- https://clang.llvm.org/extra/clang-tidy/

- cppcheck is sometimes updated also

- clazy : https://github.com/KDE/clazy

Note that https://clang-analyzer.llvm.org/scan-build.html is another llvm-based static analyzer.

It does a more deep analysis into the control flow, whereas clang-tidy does (mostly?) comparatively simpler checks on the AST.

You can actually run the static analysis checks from clang-tidy.

But you won't get the detailed HTML output that tells you why Clang Analyzer things a problem exists.

yep, see all the clang-analyzer checks listed here : https://clang.llvm.org/extra/clang-tidy/checks/list.html

direct link to cppcheck releases: https://github.com/danmar/cppcheck/releases

https://github.com/facebook/infer Seems cool.

I wrote a few posts on this topic that may be helpful: http://btorpey.github.io/blog/categories/static-analysis/

I hear about PVS-Studio often.

I only hear about PVS-Studio from their adticles that they agressively post to programming-related communities.

I'm interested in this too! I've been looking for one that can be used with arm-gcc for cross compiling on embedded platforms. What do people use in such situations?

Clang has support for cross-compiling [1] without needing separate builds for each target so you should be able to use clang-analyzer and clang-tidy whit the right -target flag for your ARM platform.

https://clang.llvm.org/docs/CrossCompilation.html

Besides that, most bugs found by static analysis are platform independent so you should be able to use any static analyzer you get your hands on as long as your code is cross-platform.

Oh cool, thanks!

I use what Visual C++ offers, which is already quite nice.

Plus VC++ debug builds do bounds checking, even for [].

You can also get run-time checks in libstdc++ and libc++ with -D_GLIBCXX_DEBUG -D_GLIBCXX_DEBUG_PEDANTIC and -D_LIBCPP_DEBUG=1.

Thanks, I guess I spend too much time on Windows. :)

Coverity is used at my company and seems to work reasonably well.