最新版 PC-lint Plus v2.2 (原名PC-lint for C/C++) 更新於 2024/7/9
PC-lint Plus 是 GIMPEL SOFTWARE 公司開發的 C/C++軟體程式碼靜態分析工具
PC-lint Plus是一種靜態分析工具,通過分析C和C ++源代碼來發現軟體中的缺陷。
與編譯器一樣,PC-lint Plus會解析您的源代碼文件,執行語義分析,並構建一個抽象語法樹來表示您的程式。從那裡開始,PC-lint Plus採用各種機制,包括數據流分析,價值跟踪,讀寫分析,強類型檢查,功能語義驗證和許多其他技術,以提供對單個文件和整個項目的可靠和整體分析。
然後,PC-lint Plus使用易於理解的清晰,簡潔和可操作的診斷報告其發現。診斷消息格式是完全可定制的,包括快速解決缺陷所需的精確位置信息和上下文。PC-lint Plus可以從命令行運行,集成到構建過程或持續集成系統中,也可以在IDE中運行。
Comply with Safety Standards
Enforce compliance with industry coding standards including MISRA, AUTOSAR, and CERT C, customize detection of individual guidelines, and easily support guideline deviations.
Identify Defects and Vulnerabilities
Detect critical bugs and vulnerabilities such as buffer overflows, null pointer dereferences, inappropriate interface use, and undefined behavior by providing constructive diagnostics.
Find Potential Bugs
Identify code that is brittle, difficult to maintain, invokes implementation-defined behavior, or is otherwise suspicious, in order to reduce the potential for defects to develop in the first place.
Improve Developer Productivity
Avoid wasted time spent tracking down bugs and identify issues proactively during the development process.
Widely Compatible
Runs natively on Windows, Linux, and macOS. Analyze source code targeting virtually any platform. Supports a wide variety of compilers, C11/C18 and C++17, and integration with your IDE, build process, or CI system.
Scalable
Fully multi-threaded operation allows analysis of large projects to efficiently scale across multiple cores to take full advantage of the available hardware.
Secure, On-site Analysis
Analysis is performed on developer workstations or build/CI servers without using an internet connection to provide a truly secure, private, and local solution.
Certified for ISO 26262 and IEC 61508
PC-lint Plus has been certified by exida® for ISO 26262:2018 (ASIL D qualified) and IEC 61508:2010 (SIL 4 qualified).
A Short Example
要查看PC-lint Plus的運行情況,請考慮以下示例:
While this program probably won't produce any warnings from your compiler (try it with the highest warning level), it contains multiple defects that PC-lint Plus will uncover:
The malloc function can return a null pointer and passing a null pointer to strcpy results in undefined behavior. Checking the return value of malloc will suppress this message. The supplemental messages demonstrate how PC-lint Plus determined that the pointer might be null (the return value of malloc was stored in b.title which was then passed to strcpy).
The intention was to allocate enough space for both the string and the nul character terminator but the + 1 was accidentally placed in the wrong spot (it should have been malloc(strlen(title) + 1)) so the result is that the allocation is 2 bytes too short. This will result in a buffer overflow in the call to strcpy.
The make_book function fails to initialize the category member which is now used before being initialized.
Each diagnostic that PC-lint Plus produces has an accompanying message number that can be used for message customization and suppression purposes. Messages are documented in the PC-lint Plus Reference Manual and message descriptions can also be obtained from PC-lint Plus using the -help option. For example, to see the description of message 432, you can run PC-lint Plus with the option -help=432 which yields:
The -help option can also be used to obtain help for the various options supported by PC-lint Plus.
PC-lint Plus has a class of diagnostics called 'Elective Notes' that are disabled by default. If the above example is run with all messages enabled, PC-lint Plus will have quite a bit more to say.
Coding Standards
PC-lint Plus can check for violations of internal code guidelines as well as analyzing compliance with industry standards such as MISRA. Thousands of highly configurable messages can be enabled to support many different code guidelines; e.g. use of braces for control structures, assignment in conditional expressions, explicit clarification of operator precedence, and more. The exact set of desired messages can be specified in reusable configuration files to share between projects and teams.
For example,
can be configured to emit:
This output was produced using the options -w1 +e9012 which uses warning level 1, the lowest warning level enabling only syntax errors, and then specifically enables message 9012.
Using default settings, the only message issued for this example would have been:
because the default warning level excludes "elective notes" like message 9012.
Running with -w4 (warning level 4, the highest warning level corresponding to enabling all messages including elective notes) would emit:
MISRA Support
PC-lint Plus provides industry-leading support for MISRA standards including MISRA C 2012, MISRA C 2004, and MISRA C++ 2008 as well as their addendums and corrigenda. Detailed information on which rules are supported, which messages are used to report them, and the extent to which they are supported is available in our manual and MISRA configuration files. We communicate extensively with the MISRA committee to implement even the smallest details and resolve ambiguities in the published text.
Clear and concise diagnostics make rule violations easy to understand:
MISRA checking can be quickly enabled using configuration files distributed with PC-lint Plus. Individual rules can be enabled and disabled, and messages can be controlled on a case-by-casis basis as described below.
Flexible Message Suppression
PC-lint Plus contains a variety of flexible ways to control message suppression, i.e. whether or not a particular instance of a message will be emitted or ignored. Messages can be enabled or suppressed globally, on a per-file, per-function, per-statement basis, depending on the names of the classes, structures, variables, functions, or macros that the message refers to, or on an individual line. PC-lint Plus can distinguish third-party or library source code from the rest of the project and separate suppression policies can be applied to such code.
The simplest suppression options, +e# and -e#, enable or disable message # everywhere after the point where they are encounterd.
A message can be suppressed on a single line by adding a comment of the form //lint !e# to temporarily disable message #.
Messages mentioning a particular variable, class, structure, or function can be suppressed or enabled using -esym or +esym, e.g. -esym(#,name) would suppress message # when a particular instance of the message mentions name.
-estring and +estring work similiarly to esym for other text mentioned in messages.
The emacro options enable or disable messages within the expansions of specified macros.
A variety of suppressions within lint comments can influence the next or enclosing statement, declaration, or expression.
Documentation and Support
PC-lint Plus is distributed with a well-organized manual in PDF format describing its configuration, operation, options, and messages. The introduction and installation sections help you get started quickly. Every option and message is described in detail and is easy to find with reference tables and an extensive table of contents. Changes between versions are documented in the revision history section.
Our skilled support team can answer any questions about PC-lint Plus and help you configure it for unusual and exotic compilers and toolchains.
Source Code Security
PC-lint Plus runs locally on your developer workstations or your own server. It does not connect to the internet or otherwise utilize a network connection. Your source code never leaves your machine. It does not submit "analytics" or any other form of usage data.
Gimpel Software LLC
Widely Compatible
PC-lint Plus runs natively on Windows 7/8/10/11, Linux,and macOS and can analyze source code targeting virtually any platform. By providing support for a wide variety of compilers, C11 and C++17/C++20, and the ability to integrate with your existing IDE, build process, or continuous integration system, PC-lint Plus can quickly be incorporated into any project.
PC-lint Plus supports plain text, HTML, and XML output which can easily be customized to support virtually any format.