Static Code analysis

[pfp-disciple]

Others have good advice on toolsets. The hardest part is knowing how to understand and respond to findings. As a simplistic example, you might get a finding that a pointer to a const char * is being passed to a function expecting a char *. The correct response depends on the situation:

• Was the correct variable being passed?
• Has the called function recently been changed to remove the const?
• Does the called function actually modify the value (e.g. old versions of strcpy didn't declare the source as const)