<p>I'm working on a project where I'm coding in C in a UNIX environment. I've been using the lint tool to check my source code. Lint has been around a long time (since 1979), can anyone suggest a more recent code analysis tool I could use ? Preferably a tool that is free.</p>

[{'answer_id': 2897, 'author': 'Mark Harrison', 'author_id': 116, 'author_profile': 'https://Stackoverflow.com/users/116', 'pm_score': 4, 'selected': False, 'text': '<p>For C code, you definitely should definitely use <a href="http://www.gimpel.com/html/lintinfo.htm" rel="noreferrer">Flexelint</a>.  I used it for nearly 15 years and swear by it.  One of the really great features it has is that warnings can be selectively turned off and on via comments in the code ("/* lint -e123*/").  This turned out to be a powerful documentation tool when you wanted to something out of the ordinary.  "I am turning off warning X, therefore, there is some good reason I\'m doing X."</p>\n\n<p>For anybody into interesting C/C++ questions, look at some of their examples on their site and see if you can figure out the bugs without looking at the hints.</p>\n'}, {'answer_id': 2927, 'author': 'svec', 'author_id': 103, 'author_profile': 'https://Stackoverflow.com/users/103', 'pm_score': 6, 'selected': True, 'text': '<p>Don\'t overlook the compiler itself. Read the compiler\'s documentation and find all the warnings and errors it can provide, and then enable as many as make sense for you.</p>\n<p>Also make sure to tell your compiler to treat warnings like errors so you\'re forced to fix them right away (<code>-Werror</code> on gcc).\nBy the way, don\'t be fooled <code>-Wall</code> on gcc does <em>not</em> enable all warnings.</p>\n<p>You may want to check <a href="http://valgrind.org" rel="nofollow noreferrer"><code>valgrind</code></a> (free!) — it &quot;automatically detect[s] many memory management and threading bugs, and profile[s] your programs in detail.&quot; It isn\'t a static checker, but it\'s a great tool!</p>\n'}, {'answer_id': 2984, 'author': 'Matthew Schinckel', 'author_id': 188, 'author_profile': 'https://Stackoverflow.com/users/188', 'pm_score': 4, 'selected': False, 'text': '<p>I\'ve heard good things about <a href="http://clang-analyzer.llvm.org/" rel="noreferrer">clang static analyzer</a>, which IIRC uses LLVM as it\'s backend.  If that\'s implemented on your platform, that might be a good choice.</p>\n\n<p>From what I understand, it does a bit more than just syntax analysis.  "Automatic Bug Finding", for instance.</p>\n'}, {'answer_id': 12532, 'author': 'Kristof Provost', 'author_id': 1466, 'author_profile': 'https://Stackoverflow.com/users/1466', 'pm_score': 3, 'selected': False, 'text': '<p>We\'ve been using <a href="http://www.coverity.com/" rel="noreferrer">Coverity Prevent</a> to check out C++ source code. </p>\n\n<p>It\'s not a free tool (although I believe they offer free scanning for open source projects), but it\'s one of the best static analysis tools you\'ll find. I\'ve heard it\'s even more impressive on C than on C++, but it\'s helped us avoid quite a number of bugs so far.</p>\n'}, {'answer_id': 12816, 'author': 'pauldoo', 'author_id': 755, 'author_profile': 'https://Stackoverflow.com/users/755', 'pm_score': -1, 'selected': False, 'text': '<p>There is a "-Weffc++" option for gcc which according to the Mac OS X man page will:</p>\n\n<blockquote>\n  <p>Warn about violations of the following style guidelines from Scott Meyers\' Effective C++ book:</p>\n</blockquote>\n\n<p><strong><em>[snip]</em></strong></p>\n\n<p>I know you asked about C, but this is the closest I know of..</p>\n'}, {'answer_id': 12851, 'author': 'Chris Conway', 'author_id': 1412, 'author_profile': 'https://Stackoverflow.com/users/1412', 'pm_score': 1, 'selected': False, 'text': '<p>You might find the <a href="http://spinroot.com/uno/" rel="nofollow noreferrer">Uno tool</a> useful. It\'s one of the few free non-toy options. It differs from lint, Flexelint, etc. in focusing on a small number of "semantic" errors (null pointer derefs, out-of-bounds array indices, and use of uninitialized variables). It also allows user-defined checks, like lock-unlock discipline. </p>\n\n<p>I\'m working towards a public release of a successor tool, <strike><a href="http://cm.bell-labs.com/cm/cs/what/orion/" rel="nofollow noreferrer">Orion</a> </strike> (<strong>CONTENT NOT AVAILABLE ANYMORE</strong>)</p>\n'}, {'answer_id': 24161, 'author': 'itj', 'author_id': 888, 'author_profile': 'https://Stackoverflow.com/users/888', 'pm_score': 0, 'selected': False, 'text': '<p><strong>lint</strong> is constantly updated... so why would you want a more recent one.</p>\n\n<p>BTW flexelint <strong>is</strong> lint</p>\n'}, {'answer_id': 24260, 'author': 'Chris Conway', 'author_id': 1412, 'author_profile': 'https://Stackoverflow.com/users/1412', 'pm_score': 2, 'selected': False, 'text': '<p>Lint-like tools generally suffer from a "false alarm" problem: they report a lot more issues than really exist. If the proportion of genuinely-useful warnings is too low, the user learns to just ignore the tool. More modern tools expend some effort to focus on the most likely/interesting warnings.</p>\n'}, {'answer_id': 28347, 'author': 'Rob Wells', 'author_id': 2974, 'author_profile': 'https://Stackoverflow.com/users/2974', 'pm_score': 0, 'selected': False, 'text': '<p>G\'day,</p>\n\n<p>I totally agree with the suggestions to read and digest what the compiler is telling you after setting -Wall.</p>\n\n<p>A good static analysis tool for security is <a href="http://www.dwheeler.com/flawfinder/" rel="nofollow noreferrer">FlawFinder</a> written by David Wheeler. It does a good job looking for various security exploits,</p>\n\n<p>However, it doesn\'t replace having a knowledgable someone read through your code. As David says on his web page, "A fool with a tool is still a fool!"</p>\n\n<p>cheers,</p>\n\n<p>Rob</p>\n'}, {'answer_id': 42723, 'author': 'David Bryson', 'author_id': 3663, 'author_profile': 'https://Stackoverflow.com/users/3663', 'pm_score': 3, 'selected': False, 'text': '<p>I recently compiled a list of all the static analysis tools I had at my disposal, I am still in the process of evaluating them all.  Note, these are mostly security analysis tools.</p>\n\n<ul>\n<li><a href="http://www.splint.org/" rel="noreferrer">splint</a></li>\n<li><a href="http://www.fortify.com/security-resources/rats.jsp" rel="noreferrer">RATS</a></li>\n<li><a href="http://smatch.sourceforge.net/" rel="noreferrer">SMATCH</a></li>\n<li><a href="http://www.spinroot.com/uno/" rel="noreferrer">Uno</a></li>\n</ul>\n'}, {'answer_id': 382569, 'author': 'Steve Melnikoff', 'author_id': 45552, 'author_profile': 'https://Stackoverflow.com/users/45552', 'pm_score': 1, 'selected': False, 'text': '<p><a href="http://www.gimpel.com/html/products.htm" rel="nofollow noreferrer">PC-lint/Flexelint</a> are very powerful and useful static analysis tools, and highly configurable, though sadly not free.</p>\n\n<p>When first using a tool like this, they can produce huge numbers of warnings, which can make it hard to differentiate between major and minor ones. Therefore, it is best to start using the tool on your code as early in the project as possible, and then to run it on your code as often as possible, so that you can deal with new warnings as they come up.</p>\n\n<p>With continual use like this, you soon learn how to write your code in a way which confirms to the rules applied by the tool.</p>\n\n<p>Because of this, I prefer tools like Lint which run relatively quickly, and so encourage continual use, rather than the more cumbersome tools which you may end up using less often, if at all.</p>\n'}, {'answer_id': 6354112, 'author': 'Dominic Gurto', 'author_id': 389135, 'author_profile': 'https://Stackoverflow.com/users/389135', 'pm_score': 0, 'selected': False, 'text': '<p>I\'ve found that it\'s generally best to use multiple static analysis tools to find bugs. Every tool is designed differently, and they can find very different things from each other.</p>\n\n<p>There are some good discussions in some of the talks <a href="http://samate.nist.gov/SATE2010Workshop.html" rel="nofollow">here</a>. It\'s from a conference held by the US Department of Homeland Security on static analysis.</p>\n'}, {'answer_id': 13967300, 'author': 'manav m-n', 'author_id': 220386, 'author_profile': 'https://Stackoverflow.com/users/220386', 'pm_score': 0, 'selected': False, 'text': '<p><a href="http://en.wikipedia.org/wiki/Sparse" rel="nofollow">Sparse</a> is a computer software tool, already available on Linux, designed to find possible coding faults in the Linux kernel.</p>\n\n<p>There are two active projects of <a href="http://linuxtesting.org/kernel" rel="nofollow">Linux Verification Center</a> aimed to improve quality of the loadable kernel modules.</p>\n\n<ol>\n<li>Linux Driver Verification (LDV) - a comprehensive toolset for static source code verification of Linux device drivers.</li>\n<li>KEDR Framework - an extensible framework for dynamic analysis and verification of kernel modules.</li>\n<li>Another ongoing project is Linux File System Verification that aims to develop a dedicated toolset for verification of Linux file system implementations.</li>\n</ol>\n'}, {'answer_id': 31055169, 'author': 'Nicolas Jean', 'author_id': 4830306, 'author_profile': 'https://Stackoverflow.com/users/4830306', 'pm_score': 3, 'selected': False, 'text': '<p>You can use <a href="http://cppcheck.sourceforge.net" rel="noreferrer">cppcheck</a>. It is an easy to use static code analysis tool.<br/>For example:<br/>\n<code>cppcheck --enable=all .</code><br/>\nwill check all C/C++ files under the current folder.<br/></p>\n'}, {'answer_id': 31072703, 'author': 'Dane', 'author_id': 2160675, 'author_profile': 'https://Stackoverflow.com/users/2160675', 'pm_score': 1, 'selected': False, 'text': '<p>You can try <a href="http://www.cppdepend.com" rel="nofollow">CppDepend</a>, a pretty complete static analyzer available on windows and linux, throught VS Plugin, IDE or command line, and it\'s free for <a href="http://www.cppdepend.com/CppDependForOSS" rel="nofollow">open source contributors</a></p>\n'}]
['https://Stackoverflow.com/questions/2873', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/381/']