0
votes
1answer
68 views

Buffer-overflow vulnerabilities that a static code analyser won't pick up [closed]

I'll use FlawFinder in this example. FlawFinder is a static code "analyser" tool that examines C/C++ source files and outputs warnings/hits if a vulnerability was identified. The way it does this is ...
7
votes
4answers
1k views

Semi-intelligent “diff” utility

Part of the QA steps required for a project I am tangentially involved with require the person who is responsible to integrate new version of source file to first calculate how many lines have been ...
9
votes
5answers
652 views

How to avoid the pitfalls of static analysis

I'm working at a company that would score 11 on Joel Test - at least on paper. In practice, however, nothing works quite as well as expected, and the project has been on DEFCON 1 for half a year. ...
3
votes
2answers
205 views

“continue” and “break” for static analysis

I know there have been a number of discussions of whether break and continue should be considered harmful generally (with the bottom line being - more or less - that it depends; in some cases they ...