The question I have is how many Open Source projects use static analysis tools as part of their development process?

Given that the code is publicly available it seems likely that bad actors would be using such tools (both proprietary and open) to find exploits for each release.

I remember Eric Raymond blogging about using Coverity to analyze gpsd but beyond that I don't recall any wider discussion about the issue.

Honest question, what are decent tools to find bugs like this in C code nowadays? I was saddened to read that gcc cannot check for unreachable code.

The -Wunreachable-code flag does work in clang, to some extent at least (I have a rather old version here so YMMV). Other tools that may help:

The clang static analyzer: http://clang-analyzer.llvm.org

Valgrind: http://www.valgrind.org

Address Sanitizer: http://clang.llvm.org/docs/AddressSanitizer.html

The various -fsanitize options in clang (undefined behaviours, integer overflows etc): http://clang.llvm.org/docs/UsersManual.html#id28

There is a list here:

http://en.wikipedia.org/wiki/List_of_tools_for_static_code_a...

Also there is oclint not listed there, which is pretty amazing, but it has a strange notation for ignoring wqrnings. splint is pretty good too though and still supports the legacy lint stuff like /* NOTREACHED /

BSD lint seems to work still (though it looks like the lintlib is no longer built on FreeBSD and stdlib is not lint clean!) but even it would have caught this gotofail:

  01: #include <stdlib.h>
  02: 
  03: int
  04: main(int argc, char *argv[])
  05: {
  06:   if (argc == 0)
  07:           goto fail;
  08:           goto fail;
  09: 
  10:   exit(0);
  11: 
  12: 
  13: fail:
  14:   exit(1);
  15: }
  $ lint a.c 
  a.c:
  stdlib.h(286): warning: ANSI C does not support 'long  long' [265]
  stdlib.h(287): warning: ANSI C does not support 'long long' [265]
  stdlib.h(287): warning: ANSI C does not support 'long long' [265]
  a.c(10): warning: statement not reached [193]
  a.c(15): warning: function main falls off bottom without returning value [217]
  a.c(4): warning: argument argv unused in function main [231]
  _types.h(61): warning: struct __timer never defined [233]
  _types.h(62): warning: struct __mq never defined [233]
  lint: cannot find llib-lc.ln
  Lint pass2:
  exit used( a.c(10) ), but not defined
  $ cc a.c 
  $ ./a.out 
  $ echo $?
  1

edit: grrr, sorry small copy/paste mistakes before.