Comparative study on static code analysis tools for C/C++

With the advancements in the field of modern science and technology, there is a growing trend in reliance on software codes, which puts more emphasis on the quality of software codes. A software program is characterized by the quality of its code and the coding standards it follows. Static Code Analysis is an efficient solution to check software system coding scheme. The significant feature is that any kind of bug or vulnerability in the code is detected without actually executing the code. The major concern is to detect the complex code constructs and the potential defects in a system. Static Code Analysis tools are helping the developers to build long lasting software without any bugs or vulnerabilities. Different C and C++ static code analyzers are in use. Each of them has its own significance and limitations as well. However, until now no tool can give 100% surety that the software will never halt, crash or perform erratically. Better tools, however, may be selected to minimize software-coding flaws. In order to find that tool, sixteen different tools that analyze C and C++ codes according to some set of rules or standards are compared in this paper. The paper includes review on the tools, behavior of tools against basic injection problems, input problems, functions and loops problems, variable and pointer problems and some basic coding problems. The tools were compared according to twenty-eight parameters and result was obtained through scoring. The tool that covered most of the attributes was ranked as first and the tool that covered least of the attributes was ranked as last.