A defined but unused function can have few implications. It can lead to development confusion such as the wrong function having similar name being called. In some rare occasions the unused function may also find its way to the final executable which may lead to other vulnerabilities. This checker is mostly concerned about static functions that are not used. By definition static functions cannot be called from outside of the translation unit (unless they are inside a header file and included in multiple translation units).

Vulnerable code example 1

1  static void used() {}
2  static void unused() {}
3  int main() {
4    used();
5    return 0;
6  }

In the above code snippet the function "unused()" is defined as static but never used within the current translation unit; hence should be removed. Klocwork produces UNUSED.FUNC.GEN on line 2 alerting the developer.

Fixed code example 1

1  static void used() {}
2  int main() {
3    used();
4    return 0;
5  }

In order to fix the issue the function “unused()” is simply removed from the file.

Vulnerable code example 2

1  static void foo(int x) {}
2  static void foo(int x, int y) {}
3  int main() {
4    foo(0,0);
5    return 0;
6  }

Similar idea but in the context of overloaded functions. Klocwork produces UNUSED.FUNC.GEN on line 1.

Fixed code example 2

1  static void used(int x, int y) {}
2  int main() {
3    used(0,0);
4    return 0;
5  }

The unused version of foo – "foo(int)" is simply removed.

Related checkers

UNUSED.FUNC.WARN