SonarSource Rules
  • Products

    In-IDE

    Code Quality and Security in your IDE with SonarQube Ide

    IDE extension that lets you fix coding issues before they exist!

    Discover SonarQube for IDE

    SaaS

    Code Quality and Security in the cloud with SonarQube Cloud

    Setup is effortless and analysis is automatic for most languages

    Discover SonarQube Cloud

    Self-Hosted

    Code Quality and Security Self-Hosted with SonarQube Server

    Fast, accurate analysis; enterprise scalability

    Discover SonarQube Server
  • SecretsSecrets
  • ABAPABAP
  • AnsibleAnsible
  • ApexApex
  • AzureResourceManagerAzureResourceManager
  • CC
  • C#C#
  • C++C++
  • CloudFormationCloudFormation
  • COBOLCOBOL
  • CSSCSS
  • DartDart
  • DockerDocker
  • FlexFlex
  • GitHub ActionsGitHub Actions
  • GoGo
  • HTMLHTML
  • JavaJava
  • JavaScriptJavaScript
  • JSONJSON
  • JCLJCL
  • KotlinKotlin
  • KubernetesKubernetes
  • Objective CObjective C
  • PHPPHP
  • PL/IPL/I
  • PL/SQLPL/SQL
  • PythonPython
  • RPGRPG
  • RubyRuby
  • RustRust
  • ScalaScala
  • ShellShell
  • SwiftSwift
  • TerraformTerraform
  • TextText
  • TypeScriptTypeScript
  • T-SQLT-SQL
  • VB.NETVB.NET
  • VB6VB6
  • XMLXML
  • YAMLYAML
C++

C++ static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your C++ code

  • All rules 798
  • Vulnerability14
  • Bug173
  • Security Hotspot19
  • Code Smell592

  • Quick Fix 99
Filtered: 124 rules found
misra-required
    Impact
      Clean code attribute
        1. "Predicates" shall not have "persistent side effects"

           Bug
        2. The C++ Standard Library functions "memcpy", "memmove" and "memcmp" from "<cstring>" shall not be used

           Code Smell
        3. A function call shall not violate the function's preconditions

           Bug
        4. The character handling functions from "<cctype>" and "<cwctype>" shall not be used

           Code Smell
        5. An "integer-literal" of type "long long" shall not use a single "L" or "l" in any suffix

           Code Smell
        6. The literal value zero shall be the only value assigned to "errno"

           Code Smell
        7. A non-"transient lambda" shall not implicitly capture "this"

           Code Smell
        8. There shall be no occurrence of "undefined" or "critical unspecified behaviour"

           Bug
        9. User-defined identifiers shall have an appropriate form

           Code Smell
        10. A "for-range-initializer" shall contain at most one function call

           Bug
        11. "Global variables" shall not be used

           Code Smell
        12. The "volatile" qualifier shall be used appropriately

           Bug
        13. "Assignment" between numeric types shall be appropriate

           Code Smell
        14. "Integral promotion" and the "usual arithmetic conversions" shall not change the signedness or the "type category" of an operand

           Code Smell
        15. The operands of "bitwise operators" and "shift operators" shall be appropriate

           Bug
        16. There shall be no conversion to type "bool"

           Code Smell
        17. There shall be no conversion from type "bool"

           Code Smell
        18. The numerical value of a character shall not be used

           Code Smell
        19. "Special member functions" shall be provided appropriately

           Code Smell
        20. The argument to a "mixed-use macro parameter" shall not be subject to further expansion

           Code Smell
        21. An "object pointer type" shall not be cast to an integral type other than "std::uintptr_t" or "std::intptr_t"

           Code Smell
        22. The library function "system" from "<cstdlib>" shall not be used

           Vulnerability
        23. "Exception-unfriendly" functions shall be "noexcept"

           Code Smell
        24. An object shall not be accessed outside of its lifetime

           Bug
        25. A function declared with the "[[noreturn]]" attribute shall not return

           Bug
        26. If a project defines either a sized or unsized version of a global "operator delete", then both shall be defined

           Bug
        27. The "setlocale" and "std::locale::global" functions shall not be called

           Code Smell
        28. "User-provided" "copy assignment operators" and "move assignment operators" shall handle self-assignment

           Code Smell
        29. "User-declared" member functions shall use the "virtual", "override" and "final" specifiers appropriately

           Code Smell
        30. Derived classes shall not "conceal" functions that are inherited from their bases

           Code Smell
        31. A class shall only define an "initializer-list constructor" when it is the only constructor

           Code Smell
        32. An "explicit type conversion" shall not be an "expression statement"

           Bug
        33. "Advanced memory management" shall not be used

           Code Smell
        34. Reads and writes on the same file stream shall be separated by a positioning operation

           Bug
        35. An argument passed via ellipsis shall have an appropriate type

           Bug
        36. Line-splicing shall not be used in "//" comments

           Bug
        37. A pointer to an incomplete "class" type shall not be deleted

           Bug
        38. Octal escape sequences, hexadecimal escape sequences and universal character names shall be terminated

           Code Smell
        39. The result of "std::remove", "std::remove_if", "std::unique" and "empty" shall be "used"

           Bug
        40. An object shall not be used while in a "potentially moved-from state"

           Code Smell
        41. "Forwarding references" and "std::forward" shall be used together

           Code Smell
        42. The argument to "std::move" shall be a non-const "lvalue"

           Code Smell
        43. Dynamic memory shall be managed automatically

           Code Smell
        44. An enumeration shall be defined with an explicit underlying type

           Code Smell
        45. The "assert" macro shall not be used with a "constant-expression"

           Code Smell
        46. A comparison of a "potentially virtual" pointer to member function shall only be with "nullptr"

           Bug
        47. Local variables shall not have static storage duration

           Code Smell
        48. The C Library input/output functions shall not be used

           Code Smell
        49. The facilities provided by the standard "header file" "<csignal>" shall not be used

           Code Smell
        50. The macro "offsetof" shall not be used

           Code Smell
        51. The "string handling functions" from "<cstring>", "<cstdlib>", "<cwchar>" and "<cinttypes>" shall not be used

           Code Smell
        52. The library functions "atof", "atoi", "atol" and "atoll" from "<cstdlib>" shall not be used

           Bug
        53. The standard "header file" "<csetjmp>" shall not be used

           Code Smell
        54. A macro parameter immediately following a "#" operator shall not be immediately followed by a "##" operator

           Code Smell
        55. The "#include" directive shall be followed by either a "<filename>" or ""filename"" sequence

           Bug
        56. The "'" or """ or "\" characters and the "/*" or "//" character sequences shall not occur in a "header file" name

           Bug
        57. Precautions shall be taken in order to prevent the contents of a "header file" being included more than once

           Code Smell
        58. All "#else", "#elif" and "#endif" preprocessor directives shall reside in the same file as the "#if", "#ifdef" or "#ifndef" directive to which they are related

           Code Smell
        59. The "defined" preprocessor operator shall be used appropriately

           Bug
        60. An exception of "class" type shall be caught by "const" reference or reference

           Bug
        61. Handlers for a "function-try-block" of a constructor or destructor shall not refer to non-static members from their class or its bases

           Bug
        62. An "empty throw" shall only occur within the "compound-statement" of a "catch handler"

           Code Smell
        63. An exception object shall not have pointer type

           Bug
        64. Function templates shall not be explicitly specialized

           Code Smell
        65. A name that is present in a dependent base shall not be resolved by unqualified lookup

           Code Smell
        66. Conversion operators and constructors that are callable with a single argument shall be "explicit"

           Code Smell
        67. An object's dynamic type shall not be used from within its constructor or destructor

           Code Smell
        68. An accessible base class shall not be both virtual and non-virtual in the same hierarchy

           Bug
        69. A named bit-field with "signed integer type" shall not have a length of one bit

           Bug
        70. A bit-field shall have an appropriate type

           Code Smell
        71. The "union" keyword shall not be used

           Code Smell
        72. Within an enumerator list, the value of an implicitly-specified "enumeration constant" shall be unique

           Code Smell
        73. A conversion from function type to pointer-to-function type shall only occur in appropriate contexts

           Code Smell
        74. A function with non-"void" return type shall return a value on all paths

           Bug
        75. The parameters in all "declarations" or overrides of a function shall either be unnamed or have identical names

           Code Smell
        76. The features of "<cstdarg>" shall not be used

           Code Smell
        77. Parameters in an overriding virtual function shall not specify different default arguments

           Code Smell
        78. Functions shall not call themselves, either directly or indirectly

           Code Smell
        79. An assignment operator shall not assign the address of an object with automatic storage duration to an object with a greater lifetime

           Code Smell
        80. The "asm" declaration shall not be used

           Code Smell
        81. The identifier "main" shall not be used for a function other than the global function "main"

           Code Smell
        82. The "goto" statement shall jump to a label declared later in the function body

           Code Smell
        83. A "goto" statement shall reference a label in a surrounding block

           Code Smell
        84. The structure of a "switch" statement shall be appropriate

           Code Smell
        85. All "if ... else if" constructs shall be terminated with an "else" statement

           Code Smell
        86. The body of an "iteration-statement" or a "selection-statement" shall be a "compound-statement"

           Code Smell
        87. The operand to "typeid" shall not be an expression of polymorphic class type

           Code Smell
        88. The "address-of" operator shall not be overloaded

           Code Smell
        89. An array passed as a function argument shall not decay to a pointer

           Code Smell
        90. The logical AND and logical OR operators shall not be overloaded

           Code Smell
        91. An object with integral, enumerated, or pointer to "void" type shall not be cast to a pointer type

           Code Smell
        92. "reinterpret_cast" shall not be used

           Code Smell
        93. Casts shall not be performed between a pointer to function and any other type

           Bug
        94. A cast shall not remove any "const" or "volatile" qualification from the type accessed via a pointer or by reference

           Code Smell
        95. C-style casts and "functional notation" casts shall not be used

           Code Smell
        96. A virtual base class shall only be cast to a derived class by means of "dynamic_cast"

           Bug
        97. The built-in relational operators ">", ">=", "<" and "<=" shall not be applied to objects of pointer type, except where they point to elements of the same array

           Bug
        98. Subtraction between pointers shall only be applied to pointers that address elements of the same array

           Bug
        99. Pointer arithmetic shall not form an invalid pointer

           Bug
        100. Operations on a memory location shall be sequenced appropriately

           Bug
        101. "nullptr" shall be the only form of the "null-pointer-constant"

           Code Smell
        102. The numeric value of an "unscoped enumeration" with no fixed "underlying type" shall not be used

           Code Smell
        103. The same type aliases shall be used in all "declarations" of the same "entity"

           Code Smell
        104. The source code used to implement an "entity" shall appear only once

           Bug
        105. The "one-definition rule" shall not be violated

           Bug
        106. All "declarations" of a variable or function shall have the same type

           Bug
        107. Block scope "declarations" shall not be "visually ambiguous"

           Code Smell
        108. A "header file" shall not contain definitions of functions or objects that are non-inline and have external linkage

           Code Smell
        109. A line whose first token is "#" shall be a valid preprocessing directive

           Bug
        110. All identifiers used in the controlling expression of "#if" or "#elif" preprocessing directives shall be defined prior to evaluation

           Bug
        111. Parentheses shall be used to ensure macro arguments are expanded appropriately

           Code Smell
        112. Tokens that look like a preprocessing directive shall not occur within a macro argument

           Bug
        113. Function-like macros shall not be defined

           Code Smell
        114. String literals with different encoding prefixes shall not be concatenated

           Bug
        115. The lowercase form of "L" shall not be used as the first character in a literal suffix

           Code Smell
        116. Unsigned "integer literals" shall be appropriately suffixed

           Code Smell
        117. Octal constants shall not be used

           Code Smell
        118. Within character literals and non raw-string literals, "\" shall only be used to form a defined escape sequence or universal character name

           Bug
        119. A variable declared in an "inner scope" shall not hide a variable declared in an "outer scope"

           Code Smell
        120. The character sequence "/*" shall not be used within a C-style comment

           Code Smell
        121. A program shall conform to ISO/IEC 14882:2017 (C++17)

           Code Smell
        122. A named function parameter shall be "used" at least once

           Code Smell
        123. The value returned by a function shall be "used"

           Code Smell
        124. A function shall not contain "unreachable" statements

           Bug

        Functions shall not call themselves, either directly or indirectly

        intentionality - logical
        maintainability
        Code Smell
        • bad-practice
        • pitfall
        • misra-c++2023
        • misra-required

        Why is this an issue?

        More Info

        This rule is part of MISRA C++:2023.

        Usage of this content is governed by Sonar’s terms and conditions. Redistribution is prohibited.

        Rule 8.2.10 - Functions shall not call themselves, either directly or indirectly

        Category: Required

        Analysis: Undecidable,System

        Rationale

        Recursion carries with it the danger of exceeding available stack space, which can lead to a serious failure. Unless recursion is very tightly controlled, it is not possible to determine before execution what the worst-case stack usage could be.

        Note: any deviation used to justify non-compliance with this rule will need to explain how stack usage is to be controlled.

        Exception

        A constexpr function that is only called within a core constant expression may be recursive.

        Example

        int32_t fn( int32_t x )
        {
          if ( x > 0 )
          {
            x = x * fn( x - 1 );              // Non-compliant
          }
        
          return x;
        }
        
        // File1.cpp
        int32_t fn_3( int32_t x );
        
        int32_t fn_2( int32_t x )
        {
          if ( x > 0 )
          {
            x = x * fn_3( x - 1 );            // Non-compliant
          }
        
          return x;
        }
        
        // File2.cpp
        int32_t fn_2( int32_t x );
        
        int32_t fn_3( int32_t x )
        {
          if ( x > 0 )
          {
            x = x * fn_2( x - 1 );            // Non-compliant
          }
        
          return x;
        }
        

        In the following, the recursion within fn_4 satisfies the requirements of the exception as it is only called from within a core constant expression.

        constexpr int32_t fn_4( int32_t x )
        {
          if ( x > 0 )
          {
            x = x * fn_4( x - 1 );            // Compliant by exception
          }
        
          return x;
        }
        
        constexpr int32_t n = fn_4( 6 );      // Core constant expression
        
        
        constexpr int32_t fn_5( int32_t x )
        {
          if ( x > 0 )
          {
            x = x * fn_5( x - 1 );            // Non-compliant
          }
        
          return x;
        }
        
        int32_t n = fn_5( 6 );                // Not a core constant expression
        
        
        template< class T >
        auto Sum( T t )
        {
          return t;
        }
        
        template< class T, class ... Vals >
        auto Sum( T t, Vals ... vals )
        {
          return t + Sum( vals ... );         // Compliant - calls a different overload
        }
        

        Copyright The MISRA Consortium Limited © 2023

          Available In:
        • SonarQube IdeCatch issues on the fly,
          in your IDE
        • SonarQube CloudDetect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories
        • SonarQube ServerAnalyze code in your
          on-premise CI

        © 2025 SonarSource Sàrl. All rights reserved.

        Privacy Policy | Cookie Policy | Terms of Use