PClint常见告警整理_20150710

编号

40

nfig.c413

415

420

423

429

433

504

506

520

521

522

525

527

529

530

533

534

539

545

550

564

568

569

572

573

578

603

605

603,605

613

616

644

650

661

668

673

685

701

702

708

713

714

715

716

717

725

731

734

737

740

744

747

752

762

766

773

774

775

785

786

794

796

797

801

818

825

826

827

834

1065

1401

1411

1501

1509

1511

1512

1540

1551

1554

1555

1707

1722

1732

1733

1735

1738

1740

1746

1762

1763

1768

1773

1774

1776

1778

1786

1788

规则说明

Undeclared identifier 'Name' -- Within an expression, an identifier was

encountered that had not previously been declared and was not followed by a left

parenthesis. Name is the name of the identifier.

可能使用空指针

Likely use of null pointer 'Symbol' in [left/right] argument to

operator 'String' Reference

Likely Access of out-of-bounds pointer

访问越界

访问超出范围的内存

Apparent access beyond array for function 'Symbol', argument

Integer exceeds Integer Reference -- This message is issued for several

libraryfunctions(suchasfwrite,memcmp,etc.)whereinthereisanapparent

attempt

mple,ifthelengthofdataspecifiedin

the

ctionisspecifiedby

Symbol

oSection11.1

Function

在变量' Symbol'赋值时出现内存泄漏

分配给一个指针变量，这个指针变量保留有一个分配的目标的地址，还没有释放。

指针存储空间未释放或返回

Custodial pointer 'Symbol' (Location) has not been freed or

returned--Apointerofautostorageclasswasallocatedstorage,whichwas

neither

freed nor returned to the caller. This represents a "memory leak". A pointer is

t

considered

custodial if it has been copied. Thus:

int *p = new int[20]; // p is a custodial pointer

int *q = p; // p is no longer custodial

p = new int[20]; // p again becomes custodial

q = p + 0; // p remains custodial

Herepdoesnotloseitscustodialpropertybymerelyparticipatinginan

arithmetic

operation.

Apointercanloseitscustodialpropertybypassingthepointertoafunction.

If the

parameterofthefunctionistypedpointertoconstorifthefunctionisa

library

function, that assumption is not made. For example

p = malloc(10);

strcpy (p, "hello");

为指针分配的空间不够

Allocated area not large enough for pointer -- An allocation was

assignedtoapointerwhosereachextendsbeyondtheareathatwasallocated.

This

would usually happen only with library allocation routines such as malloc and

calloc. For example:

int *p = malloc(1);

example, if a

user's own allocation function is provided with the following semantic:

-sem(ouralloc,@P==malloc(1n))

notethatitisnecessarytodesignate

that the

异常的移位

固定的Boolean值

Constant value Boolean -- A Boolean, i.e., a quantity found in a context that

requires a Boolean such as an argument to && or || or an if() or while() clause

or !,

was found to be a constant and hence will evaluate the same way each time.

for循环的第一个表达式

Highest String ’Name’ lacks side-effects -- The first expression of a for

clause should either be one of the privileged operators: assignment,

increment,decrement or a call to an impure function or one modifying its

argument(s). See Warning 522.

for循环的第三个表达式

Highest String ’Name’ lacks side-effects -- The third expression of a for

clause should either be one of the privileged operators: assignment,

increment,decrement or a call to an impure function or one modifying its

argument(s). See Warning 522.

指针自加

Highest String ’Name’ lacks side-effects -- If a statement consists only of

an expression, it should either be one of the privileged operators: assignment,

increment,

decrement or a call to an impure function or one modifying its argument(s). For

example, if operator * is the built-in operator, the statement *p++; draws this

message with String equal to operator and Name equal to *. But note that p++;

does not. This is because the highest operator in the former case is '*' which

has no side effects whereas p++ does. It is possible for a function to have no

side-effects. Such a function is called pure. See the discussion of the pure

semantic in Section 11.2.1. For example:

void f() { int n = 3; n++; }

void g() { f(); }

will trigger this message with String in the message equal to function and Name

equal to definition of pure and impure functions and function calls which

have side effects are given in the discussion of the pure semantic in Chapter 11

Semantics.

缩排格式错误/未正确缩进

Negative indentation from Location -- The current line was found to be

,notindentedasmuch)

latter

correspondstoaclauseintroducingacontrolstructure,andstatementsand

other control

c

tabs

withinyourprogramareotherthan8blanksyoushouldusethe-toption(See

Section

13.3 Indentation Checking).

无法执行到的语句

UnreachablecodeattokenName--Aportionoftheprogramcannotbereached.

Thefirsttokenencounteredinthatportionoftheprogramappearsasthe

etheparameterisdesignatedasNamethe

message may be suppressed for selected tokens.

变量未被引用

Symbol 'Symbol' (Location) not referenced -- The named static variable or

static function was not referenced in the module after having been declared.

使用未初始化的变量

Symbol 'Symbol' (Location) not initialized -- An auto variable was used

before it was initialized.

函数“Symbol”在此处是否应该有返回值，

在一个函数内的返回语句(或在函数的结尾缺少一个return )

忽略函数的返回值

Ignoring return value of function 'Symbol' (compare with

Location)--Afunctionthatreturnsavalueiscalledjustforsideeffectsas,

for

example,inastatementbyitselfortheleft-handsideofacommaoperator.

Try:

(void)function();othe

fvr,

fvo and fdr flags in Section 5.5 Flag Options.

缩排格式错误

Did not expect positive indentation from Location -- The current line

wasfoundtobepositivelyindentedfromaclausethatdidnotcontroltheline

in

357

question. For example:

if( n > 0 )

x = 3;

y = 4;

will result in this warning being issued fory = 4;. The Location cited will be

&的可疑使用

Suspicious use of & -- An attempt was made to take the address of an array name.

Atonetimesuchanexpressionwasofficiallyillegal(K&RC[1]),wasnot

consistently

implemented,andwas,therefore,r,theexpressionislegalin

ANSI/

ISO C and designates a pointer to an array. For example, given

int a[10];

int (*p) [10];

Thenaand&a,aspointers,bothrepresentthesamebitpattern,butwhereasa

is a

pointer to int, &a is a pointer to an array of 10 integers. Of the two only &a

Symbol 'Symbol' (Location) not accessed -- A variable (local to some

function)ansthatthevalueofavariablewasnever

used.

ata

variable's

valueisnotconsideredaccessedbyautoincrementingorautodecrementingunless

the

autoincrement/decrementappearswithinalargerexpression,whichusesthe

resulting

value. The same applies to a construct of the form: var += expression. If an

addressofavariableistaken,r,

casting

volatile变量的检查

非负数不可能小于0

精度确失

Loss of information (Context) (Integer bits to Integer bits) -- An

assignment (or implied assignment, see Context) was made from a constant to an

es

include placing

ahexconstantwhosebitrequirementissuchastorequireanunsignedintinto

a

variable typed as int. The number of bits given does not count the sign bit.

位移值太大

一个量被右移，它的精度等于或小于移位的值。

除法运算中同时出现有符号和无符号变量

Signed-unsigned mix with divide -- one of the operands to / or % was signed

andtheotherunsigned;

example:

u / n

where u is unsigned and n is signed will elicit this message whereas:

u / 4

willnot,tagoodideatomix

unsigned

quantitieswithsignedquantitiesinanycase(a737willalsobeissued)but,

with

division, a negative value can create havoc. For example, the innocent looking:

n = n / u

will, if n is -2 and u is 2, not assign -1 to n but will assign some very large

Declaration of symbol 'Symbol' hides symbol 'Symbol' (Location)

--Alocalsymbolhastheidenticalnameasaglobalsymbol(orpossibly

anotherlocalsymbol).sdeliberate?Itis

usually best to rename the local symbol.

变量未初始化

Symbol 'Symbol' (Location) not initialized -- The address of the named

symbolisbeingpassedtoafunctionwherethecorrespondingparameteris

declared as

this is the

case then the original object should have been initialized sometime earlier.

增强的指针

Increase in pointer capability (Context) -- This warning is typically

caused by assigning a (pointer to const) to an ordinary pointer. For example:

int *p;

const int *q;

p = q; /* 605 */

The message will be inhibited if a cast is used as in:

p = (int *) q;

Anincreaseincapabilityisindicatedbecausetheconstpointedtobyqcannow

be

ssagecanbegivenforthevolatilequalifieraswell

as

theconstqualifierandmaybegivenforarbitrarypointerdepths(pointersto

pointers,

pointers to arrays, etc.).

Ifthenumberofpointerlevelsexceedsone,

example:

369

const char ** ppc;

char ** pp;

pp = ppc; /* 605 - clearly not safe */

ppc = pp; /* 605 - looks safe but it's not */

ItwasnotrealizedbytheCcommunityuntilveryrecentlythatassigningppto

ppc was

blemisthataftertheaboveassignment,apointertoaconst

char

canbeassignedindirectlythroughppcandaccessedthroughpp,whichcanthen

modify

the const char.

const变量检查

可能使用了空指针

Possible use of null pointer 'Symbol' in [left/right] argument

to operator 'String' Reference -- From information gleaned from earlier

statements,itispossiblethatanullpointer(apointerwhosevalueis0)can

be used in a

ntextsinclude:Unary*,

pointer

increment(++)ordecrement(--),additionofpointertonumeric,andsubtraction

of two

aseofbinaryoperators,oneofthewords'left'or'right'is

used to

identifiesthepointervariablethatmay

be

switch控制流错误；在switch语句中未使用break;

controlflowsintocase/default--Itispossibleforflowofcontroltofall

into

sdeliberateordid

the

programmerforgettoinsertabreakstatement?Ifthiswasdeliberatethenplace

a

comment immediately before the statement that was flagged as in:

case 'a': a = 0;

/* fall through */

case 'b': a++;

Note that the message will not be given for a case that merely follows another

变量 'Symbol' 可能没有初始化

比较数值时，常量的范围超过了变量范围

Constant out of range for operator ’String’ -- In a comparison operator

orequalitytest(orimpliedequalitytestasforacasestatement),aconstant

operand is

mple,if300iscompared

against

acharvariable,er,ifcharissigned(and8

bits)

youwillgetthismessageifyoucompareagainstanintegergreaterthan127.

The

problem can be fixed with a cast. For example:

if( ch == 0xFF ) ...

if( (unsigned char) ch == 0xFF ) ...

Ifcharissigned(+fcuhasnotbeenset)thefirstreceivesawarningandcan

never

succeed. The second suppresses the warning and corrects the bug.

数组越界

possible access of out-of-bounds pointer ('Integer' beyond end

of data) by operator 'String' -- An out-of-bounds pointer may have been

sage415foradescriptionoftheparametersIntegerand

String.

For example:

int a[10];

if( n <= 10 ) a[n] = 0;

Heretheprogrammerpresumablyshouldhavewrittenn

similar

可能传递一个 null 指针给函数

可能不适当的存储单元分配数据

一个存储单元分配(free(),delete,或delete[])可能对数据被不适当地释放。这种数

据是一个或多个：malloc,new,new[],static,auto,member,modified或constant

。单词“可能的“被用于信息中指出仅仅一些流的行来存储单元分配显示数据和分配的不

一致。

Warning--Relational operator '<=' always evaluates to ‘true’.

int类型（有符号）变量左移

int类型（有符号）变量右移

Info--Union inilization

精度丢失，把有符号型数值赋给了无符号型数值

符号没有使用，外部变量或外部函数被定义，但是没有被引用。

变量（符号）未被引用

Info--While(1)...

while（0）;

Info--Expected positive indentation from line XXX

一个布尔被用于作为== 或 !=的参数

Info--Boolean argument to equal/not equal

丢失精度

Loss of precision (Context) (Integer bits to Integer bits) -- An

ormation

being

assignedisderivedfromanotherobjectorcombinationofobjectsinsuchaway

that

berofbitsgivendoesnotcount

the sign

bit. For example if ch is a char and n is an int then:

ch = n;

will trigger this message whereas:

ch = n & 1;

will not. To suppress the message a cast can be made as in:

ch = (char) n;

Youmayreceivenoticesinvolvingmultiplicationandshiftoperatorswith

subinteger

variables. For example:

ch = ch << 2

无符号型变/常量和有符号变/常量型在于同一个表达式中

Loss of sign in promotion from Type to Type -- An unsigned quantity was

joinedwithasignedquantityinabinaryoperator(or2ndand3rdargumentsto

the

conditionaloperator?:)andthesignedquantityisimplicitlyconvertedto

unsigned.

Themessagewillnotbegivenifthesignedquantityisanunsignedconstant,a

Boolean,

or an expression involving bit manipulation. For example,

u & ~0xFF

whereuisunsigneddoesnotdrawthemessageeventhoughtheoperandonthe

right is

senoughlikeanunsignedto

warrant not

提示不寻常的类型转换

在switch语句中没有default

Info--Significant prototype coercion(.2)int to bool

setCrossTR(pSetting,period,false);清除性能越限标记

本地声明的函数未被使用

函数重复声明

头文件FileName应该被去除包含

宏定义中没有包含必须的括弧

布尔表达式总是真值或总是假值

Info--Boolean　within 'if' always evaluates to True.

无符号数不可能小于0

Info--Too few initialzers for aggregate

Info--String concatenation within initialzer

Info--Conceivable use of null pointer 'p' in left argument to operator 'ptr-ptr'

Info--Conceivable access of out-of-bounds pointer(1 beyond end of data)by

operator 'unary*'

Info--Conceivable creation of out-of-bounds pointer(2 beyond end of data)by

operator '++'

Info--Use of go to is deprecated

函数的指针参数在函数内部没被修改, 提示参数定义为常量指针.

Info 818:pointer parameter 'pGraph'(line 206)could be declared as pointing to

const

Info--control flows into case/default without-fallthrough comment

进入case/default的控制流 没有 -fallthrough 注释

Info--suspicious pointer-to-pointer conversion(area too small)

循环代码不可达

Loop not reachable -- A loop structure (for, while, or do) could not be

reached.

Was this an oversight? It may be that the body of the loop has a labeled

statement and

that the plan of the programmer is to ju+D62+C64

int x=(()-cxIcon+1)/2; operator '-' followed by operator '+'is

confusing,use parentheses.

Error-Symbol 'VOS_TerminateHandle(void)'not declared as 'C' conflicts with line

510

构造器中没有初始化成员符号‘Symbol’

Member with different signature hides virtual member 'Symbol' (Location)

成员有不同的参数列表，隐藏了虚成员

数据成员‘symbol’的长度为0

基类的析够器无效

成员隐藏非虚的成员‘symbol’

destructor for base class 'Symbol' (Location) is not virtual

基类的析构函数非虚的。

Warning--Pointer member'CXXObject::m_pCrc4Fecses'(line 76,xx.h,module

)neither freed nor zeroed by destructor

function 'Symbol' may throw an exception in destructor 'Symbol'

函数在构造函数中可能抛出异常

Direct pointer copy of member 'Symbol' within copy constructor: 'Symbol'

拷贝构造函数直接拷贝指针

Direct pointer copy of member 'Symbol' within copy assignment operator: 'Symbol'

指针直接拷贝赋值而不是重新申请一段新的内存，这意味着两个对象指向了同一块地址，

当修改或删除时，会有麻烦。

static assumed for String

类Symbol的“=”操作符重载函数没有返回类的引用

assignment operator for class 'Symbol' does not return a reference to class

Info--new in constructor for class 'FEC_CURRENT_DATA'which has no assigment

operator

Info--new in constructor for class 'ABXError'which has no copy constructor

Virtual function 'Symbol' has default parameter

non-copy constructor 'Symbol' used to initialize copy constructor

Info--Pointer member'CXXManager::m_pCpuChArr'(line 184,file xx.h)not directly

freed or zeroed by destructor

符号可以声明为const

parameter 'Symbol' of function 'Symbol' could be made const reference

Info--member　function CXXManager::GetXXInfo(unsigned char &,struct XX_INFO *&)

could made const

成员函数标记为const，间接改变了类成员

Member function 'Symbol' marked as const indirectly modifies class

派生类的虚函数和基类的函数有不同的访问权限

Virtual function 'Symbol' has an access (String) different from the access

尝试将const转化为非const

Attempt to cast away const (or volatile)

Info--could use dynamic_cast to downcast polymophic type 'IBase'

Info--Coverting a String literal to signed char* is not const safe(.4)

#...Malloc",(const char*)_FILE_,_LINE_)

Assignment of string literal to variable 'Symbol' (Location) is

not const safe

隐式转换为bool

Implicit conversion to Boolean (Context) (Type to Type)

变量只被它的构造函数使用

Variable 'Symbol' (Location) (type 'Name') is referenced only by

its constructor or destructor

示例/解决方案

例如：

int a;

a=b;

error 40: (Error -- Undeclared identifier 'b')和error 550: (Warning -- Symbol 'a' (line 8) not accessed)

svr = NULL;

„„

pthread_mutex_unlock(&svr->lock);

break;

已经将 svr 赋值为 NULL, 后面又使用了 svr 变量。

会导致空指针错误、而且未能正常释放锁。

int main()

{char a[10];

a[10]=0;

return 0;}

８３１：symbol "a"(line 3) not accessed.变量未被使用

error 420: (Warning -- Apparent access beyond array for function 'memcmp(const

void *, const void *, unsigned int)', argument 3 (size=21) exceeds argument 1

(size=20) [Reference: file D:: lines 9, 14])

error 420: (Warning -- Apparent access beyond array for function 'memcmp(const

void *, const void *, unsigned int)', argument 3 (size=21) exceeds argument 2

(size=20)

例：

#include

#include

main()

if(m_pMemHeader == NULL)

{

m_pRegion = new mapped_region(m_sharedMem, read_write); //mapped_region*

m_pRegion;

m_pMemHeader = (CMemHeader*)(m_pRegion->get_address());

}

例子同530

示例见529：

p = (Array10) malloc( sizeof(Array10) );

error 529: (Warning -- Symbol 'a' (line 19) not subsequently referenced)

error 433: (Warning -- Allocated area not large enough for pointer)

m->speed_factor = (double)(1 << (-32));执行了负数位移

} while( Random() != 0 );error 506: (Warning -- Constant value Boolean)

例： char c=3; if(c<300){}

例：

#define Random() rand

#include "stdafx.h"

#include

int main()

for( i = 0, i < n; i++; ) error 520: (Warning -- Expected void type, assignment,

increment or decrement)

error 681: (Warning -- Loop is not entered)

#include "stdafx.h"

#include

int sum( int a[], int n )

{

例：for( int n = 0 ; n < nscores ; + + n ) error 521: (Warning -- Expected void

type, assignment, increment or decrement)

#include "stdafx.h"

#include

double scores[] = { 67 , 87 , 100 } ;

int nscores = 3 ;

例：*p++; error 522: (Warning -- Expected void type, assignment, increment or

decrement) ，把increment函数中的*p++改为*p=*p+1

#include "stdafx.h"

int scores[19];

int hole = 0;

bool done = false;

void increment( int *p )

{

//*p=*p+1;

*p++;

}

void ball_is_struck()

{

increment( &scores[hole] );

}

提示错误缩进, 原因是代码中空格和 TAB 键混合使用了, PC-Lint 认为代码的缩进与代码

逻辑不符合. 把代码统一改成使用空格即可

例：else manner = ""; error 525: (Warning -- Negative indentation from line 11)

#include "stdafx.h"

#include

typedef const char *CSTRING;

CSTRING revere( int lights )

{

CSTRING manner = "by land";

if( lights > 0 )

if( lights == 2 ) manner = "by sea";

else manner = "";

return manner;

}

int main()

{

printf( "The British are coming %sn", revere( 1 ) );

return 0;

}

if(a > B) return TRUE; else return FALSE;return FALSE;

检查变量未引用的原因

例：p = (Array10) malloc( sizeof(Array10) ); error 529: (Warning -- Symbol 'a'

(line 19) not subsequently referenced) error 433: (Warning -- Allocated area not

large enough for pointer)

#include "stdafx.h"

#include

例：error 429: (Warning -- Custodial pointer 'x' (line 6) has not been freed or

returned) foo(x);error 530: (Warning -- Symbol 'x' (line 15) not initialized)

#include "stdafx.h"

#include

#include

#include

void foo( char *x )

{

x = (char *)malloc(100);

if( !x ) exit(1);

strcpy( x, "this is a test" );

void *select_fixed_order_thread_func(void *arg)

{

„

error3:

if(op->command_pipe[0]>0)

close(op->command_pipe[0]);

if(op->command_pipe[1]>0)

close(op->command_pipe[1]);

error2:

free(op);

error1:

printf("fixed_order stopn");

}

for( j = 0; j < n; j++ ) fgets( buf, 200, f );

error 534: (Warning -- Ignoring return value of function 'fgets(char *, int,

struct _iobuf *)' (compare with line 300, file C:Program FilesMicrosoft Visual

StudioVC98Includestdio.h))

如果fgets( buf, 200, f )返回的行中字符个数超过200个会怎样？

例：a[j] = 0;

error 539: (Warning -- Did not expect positive indentation from line 11)

#include "stdafx.h"

#include

#define N 10

int a[N];

void fill_upper( int from, int fill )

{

int i, j;

char arr[100], *p; p=&arr;

p=&a;

error 545: (Warning -- Suspicious use of &)

int main()

{

int a[3], (*p)[3];

p=&a;

a[0] = 11;

a[1] = 22;

a[2] = 33;

例：error 550: (Warning -- Symbol 'cows' (line 9) not accessed)

#include "stdafx.h"

/* returns 100*bulls + cows where a bull is equality at some

index and a cow is equality at a different index. a[] and b[]

are strings of length n. Caution: a and b are modified */

int Cows_Bulls( char a[], char b[], int n )

{

int i, j;

int cows = 0, bulls = 0, score = 0;

if( n >= 100 ) n = 99;

for( i = 0; i < n; i++ )

在PC-Lint中有这样的规定，如果一个表达式中同时使用了两次相同的volatile变量，那么

就会给出564告警，因为这时候会产生赋值顺序的问题。

volatile char *p;

volatile char f();

n = (f() << 8) | f(); /* Warning 564 */

n = (*p << 8) | *p; /* Warning 564 */

u < 0， 0 > u

是可疑的，如果 u 是一个无符号量，或一个量断定永远不会小于零

static inline int fun(int s)

{

u_int arg = 1;

return arg；//32位转到31位

}

例如：

ch >> 10

将得出这个信息，如果 ch 类型是 char ，这里 char 是一个小于 10 比特宽度(通常情况

下)的类型。

示例同737

“Symbol”的声明隐藏了此符号其它地方声明

一个局部符号和一个全局符号（或可能另一个局部符号）有相同的名称。这可能很危险。这

是故意的？最好重命名这个局部符号。

void print_str(const char *p); „ char *sz; print_str(sz);

例：string_copy( buf, "hello world" ); error 603: (Warning -- Symbol 'buf' (line

27) not initialized)

#include "stdafx.h"

#include

void string_copy( const char * dest, char * source)

{

//...

}

int main()

{

char buf[12] ;//= "hello,all!!";

string_copy( buf, "hello world" );

printf( "%sn", buf );

return 0;

}

void write_str(char *lpsz); „ write_str(“string”);

p = q; /* 605 */ error 605: (Warning -- Increase in pointer capability

(assignment))

int main()

{

int *p;

const int *q; //int *q;

p = q; /* 605 */

//p = (int *) q; /* inhibited */

return 0;

}

由于指针q被定义为const，而后面赋值给p后，可以通过p修改q的内容，因此相当于是增强

了指针q的功能。

VC6的编译器也不允许这种行为：

--------------------Configuration: Test1 - Win32 Debug--------------------

D:(7) : error C2440: '=' : cannot convert from

'const int *' to 'int *'

Conversion loses qualifiers

Error executing .

对于const变量的检查，PC-Lint是完全支持的。使用const变量，对于提高代码的质量非常

有好处，看一下下面的例子：

char *strcpy( char *, const char * );

const char c = 'a';

const char *p = &c;

void main()

{

char buf[100];

c = 'b';

*p = 'c';

strcpy( p, buf );

...

这里的c和*P指向的内容都是静态变量，不可修改。上面的代码明显违反了这个规定，会产

生Error(11)，另外，把P作为第一个参数传入strcpy中，会产生告警605（Increase in

pointer capability），而把buf作为第二个参数传入strcpy函数中，会产生告警603

error 613: (Warning -- Possible use of null pointer 'p' in argument to operator

'unary *' [Reference: file D:: line 8]) 其他略

int count( char *, char );

int main( int argc, char **argv)

{

char *p = argv[1];

if(argc > 1 && p) ;else return count( p, 'e' );

return 0;

}

// count( buf, letter ) counts the number of letters in buf

int count( char *buf, char letter )

例： error 616: (Warning -- control flows into case/default) case 3: cout <<

"Comet"; 其他同类error略

#include "stdafx.h"

#include

void printdeer( int reindeer )

{

switch (reindeer)

{

case 1: cout << "Dasher";

case 2: cout << "Dancer";

case 3: cout << "Comet";

int find_monitor(int s_id,int id,char *ip,int *slot,int *port)

{

int s_ok;

...

conElement = doc_hildElement("modbus").Element();

for(element = conElement->FirstChildElement(); element; element = element-

>NextSiblingElement())

{

if(strcasecmp(element->Value(), "monitor") == 0)

{

s_ok = 0;

...

}

}

if(s_ok == 0 ) //s_ok可能没有初始化

{

return 1;

}

return 0;

}

例1：

char ch = 127;

if( ch == 0xFF ) ...

error 650: (Warning -- Constant out of range for operator '==')

例2：

#define N 10000

unsigned char i;

for( i = 0; i < N; i++ )

for( i = 0; i < N; i++ ) error 650: (Warning -- Constant out of range for

operator '<')

例：printf("a[%d]=%dn",i,a[i]); error 661: (Warning -- Possible access of out-

of-bounds pointer (1 beyond end of data) by operator '[' [Reference: file D:PC-

: lines 8, 9, 10])

#include "stdafx.h"

#include

int main()

{

int i;

int a[] = {1,2,3};

void TiXmlUnknown::Print( FILE* cfile, int depth ) const

{

for ( int i=0; i

fprintf( cfile, " " );

fprintf( cfile, "<%s>", value.c_str() );//cfile可能未null

}

简单问题。通常是代码里判断条件错误造成，修改代码即可。

如定义一个char类型变量，条件判断让它<=127，显然判断总是真

移位应该在无符号数上操作

移位应该在无符号数上操作。一个有符号数右移依赖于系统

要对联合体的第一个成员赋值进行初始化才不会告警，

不可以直接写成union A a={0}; 应写成：union A a；=0;

原因是在函数中的某个调用参数或者局部变量没被使用. 对局部变量可以直接去掉, 对于参

数则把其放到 if 语句中即可.

while(1)的问题，请使用for(;;)替代

使用-emacro进行屏蔽或修改代码

有时候因为Tab键或排版格式没有对齐造成

判断两个布尔变量或条件表达式是否相等或不等时出现此告警。布尔值变量通常就是可以代

表布尔值，不需要另外与布尔值判断

例如：if(monPer15!=m_bCollectOf15),当出现此警告时可以改为：

if((INT)monPer15!=(INT)m_bCollectOf15)

如果这样写if(true==m_bFlag)出现告警，改为：if(m_bFlag)消除告警

char ch = 0;

int n = 0;

ch = n;

ch = n; error 734: (Info -- Loss of precision (assignment) (31 bits to 7 bits))

" %d degreesn", sum / count );

error 573: (Warning -- Signed-unsigned mix with divide)

error 737: (Info -- Loss of sign in promotion from int to unsigned int)

const int march[31] = {

8, 5, 7, 2, -4, -14, -7, -4, -2, 0,

0, 2, 5, 7, 2, -4, -14, -7, -4, -2,

1, 7, 2, 2, -2, -3, -4, 6, -4, 3, 9 };

int main()

{

unsigned int i, count = 31;

int sum = 0;

for( i = 0; i < count; i++ )

{

通常发生在指针类型转换时, 转换前后指针所指类型空间大小不一致时. 可通过在转换前

加/*lint -e(740) */的方式屏蔽此警告.

error 616: (Warning -- control flows into case/default)

error 744: (Info -- switch statement has no default)

switch (reindeer)

{

case 1: cout << "Dasher";

case 2: cout << "Dancer";

case 3: cout << "Comet";

case 4: cout << "Cupid";

类型转换问题。

如：setThisCrossTR(pSetting,false);有告警

改为：setThisCrossTR(pSetting,（bool）false);消除告警

一般情况下尽量避免使用ｂｏｏｌ型变量

文件用#include包含了头文件，但是头文件没有被模块使用，应该被移除。

The named header

file was directly #include'd in the named module but the #include can be removed

because it

was not used in processing the named module or in any header included by the

module. It contained

no macro, typedef, struct, union or enum tag or component, or declaration

referenced

#define A B + 1

可能在以后的上下文中被使用为：

f( A * 2 );

可能产生奇怪的结果，B+2 被传递给 f ，而不是 (B+1)*2 。校正方法是：定义 A 为：

#define A (B + 1)

最高优先级的二元操作符不属于上面的情况，因为：

#define A s.x

将不会产生这个信息

void claNameManager::ManagerDestroy()

{

ASSERT(m_pNameTable!=NULL);

m_pNameTable->HashDestroy();

if(m_pNameTable!=NULL)

{

delete m_pNameTable;

m_pNameTable=NULL;

}

}明显应该将hash那一行放到ｉｆ判断里面，并且要删除掉ＡＳＳＥＲＴ那一行

通常是给数组初始化赋值时没有给所有的赋值造成，可以将其他的也赋值完来消除这个问题

。这个告警目前在平台中非常多，即使使用－ｅ参数屏蔽也屏蔽不了，这就要求编码时养成

好习惯。

同一个字符串分成多行书写时，使用双引号连接出的告警，此告警主要是提示是否多个字符

串在中间忘了用标点符号隔开，有些时候有些字符串很长，需要分成多行书写时也会使用多

个双引号，这时可以使用//lint-save-786,//lint-restore来屏蔽

同告警６１３一样，指针未校验引起，如果校验是在函数外部保证的，可以使用assert来避

免此屏蔽

指针有可能越界的问题，通常是由于没有校验分配空间的长度引起

指针未做校验可能引起越界，比如定义一个指针指向字符串，但是在使用Ｐ＋＋操作时，没

有先判断指针是否会越界，如可以判断 *P!='0'或校验指针和起始地点差是否超过预先分配

的空间长度

使用了goto语句造成，有些人使用goto语句不规范，如果屏蔽会引起其它程序结构不合理的

问题，所以在程序中还是不要使用goto语句。

int f( int *p ) { return *p; }

能被声明为：

int f( const int *p ) { return *p; }

使用//lint - fallthrough在代码里可以消除此告警

一个普通的程序错误是忘记在switch语句的case语句间的break语句，例如：

case 'a': a = 0;

case 'b': a++;

这个失败是故意的还是这是一个bug？要标识这是有意的，使用选项- fallthrough在一个

lint注释中：

case 'a': a = 0;

//lint -fallthrough

case 'b': a++;

这个问题产生通常是由于内存越界造成或将一个空间小的指针转换为一个空间大的指针造

成，如：pTailCheck=(DWORD*)((char*)pBuf+pPtInfo->BufSize-VOS_PT_BUF_TAIL_LEN);实

际上是将char*转换为DWORD*造成，可以在本行前使用//lint-save -e826,在本行后再使用

//lint-restore恢复的办法

原因是在 while (1)/for (;;) 后还有代码, 但这些代码永远无法执行到. 解决方法是

在不能执行到的代码行前加上

　　/*lint -unreachable */

用括号将表达式按优先顺序括起来以方便阅读

在头文件里被声明为extern"C",但在CPP文件里没有函数前没有加上extern"C" 关键字造成

指示构造器中没有初始化成员符号‘Symbol’。这是一个疏忽吗？

一个成员方法的名字和基类的一个虚方法名字一样，但是参数列表不一致，这是合法的，但

是值得怀疑，看起来是想重写基类虚函数，但是参数列表又不一样，要不就改变参数列表，

要不就使用其他的名字。

它可能是一个长度为0的数组，或是一个没有数据成员的类。在C中，这认为是错误的，在

C++中，这认为是警告。检查你的代码确保这不是一个错误。

Some libraries employ clever templating, which will elicit this message. In such

a case it is necessary for you

to inhibit the message outright (using -e1501) or through a judicious use of -

esym(1501,...).

类是一个基类，但是析构函数不是virtual，这是一个错误？基类的析构函数应该为vitual

的，以致能够安全的删除指向基类的指针。

派生类的成员和基类的成员名字一样，但是基类的成员是非虚的，是否是一个错误？基类的

成员是否应该声明为virtual？如果不是必要的，不要使用同样的名字。

In a final pass

through all the classes, we have found a class (named in the message) that is

the base class of a

derivation and has a destructor but the destructor is not virtual. It is

conventional for inherited

classes to have virtual destructors so that it is safe to 'delete' a pointer to

析构函数中没有对指针变量进行内存释放或清零操作，修改代码即可

函数被定义为可能会抛出异常，这样的异常应该放在try块捕获，因为析构函数任何时候都

不应该抛出异常。

class X

{

char *p;

X( const X & x )

{ p = x.p; }

...

};

p应该重新申请内存

例如,下面这个例子就会产生错误

class X

{

char *p;

X& operator=( const X & x )

{ p = x.p; }

...

};

这里的p应该重新申请一段内存

operator new() and operator delete(), when declared

as member functions, should be declared as static. They do not operate on an

object instantiation

(implied this pointer).

void operator=( const TiXmlAttribute& base );

Info -- assignment operator for class 'TiXmlAttribute' does not return a

reference to class

在构造函数中调用new造成，所以在构造函数中尽量不要分配内存

在构造函数中使用了new函数，但没有拷贝构造函数，有时候会出这个报警

class B

{

virtual void f( int n = 5 );

...

}

每个重写f的函数都必须定义缺省值，且缺省值必须为5，如果不这样做，也不会有错，但是

使用基类指针实现多态时会有错误，由于虚函数是动态绑定，默认参数是静态绑定，所有多

态时，调用的是子类的虚函数，但是默认参数是基类的。

在一个拷贝函数的初始化列表中，调用了基类的构造函数，然而，基类的构造函数不是自己

的拷贝构造函数。我们认为，拷贝构造函数应该调用拷贝构造函数，这是疏忽？或是有某种

原因选择不同的构造？

class TiXmlText : public TiXmlNode{

public：

TiXmlText( const TiXmlText& copy ) : TiXmlNode( TiXmlNode::TINYXML_TEXT ) {

( this ); }

...

调用VOS_Free造成，可以使用//lint-save 1735, //lint-restore来屏蔽，有时候定义了一

个类的成员指针变量，析构函数没有释放或将指针赋空的话也会有此告警，只要在析构函数

中将指针赋成０即可清除此告警，这个告警在平台中也是非常多见的，即使用-e1740也屏蔽

不了

The

indicated parameter is a candidate to be declared as a const reference. 例如:

void f( X x )

{

// x not modified.

}

Then the function definition can be replaced with:

void f( const X &x )

{

// x not modified.

}

函数可以声明为const类型，通常都是一些没有修改成员变量的函数会有此类告警

class X

{

char *pc;

char & get(int i) const { return pc[i]; }

};

results in Info 1763 for function X::get. This is because the function exposes

information indirectly

held by the class X.

建议修改如下：

class X

{

char *pc;

const char & get(int i) const { return pc[i]; }

char & get(int i) { return pc[i]; }

};

派生类重写的虚函数的访问权限（public，protected，private）和基类被重写的不一致，

这是疏忽？调用派生类的虚函数也会调用基类的虚函数，使用不同的访问权限是不正常的

（虽然合法）

Info -- Virtual function 'TiXmlDocument::Clone(void) const' has an access

(protected) different from the access (public) in the base class (TiXmlNode)

Class TiXmlDocument：public TiXmlNode{

protected：

virtual TiXmlNode* Clone() const;

...

}

class TiXmlNode{

public:

virtual TiXmlNode* Clone() const;

...

}

尝试转换const，这会破坏const系统的完整性，可以使用const_cast抑制这类信息

char *f( const char * p )

{

if( test() )

return (char *) p; // Info 1773

else

return const_cast(p); // OK

}

在这里主要是LoadPlugin()函数本来返回值类型为IBase*,但把它转换成IPlugin*后是使用

强制转换，没有使用dynamic_cast转换

主要是参数可以声明为const造成，像_FILE_前可以加(const char*)进行转换，并且对应的

VOS_Malloc()函数定义时需要将参数定义为(const char*)类型

将一个字符常量赋给一个非const的变量，如果是常量，应该定义为const

一个非bool的表达是分配（通过赋值，return，参数传递，初始化）给一个bool对象，这个

开发者的意图？强制转换可以阻止这类问题产生

class A { A(); };

void f()

{

A a;

}

will produce a 1788 for variable 'a' and for type 'A'.是否可以删除？