifting by a negative value is undefined behaviour
shiftTooManyBits	758	Shifting 32-bit value by 40 bits is undefined behaviour
shiftTooManyBitsSigned	758	Shifting signed 32-bit value by 31 bits is undefined behaviour
sprintfOverlappingData	628	Undefined behavior: Variable 'varname' is used as parameter and destination in s[n]printf().
stlBoundaries	664	Dangerous comparison using operator< on iterator.
stlcstr	664	Dangerous usage of c_str(). The value returned by c_str() is invalid after this call.
stlcstrthrow	—	Dangerous usage of c_str(). The value returned by c_str() is invalid after throwing exception.
stlOutOfBounds	788	When i==foo.size(), foo[i] is out of bounds.
stringLiteralWrite	758	Modifying string literal directly or indirectly is undefined behaviour.
strPlusChar	665	Unusual pointer arithmetic. A value of type 'char' is added to a string literal.
syntaxError	—	message
throwInEntryPoint	398	Unhandled exception thrown in function that is an entry point.
throwInNoexceptFunction	398	Unhandled exception thrown in function declared not to throw exceptions.
unhandledChar	—	message
uninitdata	457	Memory is allocated but not initialized: varname
uninitStructMember	457	Uninitialized struct member: a.b
unknownEvaluationOrder	768	Expression 'x = x++;' depends on order of evaluation of side effects
useClosedFile	910	Used file that is not opened.
va_end_missing	664	va_list 'vl' was opened but not closed by va_end().
va_list_usedBeforeStarted	664	va_list 'vl' used before va_start() was called.
va_start_referencePassed	758	Using reference 'arg1' as parameter for va_start() results in undefined behaviour.
va_start_subsequentCalls	664	va_start() or va_copy() called subsequently on 'vl' without va_end() in between.
virtualDestructor	404	Class 'Base' which is inherited by class 'Derived' does not have a virtual destructor.
writeReadOnlyFile	664	Write operation on a file that was opened only for reading.
wrongPrintfScanfArgNum	685	printf format string requires 3 parameters but only 2 are given.
zerodiv	369	Division by zero.

warning（警告）（110 项）

Error ID	CWE	说明（cppcheck 原始消息）
accessForwarded	672	Access of forwarded variable 'v'.
accessMoved	672	Access of moved variable 'v'.
argumentSize	398	Buffer 'buffer' is too small, the function 'function' expects a bigger buffer in 2nd argument
arrayIndexOutOfBoundsCond	788	Array 'arr[16]' accessed at index 16, which is out of bounds.
assertWithSideEffect	398	Assert statement calls a function which may have desired side effects: 'function'.
assignmentInAssert	398	Assert statement modifies 'var'.
badBitmaskCheck	571	Result of operator '|' is always true if one operand is non-zero. Did you intend to use '&'?
charBitOp	398	When using 'char' variables in bit operations, sign extension can generate unexpected results.
charLiteralWithCharPtrCompare	595	Char literal compared with pointer 'foo'. Did you intend to dereference it?
checkCastIntToCharAndBack	197	Storing func_name() return value in char variable and then comparing with EOF.
clarifyStatement	783	In expression like '*A++' the result of '*' is unused. Did you intend to write '(*A)++;'?
compareBoolExpressionWithInt	398	Comparison of a boolean expression with an integer other than 0 or 1.
comparisonFunctionIsAlwaysTrueOrFalse	570	Comparison of two identical variables with isless(varName,varName) always evaluates to false.
comparisonOfBoolWithInvalidComparator	—	Comparison of a boolean value using relational operator (<, >, <= or >=).
constStatement	398	Redundant code: Found a statement that begins with type constant.
copyCtorAndEqOperator	—	The class 'class' has 'operator=' but lack of 'copy constructor'.
copyCtorPointerCopying	398	Value of pointer 'var', which points to allocated memory, is copied in copy constructor instead of allocating new memory.
dangerousTypeCast	398	Potentially invalid type conversion in old-style C cast, clarify/fix with C++ cast
derefInvalidIterator	825	Possible dereference of an invalid iterator: i
divideSizeof	682	Division of result of sizeof() on pointer type.
duplInheritedMember	398	The class 'class' defines member variable with name 'variable' also defined in its parent class 'class'.
eraseIteratorOutOfBoundsCond	628	Either the condition 'x' is redundant or function 'erase()' is called on the iterator 'iter' which is out of bounds.
exceptDeallocThrow	398	Exception thrown in invalid state, 'p' points at deallocated memory.
exceptThrowInDestructor	398	Class Class is not safe, destructor throws exception
fcloseInLoopCondition	910	fclose() used as loop condition may skip loop body or double-close file handle.
funcArgOrderDifferent	683	Function 'function' argument order different: declaration '' definition ''
globalLockGuard	833	Lock guard is defined globally. Lock guards are intended to be local. A global lock guard could lead to a deadlock since it won't unlock until the end of the program.
identicalConditionAfterEarlyExit	398	Identical condition 'x', second condition is always false
identicalInnerCondition	398	Identical inner 'if' condition is always true.
ignoredReturnValue	252	Return value of function malloc() is not used.
incompatibleFileOpen	664	The file 'tmp' is opened for read and write access at the same time on different streams
incompleteArrayFill	131	Array 'buffer' is filled incompletely. Did you forget to multiply the size given to 'memset()' with 'sizeof(*buffer)'?
incorrectCharBooleanError	571	Conversion of char literal 'x' to bool always evaluates to true.
incorrectLogicOperator	571	Logical disjunction always evaluates to true: foo > 3 && foo < 4.
incorrectStringBooleanError	571	Conversion of string literal "Hello World" to bool always evaluates to true.
incorrectStringCompare	570	String literal "Hello World" doesn't match length argument for substr().
invalidLengthModifierError	704	'I' in format string (no. 1) is a length modifier and cannot be used without a conversion specifier.
invalidPrintfArgType_float	686	%f in format string (no. 1) requires 'double' but the argument type is Unknown.
invalidPrintfArgType_n	686	%n in format string (no. 1) requires 'int *' but the argument type is Unknown.
invalidPrintfArgType_p	686	%p in format string (no. 1) requires an address but the argument type is Unknown.
invalidPrintfArgType_s	686	%s in format string (no. 1) requires 'char *' but the argument type is Unknown.
invalidPrintfArgType_sint	686	%i in format string (no. 1) requires 'int' but the argument type is Unknown.
invalidPrintfArgType_uint	686	%u in format string (no. 1) requires 'unsigned int' but the argument type is Unknown.
invalidscanf	119	scanf() without field width limits can crash with huge input data.
invalidScanfArgType_float	686	%f in format string (no. 1) requires 'float *' but the argument type is Unknown.
invalidScanfArgType_int	686	%d in format string (no. 1) requires 'int *' but the argument type is Unknown.
invalidScanfArgType_s	686	%s in format string (no. 1) requires a 'char *' but the argument type is Unknown.
invalidScanfFormatWidth_smaller	—	Width -1 given in format string (no. 99) is smaller than destination buffer '[0]'.
invalidTestForOverflow	391	Invalid test for overflow 'x + c < x'; signed integer overflow is undefined behavior. Some mainstream compilers remove such overflow tests when optimising the code and assume it's always false.
leakUnsafeArgAlloc	401	Unsafe allocation. If funcName() throws, memory could be leaked. Use make_shared<int>() instead.
literalWithCharPtrCompare	595	String literal compared with variable 'foo'. Did you intend to use strcmp() instead?
localMutex	667	The lock is ineffective because the mutex is locked at the same scope as the mutex itself.
mallocOnClassWarning	762	Memory for class instance allocated with malloc(), but class provides constructors.
memsetValueOutOfRange	686	The 2nd memset() argument 'varname' doesn't fit into an 'unsigned char'.
memsetZeroBytes	687	memset() called to fill 0 bytes.
mismatchingContainerExpression	664	Iterators to containers from different expressions 'v1' and 'v2' are used together.
missingMemberCopy	398	Member variable 'classname::varnamepriv' is not assigned in the move constructor. Should it be moved?
moduloAlwaysTrueFalse	398	Comparison of modulo result is predetermined, because it is always less than 1.
multiplySizeof	682	Multiplying sizeof() with sizeof() indicates a logic error.
negativeContainerIndex	786	Array index -1 is out of bounds.
noCopyConstructor	398	Class 'class' does not have a copy constructor which is recommended since it has dynamic memory/resource management.
noDestructor	398	Class 'class' does not have a destructor which is recommended since it has dynamic memory/resource management.
noOperatorEq	398	Class 'class' does not have a operator= which is recommended since it has dynamic memory/resource management.
nullPointerArithmeticRedundantCheck	682	Either the condition is redundant or there is pointer arithmetic with NULL pointer.
nullPointerDefaultArg	476	Possible null pointer dereference if the default parameter value is used: pointer
nullPointerOutOfMemory	476	Null pointer dereference
nullPointerOutOfResources	476	Null pointer dereference
nullPointerRedundantCheck	476	Either the condition is redundant or there is possible null pointer dereference: pointer.
operatorEqToSelf	398	'operator=' should check for assignment to self to avoid problems with dynamic memory.
operatorEqVarError	398	Member variable 'classname::' is not assigned a value in 'classname::operator='.
oppositeInnerCondition	398	Opposite inner 'if' condition leads to a dead code block.
overlappingInnerCondition	398	Overlapping inner 'if' condition is always true.
overlappingStrcmp	—	The expression 'strcmp(x,"def") != 0' is suspicious. It overlaps 'strcmp(x,"abc") == 0'.
pointerAdditionResultNotNull	—	Comparison is wrong. Result of 'ptr+1' can't be 0 unless there is pointer overflow, and pointer overflow is undefined behaviour.
pointerSize	467	Size of pointer 'varname' used instead of size of its data.
publicAllocationError	398	Possible leak in public function. The pointer 'varname' is not deallocated before it is allocated.
pureVirtualCall	—	Call of pure virtual function 'f' in constructor.
seekOnAppendedFile	398	Repositioning operation performed on a file opened in append mode has no effect.
signConversion	195	Expression 'var' can have a negative value. That is converted to an unsigned value and used in an unsigned calculation.
signedCharArrayIndex	128	Signed 'char' type used as array index.
sizeofCalculation	682	Found calculation inside sizeof().
sizeofDivisionMemfunc	682	Division by result of sizeof(). memset() expects a size in bytes, did you intend to multiply instead?
sizeofFunctionCall	682	Found function call inside sizeof().
sizeofsizeof	682	Calling 'sizeof' on 'sizeof'.
sizeofwithnumericparameter	682	Suspicious usage of 'sizeof' with a numeric constant as parameter.
sizeofwithsilentarraypointer	467	Using 'sizeof' on array given as function argument returns size of a pointer.
staticStringCompare	570	Unnecessary comparison of static strings.
stlIfFind	398	Suspicious condition. The result of find() is an iterator, but it is not properly checked.
StlMissingComparison	834	Missing bounds check for extra iterator increment in loop.
stringCompare	571	Comparison of identical string variables.
suspiciousCase	398	Found suspicious case label in switch(). Operator '||' probably doesn't work as intended.
suspiciousSemicolon	398	Suspicious use of ; at the end of '' statement.
terminateStrncpy	170	The buffer 'var_name' may not be null-terminated after the call to strncpy().
thisSubtraction	398	Suspicious pointer subtraction. Did you intend to write '->'?
thisUseAfterFree	—	Using member 'x' when 'this' might be invalid
uninitDerivedMemberVar	398	Member variable 'classname::varname' is not initialized in the constructor. Maybe it should be initialized directly in the class classname?
uninitDerivedMemberVarPrivate	398	Member variable 'classname::varnamepriv' is not initialized in the constructor. Maybe it should be initialized directly in the class classname?
uninitMemberVar	398	Member variable 'classname::varname' is not initialized in the constructor.
uninitMemberVarPrivate	398	Member variable 'classname::varnamepriv' is not initialized in the constructor.
unsafeClassRefMember	—	Unsafe class: The const reference member 'UnsafeClass::var' is initialized by a const reference constructor argument. You need to be careful about lifetime issues.
unusedLabelSwitch	398	Label '' is not used. Should this be a 'case' of the enclosing switch()?
unusedLabelSwitchConfiguration	398	Label '' is not used. There is #if in function body so the label might be used in code that is removed by the preprocessor. Should this be a 'case' of the enclosing switch()?
uselessAssignmentPtrArg	398	Assignment of function parameter has no effect outside the function. Did you forget dereferencing it?
uselessCallsCompare	628	It is inefficient to call 'str.find(str)' as it always returns 0.
uselessCallsEmpty	398	Ineffective call of function 'empty()'. Did you intend to call 'clear()' instead?
uselessCallsRemove	762	Return value of std::remove() ignored. Elements remain in container.
va_start_wrongParameter	688	'arg1' given to va_start() is not last named argument of the function. Did you intend to pass 'arg2'?
wrongmathcall	758	Passing value '#' to #() leads to implementation-defined result.
wrongPrintfScanfParameterPositionError	685	printf: referencing parameter 2 while 1 arguments given
zerodivcond	369	Either the condition is redundant or there is division by zero.

style（风格）（95 项）

Error ID	CWE	说明（cppcheck 原始消息）
arrayIndexThenCheck	398	Array index 'i' is used before limits check.
assignBoolToFloat	704	Boolean value assigned to floating point variable.
assignIfError	398	Mismatching assignment and comparison, comparison '' is always false.
assignmentInCondition	571	Suspicious assignment in condition. Condition 'x=y' is always true.
bitwiseOnBoolean	398	Boolean expression 'expression' is used in bitwise operation. Did you mean '&&'?
catchExceptionByValue	398	Exception should be caught by reference.
clarifyCalculation	783	Clarify calculation precedence for '+' and '?'.
clarifyCondition	398	Suspicious condition (assignment + comparison); Clarify expression with parentheses.
commaSeparatedReturn	398	Comma is used in return statement. The comma can easily be misread as a ';'.
compareValueOutOfTypeRangeError	398	Comparing expression of type 'unsigned char' against value 256. Condition is always true.
comparisonError	398	Expression '(X & 0x6) == 0x1' is always false.
comparisonOfBoolWithBoolError	398	Comparison of a variable having boolean value using relational (<, >, <= or >=) operator.
comparisonOfFuncReturningBoolError	398	Comparison of a function returning boolean value using relational (<, >, <= or >=) operator.
comparisonOfTwoFuncsReturningBoolError	398	Comparison of two functions returning boolean value using relational (<, >, <= or >=) operator.
constParameter	—	Parameter 'x' can be declared with const
constParameterCallback	—	Parameter 'x' can be declared with const, however it seems that 'f' is a callback function.
constParameterPointer	—	Parameter 'x' can be declared with const
constParameterReference	—	Parameter 'x' can be declared with const
constVariable	—	Variable 'x' can be declared with const
constVariablePointer	—	Variable 'x' can be declared with const
constVariableReference	—	Variable 'x' can be declared with const
cstyleCast	398	C-style pointer casting
duplicateAssignExpression	398	Same expression used in consecutive assignments of 'x' and 'x'.
duplicateBranch	398	Found duplicate branches for 'if' and 'else'.
duplicateBreak	561	Consecutive return, break, continue, goto or throw statements are unnecessary.
duplicateCondition	398	The if condition is the same as the previous if condition
duplicateConditionalAssign	398	Duplicate expression for the condition and assignment.
duplicateExpression	398	Same expression on both sides of '&&'.
duplicateExpressionTernary	398	Same expression in both branches of ternary operator.
duplicateValueTernary	398	Same value in both branches of ternary operator.
exceptRethrowCopy	398	Throwing a copy of the caught exception instead of rethrowing the original exception.
funcArgNamesDifferent	628	Function 'function' argument 2 names different: declaration '<unnamed>' definition '<unnamed>'.
functionConst	398	Technically the member function 'class::function' can be const.
functionStatic	398	The member function 'class::function' can be static.
ignoredReturnErrorCode	252	Error code from the return value of function func_name() is not used.
incrementboolean	398	Incrementing a variable of type 'bool' with postfix operator++ is deprecated by the C++ Standard. You should assign it the value 'true' instead.
initializerList	398	Member variable 'class::variable' is in the wrong place in the initializer list.
knownArgument	—	Argument 'x-x' to function 'func' is always 0. It does not matter what value 'x' has.
knownArgumentHiddenVariableExpression	—	Argument 'x*0' to function 'func' is always 0. Constant literal calculation disable/hide variable expression 'x'.
knownConditionTrueFalse	570	Condition 'x' is always false
knownEmptyContainer	398	Iterating over container 'var' that is always empty.
knownPointerToBool	—	Pointer expression 'p' converted to bool is always true.
mismatchingBitAnd	398	Mismatching bitmasks. Result is always 0 (X = Y & 0xf0; Z = X & 0x1; => Z=0).
missingOverride	—	The function '' overrides a function in a base class but is not marked with a 'override' specifier.
moduloofone	—	Modulo of one is always equal to zero
multiCondition	398	Expression is always false because 'else if' condition matches previous condition at line 1.
nanInArithmeticExpression	369	Using NaN/Inf in a computation.
noConstructor	398	The class 'classname' does not declare a constructor although it has private member variables which likely require initialization.
noExplicitConstructor	398	Class 'classname' has a constructor with 1 argument that is not explicit.
operatorEqRetRefThis	398	'operator=' should return reference to 'this' instance.
operatorEqShouldBeLeftUnimplemented	398	'operator=' should either return reference to 'this' instance or be declared private and left unimplemented.
oppositeExpression	398	Opposite expression on both sides of '&&'.
pointerLessThanZero	570	A pointer can not be negative so it is either pointless or an error to check if it is.
pointerPositive	570	A pointer can not be negative so it is either pointless or an error to check if it is not.
redundantAssignInSwitch	563	Variable 'var' is reassigned a value before the old one has been used. 'break;' missing?
redundantAssignment	563	Variable 'var' is reassigned a value before the old one has been used.
redundantBitwiseOperationInSwitch	—	Redundant bitwise operation on 'varname' in 'switch' statement. 'break;' missing?
redundantCondition	398	Redundant condition: If x > 11 the condition x > 10 is always true.
redundantContinue	561	'continue' is redundant since it is the last statement in a loop.
redundantIfRemove	398	Redundant checking of STL container element existence before removing it.
redundantInitialization	563	Redundant initialization for 'var'. The initialized value is overwritten before it is read.
redundantPointerOp	398	Redundant pointer operation on 'varname' - it's already a pointer.
returnNonBoolInBooleanFunction	—	Non-boolean value returned from function returning bool
sameIteratorExpression	664	Same iterators expression are used for algorithm.
selfAssignment	398	Redundant assignment of 'varname' to itself.
shadowArgument	398	Local variable 'local variable' shadows outer argument
shadowFunction	398	Local variable 'local variable' shadows outer function
shadowMember	398	Local variable 'local variable' shadows outer member
shadowVariable	398	Local variable 'local variable' shadows outer variable
staticFunction	—	The function 'funcName' should have static linkage since it is not used outside of its translation unit.
suspiciousFloatingPointCast	398	Floating-point cast causes loss of precision.
truncLongCastAssignment	197	int result is assigned to long variable. If the variable is long to avoid loss of information, then you have loss of information.
truncLongCastReturn	197	int result is returned as long value. If the return value is long to avoid loss of information, then you have loss of information.
unassignedVariable	665	Variable 'varname' is not assigned a value.
unhandledExceptionSpecification	703	Unhandled exception specification when calling function foo().
unpreciseMathCall	758	Expression '1 - erf(x)' can be replaced by 'erfc(x)' to avoid loss of precision.
unreachableCode	561	Statements following return, break, continue, goto or throw will never be executed.
unreadVariable	563	Variable 'varname' is assigned a value that is never used.
unsafeClassCanLeak	398	Class 'class' is unsafe, 'class::varname' can leak by wrong usage.
unsignedLessThanZero	570	Checking if unsigned expression 'varname' is less than zero.
unsignedPositive	570	Unsigned expression 'varname' can't be negative so it is unnecessary to test it.
unusedAllocatedMemory	563	Variable 'varname' is allocated memory that is never used.
unusedFunction	561	The function 'funcName' is never used.
unusedLabel	398	Label '' is not used.
unusedLabelConfiguration	398	Label '' is not used. There is #if in function body so the label might be used in code that is removed by the preprocessor.
unusedPrivateFunction	398	Unused private function: 'classname::funcname'
unusedScopedObject	563	Instance of 'varname' object is destroyed immediately.
unusedStructMember	563	struct member 'structname::variable' is never used.
unusedVariable	563	Unused variable: varname
uselessAssignmentArg	398	Assignment of function parameter has no effect outside the function.
uselessOverride	—	The function '' overrides a function in a base class but just delegates back to the base class.
useStandardLibrary	—	Consider using memcpy instead of loop.
useStlAlgorithm	398	Consider using algorithm instead of a raw loop.
variableScope	398	The scope of the variable 'varname' can be reduced.
virtualCallInConstructor	—	Virtual function 'f' is called from constructor '' at line 1. Dynamic binding is not used.

performance（性能）（19 项）

Error ID	CWE	说明（cppcheck 原始消息）
passedByValue	398	Function parameter '' should be passed by const reference.
postfixOperator	398	Prefer prefix ++/-- operators for non-primitive types.
redundantCopy	563	Buffer 'var' is being written before its old content has been used.
redundantCopyLocalConst	398	Use const reference for 'varname' to avoid unnecessary data copying.
returnByReference	—	Function 'func()' should return member 'var' by const reference.
returnStdMoveLocal	—	Using std::move for returning object by-value from function will affect copy elision optimization. More: https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#Rf-return-move-local
stlcstrAssignment	704	Assigning the result of c_str() to a std::string is slow and redundant.
stlcstrConcat	704	Concatenating the result of c_str() and a std::string is slow and redundant.
stlcstrConstructor	704	Constructing a std::string from the result of c_str() is slow and redundant.
stlcstrParam	704	Passing the result of c_str() to a function that takes std::string as argument no. 0 is slow and redundant.
stlcstrReturn	704	Returning the result of c_str() in a function that returns std::string is slow and redundant.
stlcstrStream	704	Passing the result of c_str() to a stream is slow and redundant.
stlFindInsert	398	Searching before insertion is not necessary.
stlIfStrFind	597	Inefficient usage of string::find() in condition; string::starts_with() could be faster.
stlSize	398	Possible inefficient checking for 'list' emptiness.
useInitializationList	398	Variable 'variable' is assigned in constructor body. Consider performing initialization in initialization list.
uselessCallsConstructor	398	Inefficient constructor call: container '' is assigned a partial copy of itself. Use erase() or resize() instead.
uselessCallsSubstr	398	Ineffective call of function 'substr' because it returns a copy of the object. Use operator= instead.
uselessCallsSwap	628	It is inefficient to swap a object with itself by calling 'str.swap(str)'

portability（可移植性）（20 项）

Error ID	CWE	说明（cppcheck 原始消息）
arithOperationsOnVoidPointer	467	'varname' is of type 'vartype'. When using void pointers in calculations, the behaviour is undefined.
AssignmentAddressToInteger	758	Assigning a pointer to an integer is not portable.
AssignmentIntegerToAddress	758	Assigning an integer to a pointer is not portable.
CastAddressToIntegerAtReturn	758	Returning an address value in a function with integer return type is not portable.
CastIntegerToAddressAtReturn	758	Returning an integer in a function with pointer return type is not portable.
fflushOnInputStream	398	fflush() called on input stream 'stdin' may result in undefined behaviour on non-linux systems.
intToPointerCast	398	Casting non-zero decimal integer literal to pointer.
invalidConstFunctionType	—	It is unspecified behavior to const qualify a function type.
invalidPointerCast	704	Casting between float * and double * which have an incompatible binary data representation.
memsetClassFloat	758	Using memset() on class which contains a floating point number.
memsetFloat	688	The 2nd memset() argument 'varname' is a float, its representation is implementation defined.
nonStandardCharLiteral	—	Non-standard character literal.
pointerOutOfBounds	758	Pointer arithmetic overflow.
pointerOutOfBoundsCond	758	Pointer arithmetic overflow.
shiftNegativeLHS	758	Shifting a negative value is technically undefined behaviour
sizeofDereferencedVoidPointer	682	'*varname' is of type 'void', the behaviour of 'sizeof(void)' is not covered by the ISO C standard.
sizeofVoid	682	Behaviour of 'sizeof(void)' is not covered by the ISO C standard.
UnionZeroInit	—	Zero initializing union '' does not guarantee its complete storage to be zero initialized as its largest member is not declared as the first member. Consider making the first member or favor memset().
unknownSignCharArrayIndex	758	'char' type used as array index.
varFuncNullUB	475	Passing NULL after the last typed argument to a variadic function leads to undefined behaviour.

information（信息）（5 项）

Error ID	CWE	说明（cppcheck 原始消息）
class_X_Y	—	The code ' ' is not handled. You can use -I or --include to add handling of this code.
missingInclude	—	Include file: "" not found.
missingIncludeSystem	—	Include file: <> not found. Please note: Standard library headers do not need to be provided to get proper results.
purgedConfiguration	—	The configuration '' was not checked because its code equals another one.
toomanyconfigs	398	Too many #ifdef configurations - cppcheck only checks 12 of 0 configurations. Use --force to check all configurations.

4 附加能力（MISRA / 规则文件 / 抑制 / CWE）

• 编码规范插件（addon）：--addon=misra 校验 MISRA C 2012；另有 cert、y2038、threadsafety 等 addon。需配 --addon=misra.json 指定规则文本映射。
• 自定义规则：--rule="<regex>" 或 --rule-file=rules.xml 可用正则/Token 表达式定义项目专有检查，用于落地几何内核等领域特有的可静态化约束。
• 内联抑制：在代码中写 // cppcheck-suppress <errorId>（上一行或行内），用于已确认的误报；项目级误报集中在 suppressions.txt。
• CWE 映射：每个检查项带有 cwe 属性，便于与安全合规（如 SEI CERT、CWE Top 25）对接。

---

5 标准知识条目列表

本节分两层：§5.2 标准条目覆盖全部 342 项代码缺陷检查规则（含规则说明）；§5.3 深度解析对高频重点检查补充成因、示例、修复与案例。

5.1 条目字段说明

标准条目（§5.2）字段：规则编号、严重级别、CWE、漏洞描述（规则说明）、日志特征。深度解析（§5.3）在此基础上补充：产生原因、影响范围、典型输入、修复建议、相关案例、关联规则。规则编号采用 cppcheck 原生 error id，检测日志方括号内的 id 可直接定位本条目。

5.2 全部检查项·标准知识条目（342 条）

代码缺陷检查规则的标准知识条目，共 342 项（按严重级别分组；每条含 Error ID、严重级别、CWE、说明与日志特征）。高频重点检查的成因/示例/修复/案例见 §5.3。

error（错误）（93 项）

arrayIndexOutOfBounds — error · CWE-788

• 规则编号：arrayIndexOutOfBounds
• 严重级别：error
• CWE：CWE-788
• 漏洞描述：Array 'arr[16]' accessed at index 16, which is out of bounds.
• 日志特征：检测日志以 [arrayIndexOutOfBounds] 标识（<file>:<line>:<col>: error: ... [arrayIndexOutOfBounds]）

assignBoolToPointer — error · CWE-587

• 规则编号：assignBoolToPointer
• 严重级别：error
• CWE：CWE-587
• 漏洞描述：Boolean value assigned to pointer.
• 日志特征：检测日志以 [assignBoolToPointer] 标识（<file>:<line>:<col>: error: ... [assignBoolToPointer]）

autoVariables — error · CWE-562

• 规则编号：autoVariables
• 严重级别：error
• CWE：CWE-562
• 漏洞描述：Dangerous assignment - the function parameter is assigned the address of a local auto-variable. Local auto-variables are reserved from the stack which is freed when the function ends. So the pointer to a local variable is invalid after the function ends.
• 日志特征：检测日志以 [autoVariables] 标识（<file>:<line>:<col>: error: ... [autoVariables]）

autovarInvalidDeallocation — error · CWE-590

• 规则编号：autovarInvalidDeallocation
• 严重级别：error
• CWE：CWE-590
• 漏洞描述：The deallocation of an auto-variable results in undefined behaviour. You should only free memory that has been allocated dynamically.
• 日志特征：检测日志以 [autovarInvalidDeallocation] 标识（<file>:<line>:<col>: error: ... [autovarInvalidDeallocation]）

bufferAccessOutOfBounds — error · CWE-788

• 规则编号：bufferAccessOutOfBounds
• 严重级别：error
• CWE：CWE-788
• 漏洞描述：Buffer is accessed out of bounds: buf
• 日志特征：检测日志以 [bufferAccessOutOfBounds] 标识（<file>:<line>:<col>: error: ... [bufferAccessOutOfBounds]）

comparePointers — error · CWE-758

• 规则编号：comparePointers
• 严重级别：error
• CWE：CWE-758
• 漏洞描述：Comparing pointers that point to different objects
• 日志特征：检测日志以 [comparePointers] 标识（<file>:<line>:<col>: error: ... [comparePointers]）

containerOutOfBounds — error · CWE-398

• 规则编号：containerOutOfBounds
• 严重级别：error
• CWE：CWE-398
• 漏洞描述：Out of bounds access in expression 'container[x]'
• 日志特征：检测日志以 [containerOutOfBounds] 标识（<file>:<line>:<col>: error: ... [containerOutOfBounds]）

containerOutOfBoundsIndexExpression — error · CWE-398

• 规则编号：containerOutOfBoundsIndexExpression
• 严重级别：error
• CWE：CWE-398
• 漏洞描述：Out of bounds access of var, index 'var.size()' is out of bounds.
• 日志特征：检测日志以 [containerOutOfBoundsIndexExpression] 标识（<file>:<line>:<col>: error: ... [containerOutOfBoundsIndexExpression]）

coutCerrMisusage — error · CWE-398

• 规则编号：coutCerrMisusage
• 严重级别：error
• CWE：CWE-398
• 漏洞描述：Invalid usage of output stream: '<< std::cout'.
• 日志特征：检测日志以 [coutCerrMisusage] 标识（<file>:<line>:<col>: error: ... [coutCerrMisusage]）

danglingLifetime — error · CWE-562

• 规则编号：danglingLifetime
• 严重级别：error
• CWE：CWE-562
• 漏洞描述：Non-local variable 'x' will use object.
• 日志特征：检测日志以 [danglingLifetime] 标识（<file>:<line>:<col>: error: ... [danglingLifetime]）

danglingReference — error · CWE-562

• 规则编号：danglingReference
• 严重级别：error
• CWE：CWE-562
• 漏洞描述：Non-local reference variable 'x' to local variable 'y'
• 日志特征：检测日志以 [danglingReference] 标识（<file>:<line>:<col>: error: ... [danglingReference]）

danglingTemporaryLifetime — error · CWE-562

• 规则编号：danglingTemporaryLifetime
• 严重级别：error
• CWE：CWE-562
• 漏洞描述：Using object that is a temporary.
• 日志特征：检测日志以 [danglingTemporaryLifetime] 标识（<file>:<line>:<col>: error: ... [danglingTemporaryLifetime]）

danglingTempReference — error · CWE-562

• 规则编号：danglingTempReference
• 严重级别：error
• CWE：CWE-562
• 漏洞描述：Using reference to dangling temporary.
• 日志特征：检测日志以 [danglingTempReference] 标识（<file>:<line>:<col>: error: ... [danglingTempReference]）

deallocret — error · CWE-672

• 规则编号：deallocret
• 严重级别：error
• CWE：CWE-672
• 漏洞描述：Returning/dereferencing 'p' after it is deallocated / released
• 日志特征：检测日志以 [deallocret] 标识（<file>:<line>:<col>: error: ... [deallocret]）

deallocuse — error · CWE-416

• 规则编号：deallocuse
• 严重级别：error
• CWE：CWE-416
• 漏洞描述：Dereferencing 'varname' after it is deallocated / released
• 日志特征：检测日志以 [deallocuse] 标识（<file>:<line>:<col>: error: ... [deallocuse]）

doubleFree — error · CWE-415

• 规则编号：doubleFree
• 严重级别：error
• CWE：CWE-415
• 漏洞描述：Memory pointed to by 'varname' is freed twice.
• 日志特征：检测日志以 [doubleFree] 标识（<file>:<line>:<col>: error: ... [doubleFree]）

eraseDereference — error · CWE-664

• 规则编号：eraseDereference
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：The iterator 'iter' is invalid before being assigned. Dereferencing or comparing it with another iterator is invalid operation.
• 日志特征：检测日志以 [eraseDereference] 标识（<file>:<line>:<col>: error: ... [eraseDereference]）

eraseIteratorOutOfBounds — error · CWE-628

• 规则编号：eraseIteratorOutOfBounds
• 严重级别：error
• CWE：CWE-628
• 漏洞描述：Calling function 'erase()' on the iterator 'iter' which is out of bounds.
• 日志特征：检测日志以 [eraseIteratorOutOfBounds] 标识（<file>:<line>:<col>: error: ... [eraseIteratorOutOfBounds]）

floatConversionOverflow — error · CWE-190

• 规则编号：floatConversionOverflow
• 严重级别：error
• CWE：CWE-190
• 漏洞描述：Undefined behaviour: float (1e+100) to integer conversion overflow.
• 日志特征：检测日志以 [floatConversionOverflow] 标识（<file>:<line>:<col>: error: ... [floatConversionOverflow]）

includeNestedTooDeeply — error

• 规则编号：includeNestedTooDeeply
• 严重级别：error
• CWE：—
• 漏洞描述：message
• 日志特征：检测日志以 [includeNestedTooDeeply] 标识（<file>:<line>:<col>: error: ... [includeNestedTooDeeply]）

integerOverflow — error · CWE-190

• 规则编号：integerOverflow
• 严重级别：error
• CWE：CWE-190
• 漏洞描述：Signed integer overflow for expression ''.
• 日志特征：检测日志以 [integerOverflow] 标识（<file>:<line>:<col>: error: ... [integerOverflow]）

invalidContainer — error · CWE-664

• 规则编号：invalidContainer
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：Using object that may be invalid.
• 日志特征：检测日志以 [invalidContainer] 标识（<file>:<line>:<col>: error: ... [invalidContainer]）

invalidContainerLoop — error · CWE-664

• 规则编号：invalidContainerLoop
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：Calling 'erase' while iterating the container is invalid.
• 日志特征：检测日志以 [invalidContainerLoop] 标识（<file>:<line>:<col>: error: ... [invalidContainerLoop]）

invalidContainerReference — error · CWE-664

• 规则编号：invalidContainerReference
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：Reference to x that may be invalid.
• 日志特征：检测日志以 [invalidContainerReference] 标识（<file>:<line>:<col>: error: ... [invalidContainerReference]）

invalidFree — error

• 规则编号：invalidFree
• 严重级别：error
• CWE：—
• 漏洞描述：Mismatching address is freed. The address you get from malloc() must be freed without offset.
• 日志特征：检测日志以 [invalidFree] 标识（<file>:<line>:<col>: error: ... [invalidFree]）

invalidFunctionArg — error · CWE-628

• 规则编号：invalidFunctionArg
• 严重级别：error
• CWE：CWE-628
• 漏洞描述：Invalid func_name() argument nr 1. The value is 0 or 1 (boolean) but the valid values are '1:4'.
• 日志特征：检测日志以 [invalidFunctionArg] 标识（<file>:<line>:<col>: error: ... [invalidFunctionArg]）

invalidFunctionArgBool — error · CWE-628

• 规则编号：invalidFunctionArgBool
• 严重级别：error
• CWE：CWE-628
• 漏洞描述：Invalid func_name() argument nr 1. A non-boolean value is required.
• 日志特征：检测日志以 [invalidFunctionArgBool] 标识（<file>:<line>:<col>: error: ... [invalidFunctionArgBool]）

invalidFunctionArgStr — error · CWE-628

• 规则编号：invalidFunctionArgStr
• 严重级别：error
• CWE：CWE-628
• 漏洞描述：Invalid func_name() argument nr 1. A nul-terminated string is required.
• 日志特征：检测日志以 [invalidFunctionArgStr] 标识（<file>:<line>:<col>: error: ... [invalidFunctionArgStr]）

invalidIterator1 — error · CWE-664

• 规则编号：invalidIterator1
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：Invalid iterator: iterator
• 日志特征：检测日志以 [invalidIterator1] 标识（<file>:<line>:<col>: error: ... [invalidIterator1]）

invalidLifetime — error · CWE-562

• 规则编号：invalidLifetime
• 严重级别：error
• CWE：CWE-562
• 漏洞描述：Using object that is out of scope.
• 日志特征：检测日志以 [invalidLifetime] 标识（<file>:<line>:<col>: error: ... [invalidLifetime]）

invalidScanfFormatWidth — error · CWE-687

• 规则编号：invalidScanfFormatWidth
• 严重级别：error
• CWE：CWE-687
• 漏洞描述：Width 5 given in format string (no. 10) is larger than destination buffer '[0]', use %-1s to prevent overflowing it.
• 日志特征：检测日志以 [invalidScanfFormatWidth] 标识（<file>:<line>:<col>: error: ... [invalidScanfFormatWidth]）

invalidSuppression — error

• 规则编号：invalidSuppression
• 严重级别：error
• CWE：—
• 漏洞描述：message
• 日志特征：检测日志以 [invalidSuppression] 标识（<file>:<line>:<col>: error: ... [invalidSuppression]）

IOWithoutPositioning — error · CWE-664

• 规则编号：IOWithoutPositioning
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：Read and write operations without a call to a positioning function (fseek, fsetpos or rewind) or fflush in between result in undefined behaviour.
• 日志特征：检测日志以 [IOWithoutPositioning] 标识（<file>:<line>:<col>: error: ... [IOWithoutPositioning]）

iterators1 — error · CWE-664

• 规则编号：iterators1
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：Same iterator is used with different containers 'container1' and 'container2'.
• 日志特征：检测日志以 [iterators1] 标识（<file>:<line>:<col>: error: ... [iterators1]）

iterators3 — error · CWE-664

• 规则编号：iterators3
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：Same iterator is used with containers 'container' that are temporaries or defined in different scopes.
• 日志特征：检测日志以 [iterators3] 标识（<file>:<line>:<col>: error: ... [iterators3]）

leakNoVarFunctionCall — error · CWE-772

• 规则编号：leakNoVarFunctionCall
• 严重级别：error
• CWE：CWE-772
• 漏洞描述：Allocation with funcName, funcName doesn't release it.
• 日志特征：检测日志以 [leakNoVarFunctionCall] 标识（<file>:<line>:<col>: error: ... [leakNoVarFunctionCall]）

leakReturnValNotUsed — error · CWE-771

• 规则编号：leakReturnValNotUsed
• 严重级别：error
• CWE：CWE-771
• 漏洞描述：Return value of allocation function 'funcName' is not stored.
• 日志特征：检测日志以 [leakReturnValNotUsed] 标识（<file>:<line>:<col>: error: ... [leakReturnValNotUsed]）

mallocOnClassError — error · CWE-665

• 规则编号：mallocOnClassError
• 严重级别：error
• CWE：CWE-665
• 漏洞描述：Memory for class instance allocated with malloc(), but class a std::string. This is unsafe, since no constructor is called and class members remain uninitialized. Consider using 'new' instead.
• 日志特征：检测日志以 [mallocOnClassError] 标识（<file>:<line>:<col>: error: ... [mallocOnClassError]）

memleak — error · CWE-401

• 规则编号：memleak
• 严重级别：error
• CWE：CWE-401
• 漏洞描述：Memory leak: varname
• 日志特征：检测日志以 [memleak] 标识（<file>:<line>:<col>: error: ... [memleak]）

memleakOnRealloc — error · CWE-401

• 规则编号：memleakOnRealloc
• 严重级别：error
• CWE：CWE-401
• 漏洞描述：Common realloc mistake: 'varname' nulled but not freed upon failure
• 日志特征：检测日志以 [memleakOnRealloc] 标识（<file>:<line>:<col>: error: ... [memleakOnRealloc]）

memsetClass — error · CWE-762

• 规则编号：memsetClass
• 严重级别：error
• CWE：CWE-762
• 漏洞描述：Using 'memfunc' on class that contains a classname is unsafe, because constructor, destructor and copy operator calls are omitted. These are necessary for this non-POD type to ensure that a valid object is created.
• 日志特征：检测日志以 [memsetClass] 标识（<file>:<line>:<col>: error: ... [memsetClass]）

memsetClassReference — error · CWE-665

• 规则编号：memsetClassReference
• 严重级别：error
• CWE：CWE-665
• 漏洞描述：Using 'memfunc' on class that contains a reference.
• 日志特征：检测日志以 [memsetClassReference] 标识（<file>:<line>:<col>: error: ... [memsetClassReference]）

mismatchAllocDealloc — error · CWE-762

• 规则编号：mismatchAllocDealloc
• 严重级别：error
• CWE：CWE-762
• 漏洞描述：Mismatching allocation and deallocation: varname
• 日志特征：检测日志以 [mismatchAllocDealloc] 标识（<file>:<line>:<col>: error: ... [mismatchAllocDealloc]）

mismatchingContainerIterator — error · CWE-664

• 规则编号：mismatchingContainerIterator
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：Iterator 'it' referring to container 'v2' is used with container 'v1'.
• 日志特征：检测日志以 [mismatchingContainerIterator] 标识（<file>:<line>:<col>: error: ... [mismatchingContainerIterator]）

mismatchingContainers — error · CWE-664

• 规则编号：mismatchingContainers
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：Iterators of different containers 'v1' and 'v2' are used together.
• 日志特征：检测日志以 [mismatchingContainers] 标识（<file>:<line>:<col>: error: ... [mismatchingContainers]）

missingFile — error

• 规则编号：missingFile
• 严重级别：error
• CWE：—
• 漏洞描述：message
• 日志特征：检测日志以 [missingFile] 标识（<file>:<line>:<col>: error: ... [missingFile]）

missingIncludeExplicit — error

• 规则编号：missingIncludeExplicit
• 严重级别：error
• CWE：—
• 漏洞描述：message
• 日志特征：检测日志以 [missingIncludeExplicit] 标识（<file>:<line>:<col>: error: ... [missingIncludeExplicit]）

missingReturn — error · CWE-758

• 规则编号：missingReturn
• 严重级别：error
• CWE：CWE-758
• 漏洞描述：Found an exit path from function with non-void return type that has missing return statement
• 日志特征：检测日志以 [missingReturn] 标识（<file>:<line>:<col>: error: ... [missingReturn]）

negativeArraySize — error · CWE-758

• 规则编号：negativeArraySize
• 严重级别：error
• CWE：CWE-758
• 漏洞描述：Declaration of array '' with negative size is undefined behaviour
• 日志特征：检测日志以 [negativeArraySize] 标识（<file>:<line>:<col>: error: ... [negativeArraySize]）

negativeIndex — error · CWE-786

• 规则编号：negativeIndex
• 严重级别：error
• CWE：CWE-786
• 漏洞描述：Negative array index
• 日志特征：检测日志以 [negativeIndex] 标识（<file>:<line>:<col>: error: ... [negativeIndex]）

negativeMemoryAllocationSize — error · CWE-131

• 规则编号：negativeMemoryAllocationSize
• 严重级别：error
• CWE：CWE-131
• 漏洞描述：Memory allocation size is negative.
• 日志特征：检测日志以 [negativeMemoryAllocationSize] 标识（<file>:<line>:<col>: error: ... [negativeMemoryAllocationSize]）

nullPointer — error · CWE-476

• 规则编号：nullPointer
• 严重级别：error
• CWE：CWE-476
• 漏洞描述：Null pointer dereference
• 日志特征：检测日志以 [nullPointer] 标识（<file>:<line>:<col>: error: ... [nullPointer]）

nullPointerArithmetic — error · CWE-682

• 规则编号：nullPointerArithmetic
• 严重级别：error
• CWE：CWE-682
• 漏洞描述：Pointer arithmetic with NULL pointer.
• 日志特征：检测日志以 [nullPointerArithmetic] 标识（<file>:<line>:<col>: error: ... [nullPointerArithmetic]）

objectIndex — error · CWE-758

• 规则编号：objectIndex
• 严重级别：error
• CWE：CWE-758
• 漏洞描述：The address of variable '' is accessed at non-zero index.
• 日志特征：检测日志以 [objectIndex] 标识（<file>:<line>:<col>: error: ... [objectIndex]）

operatorEqMissingReturnStatement — error · CWE-398

• 规则编号：operatorEqMissingReturnStatement
• 严重级别：error
• CWE：CWE-398
• 漏洞描述：No 'return' statement in non-void function causes undefined behavior.
• 日志特征：检测日志以 [operatorEqMissingReturnStatement] 标识（<file>:<line>:<col>: error: ... [operatorEqMissingReturnStatement]）

overlappingWriteFunction — error

• 规则编号：overlappingWriteFunction
• 严重级别：error
• CWE：—
• 漏洞描述：Overlapping read/write in funcname() is undefined behavior
• 日志特征：检测日志以 [overlappingWriteFunction] 标识（<file>:<line>:<col>: error: ... [overlappingWriteFunction]）

overlappingWriteUnion — error

• 规则编号：overlappingWriteUnion
• 严重级别：error
• CWE：—
• 漏洞描述：Overlapping read/write of union is undefined behavior
• 日志特征：检测日志以 [overlappingWriteUnion] 标识（<file>:<line>:<col>: error: ... [overlappingWriteUnion]）

pointerArithBool — error · CWE-571

• 规则编号：pointerArithBool
• 严重级别：error
• CWE：CWE-571
• 漏洞描述：Converting pointer arithmetic result to bool. The boolean result is always true unless there is pointer arithmetic overflow, and overflow is undefined behaviour. Probably a dereference is forgotten.
• 日志特征：检测日志以 [pointerArithBool] 标识（<file>:<line>:<col>: error: ... [pointerArithBool]）

preprocessorErrorDirective — error

• 规则编号：preprocessorErrorDirective
• 严重级别：error
• CWE：—
• 漏洞描述：message
• 日志特征：检测日志以 [preprocessorErrorDirective] 标识（<file>:<line>:<col>: error: ... [preprocessorErrorDirective]）

raceAfterInterlockedDecrement — error · CWE-362

• 规则编号：raceAfterInterlockedDecrement
• 严重级别：error
• CWE：CWE-362
• 漏洞描述：Race condition: non-interlocked access after InterlockedDecrement(). Use InterlockedDecrement() return value instead.
• 日志特征：检测日志以 [raceAfterInterlockedDecrement] 标识（<file>:<line>:<col>: error: ... [raceAfterInterlockedDecrement]）

readWriteOnlyFile — error · CWE-664

• 规则编号：readWriteOnlyFile
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：Read operation on a file that was opened only for writing.
• 日志特征：检测日志以 [readWriteOnlyFile] 标识（<file>:<line>:<col>: error: ... [readWriteOnlyFile]）

resourceLeak — error · CWE-775

• 规则编号：resourceLeak
• 严重级别：error
• CWE：CWE-775
• 漏洞描述：Resource leak: varname
• 日志特征：检测日志以 [resourceLeak] 标识（<file>:<line>:<col>: error: ... [resourceLeak]）

rethrowNoCurrentException — error · CWE-480

• 规则编号：rethrowNoCurrentException
• 严重级别：error
• CWE：CWE-480
• 漏洞描述：Rethrowing current exception with 'throw;', it seems there is no current exception to rethrow. If there is no current exception this calls std::terminate(). More: https://isocpp.org/wiki/faq/exceptions#throw-without-an-object
• 日志特征：检测日志以 [rethrowNoCurrentException] 标识（<file>:<line>:<col>: error: ... [rethrowNoCurrentException]）

returnDanglingLifetime — error · CWE-562

• 规则编号：returnDanglingLifetime
• 严重级别：error
• CWE：CWE-562
• 漏洞描述：Returning object that will be invalid when returning.
• 日志特征：检测日志以 [returnDanglingLifetime] 标识（<file>:<line>:<col>: error: ... [returnDanglingLifetime]）

returnReference — error · CWE-562

• 规则编号：returnReference
• 严重级别：error
• CWE：CWE-562
• 漏洞描述：Reference to local variable returned.
• 日志特征：检测日志以 [returnReference] 标识（<file>:<line>:<col>: error: ... [returnReference]）

returnTempReference — error · CWE-562

• 规则编号：returnTempReference
• 严重级别：error
• CWE：CWE-562
• 漏洞描述：Reference to temporary returned.
• 日志特征：检测日志以 [returnTempReference] 标识（<file>:<line>:<col>: error: ... [returnTempReference]）

selfInitialization — error · CWE-665

• 规则编号：selfInitialization
• 严重级别：error
• CWE：CWE-665
• 漏洞描述：Member variable 'var' is initialized by itself.
• 日志特征：检测日志以 [selfInitialization] 标识（<file>:<line>:<col>: error: ... [selfInitialization]）

shiftNegative — error · CWE-758

• 规则编号：shiftNegative
• 严重级别：error
• CWE：CWE-758
• 漏洞描述：Shifting by a negative value is undefined behaviour
• 日志特征：检测日志以 [shiftNegative] 标识（<file>:<line>:<col>: error: ... [shiftNegative]）

shiftTooManyBits — error · CWE-758

• 规则编号：shiftTooManyBits
• 严重级别：error
• CWE：CWE-758
• 漏洞描述：Shifting 32-bit value by 40 bits is undefined behaviour
• 日志特征：检测日志以 [shiftTooManyBits] 标识（<file>:<line>:<col>: error: ... [shiftTooManyBits]）

shiftTooManyBitsSigned — error · CWE-758

• 规则编号：shiftTooManyBitsSigned
• 严重级别：error
• CWE：CWE-758
• 漏洞描述：Shifting signed 32-bit value by 31 bits is undefined behaviour
• 日志特征：检测日志以 [shiftTooManyBitsSigned] 标识（<file>:<line>:<col>: error: ... [shiftTooManyBitsSigned]）

sprintfOverlappingData — error · CWE-628

• 规则编号：sprintfOverlappingData
• 严重级别：error
• CWE：CWE-628
• 漏洞描述：The variable 'varname' is used both as a parameter and as destination in s[n]printf(). The origin and destination buffers overlap. Quote from glibc (C-library) documentation (http://www.gnu.org/software/libc/manual/html_mono/libc.html#Formatted-Output-Functions): "If copying takes place between objects that overlap as a result of a call to sprintf() or snprintf(), the results are undefined."
• 日志特征：检测日志以 [sprintfOverlappingData] 标识（<file>:<line>:<col>: error: ... [sprintfOverlappingData]）

stlBoundaries — error · CWE-664

• 规则编号：stlBoundaries
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：Iterator compared with operator<. This is dangerous since the order of items in the container is not guaranteed. One should use operator!= instead to compare iterators.
• 日志特征：检测日志以 [stlBoundaries] 标识（<file>:<line>:<col>: error: ... [stlBoundaries]）

stlcstr — error · CWE-664

• 规则编号：stlcstr
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：Dangerous usage of c_str(). The c_str() return value is only valid until its string is deleted.
• 日志特征：检测日志以 [stlcstr] 标识（<file>:<line>:<col>: error: ... [stlcstr]）

stlcstrthrow — error

• 规则编号：stlcstrthrow
• 严重级别：error
• CWE：—
• 漏洞描述：Dangerous usage of c_str(). The string is destroyed after the c_str() call so the thrown pointer is invalid.
• 日志特征：检测日志以 [stlcstrthrow] 标识（<file>:<line>:<col>: error: ... [stlcstrthrow]）

stlOutOfBounds — error · CWE-788

• 规则编号：stlOutOfBounds
• 严重级别：error
• CWE：CWE-788
• 漏洞描述：When i==foo.size(), foo[i] is out of bounds.
• 日志特征：检测日志以 [stlOutOfBounds] 标识（<file>:<line>:<col>: error: ... [stlOutOfBounds]）

stringLiteralWrite — error · CWE-758

• 规则编号：stringLiteralWrite
• 严重级别：error
• CWE：CWE-758
• 漏洞描述：Modifying string literal directly or indirectly is undefined behaviour.
• 日志特征：检测日志以 [stringLiteralWrite] 标识（<file>:<line>:<col>: error: ... [stringLiteralWrite]）

strPlusChar — error · CWE-665

• 规则编号：strPlusChar
• 严重级别：error
• CWE：CWE-665
• 漏洞描述：Unusual pointer arithmetic. A value of type 'char' is added to a string literal.
• 日志特征：检测日志以 [strPlusChar] 标识（<file>:<line>:<col>: error: ... [strPlusChar]）

syntaxError — error

• 规则编号：syntaxError
• 严重级别：error
• CWE：—
• 漏洞描述：message
• 日志特征：检测日志以 [syntaxError] 标识（<file>:<line>:<col>: error: ... [syntaxError]）

throwInEntryPoint — error · CWE-398

• 规则编号：throwInEntryPoint
• 严重级别：error
• CWE：CWE-398
• 漏洞描述：Unhandled exception thrown in function that is an entry point.
• 日志特征：检测日志以 [throwInEntryPoint] 标识（<file>:<line>:<col>: error: ... [throwInEntryPoint]）

throwInNoexceptFunction — error · CWE-398

• 规则编号：throwInNoexceptFunction
• 严重级别：error
• CWE：CWE-398
• 漏洞描述：Unhandled exception thrown in function declared not to throw exceptions.
• 日志特征：检测日志以 [throwInNoexceptFunction] 标识（<file>:<line>:<col>: error: ... [throwInNoexceptFunction]）

unhandledChar — error

• 规则编号：unhandledChar
• 严重级别：error
• CWE：—
• 漏洞描述：message
• 日志特征：检测日志以 [unhandledChar] 标识（<file>:<line>:<col>: error: ... [unhandledChar]）

uninitdata — error · CWE-457

• 规则编号：uninitdata
• 严重级别：error
• CWE：CWE-457
• 漏洞描述：Memory is allocated but not initialized: varname
• 日志特征：检测日志以 [uninitdata] 标识（<file>:<line>:<col>: error: ... [uninitdata]）

uninitStructMember — error · CWE-457

• 规则编号：uninitStructMember
• 严重级别：error
• CWE：CWE-457
• 漏洞描述：Uninitialized struct member: a.b
• 日志特征：检测日志以 [uninitStructMember] 标识（<file>:<line>:<col>: error: ... [uninitStructMember]）

unknownEvaluationOrder — error · CWE-768

• 规则编号：unknownEvaluationOrder
• 严重级别：error
• CWE：CWE-768
• 漏洞描述：Expression 'x = x++;' depends on order of evaluation of side effects
• 日志特征：检测日志以 [unknownEvaluationOrder] 标识（<file>:<line>:<col>: error: ... [unknownEvaluationOrder]）

useClosedFile — error · CWE-910

• 规则编号：useClosedFile
• 严重级别：error
• CWE：CWE-910
• 漏洞描述：Used file that is not opened.
• 日志特征：检测日志以 [useClosedFile] 标识（<file>:<line>:<col>: error: ... [useClosedFile]）

va_end_missing — error · CWE-664

• 规则编号：va_end_missing
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：va_list 'vl' was opened but not closed by va_end().
• 日志特征：检测日志以 [va_end_missing] 标识（<file>:<line>:<col>: error: ... [va_end_missing]）

va_list_usedBeforeStarted — error · CWE-664

• 规则编号：va_list_usedBeforeStarted
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：va_list 'vl' used before va_start() was called.
• 日志特征：检测日志以 [va_list_usedBeforeStarted] 标识（<file>:<line>:<col>: error: ... [va_list_usedBeforeStarted]）

va_start_referencePassed — error · CWE-758

• 规则编号：va_start_referencePassed
• 严重级别：error
• CWE：CWE-758
• 漏洞描述：Using reference 'arg1' as parameter for va_start() results in undefined behaviour.
• 日志特征：检测日志以 [va_start_referencePassed] 标识（<file>:<line>:<col>: error: ... [va_start_referencePassed]）

va_start_subsequentCalls — error · CWE-664

• 规则编号：va_start_subsequentCalls
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：va_start() or va_copy() called subsequently on 'vl' without va_end() in between.
• 日志特征：检测日志以 [va_start_subsequentCalls] 标识（<file>:<line>:<col>: error: ... [va_start_subsequentCalls]）

virtualDestructor — error · CWE-404

• 规则编号：virtualDestructor
• 严重级别：error
• CWE：CWE-404
• 漏洞描述：Class 'Base' which is inherited by class 'Derived' does not have a virtual destructor. If you destroy instances of the derived class by deleting a pointer that points to the base class, only the destructor of the base class is executed. Thus, dynamic memory that is managed by the derived class could leak. This can be avoided by adding a virtual destructor to the base class.
• 日志特征：检测日志以 [virtualDestructor] 标识（<file>:<line>:<col>: error: ... [virtualDestructor]）

writeReadOnlyFile — error · CWE-664

• 规则编号：writeReadOnlyFile
• 严重级别：error
• CWE：CWE-664
• 漏洞描述：Write operation on a file that was opened only for reading.
• 日志特征：检测日志以 [writeReadOnlyFile] 标识（<file>:<line>:<col>: error: ... [writeReadOnlyFile]）

wrongPrintfScanfArgNum — error · CWE-685

• 规则编号：wrongPrintfScanfArgNum
• 严重级别：error
• CWE：CWE-685
• 漏洞描述：printf format string requires 3 parameters but only 2 are given.
• 日志特征：检测日志以 [wrongPrintfScanfArgNum] 标识（<file>:<line>:<col>: error: ... [wrongPrintfScanfArgNum]）

zerodiv — error · CWE-369

• 规则编号：zerodiv
• 严重级别：error
• CWE：CWE-369
• 漏洞描述：Division by zero.
• 日志特征：检测日志以 [zerodiv] 标识（<file>:<line>:<col>: error: ... [zerodiv]）

warning（警告）（110 项）

accessForwarded — warning · CWE-672

• 规则编号：accessForwarded
• 严重级别：warning
• CWE：CWE-672
• 漏洞描述：Access of forwarded variable 'v'.
• 日志特征：检测日志以 [accessForwarded] 标识（<file>:<line>:<col>: warning: ... [accessForwarded]）

accessMoved — warning · CWE-672

• 规则编号：accessMoved
• 严重级别：warning
• CWE：CWE-672
• 漏洞描述：Access of moved variable 'v'.
• 日志特征：检测日志以 [accessMoved] 标识（<file>:<line>:<col>: warning: ... [accessMoved]）

argumentSize — warning · CWE-398

• 规则编号：argumentSize
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Buffer 'buffer' is too small, the function 'function' expects a bigger buffer in 2nd argument
• 日志特征：检测日志以 [argumentSize] 标识（<file>:<line>:<col>: warning: ... [argumentSize]）

arrayIndexOutOfBoundsCond — warning · CWE-788

• 规则编号：arrayIndexOutOfBoundsCond
• 严重级别：warning
• CWE：CWE-788
• 漏洞描述：Array 'arr[16]' accessed at index 16, which is out of bounds.
• 日志特征：检测日志以 [arrayIndexOutOfBoundsCond] 标识（<file>:<line>:<col>: warning: ... [arrayIndexOutOfBoundsCond]）

assertWithSideEffect — warning · CWE-398

• 规则编号：assertWithSideEffect
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Non-pure function: 'function' is called inside assert statement. Assert statements are removed from release builds so the code inside assert statement is not executed. If the code is needed also in release builds, this is a bug.
• 日志特征：检测日志以 [assertWithSideEffect] 标识（<file>:<line>:<col>: warning: ... [assertWithSideEffect]）

assignmentInAssert — warning · CWE-398

• 规则编号：assignmentInAssert
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Variable 'var' is modified inside assert statement. Assert statements are removed from release builds so the code inside assert statement is not executed. If the code is needed also in release builds, this is a bug.
• 日志特征：检测日志以 [assignmentInAssert] 标识（<file>:<line>:<col>: warning: ... [assignmentInAssert]）

badBitmaskCheck — warning · CWE-571

• 规则编号：badBitmaskCheck
• 严重级别：warning
• CWE：CWE-571
• 漏洞描述：Result of operator '|' is always true if one operand is non-zero. Did you intend to use '&'?
• 日志特征：检测日志以 [badBitmaskCheck] 标识（<file>:<line>:<col>: warning: ... [badBitmaskCheck]）

charBitOp — warning · CWE-398

• 规则编号：charBitOp
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：When using 'char' variables in bit operations, sign extension can generate unexpected results. For example:\012 char c = 0x80;\012 int i = 0 | c;\012 if (i & 0x8000)\012 printf("not expected");\012The "not expected" will be printed on the screen.
• 日志特征：检测日志以 [charBitOp] 标识（<file>:<line>:<col>: warning: ... [charBitOp]）

charLiteralWithCharPtrCompare — warning · CWE-595

• 规则编号：charLiteralWithCharPtrCompare
• 严重级别：warning
• CWE：CWE-595
• 漏洞描述：Char literal compared with pointer 'foo'. Did you intend to dereference it?
• 日志特征：检测日志以 [charLiteralWithCharPtrCompare] 标识（<file>:<line>:<col>: warning: ... [charLiteralWithCharPtrCompare]）

checkCastIntToCharAndBack — warning · CWE-197

• 规则编号：checkCastIntToCharAndBack
• 严重级别：warning
• CWE：CWE-197
• 漏洞描述：When saving func_name() return value in char variable there is loss of precision. When func_name() returns EOF this value is truncated. Comparing the char variable with EOF can have unexpected results. For instance a loop "while (EOF != (c = func_name());" loops forever on some compilers/platforms and on other compilers/platforms it will stop when the file contains a matching character.
• 日志特征：检测日志以 [checkCastIntToCharAndBack] 标识（<file>:<line>:<col>: warning: ... [checkCastIntToCharAndBack]）

clarifyStatement — warning · CWE-783

• 规则编号：clarifyStatement
• 严重级别：warning
• CWE：CWE-783
• 漏洞描述：A statement like 'A++;' might not do what you intended. Postfix 'operator++' is executed before 'operator'. Thus, the dereference is meaningless. Did you intend to write '(*A)++;'?
• 日志特征：检测日志以 [clarifyStatement] 标识（<file>:<line>:<col>: warning: ... [clarifyStatement]）

compareBoolExpressionWithInt — warning · CWE-398

• 规则编号：compareBoolExpressionWithInt
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Comparison of a boolean expression with an integer other than 0 or 1.
• 日志特征：检测日志以 [compareBoolExpressionWithInt] 标识（<file>:<line>:<col>: warning: ... [compareBoolExpressionWithInt]）

comparisonFunctionIsAlwaysTrueOrFalse — warning · CWE-570

• 规则编号：comparisonFunctionIsAlwaysTrueOrFalse
• 严重级别：warning
• CWE：CWE-570
• 漏洞描述：The function isless is designed to compare two variables. Calling this function with one variable (varName) for both parameters leads to a statement which is always false.
• 日志特征：检测日志以 [comparisonFunctionIsAlwaysTrueOrFalse] 标识（<file>:<line>:<col>: warning: ... [comparisonFunctionIsAlwaysTrueOrFalse]）

comparisonOfBoolWithInvalidComparator — warning

• 规则编号：comparisonOfBoolWithInvalidComparator
• 严重级别：warning
• CWE：—
• 漏洞描述：The result of the expression 'expression' is of type 'bool'. Comparing 'bool' value using relational (<, >, <= or >=) operator could cause unexpected results.
• 日志特征：检测日志以 [comparisonOfBoolWithInvalidComparator] 标识（<file>:<line>:<col>: warning: ... [comparisonOfBoolWithInvalidComparator]）

constStatement — warning · CWE-398

• 规则编号：constStatement
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Redundant code: Found a statement that begins with type constant.
• 日志特征：检测日志以 [constStatement] 标识（<file>:<line>:<col>: warning: ... [constStatement]）

copyCtorAndEqOperator — warning

• 规则编号：copyCtorAndEqOperator
• 严重级别：warning
• CWE：—
• 漏洞描述：The class 'class' has 'operator=' but lack of 'copy constructor'.
• 日志特征：检测日志以 [copyCtorAndEqOperator] 标识（<file>:<line>:<col>: warning: ... [copyCtorAndEqOperator]）

copyCtorPointerCopying — warning · CWE-398

• 规则编号：copyCtorPointerCopying
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Value of pointer 'var', which points to allocated memory, is copied in copy constructor instead of allocating new memory.
• 日志特征：检测日志以 [copyCtorPointerCopying] 标识（<file>:<line>:<col>: warning: ... [copyCtorPointerCopying]）

dangerousTypeCast — warning · CWE-398

• 规则编号：dangerousTypeCast
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Potentially invalid type conversion in old-style C cast, clarify/fix with C++ cast
• 日志特征：检测日志以 [dangerousTypeCast] 标识（<file>:<line>:<col>: warning: ... [dangerousTypeCast]）

derefInvalidIterator — warning · CWE-825

• 规则编号：derefInvalidIterator
• 严重级别：warning
• CWE：CWE-825
• 漏洞描述：Possible dereference of an invalid iterator: i. Make sure to check that the iterator is valid before dereferencing it - not after.
• 日志特征：检测日志以 [derefInvalidIterator] 标识（<file>:<line>:<col>: warning: ... [derefInvalidIterator]）

divideSizeof — warning · CWE-682

• 规则编号：divideSizeof
• 严重级别：warning
• CWE：CWE-682
• 漏洞描述：Division of result of sizeof() on pointer type. sizeof() returns the size of the pointer, not the size of the memory area it points to.
• 日志特征：检测日志以 [divideSizeof] 标识（<file>:<line>:<col>: warning: ... [divideSizeof]）

duplInheritedMember — warning · CWE-398

• 规则编号：duplInheritedMember
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：The class 'class' defines member variable with name 'variable' also defined in its parent class 'class'.
• 日志特征：检测日志以 [duplInheritedMember] 标识（<file>:<line>:<col>: warning: ... [duplInheritedMember]）

eraseIteratorOutOfBoundsCond — warning · CWE-628

• 规则编号：eraseIteratorOutOfBoundsCond
• 严重级别：warning
• CWE：CWE-628
• 漏洞描述：Either the condition 'x' is redundant or function 'erase()' is called on the iterator 'iter' which is out of bounds.
• 日志特征：检测日志以 [eraseIteratorOutOfBoundsCond] 标识（<file>:<line>:<col>: warning: ... [eraseIteratorOutOfBoundsCond]）

exceptDeallocThrow — warning · CWE-398

• 规则编号：exceptDeallocThrow
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Exception thrown in invalid state, 'p' points at deallocated memory.
• 日志特征：检测日志以 [exceptDeallocThrow] 标识（<file>:<line>:<col>: warning: ... [exceptDeallocThrow]）

exceptThrowInDestructor — warning · CWE-398

• 规则编号：exceptThrowInDestructor
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：The class Class is not safe because its destructor throws an exception. If Class is used and an exception is thrown that is caught in an outer scope the program will terminate.
• 日志特征：检测日志以 [exceptThrowInDestructor] 标识（<file>:<line>:<col>: warning: ... [exceptThrowInDestructor]）

fcloseInLoopCondition — warning · CWE-910

• 规则编号：fcloseInLoopCondition
• 严重级别：warning
• CWE：CWE-910
• 漏洞描述：fclose() closes 'fp' each time it is evaluated. On success the loop body might never execute, on failure fclose() might be called again on the already-closed file handle.
• 日志特征：检测日志以 [fcloseInLoopCondition] 标识（<file>:<line>:<col>: warning: ... [fcloseInLoopCondition]）

funcArgOrderDifferent — warning · CWE-683

• 规则编号：funcArgOrderDifferent
• 严重级别：warning
• CWE：CWE-683
• 漏洞描述：Function 'function' argument order different: declaration '' definition ''
• 日志特征：检测日志以 [funcArgOrderDifferent] 标识（<file>:<line>:<col>: warning: ... [funcArgOrderDifferent]）

globalLockGuard — warning · CWE-833

• 规则编号：globalLockGuard
• 严重级别：warning
• CWE：CWE-833
• 漏洞描述：Lock guard is defined globally. Lock guards are intended to be local. A global lock guard could lead to a deadlock since it won't unlock until the end of the program.
• 日志特征：检测日志以 [globalLockGuard] 标识（<file>:<line>:<col>: warning: ... [globalLockGuard]）

identicalConditionAfterEarlyExit — warning · CWE-398

• 规则编号：identicalConditionAfterEarlyExit
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Identical condition 'x', second condition is always false
• 日志特征：检测日志以 [identicalConditionAfterEarlyExit] 标识（<file>:<line>:<col>: warning: ... [identicalConditionAfterEarlyExit]）

identicalInnerCondition — warning · CWE-398

• 规则编号：identicalInnerCondition
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Identical inner 'if' condition is always true (outer condition is 'x' and inner condition is 'x').
• 日志特征：检测日志以 [identicalInnerCondition] 标识（<file>:<line>:<col>: warning: ... [identicalInnerCondition]）

ignoredReturnValue — warning · CWE-252

• 规则编号：ignoredReturnValue
• 严重级别：warning
• CWE：CWE-252
• 漏洞描述：Return value of function malloc() is not used.
• 日志特征：检测日志以 [ignoredReturnValue] 标识（<file>:<line>:<col>: warning: ... [ignoredReturnValue]）

incompatibleFileOpen — warning · CWE-664

• 规则编号：incompatibleFileOpen
• 严重级别：warning
• CWE：CWE-664
• 漏洞描述：The file 'tmp' is opened for read and write access at the same time on different streams
• 日志特征：检测日志以 [incompatibleFileOpen] 标识（<file>:<line>:<col>: warning: ... [incompatibleFileOpen]）

incompleteArrayFill — warning · CWE-131

• 规则编号：incompleteArrayFill
• 严重级别：warning
• CWE：CWE-131
• 漏洞描述：The array 'buffer' is filled incompletely. The function 'memset()' needs the size given in bytes, but an element of the given array is larger than one byte. Did you forget to multiply the size with 'sizeof(*buffer)'?
• 日志特征：检测日志以 [incompleteArrayFill] 标识（<file>:<line>:<col>: warning: ... [incompleteArrayFill]）

incorrectCharBooleanError — warning · CWE-571

• 规则编号：incorrectCharBooleanError
• 严重级别：warning
• CWE：CWE-571
• 漏洞描述：Conversion of char literal 'x' to bool always evaluates to true.
• 日志特征：检测日志以 [incorrectCharBooleanError] 标识（<file>:<line>:<col>: warning: ... [incorrectCharBooleanError]）

incorrectLogicOperator — warning · CWE-571

• 规则编号：incorrectLogicOperator
• 严重级别：warning
• CWE：CWE-571
• 漏洞描述：Logical disjunction always evaluates to true: foo > 3 && foo < 4. Are these conditions necessary? Did you intend to use && instead? Are the numbers correct? Are you comparing the correct variables?
• 日志特征：检测日志以 [incorrectLogicOperator] 标识（<file>:<line>:<col>: warning: ... [incorrectLogicOperator]）

incorrectStringBooleanError — warning · CWE-571

• 规则编号：incorrectStringBooleanError
• 严重级别：warning
• CWE：CWE-571
• 漏洞描述：Conversion of string literal "Hello World" to bool always evaluates to true.
• 日志特征：检测日志以 [incorrectStringBooleanError] 标识（<file>:<line>:<col>: warning: ... [incorrectStringBooleanError]）

incorrectStringCompare — warning · CWE-570

• 规则编号：incorrectStringCompare
• 严重级别：warning
• CWE：CWE-570
• 漏洞描述：String literal "Hello World" doesn't match length argument for substr().
• 日志特征：检测日志以 [incorrectStringCompare] 标识（<file>:<line>:<col>: warning: ... [incorrectStringCompare]）

invalidLengthModifierError — warning · CWE-704

• 规则编号：invalidLengthModifierError
• 严重级别：warning
• CWE：CWE-704
• 漏洞描述：'I' in format string (no. 1) is a length modifier and cannot be used without a conversion specifier.
• 日志特征：检测日志以 [invalidLengthModifierError] 标识（<file>:<line>:<col>: warning: ... [invalidLengthModifierError]）

invalidPrintfArgType_float — warning · CWE-686

• 规则编号：invalidPrintfArgType_float
• 严重级别：warning
• CWE：CWE-686
• 漏洞描述：%f in format string (no. 1) requires 'double' but the argument type is Unknown.
• 日志特征：检测日志以 [invalidPrintfArgType_float] 标识（<file>:<line>:<col>: warning: ... [invalidPrintfArgType_float]）

invalidPrintfArgType_n — warning · CWE-686

• 规则编号：invalidPrintfArgType_n
• 严重级别：warning
• CWE：CWE-686
• 漏洞描述：%n in format string (no. 1) requires 'int *' but the argument type is Unknown.
• 日志特征：检测日志以 [invalidPrintfArgType_n] 标识（<file>:<line>:<col>: warning: ... [invalidPrintfArgType_n]）

invalidPrintfArgType_p — warning · CWE-686

• 规则编号：invalidPrintfArgType_p
• 严重级别：warning
• CWE：CWE-686
• 漏洞描述：%p in format string (no. 1) requires an address but the argument type is Unknown.
• 日志特征：检测日志以 [invalidPrintfArgType_p] 标识（<file>:<line>:<col>: warning: ... [invalidPrintfArgType_p]）

invalidPrintfArgType_s — warning · CWE-686

• 规则编号：invalidPrintfArgType_s
• 严重级别：warning
• CWE：CWE-686
• 漏洞描述：%s in format string (no. 1) requires 'char *' but the argument type is Unknown.
• 日志特征：检测日志以 [invalidPrintfArgType_s] 标识（<file>:<line>:<col>: warning: ... [invalidPrintfArgType_s]）

invalidPrintfArgType_sint — warning · CWE-686

• 规则编号：invalidPrintfArgType_sint
• 严重级别：warning
• CWE：CWE-686
• 漏洞描述：%i in format string (no. 1) requires 'int' but the argument type is Unknown.
• 日志特征：检测日志以 [invalidPrintfArgType_sint] 标识（<file>:<line>:<col>: warning: ... [invalidPrintfArgType_sint]）

invalidPrintfArgType_uint — warning · CWE-686

• 规则编号：invalidPrintfArgType_uint
• 严重级别：warning
• CWE：CWE-686
• 漏洞描述：%u in format string (no. 1) requires 'unsigned int' but the argument type is Unknown.
• 日志特征：检测日志以 [invalidPrintfArgType_uint] 标识（<file>:<line>:<col>: warning: ... [invalidPrintfArgType_uint]）

invalidscanf — warning · CWE-119

• 规则编号：invalidscanf
• 严重级别：warning
• CWE：CWE-119
• 漏洞描述：scanf() without field width limits can crash with huge input data. Add a field width specifier to fix this problem.\012\012Sample program that can crash:\012\012#include <stdio.h>\012int main()\012{\012 char c[5];\012 scanf("%s", c);\012 return 0;\012}\012\012Typing in 5 or more characters may make the program crash. The correct usage here is 'scanf("%4s", c);', as the maximum field width does not include the terminating null byte.\012Source: http://linux.die.net/man/3/scanf\012Source: http://www.opensource.apple.com/source/xnu/xnu-1456.1.26/libkern/stdio/scanf.c
• 日志特征：检测日志以 [invalidscanf] 标识（<file>:<line>:<col>: warning: ... [invalidscanf]）

invalidScanfArgType_float — warning · CWE-686

• 规则编号：invalidScanfArgType_float
• 严重级别：warning
• CWE：CWE-686
• 漏洞描述：%f in format string (no. 1) requires 'float *' but the argument type is Unknown.
• 日志特征：检测日志以 [invalidScanfArgType_float] 标识（<file>:<line>:<col>: warning: ... [invalidScanfArgType_float]）

invalidScanfArgType_int — warning · CWE-686

• 规则编号：invalidScanfArgType_int
• 严重级别：warning
• CWE：CWE-686
• 漏洞描述：%d in format string (no. 1) requires 'int *' but the argument type is Unknown.
• 日志特征：检测日志以 [invalidScanfArgType_int] 标识（<file>:<line>:<col>: warning: ... [invalidScanfArgType_int]）

invalidScanfArgType_s — warning · CWE-686

• 规则编号：invalidScanfArgType_s
• 严重级别：warning
• CWE：CWE-686
• 漏洞描述：%s in format string (no. 1) requires a 'char *' but the argument type is Unknown.
• 日志特征：检测日志以 [invalidScanfArgType_s] 标识（<file>:<line>:<col>: warning: ... [invalidScanfArgType_s]）

invalidScanfFormatWidth_smaller — warning

• 规则编号：invalidScanfFormatWidth_smaller
• 严重级别：warning
• CWE：—
• 漏洞描述：Width -1 given in format string (no. 99) is smaller than destination buffer '[0]'.
• 日志特征：检测日志以 [invalidScanfFormatWidth_smaller] 标识（<file>:<line>:<col>: warning: ... [invalidScanfFormatWidth_smaller]）

invalidTestForOverflow — warning · CWE-391

• 规则编号：invalidTestForOverflow
• 严重级别：warning
• CWE：CWE-391
• 漏洞描述：Invalid test for overflow 'x + c < x'; signed integer overflow is undefined behavior. Some mainstream compilers remove such overflow tests when optimising the code and assume it's always false.
• 日志特征：检测日志以 [invalidTestForOverflow] 标识（<file>:<line>:<col>: warning: ... [invalidTestForOverflow]）

leakUnsafeArgAlloc — warning · CWE-401

• 规则编号：leakUnsafeArgAlloc
• 严重级别：warning
• CWE：CWE-401
• 漏洞描述：Unsafe allocation. If funcName() throws, memory could be leaked. Use make_shared<int>() instead.
• 日志特征：检测日志以 [leakUnsafeArgAlloc] 标识（<file>:<line>:<col>: warning: ... [leakUnsafeArgAlloc]）

literalWithCharPtrCompare — warning · CWE-595

• 规则编号：literalWithCharPtrCompare
• 严重级别：warning
• CWE：CWE-595
• 漏洞描述：String literal compared with variable 'foo'. Did you intend to use strcmp() instead?
• 日志特征：检测日志以 [literalWithCharPtrCompare] 标识（<file>:<line>:<col>: warning: ... [literalWithCharPtrCompare]）

localMutex — warning · CWE-667

• 规则编号：localMutex
• 严重级别：warning
• CWE：CWE-667
• 漏洞描述：The lock is ineffective because the mutex is locked at the same scope as the mutex itself.
• 日志特征：检测日志以 [localMutex] 标识（<file>:<line>:<col>: warning: ... [localMutex]）

mallocOnClassWarning — warning · CWE-762

• 规则编号：mallocOnClassWarning
• 严重级别：warning
• CWE：CWE-762
• 漏洞描述：Memory for class instance allocated with malloc(), but class provides constructors. This is unsafe, since no constructor is called and class members remain uninitialized. Consider using 'new' instead.
• 日志特征：检测日志以 [mallocOnClassWarning] 标识（<file>:<line>:<col>: warning: ... [mallocOnClassWarning]）

memsetValueOutOfRange — warning · CWE-686

• 规则编号：memsetValueOutOfRange
• 严重级别：warning
• CWE：CWE-686
• 漏洞描述：The 2nd memset() argument 'varname' doesn't fit into an 'unsigned char'. The 2nd parameter is passed as an 'int', but the function fills the block of memory using the 'unsigned char' conversion of this value.
• 日志特征：检测日志以 [memsetValueOutOfRange] 标识（<file>:<line>:<col>: warning: ... [memsetValueOutOfRange]）

memsetZeroBytes — warning · CWE-687

• 规则编号：memsetZeroBytes
• 严重级别：warning
• CWE：CWE-687
• 漏洞描述：memset() called to fill 0 bytes. The second and third arguments might be inverted. The function memset ( void * ptr, int value, size_t num ) sets the first num bytes of the block of memory pointed by ptr to the specified value.
• 日志特征：检测日志以 [memsetZeroBytes] 标识（<file>:<line>:<col>: warning: ... [memsetZeroBytes]）

mismatchingContainerExpression — warning · CWE-664

• 规则编号：mismatchingContainerExpression
• 严重级别：warning
• CWE：CWE-664
• 漏洞描述：Iterators to containers from different expressions 'v1' and 'v2' are used together.
• 日志特征：检测日志以 [mismatchingContainerExpression] 标识（<file>:<line>:<col>: warning: ... [mismatchingContainerExpression]）

missingMemberCopy — warning · CWE-398

• 规则编号：missingMemberCopy
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Member variable 'classname::varnamepriv' is not assigned in the move constructor. Should it be moved?
• 日志特征：检测日志以 [missingMemberCopy] 标识（<file>:<line>:<col>: warning: ... [missingMemberCopy]）

moduloAlwaysTrueFalse — warning · CWE-398

• 规则编号：moduloAlwaysTrueFalse
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Comparison of modulo result is predetermined, because it is always less than 1.
• 日志特征：检测日志以 [moduloAlwaysTrueFalse] 标识（<file>:<line>:<col>: warning: ... [moduloAlwaysTrueFalse]）

multiplySizeof — warning · CWE-682

• 规则编号：multiplySizeof
• 严重级别：warning
• CWE：CWE-682
• 漏洞描述：Multiplying sizeof() with sizeof() indicates a logic error.
• 日志特征：检测日志以 [multiplySizeof] 标识（<file>:<line>:<col>: warning: ... [multiplySizeof]）

negativeContainerIndex — warning · CWE-786

• 规则编号：negativeContainerIndex
• 严重级别：warning
• CWE：CWE-786
• 漏洞描述：Array index -1 is out of bounds.
• 日志特征：检测日志以 [negativeContainerIndex] 标识（<file>:<line>:<col>: warning: ... [negativeContainerIndex]）

noCopyConstructor — warning · CWE-398

• 规则编号：noCopyConstructor
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Class 'class' does not have a copy constructor which is recommended since it has dynamic memory/resource management.
• 日志特征：检测日志以 [noCopyConstructor] 标识（<file>:<line>:<col>: warning: ... [noCopyConstructor]）

noDestructor — warning · CWE-398

• 规则编号：noDestructor
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Class 'class' does not have a destructor which is recommended since it has dynamic memory/resource management.
• 日志特征：检测日志以 [noDestructor] 标识（<file>:<line>:<col>: warning: ... [noDestructor]）

noOperatorEq — warning · CWE-398

• 规则编号：noOperatorEq
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Class 'class' does not have a operator= which is recommended since it has dynamic memory/resource management.
• 日志特征：检测日志以 [noOperatorEq] 标识（<file>:<line>:<col>: warning: ... [noOperatorEq]）

nullPointerArithmeticRedundantCheck — warning · CWE-682

• 规则编号：nullPointerArithmeticRedundantCheck
• 严重级别：warning
• CWE：CWE-682
• 漏洞描述：Either the condition is redundant or there is pointer arithmetic with NULL pointer.
• 日志特征：检测日志以 [nullPointerArithmeticRedundantCheck] 标识（<file>:<line>:<col>: warning: ... [nullPointerArithmeticRedundantCheck]）

nullPointerDefaultArg — warning · CWE-476

• 规则编号：nullPointerDefaultArg
• 严重级别：warning
• CWE：CWE-476
• 漏洞描述：Possible null pointer dereference if the default parameter value is used: pointer
• 日志特征：检测日志以 [nullPointerDefaultArg] 标识（<file>:<line>:<col>: warning: ... [nullPointerDefaultArg]）

nullPointerOutOfMemory — warning · CWE-476

• 规则编号：nullPointerOutOfMemory
• 严重级别：warning
• CWE：CWE-476
• 漏洞描述：Null pointer dereference
• 日志特征：检测日志以 [nullPointerOutOfMemory] 标识（<file>:<line>:<col>: warning: ... [nullPointerOutOfMemory]）

nullPointerOutOfResources — warning · CWE-476

• 规则编号：nullPointerOutOfResources
• 严重级别：warning
• CWE：CWE-476
• 漏洞描述：Null pointer dereference
• 日志特征：检测日志以 [nullPointerOutOfResources] 标识（<file>:<line>:<col>: warning: ... [nullPointerOutOfResources]）

nullPointerRedundantCheck — warning · CWE-476

• 规则编号：nullPointerRedundantCheck
• 严重级别：warning
• CWE：CWE-476
• 漏洞描述：Either the condition is redundant or there is possible null pointer dereference: pointer.
• 日志特征：检测日志以 [nullPointerRedundantCheck] 标识（<file>:<line>:<col>: warning: ... [nullPointerRedundantCheck]）

operatorEqToSelf — warning · CWE-398

• 规则编号：operatorEqToSelf
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：'operator=' should check for assignment to self to ensure that each block of dynamically allocated memory is owned and managed by only one instance of the class.
• 日志特征：检测日志以 [operatorEqToSelf] 标识（<file>:<line>:<col>: warning: ... [operatorEqToSelf]）

operatorEqVarError — warning · CWE-398

• 规则编号：operatorEqVarError
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Member variable 'classname::' is not assigned a value in 'classname::operator='.
• 日志特征：检测日志以 [operatorEqVarError] 标识（<file>:<line>:<col>: warning: ... [operatorEqVarError]）

oppositeInnerCondition — warning · CWE-398

• 规则编号：oppositeInnerCondition
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Opposite inner 'if' condition leads to a dead code block (outer condition is 'x' and inner condition is '!x').
• 日志特征：检测日志以 [oppositeInnerCondition] 标识（<file>:<line>:<col>: warning: ... [oppositeInnerCondition]）

overlappingInnerCondition — warning · CWE-398

• 规则编号：overlappingInnerCondition
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Overlapping inner 'if' condition is always true (outer condition is 'x' and inner condition is 'x').
• 日志特征：检测日志以 [overlappingInnerCondition] 标识（<file>:<line>:<col>: warning: ... [overlappingInnerCondition]）

overlappingStrcmp — warning

• 规则编号：overlappingStrcmp
• 严重级别：warning
• CWE：—
• 漏洞描述：The expression 'strcmp(x,"def") != 0' is suspicious. It overlaps 'strcmp(x,"abc") == 0'.
• 日志特征：检测日志以 [overlappingStrcmp] 标识（<file>:<line>:<col>: warning: ... [overlappingStrcmp]）

pointerAdditionResultNotNull — warning

• 规则编号：pointerAdditionResultNotNull
• 严重级别：warning
• CWE：—
• 漏洞描述：Comparison is wrong. Result of 'ptr+1' can't be 0 unless there is pointer overflow, and pointer overflow is undefined behaviour.
• 日志特征：检测日志以 [pointerAdditionResultNotNull] 标识（<file>:<line>:<col>: warning: ... [pointerAdditionResultNotNull]）

pointerSize — warning · CWE-467

• 规则编号：pointerSize
• 严重级别：warning
• CWE：CWE-467
• 漏洞描述：Size of pointer 'varname' used instead of size of its data. This is likely to lead to a buffer overflow. You probably intend to write 'sizeof(*varname)'.
• 日志特征：检测日志以 [pointerSize] 标识（<file>:<line>:<col>: warning: ... [pointerSize]）

publicAllocationError — warning · CWE-398

• 规则编号：publicAllocationError
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Possible leak in public function. The pointer 'varname' is not deallocated before it is allocated.
• 日志特征：检测日志以 [publicAllocationError] 标识（<file>:<line>:<col>: warning: ... [publicAllocationError]）

pureVirtualCall — warning

• 规则编号：pureVirtualCall
• 严重级别：warning
• CWE：—
• 漏洞描述：Call of pure virtual function 'f' in constructor. The call will fail during runtime.
• 日志特征：检测日志以 [pureVirtualCall] 标识（<file>:<line>:<col>: warning: ... [pureVirtualCall]）

seekOnAppendedFile — warning · CWE-398

• 规则编号：seekOnAppendedFile
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Repositioning operation performed on a file opened in append mode has no effect.
• 日志特征：检测日志以 [seekOnAppendedFile] 标识（<file>:<line>:<col>: warning: ... [seekOnAppendedFile]）

signConversion — warning · CWE-195

• 规则编号：signConversion
• 严重级别：warning
• CWE：CWE-195
• 漏洞描述：Expression 'var' can have a negative value. That is converted to an unsigned value and used in an unsigned calculation.
• 日志特征：检测日志以 [signConversion] 标识（<file>:<line>:<col>: warning: ... [signConversion]）

signedCharArrayIndex — warning · CWE-128

• 规则编号：signedCharArrayIndex
• 严重级别：warning
• CWE：CWE-128
• 漏洞描述：Signed 'char' type used as array index. If the value can be greater than 127 there will be a buffer underflow because of sign extension.
• 日志特征：检测日志以 [signedCharArrayIndex] 标识（<file>:<line>:<col>: warning: ... [signedCharArrayIndex]）

sizeofCalculation — warning · CWE-682

• 规则编号：sizeofCalculation
• 严重级别：warning
• CWE：CWE-682
• 漏洞描述：Found calculation inside sizeof().
• 日志特征：检测日志以 [sizeofCalculation] 标识（<file>:<line>:<col>: warning: ... [sizeofCalculation]）

sizeofDivisionMemfunc — warning · CWE-682

• 规则编号：sizeofDivisionMemfunc
• 严重级别：warning
• CWE：CWE-682
• 漏洞描述：Division by result of sizeof(). memset() expects a size in bytes, did you intend to multiply instead?
• 日志特征：检测日志以 [sizeofDivisionMemfunc] 标识（<file>:<line>:<col>: warning: ... [sizeofDivisionMemfunc]）

sizeofFunctionCall — warning · CWE-682

• 规则编号：sizeofFunctionCall
• 严重级别：warning
• CWE：CWE-682
• 漏洞描述：Found function call inside sizeof().
• 日志特征：检测日志以 [sizeofFunctionCall] 标识（<file>:<line>:<col>: warning: ... [sizeofFunctionCall]）

sizeofsizeof — warning · CWE-682

• 规则编号：sizeofsizeof
• 严重级别：warning
• CWE：CWE-682
• 漏洞描述：Calling sizeof for 'sizeof looks like a suspicious code and most likely there should be just one 'sizeof'. The current code is equivalent to 'sizeof(size_t)'
• 日志特征：检测日志以 [sizeofsizeof] 标识（<file>:<line>:<col>: warning: ... [sizeofsizeof]）

sizeofwithnumericparameter — warning · CWE-682

• 规则编号：sizeofwithnumericparameter
• 严重级别：warning
• CWE：CWE-682
• 漏洞描述：It is unusual to use a constant value with sizeof. For example, 'sizeof(10)' returns 4 (in 32-bit systems) or 8 (in 64-bit systems) instead of 10. 'sizeof('A')' and 'sizeof(char)' can return different results.
• 日志特征：检测日志以 [sizeofwithnumericparameter] 标识（<file>:<line>:<col>: warning: ... [sizeofwithnumericparameter]）

sizeofwithsilentarraypointer — warning · CWE-467

• 规则编号：sizeofwithsilentarraypointer
• 严重级别：warning
• CWE：CWE-467
• 漏洞描述：Using 'sizeof' for array given as function argument returns the size of a pointer. It does not return the size of the whole array in bytes as might be expected. For example, this code:\012 int f(char a[100]) {\012 return sizeof(a);\012 }\012returns 4 (in 32-bit systems) or 8 (in 64-bit systems) instead of 100 (the size of the array in bytes).
• 日志特征：检测日志以 [sizeofwithsilentarraypointer] 标识（<file>:<line>:<col>: warning: ... [sizeofwithsilentarraypointer]）

staticStringCompare — warning · CWE-570

• 规则编号：staticStringCompare
• 严重级别：warning
• CWE：CWE-570
• 漏洞描述：The compared strings, 'str1' and 'str2', are always unequal. Therefore the comparison is unnecessary and looks suspicious.
• 日志特征：检测日志以 [staticStringCompare] 标识（<file>:<line>:<col>: warning: ... [staticStringCompare]）

stlIfFind — warning · CWE-398

• 规则编号：stlIfFind
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Suspicious condition. The result of find() is an iterator, but it is not properly checked.
• 日志特征：检测日志以 [stlIfFind] 标识（<file>:<line>:<col>: warning: ... [stlIfFind]）

StlMissingComparison — warning · CWE-834

• 规则编号：StlMissingComparison
• 严重级别：warning
• CWE：CWE-834
• 漏洞描述：The iterator incrementing is suspicious - it is incremented at line and then at line . The loop might unintentionally skip an element in the container. There is no comparison between these increments to prevent that the iterator is incremented beyond the end.
• 日志特征：检测日志以 [StlMissingComparison] 标识（<file>:<line>:<col>: warning: ... [StlMissingComparison]）

stringCompare — warning · CWE-571

• 规则编号：stringCompare
• 严重级别：warning
• CWE：CWE-571
• 漏洞描述：The compared strings, 'varname1' and 'varname2', are identical. This could be a logic bug.
• 日志特征：检测日志以 [stringCompare] 标识（<file>:<line>:<col>: warning: ... [stringCompare]）

suspiciousCase — warning · CWE-398

• 规则编号：suspiciousCase
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Using an operator like '||' in a case label is suspicious. Did you intend to use a bitwise operator, multiple case labels or if/else instead?
• 日志特征：检测日志以 [suspiciousCase] 标识（<file>:<line>:<col>: warning: ... [suspiciousCase]）

suspiciousSemicolon — warning · CWE-398

• 规则编号：suspiciousSemicolon
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Suspicious use of ; at the end of '' statement.
• 日志特征：检测日志以 [suspiciousSemicolon] 标识（<file>:<line>:<col>: warning: ... [suspiciousSemicolon]）

terminateStrncpy — warning · CWE-170

• 规则编号：terminateStrncpy
• 严重级别：warning
• CWE：CWE-170
• 漏洞描述：The buffer 'var_name' may not be null-terminated after the call to strncpy(). If the source string's size fits or exceeds the given size, strncpy() does not add a zero at the end of the buffer. This causes bugs later in the code if the code assumes buffer is null-terminated.
• 日志特征：检测日志以 [terminateStrncpy] 标识（<file>:<line>:<col>: warning: ... [terminateStrncpy]）

thisSubtraction — warning · CWE-398

• 规则编号：thisSubtraction
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Suspicious pointer subtraction. Did you intend to write '->'?
• 日志特征：检测日志以 [thisSubtraction] 标识（<file>:<line>:<col>: warning: ... [thisSubtraction]）

thisUseAfterFree — warning

• 规则编号：thisUseAfterFree
• 严重级别：warning
• CWE：—
• 漏洞描述：Using member 'x' when 'this' might be invalid
• 日志特征：检测日志以 [thisUseAfterFree] 标识（<file>:<line>:<col>: warning: ... [thisUseAfterFree]）

uninitDerivedMemberVar — warning · CWE-398

• 规则编号：uninitDerivedMemberVar
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Member variable 'classname::varname' is not initialized in the constructor. Maybe it should be initialized directly in the class classname? Member variables of native types, pointers, or references are left uninitialized when the class is instantiated. That may cause bugs or undefined behavior.
• 日志特征：检测日志以 [uninitDerivedMemberVar] 标识（<file>:<line>:<col>: warning: ... [uninitDerivedMemberVar]）

uninitDerivedMemberVarPrivate — warning · CWE-398

• 规则编号：uninitDerivedMemberVarPrivate
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Member variable 'classname::varnamepriv' is not initialized in the constructor. Maybe it should be initialized directly in the class classname? Member variables of native types, pointers, or references are left uninitialized when the class is instantiated. That may cause bugs or undefined behavior.
• 日志特征：检测日志以 [uninitDerivedMemberVarPrivate] 标识（<file>:<line>:<col>: warning: ... [uninitDerivedMemberVarPrivate]）

uninitMemberVar — warning · CWE-398

• 规则编号：uninitMemberVar
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Member variable 'classname::varname' is not initialized in the constructor. Member variables of native types, pointers, or references are left uninitialized when the class is instantiated. That may cause bugs or undefined behavior.
• 日志特征：检测日志以 [uninitMemberVar] 标识（<file>:<line>:<col>: warning: ... [uninitMemberVar]）

uninitMemberVarPrivate — warning · CWE-398

• 规则编号：uninitMemberVarPrivate
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Member variable 'classname::varnamepriv' is not initialized in the constructor. Member variables of native types, pointers, or references are left uninitialized when the class is instantiated. That may cause bugs or undefined behavior.
• 日志特征：检测日志以 [uninitMemberVarPrivate] 标识（<file>:<line>:<col>: warning: ... [uninitMemberVarPrivate]）

unsafeClassRefMember — warning

• 规则编号：unsafeClassRefMember
• 严重级别：warning
• CWE：—
• 漏洞描述：Unsafe class checking: The const reference member 'UnsafeClass::var' is initialized by a const reference constructor argument. You need to be careful about lifetime issues. If you pass a local variable or temporary value in this constructor argument, be extra careful. If the argument is always some global object that is never destroyed then this is safe usage. However it would be defensive to make the member 'UnsafeClass::var' a non-reference variable or a smart pointer.
• 日志特征：检测日志以 [unsafeClassRefMember] 标识（<file>:<line>:<col>: warning: ... [unsafeClassRefMember]）

unusedLabelSwitch — warning · CWE-398

• 规则编号：unusedLabelSwitch
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Label '' is not used. Should this be a 'case' of the enclosing switch()?
• 日志特征：检测日志以 [unusedLabelSwitch] 标识（<file>:<line>:<col>: warning: ... [unusedLabelSwitch]）

unusedLabelSwitchConfiguration — warning · CWE-398

• 规则编号：unusedLabelSwitchConfiguration
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Label '' is not used. There is #if in function body so the label might be used in code that is removed by the preprocessor. Should this be a 'case' of the enclosing switch()?
• 日志特征：检测日志以 [unusedLabelSwitchConfiguration] 标识（<file>:<line>:<col>: warning: ... [unusedLabelSwitchConfiguration]）

uselessAssignmentPtrArg — warning · CWE-398

• 规则编号：uselessAssignmentPtrArg
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Assignment of function parameter has no effect outside the function. Did you forget dereferencing it?
• 日志特征：检测日志以 [uselessAssignmentPtrArg] 标识（<file>:<line>:<col>: warning: ... [uselessAssignmentPtrArg]）

uselessCallsCompare — warning · CWE-628

• 规则编号：uselessCallsCompare
• 严重级别：warning
• CWE：CWE-628
• 漏洞描述：'std::string::find()' returns zero when given itself as parameter (str.find(str)). As it is currently the code is inefficient. It is possible either the string searched ('str') or searched for ('str') is wrong.
• 日志特征：检测日志以 [uselessCallsCompare] 标识（<file>:<line>:<col>: warning: ... [uselessCallsCompare]）

uselessCallsEmpty — warning · CWE-398

• 规则编号：uselessCallsEmpty
• 严重级别：warning
• CWE：CWE-398
• 漏洞描述：Ineffective call of function 'empty()'. Did you intend to call 'clear()' instead?
• 日志特征：检测日志以 [uselessCallsEmpty] 标识（<file>:<line>:<col>: warning: ... [uselessCallsEmpty]）

uselessCallsRemove — warning · CWE-762

• 规则编号：uselessCallsRemove
• 严重级别：warning
• CWE：CWE-762
• 漏洞描述：The return value of std::remove() is ignored. This function returns an iterator to the end of the range containing those elements that should be kept. Elements past new end remain valid but with unspecified values. Use the erase method of the container to delete them.
• 日志特征：检测日志以 [uselessCallsRemove] 标识（<file>:<line>:<col>: warning: ... [uselessCallsRemove]）

va_start_wrongParameter — warning · CWE-688

• 规则编号：va_start_wrongParameter
• 严重级别：warning
• CWE：CWE-688
• 漏洞描述：'arg1' given to va_start() is not last named argument of the function. Did you intend to pass 'arg2'?
• 日志特征：检测日志以 [va_start_wrongParameter] 标识（<file>:<line>:<col>: warning: ... [va_start_wrongParameter]）

wrongmathcall — warning · CWE-758

• 规则编号：wrongmathcall
• 严重级别：warning
• CWE：CWE-758
• 漏洞描述：Passing value '#' to #() leads to implementation-defined result.
• 日志特征：检测日志以 [wrongmathcall] 标识（<file>:<line>:<col>: warning: ... [wrongmathcall]）

wrongPrintfScanfParameterPositionError — warning · CWE-685

• 规则编号：wrongPrintfScanfParameterPositionError
• 严重级别：warning
• CWE：CWE-685
• 漏洞描述：printf: referencing parameter 2 while 1 arguments given
• 日志特征：检测日志以 [wrongPrintfScanfParameterPositionError] 标识（<file>:<line>:<col>: warning: ... [wrongPrintfScanfParameterPositionError]）

zerodivcond — warning · CWE-369

• 规则编号：zerodivcond
• 严重级别：warning
• CWE：CWE-369
• 漏洞描述：Either the condition is redundant or there is division by zero.
• 日志特征：检测日志以 [zerodivcond] 标识（<file>:<line>:<col>: warning: ... [zerodivcond]）

style（风格）（95 项）

arrayIndexThenCheck — style · CWE-398

• 规则编号：arrayIndexThenCheck
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Defensive programming: The variable 'i' is used as an array index before it is checked that is within limits. This can mean that the array might be accessed out of bounds. Reorder conditions such as '(a[i] && i < 10)' to '(i < 10 && a[i])'. That way the array will not be accessed if the index is out of limits.
• 日志特征：检测日志以 [arrayIndexThenCheck] 标识（<file>:<line>:<col>: style: ... [arrayIndexThenCheck]）

assignBoolToFloat — style · CWE-704

• 规则编号：assignBoolToFloat
• 严重级别：style
• CWE：CWE-704
• 漏洞描述：Boolean value assigned to floating point variable.
• 日志特征：检测日志以 [assignBoolToFloat] 标识（<file>:<line>:<col>: style: ... [assignBoolToFloat]）

assignIfError — style · CWE-398

• 规则编号：assignIfError
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Mismatching assignment and comparison, comparison '' is always false.
• 日志特征：检测日志以 [assignIfError] 标识（<file>:<line>:<col>: style: ... [assignIfError]）

assignmentInCondition — style · CWE-571

• 规则编号：assignmentInCondition
• 严重级别：style
• CWE：CWE-571
• 漏洞描述：Suspicious assignment in condition. Condition 'x=y' is always true.
• 日志特征：检测日志以 [assignmentInCondition] 标识（<file>:<line>:<col>: style: ... [assignmentInCondition]）

bitwiseOnBoolean — style · CWE-398

• 规则编号：bitwiseOnBoolean
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Boolean expression 'expression' is used in bitwise operation. Did you mean '&&'?
• 日志特征：检测日志以 [bitwiseOnBoolean] 标识（<file>:<line>:<col>: style: ... [bitwiseOnBoolean]）

catchExceptionByValue — style · CWE-398

• 规则编号：catchExceptionByValue
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：The exception is caught by value. It could be caught as a (const) reference which is usually recommended in C++.
• 日志特征：检测日志以 [catchExceptionByValue] 标识（<file>:<line>:<col>: style: ... [catchExceptionByValue]）

clarifyCalculation — style · CWE-783

• 规则编号：clarifyCalculation
• 严重级别：style
• CWE：CWE-783
• 漏洞描述：Suspicious calculation. Please use parentheses to clarify the code. The code ''a+b?c:d'' should be written as either ''(a+b)?c:d'' or ''a+(b?c:d)''.
• 日志特征：检测日志以 [clarifyCalculation] 标识（<file>:<line>:<col>: style: ... [clarifyCalculation]）

clarifyCondition — style · CWE-398

• 规则编号：clarifyCondition
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Suspicious condition (assignment + comparison); Clarify expression with parentheses.
• 日志特征：检测日志以 [clarifyCondition] 标识（<file>:<line>:<col>: style: ... [clarifyCondition]）

commaSeparatedReturn — style · CWE-398

• 规则编号：commaSeparatedReturn
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Comma is used in return statement. When comma is used in a return statement it can easily be misread as a semicolon. For example in the code below the value of 'b' is returned if the condition is true, but it is easy to think that 'a+1' is returned:\012 if (x)\012 return a + 1,\012 b++;\012However it can be useful to use comma in macros. No warning is reported when such a macro is then used in a return statement, it is less likely such code is misunderstood.
• 日志特征：检测日志以 [commaSeparatedReturn] 标识（<file>:<line>:<col>: style: ... [commaSeparatedReturn]）

compareValueOutOfTypeRangeError — style · CWE-398

• 规则编号：compareValueOutOfTypeRangeError
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Comparing expression of type 'unsigned char' against value 256. Condition is always true.
• 日志特征：检测日志以 [compareValueOutOfTypeRangeError] 标识（<file>:<line>:<col>: style: ... [compareValueOutOfTypeRangeError]）

comparisonError — style · CWE-398

• 规则编号：comparisonError
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：The expression '(X & 0x6) == 0x1' is always false. Check carefully constants and operators used, these errors might be hard to spot sometimes. In case of complex expression it might help to split it to separate expressions.
• 日志特征：检测日志以 [comparisonError] 标识（<file>:<line>:<col>: style: ... [comparisonError]）

comparisonOfBoolWithBoolError — style · CWE-398

• 规则编号：comparisonOfBoolWithBoolError
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：The variable 'var_name' is of type 'bool' and comparing 'bool' value using relational (<, >, <= or >=) operator could cause unexpected results.
• 日志特征：检测日志以 [comparisonOfBoolWithBoolError] 标识（<file>:<line>:<col>: style: ... [comparisonOfBoolWithBoolError]）

comparisonOfFuncReturningBoolError — style · CWE-398

• 规则编号：comparisonOfFuncReturningBoolError
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：The return type of function 'func_name' is 'bool' and result is of type 'bool'. Comparing 'bool' value using relational (<, >, <= or >=) operator could cause unexpected results.
• 日志特征：检测日志以 [comparisonOfFuncReturningBoolError] 标识（<file>:<line>:<col>: style: ... [comparisonOfFuncReturningBoolError]）

comparisonOfTwoFuncsReturningBoolError — style · CWE-398

• 规则编号：comparisonOfTwoFuncsReturningBoolError
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：The return type of function 'func_name1' and function 'func_name2' is 'bool' and result is of type 'bool'. Comparing 'bool' value using relational (<, >, <= or >=) operator could cause unexpected results.
• 日志特征：检测日志以 [comparisonOfTwoFuncsReturningBoolError] 标识（<file>:<line>:<col>: style: ... [comparisonOfTwoFuncsReturningBoolError]）

constParameter — style

• 规则编号：constParameter
• 严重级别：style
• CWE：—
• 漏洞描述：Parameter 'x' can be declared with const
• 日志特征：检测日志以 [constParameter] 标识（<file>:<line>:<col>: style: ... [constParameter]）

constParameterCallback — style

• 规则编号：constParameterCallback
• 严重级别：style
• CWE：—
• 漏洞描述：Parameter 'x' can be declared with const, however it seems that 'f' is a callback function.
• 日志特征：检测日志以 [constParameterCallback] 标识（<file>:<line>:<col>: style: ... [constParameterCallback]）

constParameterPointer — style

• 规则编号：constParameterPointer
• 严重级别：style
• CWE：—
• 漏洞描述：Parameter 'x' can be declared with const
• 日志特征：检测日志以 [constParameterPointer] 标识（<file>:<line>:<col>: style: ... [constParameterPointer]）

constParameterReference — style

• 规则编号：constParameterReference
• 严重级别：style
• CWE：—
• 漏洞描述：Parameter 'x' can be declared with const
• 日志特征：检测日志以 [constParameterReference] 标识（<file>:<line>:<col>: style: ... [constParameterReference]）

constVariable — style

• 规则编号：constVariable
• 严重级别：style
• CWE：—
• 漏洞描述：Variable 'x' can be declared with const
• 日志特征：检测日志以 [constVariable] 标识（<file>:<line>:<col>: style: ... [constVariable]）

constVariablePointer — style

• 规则编号：constVariablePointer
• 严重级别：style
• CWE：—
• 漏洞描述：Variable 'x' can be declared with const
• 日志特征：检测日志以 [constVariablePointer] 标识（<file>:<line>:<col>: style: ... [constVariablePointer]）

constVariableReference — style

• 规则编号：constVariableReference
• 严重级别：style
• CWE：—
• 漏洞描述：Variable 'x' can be declared with const
• 日志特征：检测日志以 [constVariableReference] 标识（<file>:<line>:<col>: style: ... [constVariableReference]）

cstyleCast — style · CWE-398

• 规则编号：cstyleCast
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：C-style pointer casting detected. C++ offers four different kinds of casts as replacements: static_cast, const_cast, dynamic_cast and reinterpret_cast. A C-style cast could evaluate to any of those automatically, thus it is considered safer if the programmer explicitly states which kind of cast is expected.
• 日志特征：检测日志以 [cstyleCast] 标识（<file>:<line>:<col>: style: ... [cstyleCast]）

duplicateAssignExpression — style · CWE-398

• 规则编号：duplicateAssignExpression
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Finding variables 'x' and 'x' that are assigned the same expression is suspicious and might indicate a cut and paste or logic error. Please examine this code carefully to determine if it is correct.
• 日志特征：检测日志以 [duplicateAssignExpression] 标识（<file>:<line>:<col>: style: ... [duplicateAssignExpression]）

duplicateBranch — style · CWE-398

• 规则编号：duplicateBranch
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Finding the same code in an 'if' and related 'else' branch is suspicious and might indicate a cut and paste or logic error. Please examine this code carefully to determine if it is correct.
• 日志特征：检测日志以 [duplicateBranch] 标识（<file>:<line>:<col>: style: ... [duplicateBranch]）

duplicateBreak — style · CWE-561

• 规则编号：duplicateBreak
• 严重级别：style
• CWE：CWE-561
• 漏洞描述：Consecutive return, break, continue, goto or throw statements are unnecessary. The second statement can never be executed, and so should be removed.
• 日志特征：检测日志以 [duplicateBreak] 标识（<file>:<line>:<col>: style: ... [duplicateBreak]）

duplicateCondition — style · CWE-398

• 规则编号：duplicateCondition
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：The if condition is the same as the previous if condition
• 日志特征：检测日志以 [duplicateCondition] 标识（<file>:<line>:<col>: style: ... [duplicateCondition]）

duplicateConditionalAssign — style · CWE-398

• 规则编号：duplicateConditionalAssign
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Duplicate expression for the condition and assignment.
• 日志特征：检测日志以 [duplicateConditionalAssign] 标识（<file>:<line>:<col>: style: ... [duplicateConditionalAssign]）

duplicateExpression — style · CWE-398

• 规则编号：duplicateExpression
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Finding the same expression on both sides of an operator is suspicious and might indicate a cut and paste or logic error. Please examine this code carefully to determine if it is correct.
• 日志特征：检测日志以 [duplicateExpression] 标识（<file>:<line>:<col>: style: ... [duplicateExpression]）

duplicateExpressionTernary — style · CWE-398

• 规则编号：duplicateExpressionTernary
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Finding the same expression in both branches of ternary operator is suspicious as the same code is executed regardless of the condition.
• 日志特征：检测日志以 [duplicateExpressionTernary] 标识（<file>:<line>:<col>: style: ... [duplicateExpressionTernary]）

duplicateValueTernary — style · CWE-398

• 规则编号：duplicateValueTernary
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Finding the same value in both branches of ternary operator is suspicious as the same code is executed regardless of the condition.
• 日志特征：检测日志以 [duplicateValueTernary] 标识（<file>:<line>:<col>: style: ... [duplicateValueTernary]）

exceptRethrowCopy — style · CWE-398

• 规则编号：exceptRethrowCopy
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Rethrowing an exception with 'throw varname;' creates an unnecessary copy of 'varname'. To rethrow the caught exception without unnecessary copying or slicing, use a bare 'throw;'.
• 日志特征：检测日志以 [exceptRethrowCopy] 标识（<file>:<line>:<col>: style: ... [exceptRethrowCopy]）

funcArgNamesDifferent — style · CWE-628

• 规则编号：funcArgNamesDifferent
• 严重级别：style
• CWE：CWE-628
• 漏洞描述：Function 'function' argument 2 names different: declaration '<unnamed>' definition '<unnamed>'.
• 日志特征：检测日志以 [funcArgNamesDifferent] 标识（<file>:<line>:<col>: style: ... [funcArgNamesDifferent]）

functionConst — style · CWE-398

• 规则编号：functionConst
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：The member function 'class::function' can be made a const function. Making this function 'const' should not cause compiler errors. Even though the function can be made const function technically it may not make sense conceptually. Think about your design and the task of the function first - is it a function that must not change object internal state?
• 日志特征：检测日志以 [functionConst] 标识（<file>:<line>:<col>: style: ... [functionConst]）

functionStatic — style · CWE-398

• 规则编号：functionStatic
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：The member function 'class::function' can be static.
• 日志特征：检测日志以 [functionStatic] 标识（<file>:<line>:<col>: style: ... [functionStatic]）

ignoredReturnErrorCode — style · CWE-252

• 规则编号：ignoredReturnErrorCode
• 严重级别：style
• CWE：CWE-252
• 漏洞描述：Error code from the return value of function func_name() is not used.
• 日志特征：检测日志以 [ignoredReturnErrorCode] 标识（<file>:<line>:<col>: style: ... [ignoredReturnErrorCode]）

incrementboolean — style · CWE-398

• 规则编号：incrementboolean
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：The operand of a postfix increment operator may be of type bool but it is deprecated by C++ Standard (Annex D-1) and the operand is always set to true. You should assign it the value 'true' instead.
• 日志特征：检测日志以 [incrementboolean] 标识（<file>:<line>:<col>: style: ... [incrementboolean]）

initializerList — style · CWE-398

• 规则编号：initializerList
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Member variable 'class::variable' is in the wrong place in the initializer list. Members are initialized in the order they are declared, not in the order they are in the initializer list. Keeping the initializer list in the same order that the members were declared prevents order dependent initialization errors.
• 日志特征：检测日志以 [initializerList] 标识（<file>:<line>:<col>: style: ... [initializerList]）

knownArgument — style

• 规则编号：knownArgument
• 严重级别：style
• CWE：—
• 漏洞描述：Argument 'x-x' to function 'func' is always 0. It does not matter what value 'x' has.
• 日志特征：检测日志以 [knownArgument] 标识（<file>:<line>:<col>: style: ... [knownArgument]）

knownArgumentHiddenVariableExpression — style

• 规则编号：knownArgumentHiddenVariableExpression
• 严重级别：style
• CWE：—
• 漏洞描述：Argument 'x*0' to function 'func' is always 0. Constant literal calculation disable/hide variable expression 'x'.
• 日志特征：检测日志以 [knownArgumentHiddenVariableExpression] 标识（<file>:<line>:<col>: style: ... [knownArgumentHiddenVariableExpression]）

knownConditionTrueFalse — style · CWE-570

• 规则编号：knownConditionTrueFalse
• 严重级别：style
• CWE：CWE-570
• 漏洞描述：Condition 'x' is always false
• 日志特征：检测日志以 [knownConditionTrueFalse] 标识（<file>:<line>:<col>: style: ... [knownConditionTrueFalse]）

knownEmptyContainer — style · CWE-398

• 规则编号：knownEmptyContainer
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Iterating over container 'var' that is always empty.
• 日志特征：检测日志以 [knownEmptyContainer] 标识（<file>:<line>:<col>: style: ... [knownEmptyContainer]）

knownPointerToBool — style

• 规则编号：knownPointerToBool
• 严重级别：style
• CWE：—
• 漏洞描述：Pointer expression 'p' converted to bool is always true.
• 日志特征：检测日志以 [knownPointerToBool] 标识（<file>:<line>:<col>: style: ... [knownPointerToBool]）

mismatchingBitAnd — style · CWE-398

• 规则编号：mismatchingBitAnd
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Mismatching bitmasks. Result is always 0 (X = Y & 0xf0; Z = X & 0x1; => Z=0).
• 日志特征：检测日志以 [mismatchingBitAnd] 标识（<file>:<line>:<col>: style: ... [mismatchingBitAnd]）

missingOverride — style

• 规则编号：missingOverride
• 严重级别：style
• CWE：—
• 漏洞描述：The function '' overrides a function in a base class but is not marked with a 'override' specifier.
• 日志特征：检测日志以 [missingOverride] 标识（<file>:<line>:<col>: style: ... [missingOverride]）

moduloofone — style

• 规则编号：moduloofone
• 严重级别：style
• CWE：—
• 漏洞描述：Modulo of one is always equal to zero
• 日志特征：检测日志以 [moduloofone] 标识（<file>:<line>:<col>: style: ... [moduloofone]）

multiCondition — style · CWE-398

• 规则编号：multiCondition
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Expression is always false because 'else if' condition matches previous condition at line 1.
• 日志特征：检测日志以 [multiCondition] 标识（<file>:<line>:<col>: style: ... [multiCondition]）

nanInArithmeticExpression — style · CWE-369

• 规则编号：nanInArithmeticExpression
• 严重级别：style
• CWE：CWE-369
• 漏洞描述：Using NaN/Inf in a computation. Although nothing bad really happens, it is suspicious.
• 日志特征：检测日志以 [nanInArithmeticExpression] 标识（<file>:<line>:<col>: style: ... [nanInArithmeticExpression]）

noConstructor — style · CWE-398

• 规则编号：noConstructor
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：The class 'classname' does not declare a constructor although it has private member variables which likely require initialization. Member variables of native types, pointers, or references are left uninitialized when the class is instantiated. That may cause bugs or undefined behavior.
• 日志特征：检测日志以 [noConstructor] 标识（<file>:<line>:<col>: style: ... [noConstructor]）

noExplicitConstructor — style · CWE-398

• 规则编号：noExplicitConstructor
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Class 'classname' has a constructor with 1 argument that is not explicit. Such, so called "Converting constructors", should in general be explicit for type safety reasons as that prevents unintended implicit conversions.
• 日志特征：检测日志以 [noExplicitConstructor] 标识（<file>:<line>:<col>: style: ... [noExplicitConstructor]）

operatorEqRetRefThis — style · CWE-398

• 规则编号：operatorEqRetRefThis
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：'operator=' should return reference to 'this' instance.
• 日志特征：检测日志以 [operatorEqRetRefThis] 标识（<file>:<line>:<col>: style: ... [operatorEqRetRefThis]）

operatorEqShouldBeLeftUnimplemented — style · CWE-398

• 规则编号：operatorEqShouldBeLeftUnimplemented
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：'operator=' should either return reference to 'this' instance or be declared private and left unimplemented.
• 日志特征：检测日志以 [operatorEqShouldBeLeftUnimplemented] 标识（<file>:<line>:<col>: style: ... [operatorEqShouldBeLeftUnimplemented]）

oppositeExpression — style · CWE-398

• 规则编号：oppositeExpression
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Finding the opposite expression on both sides of an operator is suspicious and might indicate a cut and paste or logic error. Please examine this code carefully to determine if it is correct.
• 日志特征：检测日志以 [oppositeExpression] 标识（<file>:<line>:<col>: style: ... [oppositeExpression]）

pointerLessThanZero — style · CWE-570

• 规则编号：pointerLessThanZero
• 严重级别：style
• CWE：CWE-570
• 漏洞描述：A pointer can not be negative so it is either pointless or an error to check if it is.
• 日志特征：检测日志以 [pointerLessThanZero] 标识（<file>:<line>:<col>: style: ... [pointerLessThanZero]）

pointerPositive — style · CWE-570

• 规则编号：pointerPositive
• 严重级别：style
• CWE：CWE-570
• 漏洞描述：A pointer can not be negative so it is either pointless or an error to check if it is not.
• 日志特征：检测日志以 [pointerPositive] 标识（<file>:<line>:<col>: style: ... [pointerPositive]）

redundantAssignInSwitch — style · CWE-563

• 规则编号：redundantAssignInSwitch
• 严重级别：style
• CWE：CWE-563
• 漏洞描述：Variable 'var' is reassigned a value before the old one has been used. 'break;' missing?
• 日志特征：检测日志以 [redundantAssignInSwitch] 标识（<file>:<line>:<col>: style: ... [redundantAssignInSwitch]）

redundantAssignment — style · CWE-563

• 规则编号：redundantAssignment
• 严重级别：style
• CWE：CWE-563
• 漏洞描述：Variable 'var' is reassigned a value before the old one has been used.
• 日志特征：检测日志以 [redundantAssignment] 标识（<file>:<line>:<col>: style: ... [redundantAssignment]）

redundantBitwiseOperationInSwitch — style

• 规则编号：redundantBitwiseOperationInSwitch
• 严重级别：style
• CWE：—
• 漏洞描述：Redundant bitwise operation on 'varname' in 'switch' statement. 'break;' missing?
• 日志特征：检测日志以 [redundantBitwiseOperationInSwitch] 标识（<file>:<line>:<col>: style: ... [redundantBitwiseOperationInSwitch]）

redundantCondition — style · CWE-398

• 规则编号：redundantCondition
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Redundant condition: If x > 11 the condition x > 10 is always true.
• 日志特征：检测日志以 [redundantCondition] 标识（<file>:<line>:<col>: style: ... [redundantCondition]）

redundantContinue — style · CWE-561

• 规则编号：redundantContinue
• 严重级别：style
• CWE：CWE-561
• 漏洞描述：'continue' is redundant since it is the last statement in a loop.
• 日志特征：检测日志以 [redundantContinue] 标识（<file>:<line>:<col>: style: ... [redundantContinue]）

redundantIfRemove — style · CWE-398

• 规则编号：redundantIfRemove
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Redundant checking of STL container element existence before removing it. It is safe to call the remove method on a non-existing element.
• 日志特征：检测日志以 [redundantIfRemove] 标识（<file>:<line>:<col>: style: ... [redundantIfRemove]）

redundantInitialization — style · CWE-563

• 规则编号：redundantInitialization
• 严重级别：style
• CWE：CWE-563
• 漏洞描述：Redundant initialization for 'var'. The initialized value is overwritten before it is read.
• 日志特征：检测日志以 [redundantInitialization] 标识（<file>:<line>:<col>: style: ... [redundantInitialization]）

redundantPointerOp — style · CWE-398

• 规则编号：redundantPointerOp
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Redundant pointer operation on 'varname' - it's already a pointer.
• 日志特征：检测日志以 [redundantPointerOp] 标识（<file>:<line>:<col>: style: ... [redundantPointerOp]）

returnNonBoolInBooleanFunction — style

• 规则编号：returnNonBoolInBooleanFunction
• 严重级别：style
• CWE：—
• 漏洞描述：Non-boolean value returned from function returning bool
• 日志特征：检测日志以 [returnNonBoolInBooleanFunction] 标识（<file>:<line>:<col>: style: ... [returnNonBoolInBooleanFunction]）

sameIteratorExpression — style · CWE-664

• 规则编号：sameIteratorExpression
• 严重级别：style
• CWE：CWE-664
• 漏洞描述：Same iterators expression are used for algorithm.
• 日志特征：检测日志以 [sameIteratorExpression] 标识（<file>:<line>:<col>: style: ... [sameIteratorExpression]）

selfAssignment — style · CWE-398

• 规则编号：selfAssignment
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Redundant assignment of 'varname' to itself.
• 日志特征：检测日志以 [selfAssignment] 标识（<file>:<line>:<col>: style: ... [selfAssignment]）

shadowArgument — style · CWE-398

• 规则编号：shadowArgument
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Local variable 'local variable' shadows outer argument
• 日志特征：检测日志以 [shadowArgument] 标识（<file>:<line>:<col>: style: ... [shadowArgument]）

shadowFunction — style · CWE-398

• 规则编号：shadowFunction
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Local variable 'local variable' shadows outer function
• 日志特征：检测日志以 [shadowFunction] 标识（<file>:<line>:<col>: style: ... [shadowFunction]）

shadowMember — style · CWE-398

• 规则编号：shadowMember
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Local variable 'local variable' shadows outer member
• 日志特征：检测日志以 [shadowMember] 标识（<file>:<line>:<col>: style: ... [shadowMember]）

shadowVariable — style · CWE-398

• 规则编号：shadowVariable
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Local variable 'local variable' shadows outer variable
• 日志特征：检测日志以 [shadowVariable] 标识（<file>:<line>:<col>: style: ... [shadowVariable]）

staticFunction — style

• 规则编号：staticFunction
• 严重级别：style
• CWE：—
• 漏洞描述：The function 'funcName' should have static linkage since it is not used outside of its translation unit.
• 日志特征：检测日志以 [staticFunction] 标识（<file>:<line>:<col>: style: ... [staticFunction]）

suspiciousFloatingPointCast — style · CWE-398

• 规则编号：suspiciousFloatingPointCast
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：If this cast is not intentional, remove it to avoid loss of precision
• 日志特征：检测日志以 [suspiciousFloatingPointCast] 标识（<file>:<line>:<col>: style: ... [suspiciousFloatingPointCast]）

truncLongCastAssignment — style · CWE-197

• 规则编号：truncLongCastAssignment
• 严重级别：style
• CWE：CWE-197
• 漏洞描述：int result is assigned to long variable. If the variable is long to avoid loss of information, then there is loss of information. To avoid loss of information you must cast a calculation operand to long, for example 'l = a * b;' => 'l = (long)a * b;'.
• 日志特征：检测日志以 [truncLongCastAssignment] 标识（<file>:<line>:<col>: style: ... [truncLongCastAssignment]）

truncLongCastReturn — style · CWE-197

• 规则编号：truncLongCastReturn
• 严重级别：style
• CWE：CWE-197
• 漏洞描述：int result is returned as long value. If the return value is long to avoid loss of information, then there is loss of information. To avoid loss of information you must cast a calculation operand to long, for example 'return ab;' => 'return (long)ab'.
• 日志特征：检测日志以 [truncLongCastReturn] 标识（<file>:<line>:<col>: style: ... [truncLongCastReturn]）

unassignedVariable — style · CWE-665

• 规则编号：unassignedVariable
• 严重级别：style
• CWE：CWE-665
• 漏洞描述：Variable 'varname' is not assigned a value.
• 日志特征：检测日志以 [unassignedVariable] 标识（<file>:<line>:<col>: style: ... [unassignedVariable]）

unhandledExceptionSpecification — style · CWE-703

• 规则编号：unhandledExceptionSpecification
• 严重级别：style
• CWE：CWE-703
• 漏洞描述：Unhandled exception specification when calling function foo(). Either use a try/catch around the function call, or add a exception specification for funcname() also.
• 日志特征：检测日志以 [unhandledExceptionSpecification] 标识（<file>:<line>:<col>: style: ... [unhandledExceptionSpecification]）

unpreciseMathCall — style · CWE-758

• 规则编号：unpreciseMathCall
• 严重级别：style
• CWE：CWE-758
• 漏洞描述：Expression '1 - erf(x)' can be replaced by 'erfc(x)' to avoid loss of precision.
• 日志特征：检测日志以 [unpreciseMathCall] 标识（<file>:<line>:<col>: style: ... [unpreciseMathCall]）

unreachableCode — style · CWE-561

• 规则编号：unreachableCode
• 严重级别：style
• CWE：CWE-561
• 漏洞描述：Statements following return, break, continue, goto or throw will never be executed.
• 日志特征：检测日志以 [unreachableCode] 标识（<file>:<line>:<col>: style: ... [unreachableCode]）

unreadVariable — style · CWE-563

• 规则编号：unreadVariable
• 严重级别：style
• CWE：CWE-563
• 漏洞描述：Variable 'varname' is assigned a value that is never used.
• 日志特征：检测日志以 [unreadVariable] 标识（<file>:<line>:<col>: style: ... [unreadVariable]）

unsafeClassCanLeak — style · CWE-398

• 规则编号：unsafeClassCanLeak
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：The class 'class' is unsafe, wrong usage can cause memory/resource leaks for 'class::varname'. This can for instance be fixed by adding proper cleanup in the destructor.
• 日志特征：检测日志以 [unsafeClassCanLeak] 标识（<file>:<line>:<col>: style: ... [unsafeClassCanLeak]）

unsignedLessThanZero — style · CWE-570

• 规则编号：unsignedLessThanZero
• 严重级别：style
• CWE：CWE-570
• 漏洞描述：The unsigned expression 'varname' will never be negative so it is either pointless or an error to check if it is.
• 日志特征：检测日志以 [unsignedLessThanZero] 标识（<file>:<line>:<col>: style: ... [unsignedLessThanZero]）

unsignedPositive — style · CWE-570

• 规则编号：unsignedPositive
• 严重级别：style
• CWE：CWE-570
• 漏洞描述：Unsigned expression 'varname' can't be negative so it is unnecessary to test it.
• 日志特征：检测日志以 [unsignedPositive] 标识（<file>:<line>:<col>: style: ... [unsignedPositive]）

unusedAllocatedMemory — style · CWE-563

• 规则编号：unusedAllocatedMemory
• 严重级别：style
• CWE：CWE-563
• 漏洞描述：Variable 'varname' is allocated memory that is never used.
• 日志特征：检测日志以 [unusedAllocatedMemory] 标识（<file>:<line>:<col>: style: ... [unusedAllocatedMemory]）

unusedFunction — style · CWE-561

• 规则编号：unusedFunction
• 严重级别：style
• CWE：CWE-561
• 漏洞描述：The function 'funcName' is never used.
• 日志特征：检测日志以 [unusedFunction] 标识（<file>:<line>:<col>: style: ... [unusedFunction]）

unusedLabel — style · CWE-398

• 规则编号：unusedLabel
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Label '' is not used.
• 日志特征：检测日志以 [unusedLabel] 标识（<file>:<line>:<col>: style: ... [unusedLabel]）

unusedLabelConfiguration — style · CWE-398

• 规则编号：unusedLabelConfiguration
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Label '' is not used. There is #if in function body so the label might be used in code that is removed by the preprocessor.
• 日志特征：检测日志以 [unusedLabelConfiguration] 标识（<file>:<line>:<col>: style: ... [unusedLabelConfiguration]）

unusedPrivateFunction — style · CWE-398

• 规则编号：unusedPrivateFunction
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Unused private function: 'classname::funcname'
• 日志特征：检测日志以 [unusedPrivateFunction] 标识（<file>:<line>:<col>: style: ... [unusedPrivateFunction]）

unusedScopedObject — style · CWE-563

• 规则编号：unusedScopedObject
• 严重级别：style
• CWE：CWE-563
• 漏洞描述：Instance of 'varname' object is destroyed immediately.
• 日志特征：检测日志以 [unusedScopedObject] 标识（<file>:<line>:<col>: style: ... [unusedScopedObject]）

unusedStructMember — style · CWE-563

• 规则编号：unusedStructMember
• 严重级别：style
• CWE：CWE-563
• 漏洞描述：struct member 'structname::variable' is never used.
• 日志特征：检测日志以 [unusedStructMember] 标识（<file>:<line>:<col>: style: ... [unusedStructMember]）

unusedVariable — style · CWE-563

• 规则编号：unusedVariable
• 严重级别：style
• CWE：CWE-563
• 漏洞描述：Unused variable: varname
• 日志特征：检测日志以 [unusedVariable] 标识（<file>:<line>:<col>: style: ... [unusedVariable]）

uselessAssignmentArg — style · CWE-398

• 规则编号：uselessAssignmentArg
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Assignment of function parameter has no effect outside the function.
• 日志特征：检测日志以 [uselessAssignmentArg] 标识（<file>:<line>:<col>: style: ... [uselessAssignmentArg]）

uselessOverride — style

• 规则编号：uselessOverride
• 严重级别：style
• CWE：—
• 漏洞描述：The function '' overrides a function in a base class but just delegates back to the base class.
• 日志特征：检测日志以 [uselessOverride] 标识（<file>:<line>:<col>: style: ... [uselessOverride]）

useStandardLibrary — style

• 规则编号：useStandardLibrary
• 严重级别：style
• CWE：—
• 漏洞描述：Consider using memcpy instead of loop.
• 日志特征：检测日志以 [useStandardLibrary] 标识（<file>:<line>:<col>: style: ... [useStandardLibrary]）

useStlAlgorithm — style · CWE-398

• 规则编号：useStlAlgorithm
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：Consider using algorithm instead of a raw loop.
• 日志特征：检测日志以 [useStlAlgorithm] 标识（<file>:<line>:<col>: style: ... [useStlAlgorithm]）

variableScope — style · CWE-398

• 规则编号：variableScope
• 严重级别：style
• CWE：CWE-398
• 漏洞描述：The scope of the variable 'varname' can be reduced. Warning: Be careful when fixing this message, especially when there are inner loops. Here is an example where cppcheck will write that the scope for 'i' can be reduced:\012void f(int x)\012{\012 int i = 0;\012 if (x) {\012 // it's safe to move 'int i = 0;' here\012 for (int n = 0; n < 10; ++n) {\012 // it is possible but not safe to move 'int i = 0;' here\012 do_something(&i);\012 }\012 }\012}\012When you see this message it is always safe to reduce the variable scope 1 level.
• 日志特征：检测日志以 [variableScope] 标识（<file>:<line>:<col>: style: ... [variableScope]）

virtualCallInConstructor — style

• 规则编号：virtualCallInConstructor
• 严重级别：style
• CWE：—
• 漏洞描述：Virtual function 'f' is called from constructor '' at line 1. Dynamic binding is not used.
• 日志特征：检测日志以 [virtualCallInConstructor] 标识（<file>:<line>:<col>: style: ... [virtualCallInConstructor]）

performance（性能）（19 项）

passedByValue — performance · CWE-398

• 规则编号：passedByValue
• 严重级别：performance
• CWE：CWE-398
• 漏洞描述：Parameter '' is passed by value. It could be passed as a const reference which is usually faster and recommended in C++.
• 日志特征：检测日志以 [passedByValue] 标识（<file>:<line>:<col>: performance: ... [passedByValue]）

postfixOperator — performance · CWE-398

• 规则编号：postfixOperator
• 严重级别：performance
• CWE：CWE-398
• 漏洞描述：Prefix ++/-- operators should be preferred for non-primitive types. Pre-increment/decrement can be more efficient than post-increment/decrement. Post-increment/decrement usually involves keeping a copy of the previous value around and adds a little extra code.
• 日志特征：检测日志以 [postfixOperator] 标识（<file>:<line>:<col>: performance: ... [postfixOperator]）

redundantCopy — performance · CWE-563

• 规则编号：redundantCopy
• 严重级别：performance
• CWE：CWE-563
• 漏洞描述：Buffer 'var' is being written before its old content has been used.
• 日志特征：检测日志以 [redundantCopy] 标识（<file>:<line>:<col>: performance: ... [redundantCopy]）

redundantCopyLocalConst — performance · CWE-398

• 规则编号：redundantCopyLocalConst
• 严重级别：performance
• CWE：CWE-398
• 漏洞描述：The const variable 'varname' is assigned a copy of the data. You can avoid the unnecessary data copying by converting 'varname' to const reference.
• 日志特征：检测日志以 [redundantCopyLocalConst] 标识（<file>:<line>:<col>: performance: ... [redundantCopyLocalConst]）

returnByReference — performance

• 规则编号：returnByReference
• 严重级别：performance
• CWE：—
• 漏洞描述：Function 'func()' should return member 'var' by const reference.
• 日志特征：检测日志以 [returnByReference] 标识（<file>:<line>:<col>: performance: ... [returnByReference]）

returnStdMoveLocal — performance

• 规则编号：returnStdMoveLocal
• 严重级别：performance
• CWE：—
• 漏洞描述：Using std::move for returning object by-value from function will affect copy elision optimization. More: https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#Rf-return-move-local
• 日志特征：检测日志以 [returnStdMoveLocal] 标识（<file>:<line>:<col>: performance: ... [returnStdMoveLocal]）

stlcstrAssignment — performance · CWE-704

• 规则编号：stlcstrAssignment
• 严重级别：performance
• CWE：CWE-704
• 漏洞描述：Assigning a const char* to a std::string requires a call to strlen(). Solve that by directly assigning the string.
• 日志特征：检测日志以 [stlcstrAssignment] 标识（<file>:<line>:<col>: performance: ... [stlcstrAssignment]）

stlcstrConcat — performance · CWE-704

• 规则编号：stlcstrConcat
• 严重级别：performance
• CWE：CWE-704
• 漏洞描述：Concatenating a const char* with a std::string requires a call to strlen(). Solve that by directly concatenating the strings.
• 日志特征：检测日志以 [stlcstrConcat] 标识（<file>:<line>:<col>: performance: ... [stlcstrConcat]）

stlcstrConstructor — performance · CWE-704

• 规则编号：stlcstrConstructor
• 严重级别：performance
• CWE：CWE-704
• 漏洞描述：Constructing a std::string from const char* requires a call to strlen(). Solve that by directly passing the string.
• 日志特征：检测日志以 [stlcstrConstructor] 标识（<file>:<line>:<col>: performance: ... [stlcstrConstructor]）

stlcstrParam — performance · CWE-704

• 规则编号：stlcstrParam
• 严重级别：performance
• CWE：CWE-704
• 漏洞描述：The conversion from const char* as returned by c_str() to std::string creates an unnecessary string copy or length calculation. Solve that by directly passing the string.
• 日志特征：检测日志以 [stlcstrParam] 标识（<file>:<line>:<col>: performance: ... [stlcstrParam]）

stlcstrReturn — performance · CWE-704

• 规则编号：stlcstrReturn
• 严重级别：performance
• CWE：CWE-704
• 漏洞描述：The conversion from const char* as returned by c_str() to std::string creates an unnecessary string copy. Solve that by directly returning the string.
• 日志特征：检测日志以 [stlcstrReturn] 标识（<file>:<line>:<col>: performance: ... [stlcstrReturn]）

stlcstrStream — performance · CWE-704

• 规则编号：stlcstrStream
• 严重级别：performance
• CWE：CWE-704
• 漏洞描述：Passing a const char* to a stream requires a call to strlen(). Solve that by directly passing the string.
• 日志特征：检测日志以 [stlcstrStream] 标识（<file>:<line>:<col>: performance: ... [stlcstrStream]）

stlFindInsert — performance · CWE-398

• 规则编号：stlFindInsert
• 严重级别：performance
• CWE：CWE-398
• 漏洞描述：Searching before insertion is not necessary.
• 日志特征：检测日志以 [stlFindInsert] 标识（<file>:<line>:<col>: performance: ... [stlFindInsert]）

stlIfStrFind — performance · CWE-597

• 规则编号：stlIfStrFind
• 严重级别：performance
• CWE：CWE-597
• 漏洞描述：Either inefficient or wrong usage of string::find(). string::starts_with() will be faster if string::find's result is compared with 0, because it will not scan the whole string. If your intention is to check that there are no findings in the string, you should compare with std::string::npos.
• 日志特征：检测日志以 [stlIfStrFind] 标识（<file>:<line>:<col>: performance: ... [stlIfStrFind]）

stlSize — performance · CWE-398

• 规则编号：stlSize
• 严重级别：performance
• CWE：CWE-398
• 漏洞描述：Checking for 'list' emptiness might be inefficient. Using list.empty() instead of list.size() can be faster. list.size() can take linear time but list.empty() is guaranteed to take constant time.
• 日志特征：检测日志以 [stlSize] 标识（<file>:<line>:<col>: performance: ... [stlSize]）

useInitializationList — performance · CWE-398

• 规则编号：useInitializationList
• 严重级别：performance
• CWE：CWE-398
• 漏洞描述：When an object of a class is created, the constructors of all member variables are called consecutively in the order the variables are declared, even if you don't explicitly write them to the initialization list. You could avoid assigning 'variable' a value by passing the value to the constructor in the initialization list.
• 日志特征：检测日志以 [useInitializationList] 标识（<file>:<line>:<col>: performance: ... [useInitializationList]）

uselessCallsConstructor — performance · CWE-398

• 规则编号：uselessCallsConstructor
• 严重级别：performance
• CWE：CWE-398
• 漏洞描述：Inefficient constructor call: container '' is assigned a partial copy of itself. Use erase() or resize() instead.
• 日志特征：检测日志以 [uselessCallsConstructor] 标识（<file>:<line>:<col>: performance: ... [uselessCallsConstructor]）

uselessCallsSubstr — performance · CWE-398

• 规则编号：uselessCallsSubstr
• 严重级别：performance
• CWE：CWE-398
• 漏洞描述：Ineffective call of function 'substr' because it returns a copy of the object. Use operator= instead.
• 日志特征：检测日志以 [uselessCallsSubstr] 标识（<file>:<line>:<col>: performance: ... [uselessCallsSubstr]）

uselessCallsSwap — performance · CWE-628

• 规则编号：uselessCallsSwap
• 严重级别：performance
• CWE：CWE-628
• 漏洞描述：The 'swap()' function has no logical effect when given itself as parameter (str.swap(str)). As it is currently the code is inefficient. Is the object or the parameter wrong here?
• 日志特征：检测日志以 [uselessCallsSwap] 标识（<file>:<line>:<col>: performance: ... [uselessCallsSwap]）

portability（可移植性）（20 项）

arithOperationsOnVoidPointer — portability · CWE-467

• 规则编号：arithOperationsOnVoidPointer
• 严重级别：portability
• CWE：CWE-467
• 漏洞描述：'varname' is of type 'vartype'. When using void pointers in calculations, the behaviour is undefined. Arithmetic operations on 'void *' is a GNU C extension, which defines the 'sizeof(void)' to be 1.
• 日志特征：检测日志以 [arithOperationsOnVoidPointer] 标识（<file>:<line>:<col>: portability: ... [arithOperationsOnVoidPointer]）

AssignmentAddressToInteger — portability · CWE-758

• 规则编号：AssignmentAddressToInteger
• 严重级别：portability
• CWE：CWE-758
• 漏洞描述：Assigning a pointer to an integer (int/long/etc) is not portable across different platforms and compilers. For example in 32-bit Windows and linux they are same width, but in 64-bit Windows and linux they are of different width. In worst case you end up assigning 64-bit address to 32-bit integer. The safe way is to store addresses only in pointer types (or typedefs like uintptr_t).
• 日志特征：检测日志以 [AssignmentAddressToInteger] 标识（<file>:<line>:<col>: portability: ... [AssignmentAddressToInteger]）

AssignmentIntegerToAddress — portability · CWE-758

• 规则编号：AssignmentIntegerToAddress
• 严重级别：portability
• CWE：CWE-758
• 漏洞描述：Assigning an integer (int/long/etc) to a pointer is not portable across different platforms and compilers. For example in 32-bit Windows and linux they are same width, but in 64-bit Windows and linux they are of different width. In worst case you end up assigning 64-bit integer to 32-bit pointer. The safe way is to store addresses only in pointer types (or typedefs like uintptr_t).
• 日志特征：检测日志以 [AssignmentIntegerToAddress] 标识（<file>:<line>:<col>: portability: ... [AssignmentIntegerToAddress]）

CastAddressToIntegerAtReturn — portability · CWE-758

• 规则编号：CastAddressToIntegerAtReturn
• 严重级别：portability
• CWE：CWE-758
• 漏洞描述：Returning an address value in a function with integer (int/long/etc) return type is not portable across different platforms and compilers. For example in 32-bit Windows and Linux they are same width, but in 64-bit Windows and Linux they are of different width. In worst case you end up casting 64-bit address down to 32-bit integer. The safe way is to return a type such as intptr_t.
• 日志特征：检测日志以 [CastAddressToIntegerAtReturn] 标识（<file>:<line>:<col>: portability: ... [CastAddressToIntegerAtReturn]）

CastIntegerToAddressAtReturn — portability · CWE-758

• 规则编号：CastIntegerToAddressAtReturn
• 严重级别：portability
• CWE：CWE-758
• 漏洞描述：Returning an integer (int/long/etc) in a function with pointer return type is not portable across different platforms and compilers. For example in 32-bit Windows and Linux they are same width, but in 64-bit Windows and Linux they are of different width. In worst case you end up casting 64-bit integer down to 32-bit pointer. The safe way is to always return a pointer.
• 日志特征：检测日志以 [CastIntegerToAddressAtReturn] 标识（<file>:<line>:<col>: portability: ... [CastIntegerToAddressAtReturn]）

fflushOnInputStream — portability · CWE-398

• 规则编号：fflushOnInputStream
• 严重级别：portability
• CWE：CWE-398
• 漏洞描述：fflush() called on input stream 'stdin' may result in undefined behaviour on non-linux systems.
• 日志特征：检测日志以 [fflushOnInputStream] 标识（<file>:<line>:<col>: portability: ... [fflushOnInputStream]）

intToPointerCast — portability · CWE-398

• 规则编号：intToPointerCast
• 严重级别：portability
• CWE：CWE-398
• 漏洞描述：Casting non-zero decimal integer literal to pointer.
• 日志特征：检测日志以 [intToPointerCast] 标识（<file>:<line>:<col>: portability: ... [intToPointerCast]）

invalidConstFunctionType — portability

• 规则编号：invalidConstFunctionType
• 严重级别：portability
• CWE：—
• 漏洞描述：It is unspecified behavior to const qualify a function type.
• 日志特征：检测日志以 [invalidConstFunctionType] 标识（<file>:<line>:<col>: portability: ... [invalidConstFunctionType]）

invalidPointerCast — portability · CWE-704

• 规则编号：invalidPointerCast
• 严重级别：portability
• CWE：CWE-704
• 漏洞描述：Casting between float * and double * which have an incompatible binary data representation.
• 日志特征：检测日志以 [invalidPointerCast] 标识（<file>:<line>:<col>: portability: ... [invalidPointerCast]）

memsetClassFloat — portability · CWE-758

• 规则编号：memsetClassFloat
• 严重级别：portability
• CWE：CWE-758
• 漏洞描述：Using memset() on class which contains a floating point number. This is not portable because memset() sets each byte of a block of memory to a specific value and the actual representation of a floating-point value is implementation defined. Note: In case of an IEEE754-1985 compatible implementation setting all bits to zero results in the value 0.0.
• 日志特征：检测日志以 [memsetClassFloat] 标识（<file>:<line>:<col>: portability: ... [memsetClassFloat]）

memsetFloat — portability · CWE-688

• 规则编号：memsetFloat
• 严重级别：portability
• CWE：CWE-688
• 漏洞描述：The 2nd memset() argument 'varname' is a float, its representation is implementation defined. memset() is used to set each byte of a block of memory to a specific value and the actual representation of a floating-point value is implementation defined.
• 日志特征：检测日志以 [memsetFloat] 标识（<file>:<line>:<col>: portability: ... [memsetFloat]）

nonStandardCharLiteral — portability

• 规则编号：nonStandardCharLiteral
• 严重级别：portability
• CWE：—
• 漏洞描述：Non-standard character literal.
• 日志特征：检测日志以 [nonStandardCharLiteral] 标识（<file>:<line>:<col>: portability: ... [nonStandardCharLiteral]）

pointerOutOfBounds — portability · CWE-758

• 规则编号：pointerOutOfBounds
• 严重级别：portability
• CWE：CWE-758
• 漏洞描述：Pointer arithmetic overflow.
• 日志特征：检测日志以 [pointerOutOfBounds] 标识（<file>:<line>:<col>: portability: ... [pointerOutOfBounds]）

pointerOutOfBoundsCond — portability · CWE-758

• 规则编号：pointerOutOfBoundsCond
• 严重级别：portability
• CWE：CWE-758
• 漏洞描述：Pointer arithmetic overflow.
• 日志特征：检测日志以 [pointerOutOfBoundsCond] 标识（<file>:<line>:<col>: portability: ... [pointerOutOfBoundsCond]）

shiftNegativeLHS — portability · CWE-758

• 规则编号：shiftNegativeLHS
• 严重级别：portability
• CWE：CWE-758
• 漏洞描述：Shifting a negative value is technically undefined behaviour
• 日志特征：检测日志以 [shiftNegativeLHS] 标识（<file>:<line>:<col>: portability: ... [shiftNegativeLHS]）

sizeofDereferencedVoidPointer — portability · CWE-682

• 规则编号：sizeofDereferencedVoidPointer
• 严重级别：portability
• CWE：CWE-682
• 漏洞描述：'*varname' is of type 'void', the behaviour of 'sizeof(void)' is not covered by the ISO C standard. A value for 'sizeof(void)' is defined only as part of a GNU C extension, which defines 'sizeof(void)' to be 1.
• 日志特征：检测日志以 [sizeofDereferencedVoidPointer] 标识（<file>:<line>:<col>: portability: ... [sizeofDereferencedVoidPointer]）

sizeofVoid — portability · CWE-682

• 规则编号：sizeofVoid
• 严重级别：portability
• CWE：CWE-682
• 漏洞描述：Behaviour of 'sizeof(void)' is not covered by the ISO C standard. A value for 'sizeof(void)' is defined only as part of a GNU C extension, which defines 'sizeof(void)' to be 1.
• 日志特征：检测日志以 [sizeofVoid] 标识（<file>:<line>:<col>: portability: ... [sizeofVoid]）

UnionZeroInit — portability

• 规则编号：UnionZeroInit
• 严重级别：portability
• CWE：—
• 漏洞描述：Zero initializing union '' does not guarantee its complete storage to be zero initialized as its largest member is not declared as the first member. Consider making the first member or favor memset().
• 日志特征：检测日志以 [UnionZeroInit] 标识（<file>:<line>:<col>: portability: ... [UnionZeroInit]）

unknownSignCharArrayIndex — portability · CWE-758

• 规则编号：unknownSignCharArrayIndex
• 严重级别：portability
• CWE：CWE-758
• 漏洞描述：'char' type used as array index. Values greater than 127 will be treated depending on whether 'char' is signed or unsigned on target platform.
• 日志特征：检测日志以 [unknownSignCharArrayIndex] 标识（<file>:<line>:<col>: portability: ... [unknownSignCharArrayIndex]）

varFuncNullUB — portability · CWE-475

• 规则编号：varFuncNullUB
• 严重级别：portability
• CWE：CWE-475
• 漏洞描述：Passing NULL after the last typed argument to a variadic function leads to undefined behaviour.\012The C99 standard, in section 7.15.1.1, states that if the type used by va_arg() is not compatible with the type of the actual next argument (as promoted according to the default argument promotions), the behavior is undefined.\012The value of the NULL macro is an implementation-defined null pointer constant (7.17), which can be any integer constant expression with the value 0, or such an expression casted to (void*) (6.3.2.3). This includes values like 0, 0L, or even 0LL.\012In practice on common architectures, this will cause real crashes if sizeof(int) != sizeof(void*), and NULL is defined to 0 or any other null pointer constant that promotes to int.\012To reproduce you might be able to use this little code example on 64bit platforms. If the output includes "ERROR", the sentinel had only 4 out of 8 bytes initialized to zero and was not detected as the final argument to stop argument processing via va_arg(). Changing the 0 to (void*)0 or 0L will make the "ERROR" output go away.\012#include <stdarg.h>\012#include <stdio.h>\012\012void f(char *s, ...) {\012 va_list ap;\012 va_start(ap,s);\012 for (;;) {\012 char p = va_arg(ap,char);\012 printf("%018p, %s\n", p, (long)p & 255 ? p : "");\012 if(!p) break;\012 }\012 va_end(ap);\012}\012\012void g() {\012 char *s2 = "x";\012 char s3 = "ERROR";\012\012 // changing 0 to 0L for the 7th argument (which is intended to act as sentinel) makes the error go away on x86_64\012 f("first", s2, s2, s2, s2, s2, 0, s3, (char)0);\012}\012\012void h() {\012 int i;\012 volatile unsigned char a[1000];\012 for (i = 0; i<sizeof(a); i++)\012 a[i] = -1;\012}\012\012int main() {\012 h();\012 g();\012 return 0;\012}
• 日志特征：检测日志以 [varFuncNullUB] 标识（<file>:<line>:<col>: portability: ... [varFuncNullUB]）

information（信息）（5 项）

class_X_Y — information

• 规则编号：class_X_Y
• 严重级别：information
• CWE：—
• 漏洞描述：The code ' ' is not handled. You can use -I or --include to add handling of this code.
• 日志特征：检测日志以 [class_X_Y] 标识（<file>:<line>:<col>: information: ... [class_X_Y]）

missingInclude — information

• 规则编号：missingInclude
• 严重级别：information
• CWE：—
• 漏洞描述：Include file: "" not found.
• 日志特征：检测日志以 [missingInclude] 标识（<file>:<line>:<col>: information: ... [missingInclude]）

missingIncludeSystem — information

• 规则编号：missingIncludeSystem
• 严重级别：information
• CWE：—
• 漏洞描述：Include file: <> not found. Please note: Standard library headers do not need to be provided to get proper results.
• 日志特征：检测日志以 [missingIncludeSystem] 标识（<file>:<line>:<col>: information: ... [missingIncludeSystem]）

purgedConfiguration — information

• 规则编号：purgedConfiguration
• 严重级别：information
• CWE：—
• 漏洞描述：The configuration '' was not checked because its code equals another one.
• 日志特征：检测日志以 [purgedConfiguration] 标识（<file>:<line>:<col>: information: ... [purgedConfiguration]）

toomanyconfigs — information · CWE-398

• 规则编号：toomanyconfigs
• 严重级别：information
• CWE：CWE-398
• 漏洞描述：Too many #ifdef configurations - cppcheck only checks 12 of 0 configurations. Use --force to check all configurations.
• 日志特征：检测日志以 [toomanyconfigs] 标识（<file>:<line>:<col>: information: ... [toomanyconfigs]）

5.3 重点检查·深度解析（高频检查，含成因/示例/修复/案例）

以下为高频重点检查的深度解析（含 uninitvar 等常见检查），多数已含于 §5.2 的 342 项内。

error 类

nullPointer - 空指针解引用

• 规则编号：nullPointer
• 规则名称：空指针解引用
• 类别：error
• 严重级别：error
• CWE：CWE-476
• 漏洞描述：对值可能为 nullptr 的指针解引用，运行时崩溃或未定义行为。cppcheck 通过 ValueFlow 跟踪指针可能取空的路径。
• 影响范围：所有指针解引用、成员访问、数组下标。
• 日志特征：error: Null pointer dereference: p [nullPointer]，并给出取空的来源行。
• 产生原因
  • 未检查 malloc/new(std::nothrow)/工厂返回值
  • 提前 return nullptr 后调用方未判空
  • 几何查询（如查找相邻面）返回空但未处理
• 典型输入

  Face* f = mesh.FindFace(id);  // 可能返回 nullptr
  int n = f->EdgeCount();       // [nullPointer]
• 修复建议
  • 解引用前判空并走错误分支
  • 用引用/std::optional/智能指针表达"非空"语义
• 相关案例
  • 案例编号：nullPointer-01
  • 违规场景：拓扑遍历中假定每条边都有伴随结构，未判空导致偶发崩溃。
  • 修复结果：加入判空与日志，崩溃消除。
• 关联规则：uninitvar、deallocuse

arrayIndexOutOfBounds - 数组下标越界

• 规则编号：arrayIndexOutOfBounds
• 规则名称：数组下标越界
• 类别：error
• 严重级别：error
• CWE：CWE-788
• 漏洞描述：以编译期可知或 ValueFlow 推断的越界下标访问数组，导致内存破坏/未定义行为。
• 影响范围：固定数组、栈缓冲区、std::array、容器索引。
• 日志特征：error: Array 'a[10]' accessed at index 10, which is out of bounds [arrayIndexOutOfBounds]。
• 产生原因
  • <= 边界写法、off-by-one
  • 顶点/索引缓冲长度与循环上界不一致
• 典型输入

  double v[3];
  for (int i = 0; i <= 3; ++i) v[i] = 0.0;  // i=3 越界 [arrayIndexOutOfBounds]
• 修复建议
  • 循环用 i < N；用 std::size(arr) 取长度
  • 几何缓冲改用带边界检查的容器封装
• 相关案例
  • 案例编号：arrayIndexOutOfBounds-01
  • 违规场景：法向量数组按 <= 遍历越界，Release 偶发数据损坏。
  • 修复结果：改 < 后稳定。
• 关联规则：bufferAccessOutOfBounds、negativeIndex、containerOutOfBounds

uninitvar - 使用未初始化变量

• 规则编号：uninitvar
• 规则名称：使用未初始化变量
• 类别：error
• 严重级别：error
• CWE：CWE-457
• 漏洞描述：读取从未赋值的局部变量，结果不确定，造成偶发性 bug。
• 影响范围：所有局部标量/缓冲、聚合体部分初始化。
• 日志特征：error: Uninitialized variable: buf [uninitvar]。
• 产生原因
  • 声明与初始化分离后某分支漏赋值
  • 仅在 if 分支赋值，else 未赋值即被读
• 典型输入

  double area;
  if (closed) area = ComputeArea();
  return area;   // closed==false 时未初始化 [uninitvar]
• 修复建议
  • 声明即初始化（double area = 0.0;）
  • 保证所有路径赋值
• 相关案例
  • 案例编号：uninitvar-01
  • 违规场景：求面积函数在退化输入下返回随机值。
  • 修复结果：初始化为 0 并显式处理退化。
• 关联规则：uninitMemberVar、nullPointer

memleak - 内存泄漏

• 规则编号：memleak
• 规则名称：内存泄漏
• 类别：error
• 严重级别：error
• CWE：CWE-401
• 漏洞描述：new/malloc 分配的内存在所有路径上未被释放（含异常路径），长期运行内存上涨。
• 影响范围：裸指针所有权管理、提前 return/异常路径。
• 日志特征：error: Memory leak: p [memleak]。
• 产生原因
  • 提前 return 跳过 delete
  • 异常抛出绕过释放
• 典型输入

  Curve* c = new Curve();
  if (!c->Valid()) return false;  // 泄漏 c [memleak]
  delete c;
• 修复建议
  • 用 std::unique_ptr/RAII 管理所有权
  • 遵循 RAII 与三/五法则（Rule of Three/Five）
• 相关案例
  • 案例编号：memleak-01
  • 违规场景：曲线工厂异常路径未释放临时对象。
  • 修复结果：改用 unique_ptr，泄漏消除。
• 关联规则：resourceLeak、memleakOnRealloc、doubleFree

doubleFree - 重复释放

• 规则编号：doubleFree
• 规则名称：重复释放
• 类别：error
• 严重级别：error
• CWE：CWE-415
• 漏洞描述：同一内存被 delete/free 两次，破坏堆结构，可能被利用。
• 影响范围：拷贝控制缺失的类、错误的错误处理路径。
• 日志特征：error: Memory pointed to by 'p' is freed twice [doubleFree]。
• 产生原因
  • 浅拷贝后两对象析构同一指针
  • 错误处理与正常路径重复释放
• 典型输入

  free(buf);
  if (err) free(buf);  // [doubleFree]
• 修复建议
  • 释放后置空（buf = nullptr;）
  • 用 RAII/智能指针，遵循三/五法则
• 相关案例
  • 案例编号：doubleFree-01
  • 违规场景：缓存淘汰与析构各释放一次同一块。
  • 修复结果：统一所有权到 shared_ptr。
• 关联规则：deallocuse、mismatchAllocDealloc、memleak

mismatchAllocDealloc - 分配/释放不匹配

• 规则编号：mismatchAllocDealloc
• 规则名称：分配/释放函数不匹配
• 类别：error
• 严重级别：error
• CWE：CWE-762
• 漏洞描述：new[] 用 delete、malloc 用 delete、new 用 free 等不配对，导致未定义行为。
• 影响范围：手工内存管理代码。
• 日志特征：error: Mismatching allocation and deallocation: p [mismatchAllocDealloc]。
• 产生原因
  • 数组与单对象 new/delete 混用
  • C 与 C++ 分配器混用
• 典型输入

  int* a = new int[10];
  delete a;          // 应为 delete[] a [mismatchAllocDealloc]
• 修复建议
  • new[] 配 delete[]；优先 std::vector/智能指针
• 相关案例
  • 案例编号：mismatchAllocDealloc-01
  • 违规场景：顶点数组 new[] 却 delete，Debug 断言崩溃。
  • 修复结果：改 std::vector<Vertex>。
• 关联规则：memleak、doubleFree

warning 类

uninitMemberVar - 成员变量未初始化

• 规则编号：uninitMemberVar
• 规则名称：构造后成员变量未初始化
• 类别：warning
• 严重级别：warning
• CWE：CWE-457
• 漏洞描述：构造函数结束后仍有数据成员未初始化，后续读取得到不确定值。
• 影响范围：所有含裸标量/指针成员的类。
• 日志特征：warning: Member variable 'Mesh::count_' is not initialized in the constructor [uninitMemberVar]。
• 产生原因
  • 新增成员后忘记加入初始化列表
• 典型输入

  class Mesh {
   public:
    Mesh() {}     // count_ 未初始化 [uninitMemberVar]
   private:
    int count_;
  };
• 修复建议
  • 类内成员默认初始化（int count_ = 0;）或写入初始化列表
• 相关案例
  • 案例编号：uninitMemberVar-01
  • 违规场景：新增 dirty_ 标志未初始化，缓存逻辑随机失效。
  • 修复结果：类内默认初始化。
• 关联规则：uninitvar、useInitializationList

missingReturn - 非 void 函数缺返回值

• 规则编号：missingReturn
• 规则名称：非 void 函数缺返回值
• 类别：warning
• 严重级别：warning（部分路径）
• CWE：CWE-758
• 漏洞描述：返回类型非 void 的函数存在不返回值的执行路径，调用方得到不确定值。
• 影响范围：含多分支/异常的函数。
• 日志特征：warning: Found a exit path from function with non-void return type that has missing return statement [missingReturn]。
• 产生原因
  • switch 漏 default、循环后无兜底返回
• 典型输入

  int Sign(double x) {
    if (x > 0) return 1;
    if (x < 0) return -1;
  }   // x==0 路径无返回 [missingReturn]
• 修复建议
  • 补全所有路径返回；switch 加 default
• 相关案例
  • 案例编号：missingReturn-01
  • 违规场景：方位判断函数在共线情形无返回。
  • 修复结果：补 return 0;。
• 关联规则：uninitvar

style 类

cstyleCast - C 风格强制转换

• 规则编号：cstyleCast
• 规则名称：C 风格强制转换
• 类别：style
• 严重级别：style
• CWE：—
• 漏洞描述：使用 (T)x 式 C 强制转换，绕过类型安全，隐藏潜在错误（如 const 去除、向下转换）。
• 影响范围：所有显式类型转换。
• 日志特征：style: C-style pointer casting [cstyleCast]。
• 产生原因
  • C 习惯、追求简短
• 典型输入

  Base* b = ...;
  Derived* d = (Derived*)b;  // [cstyleCast]
• 修复建议
  • 用 static_cast/dynamic_cast/const_cast/reinterpret_cast 明确转换意图
• 相关案例
  • 案例编号：cstyleCast-01
  • 违规场景：几何对象向下转换用 C 风格，类型不符时静默错误。
  • 修复结果：改 dynamic_cast 并判空。
• 关联规则：invalidPointerCast

redundantAssignment - 冗余赋值

• 规则编号：redundantAssignment
• 规则名称：冗余赋值
• 类别：style
• 严重级别：style
• CWE：CWE-563
• 漏洞描述：变量被赋值后在读取前再次被赋值，前一次赋值无效，常暗示逻辑错误。
• 影响范围：局部变量、输出参数。
• 日志特征：style: Variable 'x' is reassigned a value before the old one has been used [redundantAssignment]。
• 产生原因
  • 合并代码遗留、复制粘贴
• 典型输入

  int n = Count();
  n = 0;          // 上一行结果被丢弃 [redundantAssignment]
• 修复建议
  • 删除无效赋值或修正逻辑
• 相关案例
  • 案例编号：redundantAssignment-01
  • 违规场景：本应累加却被重置，统计结果恒为 0。
  • 修复结果：改为累加。
• 关联规则：unreadVariable、knownConditionTrueFalse

constParameter - 参数可加 const 而未加

• 规则编号：constParameter
• 规则名称：参数可声明为 const
• 类别：style
• 严重级别：style
• CWE：—
• 漏洞描述：指针/引用形参在函数内未被修改，却未加 const，弱化接口契约，妨碍 const 正确性传播。
• 影响范围：函数接口。
• 日志特征：style: Parameter 'p' can be declared as pointer to const [constParameter]。
• 产生原因
  • 未贯彻 const 正确性
• 典型输入

  double Length(Curve* c) { return c->Length(); }  // 可加 const [constParameter]
• 修复建议
  • 改 const Curve*/const Curve&
  • 贯彻 const 正确性：只读接口一律加 const
• 相关案例
  • 案例编号：constParameter-01
  • 违规场景：只读几何查询接口未标 const，调用方无法传 const 对象。
  • 修复结果：补 const，接口契约清晰。
• 关联规则：constVariable、passedByValue

performance 类

passedByValue - 大对象按值传参

• 规则编号：passedByValue
• 规则名称：大对象按值传参
• 类别：performance
• 严重级别：performance
• CWE：—
• 漏洞描述：体积较大的对象（容器、几何实体）按值传入，触发不必要的拷贝，影响性能。
• 影响范围：函数形参。
• 日志特征：performance: Function parameter 'mesh' should be passed by const reference [passedByValue]。
• 产生原因
  • 默认按值书写习惯
• 典型输入

  double SurfaceArea(std::vector<Triangle> tris);  // 大拷贝 [passedByValue]
• 修复建议
  • 只读改 const std::vector<Triangle>&；需移动用 &&
• 相关案例
  • 案例编号：passedByValue-01
  • 违规场景：网格按值传入热点函数，性能剖析显示拷贝占比高。
  • 修复结果：改 const 引用，耗时下降。
• 关联规则：useInitializationList、redundantCopy、constParameter

stlSize - 用 empty() 替代 size()==0

• 规则编号：stlSize
• 规则名称：用 empty() 判空
• 类别：performance
• 严重级别：performance
• CWE：—
• 漏洞描述：用 container.size() == 0 判空；某些容器（如 std::list）size() 可能为 O(n)，empty() 恒为 O(1) 且语义更清晰。
• 影响范围：所有 STL 容器判空。
• 日志特征：performance: Possible inefficient checking for 'v' emptiness [stlSize]。
• 产生原因
  • 习惯写 size()==0
• 典型输入

  if (faces.size() == 0) return;  // [stlSize]
• 修复建议
  • 改 if (faces.empty())
• 相关案例
  • 案例编号：stlSize-01
  • 违规场景：链表频繁 size()==0 判空成为热点。
  • 修复结果：改 empty()。
• 关联规则：useStlAlgorithm

portability 类

invalidPointerCast - 可移植性指针强转

• 规则编号：invalidPointerCast
• 规则名称：不兼容指针类型强转读写
• 类别：portability
• 严重级别：portability
• CWE：CWE-704
• 漏洞描述：在不同类型指针间强转后读写（如 float*↔int*），违反严格别名规则，跨编译器/架构行为不一致。
• 影响范围：底层缓冲、序列化、SIMD。
• 日志特征：portability: Casting between float* and integer* which have an incompatible binary data representation [invalidPointerCast]。
• 产生原因
  • 位级重解释、手写序列化
• 典型输入

  float f = 1.0f;
  int bits = *(int*)&f;   // [invalidPointerCast]
• 修复建议
  • 用 std::memcpy 或 std::bit_cast（C++20）
• 相关案例
  • 案例编号：invalidPointerCast-01
  • 违规场景：浮点位运算在某编译器优化后结果错误。
  • 修复结果：改 std::memcpy。
• 关联规则：cstyleCast、pointerSize

information 类

missingInclude - 缺少头文件导致分析不完整

• 规则编号：missingInclude / missingIncludeSystem
• 规则名称：缺少头文件
• 类别：information
• 严重级别：information
• CWE：—
• 漏洞描述：cppcheck 找不到被包含的头文件，部分类型/宏无法解析，会降低其它检查的覆盖与准确性（可能漏报）。
• 影响范围：分析配置层面，非代码缺陷本身。
• 日志特征：information: Include file: "geom/mesh.h" not found. [missingInclude]。
• 产生原因
  • 未传 -I 包含路径或未提供 compile_commands.json
• 典型输入

  cppcheck src/  # 未指定 -I 与项目文件
• 修复建议
  • 提供 --project=compile_commands.json 或正确 -I
  • 将本条纳入 CI 监控，避免静默漏报
• 相关案例
  • 案例编号：missingInclude-01
  • 违规场景：缺包含路径，cppcheck 漏报了真实空指针缺陷。
  • 修复结果：接入编译数据库后缺陷被发现。
• 关联规则：toomanyconfigs、ConfigurationNotChecked

---

版本与时效说明：严重级别体系与 --enable 选项依据 Cppcheck 官方手册整理；error id 与 CWE 映射会随版本演进，CI 应固定 cppcheck 版本以保证规则集稳定。