在RT-Thread的scons基础上使用clang-tidy做静态分析

在RT-Thread的scons基础上使用clang-tidy做静态分析测试代码先写个简单的代码main.c#include

#include

#include

intmain(intargc,char*argv[])

{

char*tmp=(char*)malloc(argc);

if(tmp)

{

strncpy(tmp,argv[0],argc);

printf("%s",tmp);

if(argc>2)

{

free(tmp);

}

}

printf("helloworld!n");

return0;

}

使用clang-tidy分析一下aptinstall-yclang-tidyclang-tidymain.cErrorwhiletryingtoloadacompilationdatabase:

Couldnotauto-detectcompilationdatabaseforfile"main.c"

Nocompilationdatabasefoundin/work/analyzeroranyparentdirectory

fixed-compilation-database:Errorwhileopeningfixeddatabase:Nosuchfileordirectory

json-compilation-database:ErrorwhileopeningJSONdatabase:Nosuchfileordirectory

Runningwithoutflags.

2warningsgenerated.

/work/analyzer/main.c:12:3:warning:Calltofunction'strncpy'isinsecureasitdoesnotprovidesecuritychecksintroducedintheC11standard.Replacewithanalogousfunctionsthatsupportlengthargumentsorprovidesboundarycheckssuchas'strncpy_s'incaseofC11[clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling]

strncpy(tmp,argv[0],argc);

^~~~~~~

/work/analyzer/main.c:12:3:note:Calltofunction'strncpy'isinsecureasitdoesnotprovidesecuritychecksintroducedintheC11standard.Replacewithanalogousfunctionsthatsupportlengthargumentsorprovidesboundarycheckssuchas'strncpy_s'incaseofC11

strncpy(tmp,argv[0],argc);

^~~~~~~

/work/analyzer/main.c:21:2:warning:Potentialleakofmemorypointedtoby'tmp'[clang-analyzer-unix.Malloc]

printf("helloworld!n");

^

/work/analyzer/main.c:8:22:note:Memoryisallocated

char*tmp=(char*)malloc(argc);

^~~~~~~~~~~~

/work/analyzer/main.c:10:5:note:Assuming'tmp'isnon-null

if(tmp)

^~~

/work/analyzer/main.c:10:2:note:Takingtruebranch

if(tmp)

^

/work/analyzer/main.c:15:6:note:Assuming'argc'is<=2

if(argc>2)

^~~~~~~~

/work/analyzer/main.c:15:3:note:Takingfalsebranch

if(argc>2)

^

/work/analyzer/main.c:21:2:note:Potentialleakofmemorypointedtoby'tmp'

printf("helloworld!n");

^

compile_commands.json还是有点用的，但我们RT-Thread项目中代码那么多，一个一个输入太麻烦了。而且我们代码多是arm和gcc的，而开发机多是x86，clang默认参数也分析不了。刚才分析结果第1行就有提示，没有找到compilationdatabase，其实scons就可以生成需要比较新的版本python3-mpipinstallscons

python3-mSCons-v

SConsbyStevenKnightetal.:

SCons:v4.0.1.c289977f8b34786ab6c334311e232886da7e8df1,2020-07-1701:50:03,bybdbaddogonProDog2020

SConspath:['/usr/lib/python3/dist-packages/SCons']

Copyright(c)2001-2020TheSConsFoundation

然后更新下Scons脚本，让生成compile_commands.jsongitdiffSConstruct+env.Tool('compilation_db')

+envpilationDatabase()makeabuildingDoBuilding(TARGET,objs)

run-clang-tidy

然后使用run-clang-tidy就可以自动分析所有的源代码了。输出html生成的结果是文本，查看起来还是比较