Hacker News Reader

Comment by eatonphil | Hacker News Reader

It isn't super obvious as someone interested in C or C++ what compiler flags and static analyzers I should turn on.

I mean (and I'm asking because I'd genuinely like to bookmark someplace) is there a group that keeps an up-to-date list of aggressive flags and static analyzers to use?

View on HN

I'm not sure about static analyzers, but here are the clang warnings I use for my personal C++20 projects. You will get an enormous number of warnings from typical C++ code. I fix all of them, but doubt it would make sense to do so in a commercial environment.

-Weverything - this enables every clang warning

-Wno-c++98-compat - warns about using newer C++ features

-Wno-c++98-compat-pedantic - warns about using newer C++ features

-Wno-padded - warns about alignment padding. I optimize struct layout, so this warning only reports on cases I couldn't resolve.

-Wno-poison-system-directories - I'm not cross-compiling anything.

-Wno-pre-c++20-compat-pedantic - warns about using newer C++ features

For static analysis I use CodeChecker, it's a wrapper on top of the Clang static analyzer and Clang tidy (linter). Now also supports cppcheck, but I disabled it (too many false alarms). It's free and open source, and I find it useful. Make sure you use it with a version of LLVM/Clang with support of Microsoft z3 enabled (it's the case in Debian stable, so should be OK in most distros).

For the flags I would start with "-Wall -Werror", then maybe disable some warnings based on the code base / use.

All this assuming a GCC/Clang friendly code base.

Not that I know of, probably something you'll have to dig into based on your use case. I've used Coverity for static analysis, which is great but pricey. We have a corporate license so no-brainer for me.

-Wall -Werror (in cland and in think on GCC) is a good way to start. In general, clang is great at warning at UB. Also, address-san is a great tool

Reply on news.ycombinator.com