Abstract: C/C++ programming languages are applied in numerous critical software systems,and there is an extremely high demand for standardization and clarity of semantics during development.To prevent potential security issues arising from improper use of C/C++ languages,aC/C++ Language Programming Security Subset(referred to as GJB8114) was proposed domestically.Given the abundance of rules within the standard,it's inevitable that programmers may deviate from these norms,thereby necessitating automated rule detection tools to identify such non-compliant coding practices.However,existing rule checking tools do not provide comprehensive checks against the standards,especially for rules that require understanding of the program's context,leading to high false positive rates or even a lack of support for certain checks.This paper categorizes the rules in GJB8114 and defines what constitutes a complex rule.Through evaluating the Testbed tool's capability to inspect complex rules within GJB8114,it identifies that current tools lack thorough flow-sensitive analysis and are unable to perform cross-file global analysis.To address these issues,this study adops a flow-sensitive analysis method combined with syntax tree matching and a cross-file global analysis approach.Based on this,the CruletFS tool is developed.Experimental results demonstrate that CruletFS performs better in checking complex rules compared to common rule checking tools,such as Cppcheck and Testbed.In analyzing large-scale projects,CruletFS also outperforms Cppcheck in terms of time and memory overhead.

Key words: C/C++ coding style check, Flow-sensitive static analysis, Cross-file code check