How the CC Code Analyzer Works

How the C/C++ Code Analyzer Works

During the normal compilation of a C++ application, the compiler creates an internal representation of the program as objects. The linker then links these objects and converts them into executables (.exe) or Dynamic Link Libraries (.dll). Code Analysis for C/C++ intercepts the build process and attempts to run through every single execution path of your application, one function at a time. Each function is isolated; if defects are found, they are logged and displayed in the Error List within the Visual Studio 2005 IDE (more about this later).

The last three letters in the word "PREfast" stand for Abstract Structure Tree (AST). The compiler must convert your C++ into an AST to transform them into object files. (.obj). Figure 9-1 shows an example of a typical Abstract Syntax Tree. The algorithm represented in the tree is TOTAL = A+B*C/D.

Figure 9-1

An AST can be used for both code optimization and static analysis. The static code analyzer finds bugs by walking through and analyzing the AST using every execution path it can find. If during the inspection of the tree any rules are found to be violated, an error is raised. In the following simple example, the uninitVar variable is uninitialized. As a result, the Team System PREfast analysis tool returns a C6001 warning "using uninitialized memory <variable>":

     if (NULL != parameter) {         uninitVar = myFunction(parameter);     }     return uninitVar;

Figure 9-2 shows how this code looks represented as an AST structure. You can see precisely where the rule was violated and where PREfast throws a warning or error.

Figure 9-2