C C++源代码安全分析工具调研

Flawfinder
http://sourceforge.net/projects/flawfinder/

Flawfinder is a program that examines C source code and reports possible security weaknesses

(``flaws'') sorted by risk level. It's very useful for quickly finding and removing some security

problems before a program is widely released.

Flawfinder works on Unix-like systems today (it's been tested on GNU/Linux), and it should be easy to

port to Windows systems. It requires Python 1.5 or greater to run (Python 1.3 or earlier won't work).

 

CppCheck
http://cppcheck.sourceforge.net/
http://sourceforge.net/apps/mediawiki/cppcheck/index.php?title=Main_Page

Static analysis of C/C++ code. Checks for: memory leaks, mismatching allocation-deallocation, buffer

overrun, and many more. The goal is 0% false positives. See the wiki for more information.

规则：
http://sourceforge.net/apps/mediawiki/cppcheck/index.php?title=ListOfChecks
包括：变量使用、边界检查、类检查、内存泄漏检查等

支持命令行

Jenkins插件：
https://wiki.jenkins-ci.org/display/JENKINS/Cppcheck+Plugin

有Eclipse、Visual Studio的插件

 

Splint
Splint - Secure Programming Lint
Splint is a tool for statically checking C programs for security vulnerabilities and coding mistakes.

With minimal effort, Splint can be used as a better lint. If additional effort is invested adding

annotations to programs, Splint can perform stronger checking than can be done by any standard lint.

http://www.splint.org
Windows版本下载：
https://github.com/maoserr/splint_win32/downloads

注意添加几个环境变量：
LARCH_PATH - path to search for splint libraries and initializations files. Typically, this should

be: .;<directory where you installed splint>\lib
LCLIMPORTDIR - directory containing lcl imports files. Typically, this should be: <directory where

you installed splint>\imports
include - the pathname used to find system include files (e.g., stdio.h should be found on this

path). If you have installed a compiler, it probably sets this already

Set up your command PATH to include the directory containing splint.exe, or move the binary to a

directory on your command path.

不支持C++？！

 

 

RATS
RATS被Fortify收购了，Fortify被HP收购
支持C, C++, Perl, PHP 和Python
RATS is a tool for scanning C, C++, Perl, PHP and Python source code and flagging common security

related programming errors such as buffer overflows and TOCTOU (Time Of Check, Time Of Use) race

conditions.
As its name implies, the tool performs only a rough analysis of source code. It will not find every

error and will also find things that are not errors. Manual inspection of your code is still

necessary, but greatly aided with this tool.

需要额外安装eXpat：http://expat.sourceforge.net/
并且把rats和expat加入PATH环境变量

查看使用方法帮助：
rats -help

 

ITS4
http://www.cigital.com/its4/
Cigital developed ITS4 to help automate source code review for security. ITS4 is a simple tool that

statically scans C and C++ source code for potential security vulnerabilities. It is a command-line

tool that works across Unix and Windows platforms.
ITS4 scans source code, looking for function calls that are potentially dangerous. For some calls,

ITS4 tries to perform some code analysis to determine how risky the call is. In each case, ITS4

provides a problem report, including a short description of the potential problem and suggestions on

how to fix the code.

需要固定在C:\its4\目录工作
好像一次只能扫描一个文件？！
cigital公司似乎不怎么维护它了