rules.in

style simple
if \( (\b\w+\b) \) { (?:g_)?free \( \b\1\b \) ; }
Redundant condition. It is valid to free a NULL pointer.

warning
\bsystem \(
ENV04-C. Do not call system() if you do not need a command processor

//style define
//(\+\+|\-\-)
//Increment/decrement external variables inside define may have side effects. Prefer static inline functions.

// Too many false-positives
//style define
//#define \w+ \( [^)]*(\b\w+\b) \) .*[^(,] \1 [^),]
//Better wrap variables in define into ()

style define
#define \w+ (?:const\s+)?(?:char|int|short|unsigned|unsigned int |float|double)(?: [*]+)?$
PRE03-C. Prefer typedefs to defines for encoding types

style raw
[?][?][=!('>/<-]
PRE07-C. Avoid using repeated question marks

//style define
//#define \w+ \(.*?\) (?<!do).*{
//none

style raw
(?:char|int) \*+ \w+ , \w+ [^)]+;
DCL04-C. Do not declare more than one variable per declaration

style raw
typedef [^;{}()]+ \* [^;{}()]* ;
DCL05-C. Use typedefs of non-pointer types only

style
(?:(\b\w+\b) [+-] sizeof \( \b\1\b \)|sizeof \( (\b\w+\b) \) [+-] \b\1\b)
EXP08-C. Ensure pointer arithmetic is used correctly

warning raw
sizeof \( [^)]*(?:\w+ [+-]{2}|[+-]{2} \w+)[^)]* \)
EXP06-C. Operands to the sizeof operator should not contain side effects

warning raw
if [^{};]*(&&|\|\|)\W*(?:\b\w+\b [+-]{2}|[+-]{2} \b\w+\b)
EXP02-A. The second operands of the logical AND and OR operators should not contain side effects

warning raw
memcmp [^{};]* sizeof \( struct \w+ \)
EXP04-A. Do not perform byte-by-byte comparisons between structures

warning raw
(?<![>.] )(\b\w+\b)[^{};()'"]*[\[+,*/=-][^{};()'"]*(?:\b\1\b [+-]{2}|[+-]{2} \b\1\b)
EXP30-C. Do not depend on order of evaluation between sequence points

error normal
strncpy \( (\w+) , \w+ , sizeof \( \1 \) \)
The result of strncpy(a, b, sizeof(a)) will not be null-terminated

style raw
(?<!const) (?:unsigned )?(?:char \* \w+|char \w+ \[ \]) = "
STR05-A. Prefer making string literals const-qualified

error
mktemp \( "[^"]+" \)
The mktemp() function modifies its string argument

error
strcpy \( \w+ , getenv \( "[^"]+" \) \)
Buffer overrun possible for long environment variables.

error
 gets \( 
The gets() function is obsolescent, and is deprecated

warning
 rewind \( 
rewind() cannot report about errors, use fseek

style
 (?:ato[lif] \( |atoll \( )
ato*() cannot report about errors, use strtol

warning
(?: \+ = sn?printf| \+ sn?printf)
The snprintf() funciton can return -1

style
 v?sprintf \( 
Avoid using sprintf/vsprintf

warning
 f?open \( "/tmp/[^"]+" , 
TMP30-C. Temporary files must created with unique and unpredictable file names

warning
 mktemp \(
The mktemp() function was marked LEGACY in the Open Group Base Specifications Issue 6

warning
 signal \( [^,]+ , ([^,]+) \).* signal \( [^,]+ , \1 \)
SIG00-A. Avoid using the same handler for multiple signals

warning raw
 if \( \w+ = \w+ \) { 
Maybe here should be == operator?

warning
 if \( [^{}]+ \) { ; } { 
The { } block is always executed because of the ";" following the if statement

warning
 vfork \( 
Using the vfork function could result in a denial of service vulnerability

warning simple
= (?:g_)?getenv \( "[^"]+" \) ;[^()]+?(?:g_)?(?:get|set|unset|put)env
The string pointed to by the return value of getenv() can be  modified by a subsequent call to getenv, putenv, setenv, or unsetenv