# Part 2 - The Cppcheck data representation

## Introduction

In this article I will discuss the data representation that Cppcheck uses.

The data representation that Cppcheck uses is specifically designed for static analysis. It is not intended to be generic and useful for other tasks.

## See the data

There are two ways to look at the data representation at runtime.

Using --rule=.+ is one way. All tokens are written on a line:

     int a ; int b ;

Using --debug is another way. The tokens are line separated in the same way as the original code:

    1: int a@1 ;
    2: int b@2 ;

In the --debug output there are "@1" and "@2" shown. These are the variable ids (Cppcheck gives each variable a unique id). You can ignore these if you only plan to write rules with regular expressions, you can't use variable ids with regular expressions.

In general, I will use the --rule=.+ output in this article because it is more compact.

## Some of the simplifications

The data is simplified in many ways.

### Preprocessing

The Cppcheck data is preprocessed. There are no comments, #define, #include, etc.

Original source code:

    #define SIZE 123
    char a[SIZE];

The Cppcheck data for that is:

     char a [ 123 ] ;

### typedef

The typedefs are simplified.

    typedef char s8;
    s8 x;

The Cppcheck data for that is:

     ; char x ;

### Calculations

Calculations are simplified.

    int a[10 + 4];

The Cppcheck data for that is:

     int a [ 14 ] ;

### Variables

#### Variable declarations

Variable declarations are simplified. Only one variable can be declared at a time. The initialization is also broken out into a separate statement.

    int *a=0, b=2;

The Cppcheck data for that is:

    int * a ; a = 0 ; int b ; b = 2 ;

This is even done in the global scope. Even though that is invalid in C/C++.

#### Known variable values

Known variable values are simplified.

    void f()
    {
        int x = 0;
        x++;
        array[x + 2] = 0;
    }

The --debug output for that is:

    1: void f ( )
    2: {
    3: ; ;
    4: ;
    5: array [ 3 ] = 0 ;
    6: }

The variable x is removed because it is not used after the simplification. It is therefore redundant.

The "known values" doesn't have to be numeric. Variable aliases, pointer aliases, strings, etc should be handled too.

Example code:

    void f()
    {
        char *a = strdup("hello");
        char *b = a;
        free(b);
    }

The --debug output for that is:

    1: void f ( )
    2: {
    3: char * a@1 ; a@1 = strdup ( "hello" ) ;
    4: ; ;
    5: free ( a@1 ) ;
    6: }

### if/for/while

#### Braces in if/for/while-body

Cppcheck makes sure that there are always braces in if/for/while bodies.

        if (x)
            f1();

The Cppcheck data for that is:

     if ( x ) { f1 ( ) ; }

#### No else if

The simplified data representation doesn't have "else if".

    void f(int x)
    {
        if (x == 1)
            f1();
        else if (x == 2)
            f2();
    }

The --debug output:

    1: void f ( int x@1 )
    2: {
    3: if ( x@1 == 1 ) {
    4: f1 ( ) ; }
    5: else { if ( x@1 == 2 ) {
    6: f2 ( ) ; } }
    7: }

#### Condition is always true / false

Conditions that are always true / false are simplified.

    void f()
    {
        if (true) {
            f1();
        }
    }

The Cppcheck data is:

     void f ( ) { { f1 ( ) ; } }

Another example:

    void f()
    {
        if (false) {
            f1();
        }
    }

The debug output:

     void f ( ) { }

#### Assignments

Assignments within conditions are broken out from the condition.

    void f()
    {
        int x;
        if ((x = f1()) == 12) {
            f2();
        }
    }

The `x=f1()` is broken out. The --debug output:

    1: void f ( )
    2: {
    3: int x@1 ;
    4: x@1 = f1 ( ) ; if ( x@1 == 12 ) {
    5: f2 ( ) ;
    6: }
    7: }

Replacing the "if" with "while" in the above example:

    void f()
    {
        int x;
        while ((x = f1()) == 12) {
            f2();
        }
    }

The `x=f1()` is broken out twice. The --debug output:

    1: void f ( )
    2: {
    3: int x@1 ;
    4: x@1 = f1 ( ) ; while ( x@1 == 12 ) {
    5: f2 ( ) ; x@1 = f1 ( ) ;
    5:
    6: }
    7: }

#### Comparison with >

Comparisons are simplified. The two conditions in this example are logically the same:

    void f()
    {
        if (x < 2);
        if (2 > x);
    }

Cppcheck data doesn't use `>` for comparisons. It is converted into `<` instead. In the Cppcheck data there is no difference for `2>x` and `x<2`.

    1:
    2: void f ( )
    3: {
    4: if ( x < 2 ) { ; }
    5: if ( x < 2 ) { ; }
    6: }

A similar conversion happens when `>=` is used.

#### if (x) and if (!x)

If possible a condition will be reduced to x or !x. Here is an example code:

    void f()
    {
        if (!x);
        if (NULL == x);
        if (x == 0);

        if (x);
        if (NULL != x);
        if (x != 0);
    }

The --debug output is:

    1: void f ( )
    2: {
    3: if ( ! x ) { ; }
    4: if ( ! x ) { ; }
    5: if ( ! x ) { ; }
    6:
    7: if ( x ) { ; }
    8: if ( x ) { ; }
    9: if ( x ) { ; }
    10: }