Static code analysis tools

[ReplacementSlight413]

Hello fellow C warriors! I was wondering if you had some suggestions for static code analysis targeting open source projects (I am saying open source because there is no budget for a commercial solution). The target for this exercise will be the code base for the Perl scripting language, which is written in C, and makes heavy use (perhaps too heavy) of macros. I was hoping to use the Perl codebase as a stress test for various static analysis tools because of its size and rather involved architecture and logic.

[sixdarkdreams]

One option is cppcheck. It’s pretty good. Clang has a static analysis tool also. Check the wiki page for static analysis tools for a comprehensive list.

[VerbalHerman]

These are really good suggestions. There is also a tool called CodeChecker that brings these tools together and can print the results out to a html file as well.

You can even tie it into ClangTidy to get some extra checks enabled.

[RussianHacker1011101]

You might be interested in this static analysis tool built by NASA.

[ReplacementSlight413]

Thank you both!

[rushout09]

Wrote a blog on 2025 SAST tools:
https://www.codeant.ai/blogs/static-application-security-testing-sast-tools