Looking for Code Analysis / Checking Tool

I'm looking for some C/C++ code analysis tools. Preferably for a Win32 platform, as our software is Win32/MFC. The tool should look for security issues like format string vulnerabilities and check code complexity, anything else would be a welcome bonus.

The tool should be free as in "management doesn't want to pay a single dollar" ( or euro in our case ).

There seems to be a ton of tools out there. FlawFinder looked nice, but has no Windows port and I'll look into RATS tomorrow. Do you use such tools and what have you experienced using them ? Does anyone have recommendations ?

Lets say for example that your cost to the company is $60 per hour (that's your pre-tax salary, plus various employer taxes, your benefits and the cost of providing you with desk, chair, PC, heat, light etc).
In 4 hours the company could have bought PC-Lint.

How many bugs do you think one person can find in that time?

How many bugs do you think PC-Lint will flush out the first time you run it?

Maybe they'll buy the argument, but then again, bean-counters have some very weird maths.

For $0, consider http://splint.org/
But I don't think it's quite up to industrial scale use yet. Plus it can be extremely fussy over trivial details, so filtering what's important might take some getting used to.

In an off-hand way
http://en.wikipedia.org/wiki/List_of..._code_analysis

I'd definitely second PC-lint. And have pretty much the same comment for splint.

Quote:

---

Originally Posted by nvoigt

There seems to be a ton of tools out there. FlawFinder looked nice, but has no Windows port

---

You may not need a Windows port. If it's a basic terminal app (which I figure it is), you can probably compile it completely unchanged using Cygwin. Cygwin is also free, and a great thing to have around as it allows you to use a huge variety of UNIX-targetted software on Windows.

Thanks for the hints, I'll have a look. SPlint seems ok, I found PREfast when looking around, seems to be worth a test, too.

My personal opinion is that a tool like PC-lint is worth the money, but we just strechted our budged by a fair share when we bought the new VS, so I guess I will try to find a free alternative. It's better to spend the time looking for a good free tool than fighting a battle over money that I know I will lose :)