如果你想寻找更多选择，这些工具的这个功能就是“静态代码分析”。这可能会帮助您找到更多用于 C 和/或 C++ 的工具。另外，您可能对问题的答案“什么”感兴趣有开源的C++静态分析工具吗？”
The two that come to mind are Splint for C and Cppcheck for C++.
If you want to look for more options, this function of these tools is "static code analysis". That might help you find more tools for C and/or C++. Also, you might be interested in the answer to the question "What open source C++ static analysis tools are available?"
C++ is a complicated enough language that the tooling for it (such as refactoring or static analysis tools) just isn't as good as Java or C#.
Gimpel Software's PC-lint is the closest thing to a standard bug-checking tool for C++ that I know of. It's commercial with a reasonable pricing model. I don't know how well it integrates with other tools.
The Clang open source project should eventually be able to do much of what you want (and looks really cool), but it's still in development.
PC-Lint is the way to go. Unlike most of the other tools, it has full inter-function and inter-module value tracking and supports all the hairy edges of template compilation/parsing as well. I bought a personal copy for myself about 9 years ago, just because it's so cheap. I ended up using it a lot in open source projects. PC-Lint doesn't license based on LOC, it doesn't phone home, and there's no license server. It's very much on the honor system and very no-nonsense. Over the 9 years, I have found some issues in it (and those have been few and far between), but they have almost always been fixed in a few weeks.
Open-source wise, there is SMatch, based on Coverity's meta-compilation analysis techniques, which the wine project uses quite heavily to great effect. PMD's cpd (copy paste detector) sub-tool works on C++, and is really fast. For cyclomatic complexity, there's pmccabe which is easily installable via apt-get (on Linux; on Windows, I compile the source under cygwin).
PC-Lint does require some configuration to get it working well, a day or two at the most. The other tools don't work as deeply, so you can just hit the ground running with a command like "find . -name .c | xargs pmccabe | sort -n | tail -n 20"
Both of these tools scans C/C++ source code files for known vulnerabilities including buffer overflows, race conditions, weak crypto, chroot jail configs ... & more).
发布评论
评论（5）
我想到的两个是用于 C 的 Splint 和 Cppcheck 用于 C++。
如果你想寻找更多选择，这些工具的这个功能就是“静态代码分析”。这可能会帮助您找到更多用于 C 和/或 C++ 的工具。另外，您可能对问题的答案“什么”感兴趣有开源的C++静态分析工具吗？”
The two that come to mind are Splint for C and Cppcheck for C++.
If you want to look for more options, this function of these tools is "static code analysis". That might help you find more tools for C and/or C++. Also, you might be interested in the answer to the question "What open source C++ static analysis tools are available?"
C++ 是一种足够复杂的语言，其工具（例如重构或静态分析工具）不如 Java 或 C#。
Gimpel Software 的 PC-lint 是我所知道的最接近 C++ 标准错误检查工具的工具。它是商业化的，具有合理的定价模式。我不知道它与其他工具集成得如何。
Clang 开源项目最终应该能够完成您想要的大部分操作（并且看起来确实 很酷），但它仍在开发中。
C++ is a complicated enough language that the tooling for it (such as refactoring or static analysis tools) just isn't as good as Java or C#.
Gimpel Software's PC-lint is the closest thing to a standard bug-checking tool for C++ that I know of. It's commercial with a reasonable pricing model. I don't know how well it integrates with other tools.
The Clang open source project should eventually be able to do much of what you want (and looks really cool), but it's still in development.
PC-Lint 是正确的选择。与大多数其他工具不同，它具有完整的函数间和模块间值跟踪，并且还支持模板编译/解析的所有毛边。大约九年前，我为自己买了一本个人版，只是因为它太便宜了。我最终在开源项目中大量使用了它。 PC-Lint 不基于 LOC 进行许可，它不打电话回家，并且没有许可证服务器。这与荣誉系统非常相关，而且非常严肃。在这 9 年里，我发现了一些问题（而且这些问题很少而且相距甚远），但它们几乎总是在几周内得到解决。
开源方面，有 SMatch，它基于 Coverity 的元编译分析技术，wine 项目大量使用了该技术，并取得了很好的效果。 PMD 的 cpd（复制粘贴检测器）子工具适用于 C++，而且速度非常快。对于圈复杂度，可以通过 apt-get 轻松安装 pmccabe（在 Linux 上；在 Windows 上，我在 cygwin 下编译源代码）。
PC-Lint 确实需要一些配置才能使其正常工作，最多一两天。其他工具的工作原理没有那么深入，因此您只需使用“find . -name .c | xargs pmccabe | sort -n | tail -n 20”之类的命令即可开始运行
PC-Lint is the way to go. Unlike most of the other tools, it has full inter-function and inter-module value tracking and supports all the hairy edges of template compilation/parsing as well. I bought a personal copy for myself about 9 years ago, just because it's so cheap. I ended up using it a lot in open source projects. PC-Lint doesn't license based on LOC, it doesn't phone home, and there's no license server. It's very much on the honor system and very no-nonsense. Over the 9 years, I have found some issues in it (and those have been few and far between), but they have almost always been fixed in a few weeks.
Open-source wise, there is SMatch, based on Coverity's meta-compilation analysis techniques, which the wine project uses quite heavily to great effect. PMD's cpd (copy paste detector) sub-tool works on C++, and is really fast. For cyclomatic complexity, there's pmccabe which is easily installable via apt-get (on Linux; on Windows, I compile the source under cygwin).
PC-Lint does require some configuration to get it working well, a day or two at the most. The other tools don't work as deeply, so you can just hit the ground running with a command like "find . -name .c | xargs pmccabe | sort -n | tail -n 20"
我使用过 Klocwork 和 Rational Software Analyzer 过去，它们都工作得很好，尽管它们都是商业/非免费的。
I've used Klocwork and Rational Software Analyzer in the past, and they both work well, though both are commercial/non-free.
我使用缺陷查找器.py 扫描 C/C++ 中的 160 个危险函数。
http://www.dwheeler.com/flawfinder/
如果你想要一个基于缺陷查找器的 ruby 端口，那么您可以使用 vulnxpose.rb。
https://github.com/nanotechz9l/Source-code-analyzer
这两个工具扫描 C/C++ 源代码文件中的已知漏洞，包括缓冲区溢出、竞争条件、弱加密、chroot 监狱配置...更多的）。
瑞克
I use flawfinder.py which scans for 160 dangerous functions in C/C++.
http://www.dwheeler.com/flawfinder/
If you want a ruby port based on flawfinder then you can use vulnxpose.rb.
https://github.com/nanotechz9l/Source-code-analyzer
Both of these tools scans C/C++ source code files for known vulnerabilities including buffer overflows, race conditions, weak crypto, chroot jail configs ... & more).
Rick