https://scan.coverity.com/
Static analysis is a set of processes for finding source code defects and vulnerabilities.
In static analysis, the code under examination is not executed. As a result, test cases and specially designed input datasets are not required. Examination for defects and vulnerabilities is not limited to the lines of code that are run during some number of executions of the code, but can include all lines of code in the codebase.
Additionally, Synopsys's implementation of static analysis can follow all the possible paths of execution through source code (including interprocedurally) and find defects and vulnerabilities caused by the conjunction of statements that are not errors independent of each other.
Some examples of defects and vulnerabilities found by Coverity Quality Advisor include:
resources leaks
dereferences of NULL pointers
incorrect usage of APIs
use of uninitialized data
memory corruptions
buffer overruns
control flow issues
error handling issues
incorrect expressions
concurrency issues
insecure data handling
unsafe use of signed values
use of resources that have been freed
The consequences of each type of defect or vulnerability are dependent on the specific instance. For example, unsafe use of signed values may cause crashes, lead to unexpected behavior, or lead to an exploitable security vulnerability.
Easily setup automatic scans if we had an official GitHub repo *COUGH COUGH* ;)Test every line of code and potential execution path.
The root cause of each defect is clearly explained, making it easy to fix bugs
Just a thought if one of the devs get bored!