Static code analysis (SCA) or Source code analysis is the process of analyzing the source code without executing it. Static Analysis Tools can detect possible vulnerabilities in the source code.

Apart from detecting vulnerabilities in the source code, SCA includes work with project architecture.

Static Code Analysis,

• Can review source code methodically
• Can follow Coding standards and RCA learning
• Can find most common defects at desktop before you even run code
• Help to Understand complex code
• 100% Code coverage
• Manual Code review effectiveness shoots up
• Reverse Engineering code becomes easy
• You can focus on functionality in code review

How to select a Static Code Analysis Tool

What kind of coding defects can be captured by Static Code Analysis Tool?

Being an advanced Static Code Analysis tool Klocwork can detect and help developer to fix coding vulnerabilities that includes,

• Attempt to use Memory after Free
• Banned recommended APIs
• Banned required APIs
• Buffer overflow
• C/C++ Warnings
• COM defects
• Calculated values never used
• Concurrency
• DNS spoofing
• Hard-coded credentials
• Ignored return values
• Improper memory deallocation
• Inappropriate iterator usage
• Invalid Arithmetic Operations
• Localized string
• Lowest possible privilege
• Memory leaks
• Mismatched return types
• Null pointer dereference
• Parse warning defects
• Pipe hijacking
• Porting issues
• Possible DLL hijacks
• Print functions format
• Registry manipulation
• Resource handling issues
• Scan functions format
• Speculative execution issues
• Strong type checkers
• Suspicious code practices
• Unnecessary or missing includes
• Unreachable code
• Unused local variables
• Unvalidated user input
• Use of uninitialized data
• Weak encryption

Klocwork – Static Code Analyser

Klocwork is an ISO, IEC certified static source code analysis tool from Perforce and widely adopted by more than 2,200 customers worldwide, allows developers to identify code defects, at developer’s desktop, while they are coding.

Klocwork static application security testing (SAST) for C, C++, Java and C# can identify software security, quality, and reliability issues and it can help organisations to enforce compliance with industry standards.

Klocwork can perform Dataflow Analysis, Syntax Analysis and Symbolic Logic Analysis to analyse the source code for vulnerabilities. Register here for Klocwork Trail, https://meteonic.com/contact-us or send a mail to support@meteonic.com