int *p = NULL;
if (cond) {
    p = &local_var;
}
*p = 42;  // 当 cond 为假时是空指针解引用

int x = 42;
printf("%d\n", x);  // 在 -O2 下, x 可能被完全消除

(dbx) stop at main
(dbx) run
(dbx) print x
(dbx) next

int foo(int x) {
    int y = x * 2;
    if (y > 10) {
        return y - 1;
    } else {
        return y + 1;
    }
}

(gdb) bt
#0  process_string (str=0x0) at segfault.c:8
#1  0x00401789 in main () at segfault.c:18

gcc -Wall -Wextra -Wpedantic -Werror -std=c17 program.c -o program

gcc -Wall -Wextra \
    -Wformat=2          \  # 检查 printf/scanf 格式串
    -Wconversion        \  # 隐式类型转换可能丢失数据
    -Wshadow            \  # 局部变量遮蔽外层变量
    -Wundef             \  # #if 中使用未定义宏
    -Wpointer-arith     \  # 指针运算警告
    -Wstrict-prototypes \  # 函数声明必须写参数类型
    -Wmissing-prototypes\  # 非静态函数必须有原型
    -Wredundant-decls   \  # 重复声明
    -Wnested-externs    \  # 嵌套 extern
    -Wold-style-definition \  # K&R 风格函数定义
    -Wmissing-include-dirs \  # 不存在的 include 目录
    -Wundef             \  # #if 中未定义宏
    -Wcast-align        \  # 强制转换导致对齐问题
    -Wwrite-strings     \  # 字符串字面量应为 const
    -Wswitch-enum       \  # switch 未覆盖枚举值
    -Wswitch-default    \  # switch 缺少 default
    -Wuninitialized     \  # 未初始化变量
    -Winit-self         \  # 变量用自身初始化 (如 int x = x;)
    -Wmissing-field-initializers \  # 结构体初始化不全
    -Wmissing-declarations  \  # 全局函数无声明
    -Wformat-nonliteral     \  # printf 格式串不是字面量
    -Wformat-security       \  # printf 安全问题
    -Wformat-y2k            \  # 日期格式 Y2K
    -Wnull-dereference      \  # 空指针解引用
    -Wdouble-promotion      \  # float 隐式转 double
    -Wframe-larger-than=4096 \ # 栈帧过大
    -Wlarger-than=8192      \  # 单个对象过大
    -Wstack-usage=4096      \  # 栈使用过大
    -Wvla                   \  # 使用变长数组 VLA
    -Walloca                \  # 使用 alloca
    -Warray-bounds=2        \  # 数组越界检查级别 2
    -Wimplicit-fallthrough=3 \ # switch case 穿透
    -Wshift-overflow=2      \  # 移位溢出
    -Wstringop-overflow=4   \  # 字符串操作溢出
    -Wtrampolines           \  # 嵌套函数跳板
    -Wfloat-equal           \  # 浮点数相等比较
    -Wlogical-op            \  # 逻辑运算符可疑
    -Waggregate-return      \  # 返回结构体
    -Wpadded                \  # 结构体填充
    -Wsync-nand             \  # __sync_nand 不安全
    -Wunsuffixed-float-constants \  # 浮点常量无后缀
    program.c -o program

# 启用某个警告
gcc -Wunused-variable program.c -o program

# 禁用某个警告(在 -Wall 后)
gcc -Wall -Wno-unused-parameter program.c -o program

# 将某个警告视为错误
gcc -Werror=format-security program.c -o program

# 将某个错误降级为警告
gcc -Wno-error=format program.c -o program

#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Wunused-variable"

int unused_demo(void) {
    int x = 42;  // 警告被抑制
    return 0;
}

#pragma GCC diagnostic pop  // 恢复警告设置

/* 标记函数的某些参数可能未使用 */
int callback(int event, void *data)
    __attribute__((unused));  // 整个函数标记为可能未使用

/* 标记参数未使用 */
int callback(int event, void *data) {
    (void)data;  // 常用技巧:转换为 void 抑制警告
    return event;
}

#pragma warning(push)
#pragma warning(disable: 4996)  // 禁用"不安全 CRT 函数"警告
FILE *f = fopen("file.txt", "r");
#pragma warning(pop)

# 生成当前警告基线
gcc -Wall -Wextra program.c 2> warnings.baseline

# CI 中对比新警告
gcc -Wall -Wextra program.c 2> warnings.new
diff warnings.baseline warnings.new

# CMakeLists.txt
if(CMAKE_BUILD_TYPE STREQUAL "Debug")
    add_compile_options(-Wall -Wextra -Wpedantic -Werror -g -O0)
elseif(CMAKE_BUILD_TYPE STREQUAL "Release")
    add_compile_options(-Wall -Wextra -O2)
    # 生产不强制 -Werror,避免阻塞发布
endif()

# Ubuntu/Debian
sudo apt install cppcheck

# macOS
brew install cppcheck

# Windows
choco install cppcheck

# 基本用法
cppcheck program.c

# 启用所有检查
cppcheck --enable=all --suppress=missingIncludeSystem program.c

# 检查整个项目
cppcheck --enable=all --inline-suppr src/

# 生成 XML 报告(可被 CI 工具解析)
cppcheck --enable=all --xml --xml-version=2 src/ 2> report.xml

# 默认:仅 error 级别
cppcheck program.c

# 启用 warning、style、performance、portability
cppcheck --enable=warning,style program.c

# 全部启用
cppcheck --enable=all program.c

void f(void) {
    int x;
    // cppcheck-suppress uninitvar
    printf("%d\n", x);  // 抑制"未初始化变量"警告
}

#include <stdlib.h>
#include <string.h>

/* 1. 空指针解引用 */
void null_deref(int *p) {
    if (p == NULL) {
        *p = 42;  // cppcheck 报告: Null pointer dereference
    }
}

/* 2. 内存泄漏 */
void leak(void) {
    char *buf = malloc(100);
    /* 忘记 free, cppcheck 报告: Memory leak */
}

/* 3. 缓冲区溢出 */
void overflow(void) {
    char buf[10];
    strcpy(buf, "Hello, World!");  // cppcheck 报告: Buffer overflow
}

/* 4. 数组越界 */
void out_of_bounds(void) {
    int arr[5];
    for (int i = 0; i <= 5; i++) {  // cppcheck 报告: Array index out of bounds
        arr[i] = i;
    }
}

/* 5. 资源泄漏 */
void fd_leak(void) {
    FILE *f = fopen("file.txt", "r");
    if (!f) return;
    /* 忘记 fclose, cppcheck 报告: Resource leak */
}

/* 6. 重复代码 */
void duplicate_code(int x) {
    if (x > 0) {
        printf("positive\n");
    } else if (x > 0) {  // cppcheck 报告: duplicateCondition
        printf("positive again\n");
    }
}

# 基本用法
clang-tidy program.c -- -std=c17

# 使用特定检查集
clang-tidy -checks='bugprone-*,modernize-*,performance-*,readability-*' program.c -- -std=c17

# 自动修复
clang-tidy -fix -checks='modernize-*,readability-*' program.c -- -std=c17

# 列出所有可用检查
clang-tidy -list-checks -checks='*'

# 使用 .clang-tidy 配置文件
clang-tidy program.c

---
Checks: >
  -*,
  bugprone-*,
  cert-*,
  cppcoreguidelines-*,
  clang-analyzer-*,
  modernize-*,
  performance-*,
  readability-*,
  -bugprone-narrowing-conversions,
  -modernize-use-trailing-return-type,
  -readability-magic-numbers,
  -readability-identifier-name-length
WarningsAsErrors: ''
HeaderFilterRegex: '^(?!.*(third_party|build)).*$'
FormatStyle: file
CheckOptions:
  - key:   readability-identifier-naming.VariableCase
    value: lower_case
  - key:   readability-identifier-naming.FunctionCase
    value: lower_case
  - key:   readability-identifier-naming.ClassCase
    value: CamelCase
  - key:   readability-identifier-naming.EnumConstantCase
    value: UPPER_CASE
  - key:   cppcoreguidelines-avoid-magic-numbers.IgnoredIntegerValues
    value: '0;1;2;3;4;'
...

# 自动修复所有可修复的问题
clang-tidy -fix -checks='modernize-*,readability-braces-around-statements' \
    program.c -- -std=c17

# 仅显示建议的修复,不实际修改
clang-tidy -fix-errors -checks='modernize-*' program.c -- -std=c17

# 单文件分析
clang --analyze -Xanalyzer -analyzer-checker=core program.c

# 启用所有检查器
clang --analyze -Xanalyzer -analyzer-checker=alpha,alpha.security,alpha.unix program.c

# 生成 HTML 报告
scan-build -o reportDir clang program.c

# 查看可用检查器
clang -cc1 -analyzer-checker-help

# 包装 make
scan-build make

# 包装 cmake
scan-build cmake --build build/

# 指定输出目录
scan-build -o /tmp/scan-results make

# 分析完成后,自动在浏览器中查看结果
scan-view /tmp/scan-results/2024-01-01-*/  # scan-build 会输出实际路径

路径:
1. 调用 malloc() 返回指针 p
2. 检查 p == NULL
3. 当 p == NULL 时,解引用 *p
   ↑ Bug: Null pointer dereference

# 启用静态分析
gcc -fanalyzer -O0 program.c -o program

# 启用更详细的分析
gcc -fanalyzer -fanalyzer-call-summaries -fdump-analyzer program.c -o program

# 指定检查的函数
gcc -fanalyzer -fanalyzer-function-attr=analyze program.c

#include <stdlib.h>

void double_free_demo(void) {
    int *p = malloc(sizeof(int));
    free(p);
    free(p);  // -fanalyzer 报告: double-free of 'p'
}

void use_after_free_demo(void) {
    char *s = strdup("hello");
    free(s);
    printf("%s\n", s);  // -fanalyzer 报告: use after free
}

void leak_demo(void) {
    char *buf = malloc(1024);
    if (some_condition()) {
        return;  // -fanalyzer 报告: memory leak
    }
    free(buf);
}

-- 查找所有 strcpy 调用
import c

from CallExpr call
where call.getTarget().getName() = "strcpy"
select call, "Use of unsafe strcpy"

# GCC 与 Clang 都支持
gcc -fsanitize=address -g -O1 program.c -o program

# 推荐组合(开发环境)
gcc -fsanitize=address \
    -fno-omit-frame-pointer \
    -g -O1 \
    program.c -o program

# 检测内存泄漏(默认开启,可显式控制)
gcc -fsanitize=address -fsanitize=leak program.c -o program

# Clang 专属:检测栈使用后返回
clang -fsanitize=address -fsanitize-address-use-after-scope program.c -o program

#include <stdlib.h>

int main(void) {
    int *arr = malloc(5 * sizeof(int));
    arr[5] = 42;  // 堆缓冲区溢出
    free(arr);
    return 0;
}

=================================================================
==12345==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000014 at pc 0x4011c7 bp 0x7ffe9cff13d0 sp 0x7ffe9cff13c0
WRITE of size 4 at 0x602000000014 thread T0
    #0 0x4011c7 in main /path/program.c:4:5
    #1 0x7f1234568082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6:243)
    #2 0x40110d in _start (/path/program+0x40110d)

0x602000000014 is located 0 bytes to the right of 20-byte region [0x602000000000,0x602000000014)
allocated by thread T0 here:
    #0 0x40a26f in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xe926f)
    #1 0x4011b8 in main /path/program.c:3:16
    #2 0x7f1234568082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6:243)

SUMMARY: AddressSanitizer: heap-buffer-overflow /path/program.c:4:5 in main
Shadow bytes around the buggy address:
  0x0c047fff7fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c047fff7fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x602000000000: fa fa fa fa 00 00 00 00
                              ^
  0x0c047fff7fe0: fa fa fa fa fa fa fa fa
==12345==ABORTING

# 默认行为:出错即 abort
ASAN_OPTIONS=abort_on_error=1 ./program

# 不立即退出,继续报告其他错误
ASAN_OPTIONS=halt_on_error=0:print_legend=0 ./program

# 检测 use-after-return(有性能开销)
ASAN_OPTIONS=detect_stack_use_after_return=1 ./program

# 检测容器越界(C++ std::vector)
ASAN_OPTIONS=detect_container_overflow=1 ./program

# 禁用内存泄漏检测
ASAN_OPTIONS=detect_leaks=0 ./program

# 输出到文件
ASAN_OPTIONS=log_path=asan.log ./program

# 启用调试日志
ASAN_OPTIONS=verbosity=1 ./program

# MSan 仅 Clang 支持
clang -fsanitize=memory -fno-omit-frame-pointer -g -O1 program.c -o program

# 必须用 Clang 重新编译所有依赖(包括标准库)
# 推荐使用 libc++ 而非 libstdc++
clang++ -fsanitize=memory -stdlib=libc++ program.cpp -o program

#include <stdio.h>
#include <stdlib.h>

int main(void) {
    int *p = malloc(sizeof(int));
    if (*p > 0) {  // MSan 报告: 使用未初始化值
        printf("positive\n");
    }
    free(p);
    return 0;
}

==12345==WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x4011c7 in main /path/program.c:5:9
    #1 0x7f1234568082 in __libc_start_main

  Uninitialized value was created by a heap allocation
    #0 0x40a26f in malloc
    #1 0x4011b8 in main /path/program.c:4:14

# 启用所有 UB 检查
gcc -fsanitize=undefined -g program.c -o program

# 启用特定检查
gcc -fsanitize=signed-integer-overflow,shift,alignment program.c -o program

# 推荐组合
gcc -fsanitize=undefined \
    -fno-sanitize-recover=all \  # 出错立即终止
    -g -O1 \
    program.c -o program

# Clang 专属:整数溢出 traps
clang -fsanitize=integer program.c -o program

#include <stdio.h>
#include <limits.h>

int main(void) {
    int x = INT_MAX;
    int y = x + 1;  // 有符号整数溢出(UB)

    int arr[5] = {0};
    arr[10] = 42;   // 数组越界(UB)

    int shift = 32;
    int z = 1 << shift;  // 移位溢出(UB)

    int *p = NULL;
    *p = 42;        // 空指针解引用(UB)

    return 0;
}

program.c:5:11: runtime error: signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'
program.c:8:5: runtime error: index 10 out of bounds for type 'int [5]'
program.c:11:13: runtime error: shift exponent 32 is too large for 32-bit type 'int'
program.c:14:5: runtime error: load of null pointer of type 'int'

# GCC 与 Clang 都支持
gcc -fsanitize=thread -g -O1 program.c -o program -lpthread

# 必须用 -pie 与 -fPIC(位置无关代码)
gcc -fsanitize=thread -pie -fPIC -g -O1 program.c -o program -lpthread

#include <stdio.h>
#include <pthread.h>

int shared_counter = 0;

void *increment(void *arg) {
    for (int i = 0; i < 1000000; i++) {
        shared_counter++;  // 数据竞争!
    }
    return NULL;
}

int main(void) {
    pthread_t t1, t2;
    pthread_create(&t1, NULL, increment, NULL);
    pthread_create(&t2, NULL, increment, NULL);
    pthread_join(t1, NULL);
    pthread_join(t2, NULL);
    printf("counter = %d\n", shared_counter);
    return 0;
}

==================
WARNING: ThreadSanitizer: data race
  Write of size 4 by thread T1:
    #0 increment /path/program.c:7:9
    #1 <null> <null>

  Previous write of size 4 by thread T2:
    #0 increment /path/program.c:7:9
    #1 <null> <null>

  Location is global 'shared_counter' of size 4 at 0x7f...program

  Thread T1 (tid=12346, running) created by main thread at:
    #0 pthread_create <null>
    #1 main /path/program.c:13:5

  Thread T2 (tid=12347, finished) created by main thread at:
    #0 pthread_create <null>
    #1 main /path/program.c:14:5
==================

#include <stdio.h>

int main(void) {
    int x = 0;
    /* 未定义行为: 多次修改 */
    x = x++ + ++x;
    printf("x = %d\n", x);
    return 0;
}

int x = 0x3F800000;  /* 1.0f 的位模式 */
float *fp = (float *)&x;  /* 严格别名违规 */
printf("%f\n", *fp);

float f;
memcpy(&f, &x, sizeof(f));

int x = 42;
/* -O2 下 x 可能被消除 */
printf("%d\n", x);

int arr[5];
arr[10] = 42;  /* 越栈帧, 可能不崩溃, ASan 可能不报 */

/* -O2 下, 编译器可能消除未初始化读取 */
int *p = malloc(sizeof(int));
if (*p > 0) { ... }

void f(int *p) {
    if (p) {
        *p = 42;
    }
    /* cppcheck 可能报告: p 可能为 NULL */
}

# .github/workflows/ci.yml
name: CI
on: [push, pull_request]

jobs:
  build-test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        sanitizer: [none, asan, ubsan, tsan, msan]
        compiler: [gcc, clang]
    steps:
      - uses: actions/checkout@v3
      - name: Install dependencies
        run: |
          sudo apt update
          sudo apt install -y cppcheck clang-tidy valgrind
      - name: Configure
        run: |
          mkdir build && cd build
          if [ "${{ matrix.sanitizer }}" = "asan" ]; then
            cmake -DCMAKE_C_FLAGS="-fsanitize=address,undefined -g" ..
          elif ...
      - name: Static analysis
        run: |
          cppcheck --enable=all --error-exitcode=1 src/
          run-clang-tidy -checks='*' src/
      - name: Build
        run: cmake --build build
      - name: Test
        run: cd build && ctest --output-on-failure

/* sloppy.c */
#include <stdio.h>
#include <string.h>

int compute(int n) {
    int total;
    for (int i = 0; i < n; i++) {
        total += i;          /* 隐患 A */
    }
    return total;
}

int main(void) {
    char buf[8];
    strcpy(buf, "0123456789");  /* 隐患 B */
    int big = 2147483647;
    big = big + 1;              /* 隐患 C */
    printf("%d %s\n", compute(5), buf);
    return 0;
}

第一轮编译（-Wall -Wextra）会报：
- 'total' is used uninitialized（隐患 A，部分 GCC 版本在 -O0 下漏报，-O2 才稳定报出）
- '__builtin_strcpy' writing 11 bytes into a region of size 8
  （隐患 B，-O2 下的 -Wstringop-overflow 才报，-O0 可能不报）

第三处 big + 1 溢出编译警告通常不报，运行
gcc -fsanitize=undefined -g sloppy.c && ./a.out
会打印：signed integer overflow: 2147483647 + 1 cannot be represented in type 'int'

修复：
A. int total = 0;
B. 改为 strncpy(buf, "0123456789", sizeof(buf) - 1); buf[sizeof(buf)-1] = '\0';
   或者干脆把缓冲区放大到 12；
C. 若语义允许，改用 unsigned 或先检查 big < INT_MAX。

普通编译：程序正常退出，什么也不发生——这就是 C 的危险之处。
ASan 编译运行：
  ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000010
  WRITE of size 4 at 0x602000000010 thread T0
      #0 0x4011c7 in main grow.c:5
  0x602000000010 is located 0 bytes to the right of 16-byte region
  allocated by thread T0 here:
      #0 malloc
      #1 0x4011a0 in main grow.c:3

报告读法：越界地址恰好在 16 字节分配块的右侧 0 字节处（刚好压在红区上），
栈帧指回 main 第 5 行，分配栈指回第 3 行的 malloc——一次定位，无需复现技巧。
把 4 改成 400 后跳出了整个红区，可能落在别的合法内存上，ASan 不一定报：
这解释了为什么 sanitizer 也需要配合 fuzzing 与静态分析使用。

# .github/workflows/static.yml 关键 job
jobs:
  static:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: sudo apt-get install -y cppcheck clang-tidy
      # 关卡 1：error 级别直接失败
      - run: cppcheck --enable=warning,error --error-exitcode=1 src/
      # 关卡 2：clang-tidy 用构建数据库，先 CMake 生成
      - run: cmake -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
      - run: run-clang-tidy -p build 'src/.*\.c'