diff --git a/man/cppcheck-design.docbook b/man/cppcheck-design.docbook
index cd674812a..62f3d1237 100644
--- a/man/cppcheck-design.docbook
+++ b/man/cppcheck-design.docbook
@@ -31,7 +31,7 @@
error even though there is no error.
Cppcheck is a relatively simple tool. I hope that this article will
- highlight that it is possible to avoid false warnings with simple
+ highlight that it is possible to avoid false warnings even with simple
analysis.
@@ -41,11 +41,8 @@
There are many bugs in programs that are really hard to detect for
tools. Here is an example:
- // calculate the number of days
-int days(int hours)
-{
- return hours / 23;
-}
+ // calculate the number of days
+ int days = hours / 23;
A human programmer knows that there are 24 hours in a day and
therefore he could see that "23" is wrong. A tool will probably not know
@@ -62,24 +59,12 @@ int days(int hours)
Control flow analysis
- Control flow analysis is when the tool tries to determine if certain
- execution paths are possible.
-
- void f(int x)
-{
- if (x == 1)
- f1();
- if (x & 2)
- f2();
-}
-
- The function has 3 possible execution paths. The analysis you do in
- your head when you determine that there are 3 possible execution paths is
- "control flow analysis".
-
When you review code you will probably use "control flow analysis"
in your head to determine if there are bugs or not.
+ Control flow analysis is when you try to determine what the possible
+ execution paths are.
+
The control flow analysis in Cppcheck is quite simple.
@@ -89,11 +74,8 @@ int days(int hours)
This is a simple description of how buffer overflows are detected by
Cppcheck.
- For simple cases, no control flow analysis is used. If an array is
- accessed out of bounds somewhere in its scope then an error message will
- be written.
-
- An example code:
+ If an array is accessed out of bounds somewhere in its scope then an
+ error message will be written. An example code:
void f()
{
@@ -107,14 +89,15 @@ int days(int hours)
Array 'a[10]' index 20 out of bounds
- Cppcheck will not try to determine how execution can reach the
- "a[20] = 0;" statement. It is assumed that all statements are reachable.
- Cppcheck will detect the error even if it is really impossible that "x + y
- == 2" is true. I still claim that this is a correct warning because the
- statement is there and it has the error.
+ No control flow analysis is used. Cppcheck will not try to determine
+ how execution can reach the "a[20] = 0;" statement. It is assumed that all
+ statements are reachable. Cppcheck will detect the error even if it is
+ really impossible that "x + y == 2" is true. I still claim that this is a
+ correct warning because the statement is there and it has the
+ error.
Cppcheck will also investigate function calls. But then control flow
- analysis is needed to avoid false warnings. Here is an example that
+ analysis can be needed to avoid false warnings. Here is an example that
logically is the same as the previous example:
void f1(char *s)
@@ -136,10 +119,8 @@ void f2()
error.
But if the condition is moved into "f1" then it will be necessary to
- prove that "x+y==2" can be true when the function is called from
- "f2".
-
- No error message is reported for this code:
+ prove that "x+y==2" can be true when the function is called from "f2". No
+ error message is reported for this code:
void f1(char *s)
{
@@ -158,11 +139,10 @@ void f2()
Memory leaks
- Simple control-flow analysis is made. The assumtion is that all
- conditions can always be either true or false. It is assumed that all
- statements are reachable.
-
- Here is an example:
+ The check uses simple control-flow analysis. The control flow
+ analysis assumes that all conditions can always be either true or false.
+ It is assumed that all statements are reachable. Here is an
+ example:
void f()
{
@@ -197,9 +177,10 @@ void f2()
}
Cppcheck doesn't detect any error. The "all conditions can be either
- true/false" means that cppcheck doesn't know that "if (x==20)" is false
- when "if (x==10)" is true. Many other static analysis tools will probably
- detect that there will be a leak if x is 10.
+ true/false" means that cppcheck doesn't know that "if (x==20)" is always
+ false when "if (x==10)" is true. So Cppcheck can't establish that there is
+ a leak. Many other static analysis tools will probably detect that there
+ will be a leak if x is 10.
@@ -208,9 +189,6 @@ void f2()
You can not trust that Cppcheck will detect all bugs.
Cppcheck will just find some bugs. It is likely that you won't find
- these bugs unless you use Cppcheck. Cppcheck has found bugs in production
- code that has been used for years.
-
-
+ these bugs unless you use Cppcheck.