blocks|key|1097592|text|不要忽视编译器本身。阅读编译器的文档，查找它可以提供的所有警告和错误，然后启用对您有意义的尽可能多的警告和错误。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1097593|另外，一定要告诉编译器将警告当作错误来处理，这样您就不得不立即修复它们(-Werror+on+gcc)。顺便说一句，不要被-Wall愚弄到gcc身上，并不是所有的警告都是有效的。|offset|length|style|CODE|1097594|您可能需要检查valgrind+(免费！)-它“自动检测到许多内存管理和线程错误，并详细分析您的程序。”这不是一个静态检查，但它是一个伟大的工具！|1097595|entityMap|0|LINK|mutability|MUTABLE|url|http://valgrind.org/^0|0|10|7|1P|5|0|7|8|7|8|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@$D|T|E|U|F|G]|$D|V|E|W|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|X|8|@$D|Y|E|Z|F|G]]|9|@$D|10|E|11|1|12]]|A|$]]|$1|J|3|-4|5|6|7|13|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]]]

Don't overlook the compiler itself. Read the compiler's documentation and find all the warnings and errors it can provide, and then enable as many as make sense for you.
Also make sure to tell your compiler to treat warnings like errors so you're forced to fix them right away (<code>-Werror</code> on gcc).
By the way, don't be fooled <code>-Wall</code> on gcc does not enable all warnings.
You may want to check <a href="http://valgrind.org" rel="nofollow noreferrer"><code>valgrind</code></a> (free!) — it &quot;automatically detect[s] many memory management and threading bugs, and profile[s] your programs in detail.&quot; It isn't a static checker, but it's a great tool!

blocks|key|98048|text|对于C代码，绝对应该使用弗莱克林特。我用了它近15年，并发誓。它真正伟大的特性之一是，可以通过代码中的注释("/*+lint-e123*/“)选择性地关闭警告。这是一个强大的文档工具，当你想要一些与众不同的东西的时候。“我正在关闭警告X，因此，我做X是有充分理由的。”|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|98049|对于任何进入有趣的C/C%2B%2B问题的人，请查看他们站点上的一些示例，看看您是否可以在不看提示的情况下发现bug。|98050|entityMap|0|LINK|mutability|MUTABLE|url|http://www.gimpel.com/html/lintinfo.htm^0|C|5|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

For C code, you definitely should definitely use <a href="http://www.gimpel.com/html/lintinfo.htm" rel="noreferrer">Flexelint</a>. I used it for nearly 15 years and swear by it. One of the really great features it has is that warnings can be selectively turned off and on via comments in the code ("/* lint -e123*/"). This turned out to be a powerful documentation tool when you wanted to something out of the ordinary. "I am turning off warning X, therefore, there is some good reason I'm doing X."

For anybody into interesting C/C++ questions, look at some of their examples on their site and see if you can figure out the bugs without looking at the hints.

blocks|key|811989|text|我听说过关于clang静态分析仪的一些好消息，IIRC使用LLVM作为后端。如果这是在您的平台上实现的，这可能是一个很好的选择。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|811990|据我所知，它所做的不仅仅是语法分析。例如，“自动找虫”。|811991|entityMap|0|LINK|mutability|MUTABLE|url|http://clang-analyzer.llvm.org/^0|6|A|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

I've heard good things about <a href="http://clang-analyzer.llvm.org/" rel="noreferrer">clang static analyzer</a>, which IIRC uses LLVM as it's backend. If that's implemented on your platform, that might be a good choice.

From what I understand, it does a bit more than just syntax analysis. "Automatic Bug Finding", for instance.

blocks|key|1098012|text|您可以使用卡普查克。它是一个易于使用的静态代码分析工具。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1098013|例如：|1098014|cppcheck+--enable=all+.|style|CODE|1098015|将检查当前文件夹下的所有C/C%2B%2B文件。|1098016|entityMap|0|LINK|mutability|MUTABLE|url|http://cppcheck.sourceforge.net/^0|5|4|0|0|0|0|N|0|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@$A|U|B|V|1|W]]|C|$]]|$1|D|3|E|5|6|7|X|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|Y|8|@$A|Z|B|10|H|I]]|9|@]|C|$]]|$1|J|3|K|5|6|7|11|8|@]|9|@]|C|$]]|$1|L|3|-4|5|6|7|12|8|@]|9|@]|C|$]]]|M|$N|$5|O|P|Q|C|$R|S]]]]

You can use <a href="http://cppcheck.sourceforge.net" rel="noreferrer">cppcheck</a>. It is an easy to use static code analysis tool. For example: 
<code>cppcheck --enable=all .</code> 
will check all C/C++ files under the current folder.

blocks|key|812096|text|最近，我编制了一份清单，列出了我所拥有的所有静态分析工具，我仍在对它们进行评估。注意，这些主要是安全分析工具。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|812097|夹板|unordered-list-item|offset|length|812098|大鼠|812099|赛特|812100|Uno|812101|entityMap|0|LINK|mutability|MUTABLE|url|http://www.splint.org/|1|http://www.fortify.com/security-resources/rats.jsp|2|http://smatch.sourceforge.net/|3|http://www.spinroot.com/uno/^0|0|0|2|0|0|0|2|1|0|0|2|2|0|0|3|3|0^^$0|@$1|2|3|4|5|6|7|10|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|11|8|@]|9|@$E|12|F|13|1|14]]|A|$]]|$1|G|3|H|5|D|7|15|8|@]|9|@$E|16|F|17|1|18]]|A|$]]|$1|I|3|J|5|D|7|19|8|@]|9|@$E|1A|F|1B|1|1C]]|A|$]]|$1|K|3|L|5|D|7|1D|8|@]|9|@$E|1E|F|1F|1|1G]]|A|$]]|$1|M|3|-4|5|6|7|1H|8|@]|9|@]|A|$]]]|N|$O|$5|P|Q|R|A|$S|T]]|U|$5|P|Q|R|A|$S|V]]|W|$5|P|Q|R|A|$S|X]]|Y|$5|P|Q|R|A|$S|Z]]]]

I recently compiled a list of all the static analysis tools I had at my disposal, I am still in the process of evaluating them all. Note, these are mostly security analysis tools.

<ul>
<li><a href="http://www.splint.org/" rel="noreferrer">splint</a></li>
<li><a href="http://www.fortify.com/security-resources/rats.jsp" rel="noreferrer">RATS</a></li>
<li><a href="http://smatch.sourceforge.net/" rel="noreferrer">SMATCH</a></li>
<li><a href="http://www.spinroot.com/uno/" rel="noreferrer">Uno</a></li>
</ul>

blocks|key|816200|text|我们一直在使用隐性预防查看C%2B%2B源代码。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|816201|它不是一个免费的工具(虽然我相信它们为开源项目提供了免费扫描)，但它是最好的静态分析工具之一。我听说它在C上比在C%2B%2B上更令人印象深刻，但它帮助我们避免了很多but。|816202|entityMap|0|LINK|mutability|MUTABLE|url|http://www.coverity.com/^0|7|4|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]]|C|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@]|C|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|C|$]]]|G|$H|$5|I|J|K|C|$L|M]]]]

We've been using <a href="http://www.coverity.com/" rel="noreferrer">Coverity Prevent</a> to check out C++ source code. 

It's not a free tool (although I believe they offer free scanning for open source projects), but it's one of the best static analysis tools you'll find. I've heard it's even more impressive on C than on C++, but it's helped us avoid quite a number of bugs so far.

blocks|key|812030|text|类似皮棉的工具通常会遇到“虚惊”问题:它们报告的问题比实际存在的问题多得多。如果真正有用的警告的比例太低，用户就会学会忽略这个工具。更现代的工具会花费一些精力来关注最可能/最有趣的警告。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|812031|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Lint-like tools generally suffer from a "false alarm" problem: they report a lot more issues than really exist. If the proportion of genuinely-useful warnings is too low, the user learns to just ignore the tool. More modern tools expend some effort to focus on the most likely/interesting warnings.

blocks|key|816294|text|PC-lint/Flexelint是非常强大和有用的静态分析工具，并且具有高度的可配置性，但遗憾的是，它并不是免费的。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|816295|当第一次使用这样的工具时，它们会产生大量的警告，这会使区分大大小小的警告变得很困难。因此，最好在项目的早期开始对您的代码使用该工具，然后尽可能频繁地在您的代码上运行它，这样您就可以在出现新的警告时处理它们。|816296|通过这样的持续使用，您很快就会了解如何编写符合工具所应用的规则的代码。|816297|正因为如此，我更喜欢像Lint这样运行相对较快的工具，因此鼓励持续使用，而不是那些更麻烦的工具，如果有的话，这些工具可能会更少地使用。|816298|entityMap|0|LINK|mutability|MUTABLE|url|http://www.gimpel.com/html/products.htm^0|0|H|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@$A|S|B|T|1|U]]|C|$]]|$1|D|3|E|5|6|7|V|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|W|8|@]|9|@]|C|$]]|$1|H|3|I|5|6|7|X|8|@]|9|@]|C|$]]|$1|J|3|-4|5|6|7|Y|8|@]|9|@]|C|$]]]|K|$L|$5|M|N|O|C|$P|Q]]]]

<a href="http://www.gimpel.com/html/products.htm" rel="nofollow noreferrer">PC-lint/Flexelint</a> are very powerful and useful static analysis tools, and highly configurable, though sadly not free.

When first using a tool like this, they can produce huge numbers of warnings, which can make it hard to differentiate between major and minor ones. Therefore, it is best to start using the tool on your code as early in the project as possible, and then to run it on your code as often as possible, so that you can deal with new warnings as they come up.

With continual use like this, you soon learn how to write your code in a way which confirms to the rules applied by the tool.

Because of this, I prefer tools like Lint which run relatively quickly, and so encourage continual use, rather than the more cumbersome tools which you may end up using less often, if at all.

blocks|key|1098056|text|您可以通过VS插件、IDE或命令行尝试CppDepend，这是一个非常完整的静态分析器，可在windows和linux上使用，开源贡献者是免费的。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1098057|entityMap|0|LINK|mutability|MUTABLE|url|http://www.cppdepend.com/|1|http://www.cppdepend.com/CppDependForOSS^0|J|9|0|1R|5|1|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]|$A|R|B|S|1|T]]|C|$]]|$1|D|3|-4|5|6|7|U|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]|L|$5|G|H|I|C|$J|M]]]]

You can try <a href="http://www.cppdepend.com" rel="nofollow">CppDepend</a>, a pretty complete static analyzer available on windows and linux, throught VS Plugin, IDE or command line, and it's free for <a href="http://www.cppdepend.com/CppDependForOSS" rel="nofollow">open source contributors</a>

blocks|key|816220|text|lint不断更新..。那你为什么想要一个新的。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|816221|顺便说一句，柔性版是皮棉|816222|entityMap^0|0|4|0|9|1|0^^$0|@$1|2|3|4|5|6|7|J|8|@$9|K|A|L|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|M|8|@$9|N|A|O|B|C]]|D|@]|E|$]]|$1|H|3|-4|5|6|7|P|8|@]|D|@]|E|$]]]|I|$]]

lint is constantly updated... so why would you want a more recent one.

BTW flexelint is lint

blocks|key|1097809|text|G‘’day，|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1097810|我完全同意在设置-Wall后阅读和消化编译器告诉您的内容的建议。|1097811|一个很好的安全静态分析工具是由David编写的FlawFinder。它在寻找各种安全漏洞方面做得很好，|offset|length|1097812|但是，它并不能取代让一个有知识的人阅读您的代码。正如大卫在他的网页上所说：“一个有工具的傻瓜仍然是个傻瓜！”|1097813|干杯,|1097814|抢夺|1097815|entityMap|0|LINK|mutability|MUTABLE|url|http://www.dwheeler.com/flawfinder/^0|0|0|N|A|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|V|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|W|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|X|8|@]|9|@$F|Y|G|Z|1|10]]|A|$]]|$1|H|3|I|5|6|7|11|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|12|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|13|8|@]|9|@]|A|$]]|$1|N|3|-4|5|6|7|14|8|@]|9|@]|A|$]]]|O|$P|$5|Q|R|S|A|$T|U]]]]

G'day,

I totally agree with the suggestions to read and digest what the compiler is telling you after setting -Wall.

A good static analysis tool for security is <a href="http://www.dwheeler.com/flawfinder/" rel="nofollow noreferrer">FlawFinder</a> written by David Wheeler. It does a good job looking for various security exploits,

However, it doesn't replace having a knowledgable someone read through your code. As David says on his web page, "A fool with a tool is still a fool!"

cheers,

Rob

blocks|key|812129|text|我发现，通常最好使用多个静态分析工具来查找bug。每个工具的设计都是不同的，它们可以找到非常不同的东西。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|812130|在这里的一些会谈中有一些很好的讨论。这是美国国土安全部举行的静态分析会议的结果。|offset|length|812131|entityMap|0|LINK|mutability|MUTABLE|url|http://samate.nist.gov/SATE2010Workshop.html^0|0|1|2|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

I've found that it's generally best to use multiple static analysis tools to find bugs. Every tool is designed differently, and they can find very different things from each other.

There are some good discussions in some of the talks <a href="http://samate.nist.gov/SATE2010Workshop.html" rel="nofollow">here</a>. It's from a conference held by the US Department of Homeland Security on static analysis.

blocks|key|98460|text|稀疏是一种计算机软件工具，已经在Linux上使用，旨在查找Linux内核中可能存在的编码错误。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|98461|Linux验证中心有两个活动项目，旨在提高可加载内核模块的质量。|98462|Linux驱动程序验证(LDV)+-一个用于对Linux设备驱动程序进行静态源代码验证的全面工具集。|ordered-list-item|98463|KEDR框架-一个可扩展的框架，用于内核模块的动态分析和验证。|98464|另一个正在进行的项目是Linux文件系统验证，该项目旨在开发用于验证Linux文件系统实现的专用工具集。|98465|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/Sparse|1|http://linuxtesting.org/kernel^0|0|2|0|0|0|9|1|0|0|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@$A|X|B|Y|1|Z]]|C|$]]|$1|D|3|E|5|6|7|10|8|@]|9|@$A|11|B|12|1|13]]|C|$]]|$1|F|3|G|5|H|7|14|8|@]|9|@]|C|$]]|$1|I|3|J|5|H|7|15|8|@]|9|@]|C|$]]|$1|K|3|L|5|H|7|16|8|@]|9|@]|C|$]]|$1|M|3|-4|5|6|7|17|8|@]|9|@]|C|$]]]|N|$O|$5|P|Q|R|C|$S|T]]|U|$5|P|Q|R|C|$S|V]]]]

<a href="http://en.wikipedia.org/wiki/Sparse" rel="nofollow">Sparse</a> is a computer software tool, already available on Linux, designed to find possible coding faults in the Linux kernel.

There are two active projects of <a href="http://linuxtesting.org/kernel" rel="nofollow">Linux Verification Center</a> aimed to improve quality of the loadable kernel modules.

<ol>
<li>Linux Driver Verification (LDV) - a comprehensive toolset for static source code verification of Linux device drivers.</li>
<li>KEDR Framework - an extensible framework for dynamic analysis and verification of kernel modules.</li>
<li>Another ongoing project is Linux File System Verification that aims to develop a dedicated toolset for verification of Linux file system implementations.</li>
</ol>

blocks|key|1097695|text|gcc有一个"-Weffc%2B%2B“选项，根据Mac手册页面将：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1097696|警告违反了Scott的有效C%2B%2B书中的下列风格指南：|blockquote|1097697|snip|offset|length|style|BOLD|1097698|我知道你问过C，但这是我知道的最近的..。|1097699|entityMap^0|0|0|0|4|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|P|8|@]|9|@]|A|$]]|$1|E|3|F|5|6|7|Q|8|@$G|R|H|S|I|J]]|9|@]|A|$]]|$1|K|3|L|5|6|7|T|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|U|8|@]|9|@]|A|$]]]|N|$]]

There is a "-Weffc++" option for gcc which according to the Mac OS X man page will:

<blockquote>
 Warn about violations of the following style guidelines from Scott Meyers' Effective C++ book:
</blockquote>

[snip]

I know you asked about C, but this is the closest I know of..

I'm working on a project where I'm coding in C in a UNIX environment. I've been using the lint tool to check my source code. Lint has been around a long time (since 1979), can anyone suggest a more recent code analysis tool I could use ? Preferably a tool that is free.

Choosing a static code analysis tool

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我正在处理一个在UNIX环境中用C编写代码的项目。我一直在使用lint工具来检查我的源代码。Lint已经存在很长一段时间了(从1979年起)，谁能建议我可以使用的最新代码分析工具呢？最好是免费的工具。

问选择静态代码分析工具
EN

回答 14

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问选择静态代码分析工具EN

回答 14

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问选择静态代码分析工具
EN