Cppcheck Official

Cppcheck Official is a Visual Studio Code extension that runs cppcheck against C/C++ files when you open, save or switch to them, and reports any warnings or errors in the Problems panel.

• Automatic analysis of C/C++ files when you open, save or switch to them. See When analysis runs.
• Warnings in header files are shown too, and critical errors such as syntaxError are always shown. See Warnings in header files and critical errors.
• Severity filter in the status bar. See Severity filter.
• Suppress or hide warnings with code actions, inline comments or arguments. See Working with warnings.
• Project files (.cppcheck, compile_commands.json) and a shared cppcheck.json so the whole team uses the same setup. See Configuration.
• Arguments generated by a script. See Generating arguments with a script.
• Full analysis of every file in the project. See Full analysis.
• Cppcheck Premium works out of the box. See Cppcheck Premium.

• Quick start
• When analysis runs
• Configuration
• Working with warnings
• Full analysis
• Troubleshooting
• Reporting issues
• Acknowledgements

1. Install cppcheck. For example:

   • On Linux (Debian/Ubuntu): sudo apt-get install cppcheck.
   • On macOS with Homebrew: brew install cppcheck.
   • On Windows: install from cppcheck's website.

   By default, the extension looks for cppcheck on the system PATH. Alternatively, set the full path to the executable in the cppcheck-official.path setting.

   

2. Install the extension. Search for "Cppcheck Official" in the Extensions view.

3. Open a C or C++ file. It is analysed right away, and the warnings appear in the Problems panel (View > Problems).

The Getting Started walkthrough shows these steps inside VS Code. To open it again, run Welcome: Open Walkthrough… from the Command Palette and pick Get Started with Cppcheck.

The extension analyses one C/C++ file at a time. Analysis runs when:

• You save a C or C++ file.
• You open a C or C++ file.
• You switch to a file's tab.
• You open a file in a preview tab (for example with a single click in the Explorer). Analysis starts after a short delay if you stay on the file. The file's warnings are cleared when you switch to another editor.
• VS Code starts or a workspace folder is added. All open C/C++ files are then analysed.

Analysis is skipped when:

• The file isn't a C or C++ file. The extension uses VS Code's language mode for this, so the file must be shown as C or C++ in the status bar.
• The file isn't visible in any editor.
• The file content hasn't changed since the last successful analysis. The extension forgets the content when the file is closed, so reopening a file analyses it again.
• cppcheck-official.enable is false. The file's warnings are cleared instead.

Cppcheck analyses the file as it is saved on disk, not the unsaved content in the editor. Warnings for unsaved changes appear after you save the file.

When you close a file, its warnings are cleared. Warnings in a header file stay as long as another open file that includes it is still open (see Warnings in header files and critical errors).

While an analysis runs, the status bar shows Cppcheck Running.

The extension has these settings under cppcheck-official.*:

To give all developers in a project the same setup, create a cppcheck.json file in the root of the workspace folder and commit it to version control:

{
  "arguments": "--project=build/compile_commands.json --suppress=missingInclude"
}

arguments can be either a string or an array of strings. If the file specifies arguments, it takes precedence over the cppcheck-official.arguments setting. Relative paths are resolved relative to the workspace folder. All other settings are still read from the VS Code settings, so each developer can adjust them individually.

The extension reads the arguments for cppcheck from:

1. arguments in cppcheck.json in the root of the first workspace folder, if the file exists and specifies arguments (see Shared Settings File).
2. Otherwise, the cppcheck-official.arguments setting.

Separate arguments with spaces, e.g. --project=build/compile_commands.json --suppress=missingInclude.

The extension adds some flags of its own to your arguments. Without a project file, it runs:

cppcheck --enable=all --inline-suppr --xml <your arguments> --suppress=unusedFunction --suppress=missingInclude --suppress=missingIncludeSystem <file>

With a project file (--project=… in your arguments), it runs:

cppcheck --enable=all --inline-suppr --xml <your arguments> --file-filter=<file>

• --enable=all is always passed, so all checks are enabled. To reduce the number of warnings, use the severity filter or suppressions.
• --inline-suppr is always passed, so // cppcheck-suppress <id> comments always work.
• --xml is used by the extension to read the results.
• Without a project file, unusedFunction, missingInclude and missingIncludeSystem are suppressed, because they are mostly false positives when a single file is analysed on its own.
• With Cppcheck Premium, --premium=safety-off is also added (see Cppcheck Premium).

<file> is the file being analysed. A full analysis runs cppcheck --enable=all --inline-suppr --xml -j<threads> <your arguments> without a file.

Use --project=<file> in the arguments to give cppcheck a project file.

Cppcheck accepts a .cppcheck project file, compile_commands.json and the other project types described in the Cppcheck manual (open source / Premium).

When a project file is used:

• The extension adds --file-filter=<file> instead of the file path and the three suppressions (see above).
• Only warnings in the analysed file are shown, apart from critical errors (see Warnings in header files and critical errors).
• With a .cppcheck project file, you can add suppressions to the project file from code actions (see Code actions).
• You can run a full analysis.

It's a good idea to use the same project file in VS Code and in your CI, so that both give the same results.

Cppcheck runs with the first workspace folder as its working directory, so relative paths in the arguments are relative to that folder.

For these options, the extension also expands ${workspaceFolder}, ~, ./ and ../:

• --project
• --addon
• --suppressions-list
• --include
• --rule-file

A value is only treated as a path if it looks like one: it contains / or \, starts with ., or has a file extension. So --addon=misra (the name of a built-in addon) is passed on unchanged, while --addon=misra.json and --addon=./my_addon.py are resolved as paths.

The cppcheck-official.path setting supports ${workspaceFolder}, ~, ./ and ../. Any other relative path is relative to the workspace folder.

You can let a command generate some of the arguments. Write @(command) in the arguments. Before each analysis, the extension runs the command and replaces @(command) with the command's output.

The output must contain the arguments wrapped in @(…). Only the text inside is used, so the command can print other text as well. For example, if the arguments are:

--suppress=memleak:src/file1.cpp @(bash scripts/cppcheck-args.sh)

and scripts/cppcheck-args.sh prints @(--project=build/compile_commands.json), cppcheck gets:

--suppress=memleak:src/file1.cpp --project=build/compile_commands.json

• The command runs in a shell, with the first workspace folder as its working directory.
• If the command writes anything to stderr, it counts as failed and the analysis doesn't run.
• ${workspaceFolder} is a path variable for the options listed under Paths. It isn't script syntax, so don't wrap a path in @(…).

Cppcheck Premium works without extra setup. The extension detects Premium and adds --premium=safety-off.

To enable Premium checks, such as MISRA or CERT, add them to the arguments, e.g. --premium=misra-c-2023 or --premium=cert-c. The available options are described in the Premium manual.

The status bar item Cppcheck severity: … opens a picker with the levels Info, Warning and Error. Your choice is saved in the workspace setting cppcheck-official.minSeverity. It applies right away to the warnings already shown, in all files.

Cppcheck severities map to the levels like this:

Info shows everything, Warning shows warnings and errors, and Error shows only errors.

Put the cursor on a line with a cppcheck warning and click the lightbulb or press Ctrl+. (Cmd+. on macOS). These actions are offered for each warning id on the line:

When warning types are hidden, the status bar shows Hidden types: N. Click it and pick a type to show its warnings again.

If you use a .cppcheck project file, two more actions are offered. Both add a <suppression> to the project file, so they are permanent and are shared with everyone who uses the project file:

• Suppress warning type <id> universally (in project file): suppresses the warning id everywhere.
• Suppress warning <id> based on file and / or symbol: first asks for a file path (leave it blank to not limit the suppression to a file). If the warning has a symbol name, it then asks whether to limit the suppression to that symbol.

A project file suppression takes effect the next time the file is analysed. These two actions aren't available with compile_commands.json or other project types.

Code actions aren't offered for a warning if its line has been edited since the analysis. Save the file to analyse it again.

• Inline suppressions: write // cppcheck-suppress <id> on the line above the warning, or at the end of the line. This always works, because the extension always passes --inline-suppr to cppcheck.

  

• Arguments: add --suppress=<id> (or --suppress=<id>:<file>) or --suppressions-list=<file> to cppcheck-official.arguments or cppcheck.json.

See the Cppcheck manual (open source / Premium) for the suppression formats.

Some warnings have several locations, for example "Either the condition … is redundant or …". The extra locations are shown as notes under the warning in the Problems panel. Click a note to jump to its location.

For some warning ids, the id in the Problems panel is a link. Click it to open the documentation for the checker, or the SEI CERT C rule that the checker relates to. For Cppcheck Premium premium-cert-* warnings, the id links to the matching SEI CERT C rule.

Analysing a source file can produce warnings in other files, usually the header files it includes. Whether these warnings are shown depends on whether you use a project file.

• Warnings in an included header file are shown in the header file, not in the source file that includes it.
• If several open source files produce warnings in the same header file, the header file shows all of them.
• A header file's warnings stay while any source file that produced them is still open. They are cleared when the last of those source files is closed.
• A warning in another file is only shown if VS Code can open that file.

If the arguments contain --project=…, only warnings in the analysed file itself are shown. Warnings in other files, including headers, are left out on purpose. Critical errors are the exception.

Some errors mean that the analysis failed or is incomplete, so the results can't be trusted. Examples are a syntax error (syntaxError), a file that can't be found (missingFile), and an invalid Cppcheck Premium licence (premium-invalidLicense). Other critical errors are about unknown macros, #error directives, include nesting that is too deep, and internal cppcheck errors.

Critical errors are always shown:

• even when they are reported in another file,
• even when a project file is used,
• whatever the severity filter is set to.

If a critical error has no valid line number, it is shown on the first line of the file.

Normally the extension analyses only the files you open. A full analysis runs cppcheck on every file in your project file, and shows the warnings for all of them in the Problems panel, including files you haven't opened.

Full analysis needs a project file, given with --project=… in cppcheck-official.arguments or in cppcheck.json. Both .cppcheck project files and compile_commands.json work.

The Full Analysis button appears in the status bar after a file has been analysed with a project file. It is hidden while an analysis is running.

1. Click Full Analysis in the status bar.
2. Choose how many threads cppcheck should use: 1, 2 or 4. This sets the cppcheck option -j1, -j2 or -j4.

While the analysis runs, the status bar shows Cppcheck Running. A full analysis can take a long time on a large project.

• All existing warnings are cleared before the full analysis starts.
• The severity filter and hidden warning types apply to the results as usual.
• The warnings stay in the Problems panel until the next full analysis, also for files that you never opened. Closing a file doesn't remove its warnings.
• If a warning is in a file that VS Code can't open, it is skipped and an information message "Unable to find location of error [id]: …" is shown.

"Cppcheck: Could not find or run '…'. Please install cppcheck or set 'cppcheck-official.path' correctly." Cppcheck isn't installed, or cppcheck-official.path points to the wrong file. Check that cppcheck --version works in a terminal. If it doesn't, install cppcheck or set cppcheck-official.path to the full path of the executable (see Quick start).

"Cppcheck failed to start: …" The executable was found but couldn't be started, for example because it isn't executable or you don't have permission to run it. The rest of the message comes from the operating system.

"Cppcheck failed with code N (unknown error), Command: …" or "cppcheck: error: …, Command: …" Cppcheck ran but reported an error, for example an unknown option or a project file it can't read. The message ends with the full command line. Run that command in a terminal from the workspace folder to reproduce the error and see cppcheck's full output.

"cppcheck: error: could not find any files matching the filter" This happens when a header file is open and the project file is compile_commands.json. A compilation database only lists source files, so cppcheck can't analyse a header file on its own. This is a known issue (#112). Until it is fixed you can ignore the message. Warnings in the header file are still shown when you analyse a source file that includes it, or when you run a full analysis.

"Cppcheck: Failed to read …/cppcheck.json: …" cppcheck.json isn't valid JSON, isn't a JSON object, or arguments isn't a string or an array of strings. Until the file is fixed, the extension uses the cppcheck-official.arguments setting instead (see Shared Settings File).

Analysis stops working after adding an @(…) script The script failed, wrote something to stderr, or its output didn't contain @(…). In any of these cases the analysis doesn't run. Run the command in a terminal from the workspace folder and check its output (see Generating arguments with a script). The error is logged in the Extension Host log (Output panel).

Cppcheck Premium licence problems Problems with the Premium licence are reported as critical errors, e.g. premium-invalidLicense, in the analysed file. Check your licence with the Cppcheck Premium documentation or contact Cppcheck Solutions.

Check that:

• The file is a C or C++ file (C or C++ is shown in the status bar) and is visible in an editor. See When analysis runs.
• cppcheck-official.enable is true.
• The severity filter (Cppcheck severity: … in the status bar) isn't hiding the warnings. Set it to Info to see everything. See Severity filter.
• The warning type isn't hidden. If the status bar shows Hidden types: N, click it to show hidden types again. See Code actions.
• If you use a project file: the file is part of the project. Warnings in other files, such as headers, aren't shown with a project file by design. See Warnings in header files and critical errors.

Running cppcheck in a terminal from the workspace folder, with the same command line the extension uses (see The command line the extension runs), shows whether cppcheck itself reports the warning.

Please submit any issues or feature requests via the GitHub Issues page.

When you report a problem, please include:

• The extension version (shown in the Extensions view).
• The VS Code version (Help > About).
• Your operating system.
• The cppcheck version and edition (open source or Premium), from cppcheck --version.
• Your cppcheck-official.arguments setting or your cppcheck.json.
• The full error message, including the command line if it has one.
• A small code example that shows the problem, if possible.

This plugin is forked from the plugin cppcheck-lite by Justus Rijke (https://github.com/JustusRijke/Cppcheck-Lite).