github move

Daniel Marjamäki — Fri, 24 Apr 2026 14:26:53 -0000

I have moved the repositories cppcheck, simplecpp and cppcheck-htdocs to
https://github.com/cppcheck-opensource

your thoughts about adding file list and sha256 dependency?

Daniel Marjamäki — Fri, 24 Apr 2026 13:54:38 -0000

I would like that the --xml-version=3 report contains a list of files. All source and header files that has been used in the analysis. And I would prefer to write the SHA-256 hash for each file.

With this information it will be possible to verify later if a certain xml report was generated when cppcheck checked certain files with specific contents or not.

I have looked up https://github.com/okdshin/PicoSHA2 it looks acceptable to me..

What is your opinions? Do you feel it's a nice feature for open source cppcheck? I can implement what I need in the premiumaddon. Do you have better suggestions for the library?

Some files not analysed

Damien — Tue, 21 Apr 2026 13:35:36 -0000

I should add the test I did.
I added in the existing code of EventDispatcher.cpp in a function body just a variable declaration:

{
    int a;
    ...
}

In the unit-test execution, I get style: Unused variable as expected. But nothing for this file in the application analysis.

Some files not analysed

Damien — Tue, 21 Apr 2026 12:39:56 -0000

I'm new to CppCheck 2.19.1 and have introduced it in our development projects. I use it on one hand in our C++ unit-tests, based on CMake and g++ compiler, executed in MSYS2 environment on Windows. CppCheck produces many useful remarks.
I use it for our C++ application too, managed in Segger Embedded Studio 8.22a (SES). I configured SES to generate a compile_commands.json file. The analyse is executed on the whole application with the same bash script in MSYS2 environment on Windows too. In this environment some files are not analysed, while they are in their dedicated unit-test project. I do not understand why. I suppose the explanation lays in the differences between the compile_commands.json files, because some JSON keys are different. Some help would be appreciated!
Here is the script calling CppCheck from MYSY2 in both environments:

#!/bin/bash

# This script executes CppCheck on a given C/C++ project: either an application or a component.
# Expected arguments:
# $1: project path from current directory, like "gateway" or "project/common/source/utility/active_object"
# $2: build configuration: "Debug" or "Release". Not required for a component.

set -e

PROJECT_PATH=$1
readonly CONFIGURATION=$2

readonly SCRIPT_PATH=$(cd $(dirname $0); pwd -P)

if [ ! -d "$PROJECT_PATH" ]
then
    echo "$PROJECT_PATH is not a folder reachable from here."
    exit 1
fi

PROJECT_PATH=$(cd $PROJECT_PATH; pwd)
readonly PROJECT_NAME=$(basename $PROJECT_PATH)

pushd $PROJECT_PATH > /dev/null

echo

# Determine if we run CppCheck on an application or a component:
if [ -d "artefact" ]
then
    if [ "$CONFIGURATION" != "Debug" ] && [ "$CONFIGURATION" != "Release" ]
    then
        echo
        echo "Please enter 'Debug' or 'Release' as second argument."
        exit 1
    fi

    ANALYSING_A_COMPONENT=false
    echo "Running CppCheck on application $PROJECT_NAME"
    COMPILATION_DATABASE="output/$CONFIGURATION/Exe/compile_commands.json"
    CPP_CHECK_BUILD_FOLDER="output/$CONFIGURATION/cppcheck"
    OPTION_SUPPRESSIONS_LIST="--suppressions-list=cppcheck-suppressions.txt"
else
    ANALYSING_A_COMPONENT=true
    echo "Running CppCheck on component $PROJECT_NAME"
    COMPILATION_DATABASE="test/_output/Debug/build/compile_commands.json"
    CPP_CHECK_BUILD_FOLDER="test/_output/Debug/cppcheck"
    OPTION_SUPPRESSIONS_LIST="--suppressions-list=$SCRIPT_PATH/cppcheck-suppressions.txt"
fi

mkdir -p $CPP_CHECK_BUILD_FOLDER

OUTPUT_FILE="cppcheck-report.txt"
rm -f $OUTPUT_FILE
if $ANALYSING_A_COMPONENT
then
    OPTION_OUTPUT_FILE="--output-file=$OUTPUT_FILE"
fi

# --suppress option format: [error id]:[filename]
cppcheck --std=c11 --std=c++14 --enable=all --check-level=exhaustive --max-ctu-depth=10 --quiet --inline-suppr \
    --project=$COMPILATION_DATABASE \
    --cppcheck-build-dir=$CPP_CHECK_BUILD_FOLDER \
    -isubmodule/* \
    --suppress=missingIncludeSystem \
    --suppress=unusedFunction \
    --suppress=unmatchedSuppression \
    --suppress=*:*"SEGGER Embedded Studio"** \
    --suppress=*:submodule/* \
    $OPTION_SUPPRESSIONS_LIST \
    $OPTION_OUTPUT_FILE

popd > /dev/null

Here is an extract of a unit-test compile_commands.json for a EventDispatcher.cpp file that is well analysed:

{
  "directory": "C:/git-repos/twinpick-sw-2/project/common/source/utility/active_object/test/_output/Debug/build",
  "command": "C:\\tools\\msys64\\mingw64\\bin\\g++.exe -DDEBUG -DPLATFORM_HOST -DUNIT_TEST @CMakeFiles/common_active_object_exe.dir/includes_CXX.rsp -g -Wstrict-aliasing -o CMakeFiles\\common_active_object_exe.dir\\private\\EventDispatcher.cpp.obj -c C:\\git-repos\\twinpick-sw-2\\project\\common\\source\\utility\\active_object\\private\\EventDispatcher.cpp",
  "file": "C:/git-repos/twinpick-sw-2/project/common/source/utility/active_object/private/EventDispatcher.cpp",
  "output": "CMakeFiles/common_active_object_exe.dir/private/EventDispatcher.cpp.obj"
},

... and the cppcheck-suppressions.txt for the unit-tests:

*:common/source/hal/led/private/host/Led.c
*:common/source/driver/mbgw_link/*

Here is the extract of the full application compile_commands.json for the same EventDispatcher.cpp that is NOT analysed:

    {
        "file": "C:/git-repos/twinpick-sw-2/project/common/source/utility/active_object/private/EventDispatcher.cpp",
        "directory": "C:/git-repos/twinpick-sw-2/project/mb_gateway",
        "arguments": [
            "clang",
            "-x",
            "c++",
            "-nostdinc",
            "-isystemC:/Program Files/SEGGER/SEGGER Embedded Studio 8.22a/include",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway",
            "-IC:/git-repos/twinpick-sw-2/project/common/source",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway/submodule",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway/submodule/free_rtos_lib/kernel/include",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway/submodule/free_rtos_lib/kernel/portable/GCC/ARM_CM4F",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway/submodule/simplelink_cc32xx_lib/source/ti/posix/gcc",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway/submodule/simplelink_cc32xx_lib/source/ti/devices/cc32xx",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway/submodule/simplelink_cc32xx_lib/source",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway/submodule/simplelink_cc32xx_lib/source/third_party/fatfs",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway/submodule/arm_cortex_m4_cmsis_lib/CMSIS/Core/Include",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway/submodule/segger_lib/rtt",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway/source",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway/source/system",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway/source/application",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway/source/system/cc32xx",
            "-IC:/git-repos/twinpick-sw-2/project/mb_gateway/submodule/wslay/lib/includes",
            "-IC:/git-repos/twinpick-sw-2/project/common/submodule/flatbuffers/include",
            "-IC:/git-repos/twinpick-sw-2/project/common/submodule",
            "-IC:/Program Files/SEGGER/SEGGER Embedded Studio 8.22a/source/libcxx/include",
            "-D__ARM_ARCH_7EM__",
            "-D__SES_ARM",
            "-D__HEAP_SIZE__=48",
            "-D__SEGGER_LINKER",
            "-D__SES_VERSION=82201",
            "-DTM4C129XNCZAD",
            "-D__TM4C_FAMILY",
            "-D__TM4C129x_Series_SUBFAMILY",
            "-DARM_MATH_CM4",
            "-DNO_SYSTEM_INIT",
            "-DUSE_FREERTOS",
            "-DSL_FULL",
            "-Dgcc",
            "-DSL_PLATFORM_MULTI_THREADED",
            "-DDISABLE_DEBUGGER_RECONNECT",
            "-DASSERT_ON",
            "-DPLATFORM_MB_GATEWAY",
            "-DTARGET_IS_CC3200",
            "-DDeviceFamily_CC3220",
            "-DUSE_CC3220_ROM_DRV_API",
            "-DCC3220SF",
            "-D__VECTORS_IN_RAM",
            "-DDEBUG",
            "-include",
            "C:/git-repos/twinpick-sw-2/project/mb_gateway/../common/source/utility/ide_compat/ses_compatibility.h",
            "-U__clang__",
            "-U__SEGGER_CC__",
            "-fcxx-exceptions",
            "-fexceptions",
            "-std=gnu++14",
            "-Xclang",
            "-mthread-model",
            "-Xclang",
            "single",
            "-target",
            "arm-none-eabi",
            "-mcpu=cortex-m4",
            "-mlittle-endian",
            "-mfloat-abi=soft",
            "-mabi=aapcs",
            "-mthumb",
            "-munaligned-access",
            "-mtp=soft",
            "../common/source/utility/active_object/private/EventDispatcher.cpp"
        ],
        "output": "C:/git-repos/twinpick-sw-2/project/mb_gateway/Output/Debug/Obj/mb_gateway/EventDispatcher.o"
    },

... and the cppcheck-suppressions.txt for the application:

unusedStructMember:source/system/cc32xx/dpl/HwiPCC32XX_freertos.c
constVariablePointer:source/system/cc32xx/dpl/*
variableScope:source/system/cc32xx/dpl/*
variableScope:source/system/cc32xx/fatfs_porting/*
unusedPrivateFunction:source/service/firmware_downloader/private/FirmwareDownloader.cpp
*:project/common/source/driver/mbgw_link/*  // remove after reworked
*:project/common/source/hal/rs232/*         // remove after reworked
*:*/driver/web_link/*                       // remove after removed !

I tried many different configurations of CppCheck, comparisons and tests. I don't find explanation.
Thanks in advance for your help!

Clarification on MISRA C:2012 support in open source Cppcheck

Daniel Marjamäki — Fri, 17 Apr 2026 18:08:41 -0000

Hi, as far as I remember misra.py covers amendments 1 & 2. But not amendments 3 & 4. I.e. rules 1.4 and 1.5 are missing. We have not actively removed or crippled the functionality in misra.py.

When it said that MISRA C:2012 support was complete it meant that we had implemented checkers for all rules. It did not mean that each checker would catch all violations.

We have made lots of improvements in the checkers in Cppcheck Premium it has substantially better coverage of many rules. I am not against that you use misra.py , feel free to use it, but Misra C checking in Cppcheck Premium is better.

github move

Daniel Marjamäki — Thu, 16 Apr 2026 09:28:57 -0000

I am thinking about moving the open source cppcheck-related repos.

my idea was to move from danmar/cppcheck to some cppcheck/cppcheck path.
however owner "cppcheck" seems to be taken already.

Anyway the repos will be owned by an organisation instead..

https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository

before I do it.. does anybode envision some particular problems.

Clarification on MISRA C:2012 support in open source Cppcheck

Karel Hevessy — Wed, 15 Apr 2026 06:34:00 -0000

Hello,

In 2021 it was stated (e.g. on the MISRA page and in forum posts) that MISRA C:2012 coverage in Cppcheck is complete, including amendments, and that together with a C compiler full coverage is achieved.

The current documentation now says that the open source version “does not fully implement MISRA C 2012”.

Has the implementation changed since then, or is this only a change in how “coverage” is defined?

Regards,
Karel

False positive (access of moved variable) after failed try_emplace (std::unique_ptr, std::map)

CHR — Tue, 07 Apr 2026 12:56:55 -0000

Covered by https://trac.cppcheck.net/ticket/12773

False positive (access of moved variable) after failed try_emplace (std::unique_ptr, std::map)

Lila — Tue, 07 Apr 2026 12:24:21 -0000

If my understanding of try_emplace is correct, it doesn't move rvalue arguments in case of insertion failure.

Unlike insert or emplace, these functions do not move from rvalue arguments if the insertion does not happen, which makes it easy to manipulate maps whose values are move-only types, such as std::map<std::string, std::unique_ptr<foo>>.
https://en.cppreference.com/w/cpp/container/map/try_emplace

Cppcheck reports "Access of moved variable" when I try to access std::unique_ptr in case of failure of the try_emplace.

Code example:

#include <iostream>
#include <map>
#include <memory>
#include <stdint.h>

int
main (void)
{
    std::map<uint32_t, std::unique_ptr<uint32_t>> m_map;
    auto req1 = std::make_unique<uint32_t>(321);
    auto req2 = std::make_unique<uint32_t>(4321);

    auto [it1, result1] = m_map.try_emplace(123, std::move(req1));
    if (result1 != true)
    {
        std::cout << "Failed to insert map, req1=" << *req1 << "\n";
        return 1;
    }

    std::cout << "Insertion OK, req1=" << *it1->second << "\n";

    auto [it2, result2] = m_map.try_emplace(123, std::move(req2));
    if (result2 != true)
    {
        std::cout << "Failed to insert map, req2=" << *req2 << "\n";
        return 1;
    }

    std::cout << "Insertion OK, req2=" << *it2->second << "\n";
    return 0;
}

Code compiling and running: g++ -std=c++20 test.cpp -o test && ./test

Cppcheck command: cppcheck test.cpp --std=c++20 --enable=all --addon=threadsafety.py --inline-suppr --suppress=missingIncludeSystem

Cppcheck output:

Checking test.cpp ...
test.cpp:16:56: warning: Access of moved variable 'req1'. [accessMoved]
        std::cout << "Failed to insert map, req1=" << *req1 << "\n";
                                                       ^
test.cpp:13:50: note: Calling std::move(req1)
    auto [it1, result1] = m_map.try_emplace(123, std::move(req1));
                                                 ^
test.cpp:16:56: note: Access of moved variable 'req1'.
        std::cout << "Failed to insert map, req1=" << *req1 << "\n";
                                                       ^
test.cpp:25:56: warning: Access of moved variable 'req2'. [accessMoved]
        std::cout << "Failed to insert map, req2=" << *req2 << "\n";
                                                       ^
test.cpp:22:50: note: Calling std::move(req2)
    auto [it2, result2] = m_map.try_emplace(123, std::move(req2));
                                                 ^
test.cpp:25:56: note: Access of moved variable 'req2'.
        std::cout << "Failed to insert map, req2=" << *req2 << "\n";

If I replace try_emplace with insert, I get segmentation fault.

spurious warnings about BOOST_AUTO_TEST_CASE_run

CHR — Tue, 07 Apr 2026 06:52:03 -0000

cppcheck will warn on the first definition of a function, so the warning will change if the order of the files on the command line is flipped.
The configuration of BOOST_AUTO_TEST_CASE in boost.cfg will need to be fixed though.

Recent posts to Discussion

github move

your thoughts about adding file list and sha256 dependency?

Some files not analysed

Some files not analysed

Clarification on MISRA C:2012 support in open source Cppcheck

github move

Clarification on MISRA C:2012 support in open source Cppcheck

False positive (access of moved variable) after failed try_emplace (std::unique_ptr, std::map)

False positive (access of moved variable) after failed try_emplace (std::unique_ptr, std::map)

spurious warnings about BOOST_AUTO_TEST_CASE_run