CodeChecker is a static analysis tool that finds bugs in code by performing interprocedural analysis across files and functions. It uses the Clang compiler infrastructure to run checks from tools like the Clang Static Analyzer and Clang Tidy. CodeChecker provides features like cross-translation unit analysis, suppressing and tagging issues, and integration with version control systems. It outputs analysis results that are easy for developers to understand and fix issues.

1. CodeChecker
short overview
Olivera Milenkovic,
Ericsson
2021-06-21​

2. Intro DEMO SeI cert and
examples
Next steps

3. • No additional test code needed
• It saves time and money
• find software bugs before they find your customers
• Can identify potential security vulnerabilities
• Increase developer productivity
• Features
• Full path coverage
• False path pruning
• Inline explanations of defects
• Customer trust and satisfaction
• Enforce safe coding standards: MISRA, CWE, SEI cert
STATIC CODE ANALYSES
CodeChecker
Cppcheck
Flexlint
Speed Depth Accuracy Usability Supported versions of OS and language
Commercial Open source
And many more….

4. Codechecker
Clang Tidy
clang.llvm.org
Clang SA
clang-analyzer.llvm.org
CodeChecker
Report Mgmt
Web Server
GIT (CI)
Commit Loop
utilities
Browser
Eclipse Client
CodeCheckercmd line
analyzer
toolset
E///
Checkers
Analyzer Report Storage
Ericsson
only checkers
New Analyzer Features
Cross Translation Unit Analysis
Statistical Checkers
Viewer & Report
Management
Features
1
2
3
Analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy

5. Demo
• http://codechecker-demo.eastus.cloudapp.azure.com/login.html#
• User id: demo
• Password: demo
• https://codechecker-demo.eastus.cloudapp.azure.com/Default/statistics/overview?is-
unique=on&detection-status=New&detection-status=Reopened&detection-
status=Unresolved

6. Short summary card CodeChecker 6.16.0 - current latest version (Clang 12)
Description
Analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
Static analysis infrastructure built on the LLVM/Clang Static Analyzer toolchain
Supported Languages
C, C++, Objective C,
Up to date C/C++ language support (C++11,14,17)
Supported Architectures Linux, OSX, docker support
Technology AST(Abstract Syntax Tree) Matcher, Symbolic Execution
Analyzers
Support for multiple analyzers, currently Clang Static Analyzer and Clang-Tidy,
Can also store results from CppCheck, FB Infer, Sanitizers more to come – report-converter
Features Inter-procedural analysis, Cross TU Analysis, statistical checkers, suppression handling, filtering,…
Price Free
Gerrit and GitLab integration Shows analysis results as Gitlab or Gerrit reviews
False Positive Rate Low
Checker Database
~300+ checkers (Clangsa 120+, clang-tidy 250+, clang warnings…)
+50 Ericsson rules
CodeChecker can enforce ~50% of the rules (through more than 400 checkers)
Developer Community Large open source. Apple, Google, Ericsson supported
Useful links
https://codechecker.readthedocs.io/en/latest/usage/
https://github.com/Ericsson/codechecker
https://github.com/Ericsson/CodeCheckerEclipsePlugin
Getting started (How-To with examples)
https://www.slideshare.net/OliveraMilenkovic/codechecker-overview-nov-2019

7. CodeChecker can be used as a
generic tool for visualizing
analyzer results.
For details see supported code
analyzers documentation and
the Report Converter Tool
Storage of reports from analyzer tools
Language Analyzer
C/C++
Clang Static Analyzer
Clang Tidy
Clang Sanitizers
Cppcheck
Facebook Infer
Coccinelle
Smatch
Kernel-Doc
Sparse
cpplint
Java
SpotBugs
Facebook Infer
Python
Pylint
Pyflakes
JavaScript ESLint
TypeScript TSLint
Go Golint
Markdown
Markdownlint
Sphinx

9. • Examples of commands to get list of checkers:
• CodeChecker checkers --profile sensitive
• CodeChecker checkers --guideline sei-cert
• See also https://codechecker.readthedocs.io/en/latest/usage/
• For analyze, parse and store commands you can use option
• --config <config file>
Codechecker config file example
{
"analyzer": [
"--jobs=10",
"--quiet",
"--ctu",
"--enable=sensitive",
"--enable= alpha.core.PointerArithm ",
"--disable= alpha.security.ArrayBound ",
"--disable= alpha.unix.cstring.BufferOverlap ",
"--report-hash=context-free-v2",
],
"parse": [
"--trim-path-prefix","${ROOT_PATH_FOR_REPO}",
"--print-step"
],
"store": [
"--url=<link to your Codechecker DB>",
"--trim-path-prefix","${ IROOT_PATH_FOR_REPO} ",
"--tag","${ CODECHECKER_STORE_TAG}"
]
}
Example of config file:
CODECHECKER_STORE_TAG can include SHA1 for commit, date,…

10. SEI cert related checkers
• $ CodeChecker checkers --guideline sei-cert
• alpha.ericsson.cpp.IteratorMismatch
• core.CallAndMessage
• core.DivideZero
• core.NonNullParamChecker
• core.NullDereference
• core.StackAddressEscape
• core.UndefinedBinaryOperatorResult
• core.VLASize
• core.uninitialized.UndefReturn
• cplusplus.InnerPointer
• cplusplus.Move
• cplusplus.NewDelete
• cplusplus.NewDeleteLeaks
• cplusplus.PlacementNew
• ericsson.cpp.InvalidatedIteratorAccess
• ericsson.cpp.PredWithState
• optin.cplusplus.VirtualCall
• optin.portability.UnixAPI
security.FloatLoopCounter
security.insecureAPI.gets
security.insecureAPI.vfork
unix.Malloc
unix.MallocSizeof
unix.MismatchedDeallocator
unix.Vfork
bugprone-assert-side-effect
bugprone-bad-signal-to-kill-thread
bugprone-exception-escape
bugprone-macro-repeated-side-effects
bugprone-narrowing-conversions
bugprone-signed-char-misuse
bugprone-sizeof-expression
bugprone-suspicious-memset-usage
bugprone-undefined-memory-manipulation
bugprone-unhandled-self-assignment
bugprone-unused-return-value
cert-dcl03-c
cert-dcl16-c
cert-dcl21-cpp
cert-dcl37-c
cert-dcl50-cpp
cert-dcl51-cpp
cert-dcl54-cpp
cert-dcl58-cpp
cert-dcl59-cpp
cert-env33-c
cert-err09-cpp
cert-err34-c
cert-err52-cpp
cert-err58-cpp
cert-err60-cpp
cert-err61-cpp
cert-fio38-c
cert-flp30-c
cert-mem57-cpp
cert-msc30-c
cert-msc32-c
cert-msc50-cpp
cert-msc51-cpp
cert-oop11-cpp
cert-oop54-cpp
cert-oop57-cpp
cert-oop58-cpp
cert-pos44-c
cert-str34-c
cppcoreguidelines-pro-type-const-cast
cppcoreguidelines-slicing
ericsson-cert-env32-c
misc-non-copyable-objects
misc-throw-by-value-catch-by-reference

11. CodeChecker references
• https://github.com/Ericsson/codechecker
• https://codechecker.readthedocs.io/en/latest/
• https://codechecker.readthedocs.io/en/latest/usage/
• http://codechecker-demo.eastus.cloudapp.azure.com/login.html#
• User id: demo
• Password: demo
• http://clang-analyzer.llvm.org/available_checks.html
• http://clang.llvm.org/extra/clang-tidy/checks/list.html

12. SUMMARY
Easier visual understanding of defects (The root cause of each defect is
clearly explained, making it easy to fix bugs)
Full path coverage – CTU analyses and statistical checkers
Overall summary of results for product (good for Status monitoring and
Planning of cleanups)
Filtering possibilities
Visibility of “Depth” of finding - number of steps that lead to error
Suppression handling (Per finding not file, False positive vs intentional)
Report generation
Easy detection of new defects
Easy integration to Gerrit verification for new defects
Eclipse integration...
Low false positive rate – path pruning

13. Some more backup slides

14. Ericsson Internal | 2016-03-08 | Page 5
Sim pl e An a l y s is
test1(){
int z=1/(3-abs(3));
}
int abs(int a){
if a<0
return –a;
else
return a;
}
source1.c Error:
Division by zero
Interprocedural: symbolic execution across
procedure (function) boundaries.
Simple analyses

15. Ericsson Internal | 2016-03-08 | Page 6
int abs(int a){
if a<0
return –a;
else
return a;
}
test1(){
int z=1/(3-abs(3));
}
Cr o s s Tr a n s l a t io n
Un it a n a l y s is (CTU)
source1.c
source2.c
Translation Unit 1
Translation Unit 2
Error:
Division by zero
To detect bugs across source file boundaries CTU analysis is needed!
Cross translational unit analyses (CTU)

16. Cross Translation unit analysis
CodeChecker analyze --ctu –b “make” –o reports_dir
• Default analysis is restricted to single translation unit only
• Cross Translation Unit mode: can catch faults across C/C++ file boundaries
• Analysis is slower (3-5 times) but finds 2-3 times more faults!
A.cpp
void abs(int&);
int foo(int j) {
return 42/(j + abs(j));
//division by zero
}
void main(){
foo(-5);
}
B.cpp
int abs(int a) {
if(a < 0)
return -a;
}

17. SUMMARY CTU
• Clang SA TU-internal analysis extended to Cross-TU analysis for C/C++
• Finds 2-3 times more reports
• Scalable & useful for industrial-size projects (PostgreSql, OpenSSL, …)
• Patch has been accepted into upstream Clang
• Try it yourself with latest Clang and CodeChecker
19

18. AST Matchers
`-FunctionDecl main 'int (void)'
`-CompoundStmt 0x5e40ea0 <col:11, line:6:1>
|-DeclStmt
| `-VarDecl used d 'double *'
|-BinaryOperator 'double *' lvalue '='
| |-DeclRefExpr 'double *' lvalue Var 0x5e2c5a0 'd' 'double *'
| `-CStyleCastExpr 'double *' <BitCast>
| `-CallExpr 'void *'
| |-ImplicitCastExpr 'void *(*)(int) throw()' <FunctionToPointerDecay>
| | `-DeclRefExpr 'void *(int) throw()' lvalue Function 0x5dea360 'malloc' 'void *(int) throw()'
| `-ImplicitCastExpr 'int' <IntegralCast>
| `-UnaryExprOrTypeTraitExpr 'unsigned long' sizeof
| `-ParenExpr 'double *' lvalue
| `-DeclRefExpr 'double *' lvalue Var 0x5e2c5a0 'd' 'double *'
`-ReturnStmt
`-IntegerLiteral 'int' 1
Call of operator sizeof Type of d is known
#include<stdlib.h>
int main(){
double *d;
d=(double*)malloc(sizeof(d));
return 1;
}
The allocated space is
pointer size and not double type size.

19. ASTMatchers
#include <stdlib.h>
#define ZERO 0
int getNull(int a) {
return a?0:1;
}
int getInput() __attribute__((notzero));
void test(int b)
{
int a,c;
double *d;
switch (b){
case 1: a = b / 0; break;
case 2: a = b / ZERO; break;
case 3: d = (double*) malloc(sizeof(d));
free(d); break;
case 4: c = b-4;
a = b / c; break;
case 5: a = b / getNull(b); break;
case 6: a = b / getInput(); break;
};
}
Found
Found as all preprocessor
statements are resolved.
Found as type resolution
can be used. (size_of checker)
Not found as
symbolic expressions
are not evaluated.
BUILD_MATCHER() { return
binaryOperator(hasOperatorName("/"),
hasRHS(integerLiteral(equals(0)).bind(
KEY_NODE)));
}
Flow insensitive

20. Symbolic Execution
• Path sensitive walk on the Control Flow Graph
• Simulated execution of the program
• On the most promising paths
• Variables are represented as symbolic values
• Constraints are calculated for symbolic values for each path
• Possible paths are calculated based on the constraints
• Impossible paths are dropped

21. Symbolic Execution
#include <stdlib.h>
void test(int b)
{
int a,c;
switch (b){
case 1: a = b / 0; break;
case 4:
c = b-4;
a = b / c; break;
};
}
b: $b
b: $b b: $b b: $b
$b=[4,4]
$b=[1,1]
$b=[MIN_INT,0],[2,3],
[5,MAX_INT]
b: $b
c: 0
$b=[4,4];
c=$b-4
c=0
b: $b
c: 0 $b=[4,4]
a=$b/$c
case 4
c = b-4;
Division by zero
switch(b)
a = b/c;
b: $b
a = b/0;
Nodes are
immutable program
states

22. SymbolicExecution
#include <stdlib.h>
#define ZERO 0
int getNull(int a) {
return a?0:1;
}
void test(int b)
{
int a,c;
double *d;
switch (b){
case 1: a = b / 0; break;
case 2: a = b / ZERO; break;
case 3: d = (double*) malloc(sizeof(d));
free(d); break;
case 4: c = b-4;
a = b / c; break;
case 5: a = b / getNull(b); break;
case 6: a = b / getInput(); break;
};
}
Internal function calls are followed
(context passed), variable constraints
are stored, possible paths are executed.
Context Sensitive
Inter-procedural
Analysis
Path Sensitive
Without context sensitivity, this is
undecidable.