Quickstart: Code analysis for C/C++

Article
10/04/2022

You can improve the quality of your application by running code analysis regularly on C or C++ code. Code analysis can help you find common problems and violations of good programming practice. And, it finds defects that are difficult to discover through testing. Its warnings differ from compiler errors and warnings: It searches for specific code patterns that are known to cause problems. That is, code that's valid, but could still create issues, either for you or for other people who use your code.

Configure rule sets for a project

In Solution Explorer, open the shortcut menu for the project name and then choose Properties.
Optionally, in the Configuration and Platform lists, choose the build configuration and target platform.
To run code analysis every time the project is built using the selected configuration, select the Enable Code Analysis on Build check box. You can also run code analysis manually by opening the Analyze menu and then choosing Run Code Analysis on ProjectName or Run Code Analysis on File.
Choose the rule set that you want to use or create a custom rule set. If using LLVM/clang-cl, see Using Clang-Tidy in Visual Studio to configure Clang-Tidy analysis options.

Standard C/C++ rule sets

Visual Studio includes these standard sets of rules for native code:

Rule Set	Description
C++ Core Check Arithmetic Rules	These rules enforce checks related to arithmetic operations from the C++ Core Guidelines.
C++ Core Check Bounds Rules	These rules enforce the Bounds profile of the C++ Core Guidelines.
C++ Core Check Class Rules	These rules enforce checks related to classes from the C++ Core Guidelines.
C++ Core Check Concurrency Rules	These rules enforce checks related to concurrency from the C++ Core Guidelines.
C++ Core Check Const Rules	These rules enforce const-related checks from the C++ Core Guidelines.
C++ Core Check Declaration Rules	These rules enforce checks related to declarations from the C++ Core Guidelines.
C++ Core Check Enum Rules	These rules enforce enum-related checks from the C++ Core Guidelines.
C++ Core Check Experimental Rules	These rules collect some experimental checks. Eventually, we expect these checks to be moved to other rulesets or removed completely.
C++ Core Check Function Rules	These rules enforce checks related to functions from the C++ Core Guidelines.
C++ Core Check GSL Rules	These rules enforce checks related to the Guidelines Support Library from the C++ Core Guidelines.
C++ Core Check Lifetime Rules	These rules enforce the Lifetime profile of the C++ Core Guidelines.
C++ Core Check Owner Pointer Rules	These rules enforce resource-management checks related to `owner<T>` from the C++ Core Guidelines.
C++ Core Check Raw Pointer Rules	These rules enforce resource-management checks related to raw pointers from the C++ Core Guidelines.
C++ Core Check Rules	These rules enforce a subset of the checks from the C++ Core Guidelines. Use this ruleset to include all of the C++ Core Check rules except the Enum and Experimental rulesets.
C++ Core Check Shared Pointer Rules	These rules enforce resource-management checks related to types with shared pointer semantics from the C++ Core Guidelines.
C++ Core Check STL Rules	These rules enforce checks related to the C++ Standard Library from the C++ Core Guidelines.
C++ Core Check Style Rules	These rules enforce checks related to use of expressions and statements from the C++ Core Guidelines.
C++ Core Check Type Rules	These rules enforce the Type profile of the C++ Core Guidelines.
C++ Core Check Unique Pointer Rules	These rules enforce resource-management checks related to types with unique pointer semantics from the C++ Core Guidelines.
Concurrency Check Rules	These rules enforce a set of Win32 concurrency pattern checks in C++.
Concurrency Rules	Adds concurrency rules from C++ Core Guidelines to Concurrency Check Rules.
Microsoft Native Minimum Rules	These rules focus on the most critical problems in your native code, including potential security holes and application crashes. We recommend you include this rule set in any custom rule set you create for your native projects.
Microsoft Native Recommended Rules	These rules focus on the most critical and common problems in your native code. These problems include potential security holes and application crashes. We recommend you include this rule set in any custom rule set you create for your native projects. This ruleset is designed to work with Visual Studio Professional edition and higher. It includes all the rules in Microsoft Native Minimum Rules.

Visual Studio includes these standard sets of rules for managed code:

Rule Set	Description
Microsoft Basic Correctness Rules	These rules focus on logic errors and common mistakes made in the usage of framework APIs. Include this rule set to expand on the list of warnings reported by the minimum recommended rules.
Microsoft Basic Design Guideline Rules	These rules focus on enforcing best practices to make your code easy to understand and use. Include this rule set if your project includes library code or if you want to enforce best practices for easily maintainable code.
Microsoft Extended Correctness Rules	These rules expand on the basic correctness rules to maximize the reported logic and framework usage errors. Extra emphasis is placed on specific scenarios such as COM interop and mobile applications. Consider including this rule set if one of these scenarios applies to your project or to find more problems in your project.
Microsoft Extended Design Guideline Rules	These rules expand on the basic design guideline rules to maximize the reported usability and maintainability issues. Extra emphasis is placed on naming guidelines. Consider including this rule set if your project includes library code or if you want to enforce the highest standards for writing maintainable code.
Microsoft Globalization Rules	These rules focus on problems that prevent data in your application from displaying correctly when used in different languages, locales, and cultures. Include this rule set if your application is localized and/or globalized.
Microsoft Managed Minimum Rules	These rules focus on the most critical problems in your code for which Code Analysis is the most accurate. These rules are small in number and they're intended only to run in limited Visual Studio editions. Use MinimumRecommendedRules.ruleset with other Visual Studio editions.
Microsoft Managed Recommended Rules	These rules focus on the most critical problems in your code. These problems include potential security holes, application crashes, and other important logic and design errors. We recommend you include this rule set in any custom rule set you create for your projects.
Microsoft Mixed (C++ /CLR) Minimum Rules	These rules focus on the most critical problems in your C++ projects that support the Common Language Runtime. These problems include potential security holes, application crashes, and other important logic and design errors. We recommend you include this rule set in any custom rule set you create for your C++ projects that support the Common Language Runtime.
Microsoft Mixed (C++ /CLR) Recommended Rules	These rules focus on the most common and critical problems in your C++ projects that support the Common Language Runtime. These problems include potential security holes, application crashes, and other important logic and design errors. This ruleset is designed for use in the Visual Studio Professional edition and higher.
Microsoft Security Rules	This rule set contains all Microsoft security rules. Include this rule set to maximize the number of potential security issues that are reported.

To include every rule:

Rule Set	Description
Microsoft All Rules	This rule set contains all rules. Running this rule set may result in a large number of warnings being reported. Use this rule set to get a comprehensive picture of all issues in your code. It can help you decide which of the more focused rule sets are most appropriate to run for your projects.

Run code analysis

On the Code Analysis page of the Project Properties dialog, you can configure code analysis to run each time you build your project. You can also run code analysis manually.

To run code analysis on a solution:

In the Build menu, choose Run Code Analysis on Solution.

To run code analysis on a project:

In the Solution Explorer, select the name of the project.
In the Build menu, choose Run Code Analysis on Project Name.

To run code analysis on a file:

In the Solution Explorer, select the name of the file.
In the Build menu, choose Run Code Analysis on File or press Ctrl+Shift+Alt+F7.

The project or solution is compiled and code analysis runs. Results appear in the Error List window.

Analyze and resolve code analysis warnings

The Error List window lists the code analysis warnings found. The results are displayed in a table. If more information is available about a particular warning, the first column contains an expansion control. Choose it to expand the display for additional information about the issue. When possible, code analysis displays the line numbers and analysis logic that led to the warning.

For detailed information about the warning, including possible solutions to the issue, choose the warning ID in the Code column to display its corresponding online help article.

Double-click a warning to move the cursor to the line of code that caused the warning in the Visual Studio code editor. Or, press Enter on the selected warning.

After you understand the problem, you can resolve it in your code. Then, rerun code analysis to make sure that the warning no longer appears in the Error List.

Create work items for code analysis warnings

You can use the work item tracking feature to log bugs from within Visual Studio. To use this feature, you must connect to an instance of Azure DevOps Server (formerly, Team Foundation Server).

To create a work item for one or more C/C++ code warnings

In the Error List, expand and select the warnings
On the shortcut menu for the warnings, choose Create Work Item, and then choose the work item type.
Visual Studio creates a single work item for the selected warnings and displays the work item in a document window of the IDE.
Add any additional information, and then choose Save Work Item.

Search and filter code analysis results

You can search long lists of warning messages and you can filter warnings in multi-project solutions.

To filter warnings by title or warning ID: Enter the keyword in the Search Error List box.
To filter warnings by severity: By default, code analysis messages are assigned a severity of Warning. You can assign the severity of one or more messages as Error in a custom rule set. On the Severity column of the Error List, choose the drop-down arrow and then the filter icon. Choose Warning or Error to display only the messages that are assigned the respective severity. Choose Select All to display all messages.