https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119324
--- Comment #11 from James K. Lowden <jklowden at gcc dot gnu.org> --- I am adding gcc/cobol/Makefile.cppcheck to the repository. It uses the bear(1) package to build a "project" file, which I minimized to build only the files in the gcc/cobol directory. It then invokes cppcheck 2.17. N.B., it does not work with cppheck 2.7, which comes with Ubuntu LTS 22. That version requires the source directory on the command line, and then quickly dies with a segfault on at least three of the inputs. The bear(1) utility produces a json project file by monitoring the commands issued by make. AFAICT it doesn't invoke Flex/Bison. It does check compilation of their outputs. cppcheck reports something about the Flex output scan.cc. That I'm ignoring. cppcheck produced many valid complaints about single-argument constructors, although a few are by design. It found one potential NULL dereference and two logic errors. All but the NULL dereference were corrected on Friday with 37f5fdd008399c239e0689f2e864519505c78c7e. The NULL dereference fix is pending. I posted two comments to the cppcheck discussion about false positives. One regards a report of returning a reference to a temporary, where the returned value is a static local variable. The other regards the ODR report. That report has the form ODR violation for X, note A, note B where A and B are, I think, the supposedly conflicting definitions. In this case, both A and B refer to symbols.h:158 (and, for another X, symbols.h:183), where A is an absolute path and B is a relative path. I suspect the report is incorrect, but otherwise the message is. There is no evidence of more than one defintion for cbl_domain_t or cbl_domain_elem_t. Outstanding as of now are reports of suspect copy constructors and assignment operators for classes with dynamic allocation. Those are in the crosshairs.
