McCabe++ (mcpp)

mcpp measures typical code complexity metrics like McCabe's cyclomatic complexity.

The goal of this project is to provide a re-usable script to analyze C/C++ source code and extract complexity metrics from it. The implemented metrics are taken from the paper

LEOPARD: Identifying Vulnerable Code for Vulnerability Assessment through Program Metrics

This tool is released as part of our research in vulnerability discovery and has been used in our paper

SoK: Where to Fuzz? Assessing Target Selection Methods in Directed Fuzzing"

See also the corresponding repo.

Complexity Metrics

Vulnerability Metrics

Additional Metrics

Setup

Build a docker container which performs the setup automatically or run the installation on your local machine:

pip install .

Note: It is recommended to install packages in virtual environments.

Usage

From Python

Simply import mcpp and then use the extract function (or one of its variants).

from pathlib import Path
from mcpp import extract

input_dir = Path("some/dir")
in_files = list(input_dir.glob("**/*.c"))
result = extract(in_files)

# to extract only a subset of the metrics
result = extract(in_files, ["V1", "C3"])

# full list of metrics:
from mcpp import METRICS
print(list(METRICS.keys()))

CLI

Configuration parameters can be changed in config.yaml or directly on the CLI with e.g. mcpp paths.out_root=some/dir.

Using all defaults:

mcpp                # with default params like input directory, see config.yaml

Changing params from command line:

mcpp in_path=/some/dir/single_source out_path=single_source_metrics.json
mcpp metrics=\[C1,C2,V4\]

Or by passing a changed config.yaml:

• -cp (config_path) specifies the absolute path to the directory where the config file is located
• -cn (config_name) specifies the name of the config file

mcpp -cp /some/other/dir -cn myconfig.yaml

Try out the example:

mcpp in_path=examples/data/source paths.out_root=examples/data-out
cat examples/data-out/complexity.json