Static Code Analysis Tools for LibreOffice

Maintaining software stability across a multi-million-line codebase requires continuous, automated inspection. LibreOffice relies on a suite of static code analysis tools to catch bugs, memory leaks, security vulnerabilities, and code smell before code reaches production. The primary tools used to audit the LibreOffice codebase include Coverity Scan, custom Clang compiler plugins, Cppcheck, PVS-Studio, and CodeQL.

Coverity Scan

Coverity Scan is one of the most prominent static analysis tools used by the LibreOffice project. Since joining the Coverity Scan initiative for open-source software, the LibreOffice development team has resolved tens of thousands of defects, dramatically lowering the project’s defect density per thousand lines of code. Coverity analyzes LibreOffice’s complex C++ structures to identify:

• Null pointer dereferences
• Resource and memory leaks
• Uninitialized variables
• Logic errors and dead code

Automated builds run Coverity scans periodically, alerting developers to regressions and defects introduced in recent commits.

Custom Clang Compiler Plugins

LibreOffice maintains an extensive internal suite of custom Clang plugins located within the compilerplugins/clang directory of its source tree. Because LibreOffice uses custom idioms—such as the Universal Network Objects (UNO) framework, custom string classes (OUString), and specialized reference-counting pointers—generic static analyzers do not always catch domain-specific misuse.

These AST-based Clang plugins run during compilation to enforce:

• Correct usage of LibreOffice-specific reference counting and smart pointers
• Elimination of temporary object allocations in string manipulations
• Project-specific coding standards and API deprecation rules
• Const-correctness and optimal parameter passing

Cppcheck

Cppcheck is regularly utilized for auditing the LibreOffice C and C++ codebase. Unlike compiler warnings, Cppcheck focuses on deep, non-standard static analysis with very low false-positive rates. It is used to detect:

• Out-of-bounds array access
• Use of deallocated resources
• Memory leaks in custom allocation logic
• Undefined behavior and performance anti-patterns

PVS-Studio

PVS-Studio is periodically used to audit the LibreOffice source tree. The tool excels at catching complex C++ issues that standard compilers miss, such as:

• Copy-paste errors and typos in long conditional expressions
• Flawed boolean logic and redundant checks
• Incorrect usage of standard library functions
• 64-bit portability issues and pointer arithmetic errors

Insights from PVS-Studio audits are regularly reviewed by core contributors to patch deep-seated legacy bugs.

CodeQL and GitHub Automated Analysis

With parts of the LibreOffice ecosystem and associated subprojects hosted or mirrored on GitHub, semantic analysis engines like GitHub CodeQL (formerly LGTM) are used for automated security reviews. CodeQL treats code as data, running queries to detect security vulnerabilities such as buffer overflows, injection points, and unsafe type casts directly within the continuous integration (CI) pipeline.