Comparison of static code analysis tools in Linux? [closed]

Answer 1

Using -Wall should be a matter of course for every c developer. Also, additionally using -Wextra could be a good idea.

Splint can find other potential weaknesses in your application but in most cases (!) it prints false warnings so you have to really understand what splint means with what warning and most times you have to insert annotations like /out/ or /unused/ in your code so splint doesn't yell on you. With splint, you should filter out warnings which are not important for you, otherwise you spent too much time in analyzing and scrolling through lots of messages.

Note that these tools do only static code checking. You should use valgrind to find runtime memory leaks.