P.: Test-driving static analysis tools in search of c code vulnerabilities

A large number of tools that automate the process of finding errors in pro-grams has recently emerged in the software development community. Many of them use static analysis as the main method for analyzing and capturing faults in the source code. Static analysis is deployed as an approximation of the pro-grams ’ runtime behavior with inherent limitations regarding its ability to detect actual code errors. It belongs to the class of computational problems which are undecidable [2]. For any such analysis, the major issues are: (1) the programming language of the source code where the analysis is applied (2) the type of errors to be detected (3) the effectiveness of the analysis and (4) the efficiency of the analysis. In order to incorporate a static analysis tool for detecting potential code defects in the software development cycle, significant costs are required. Thus, it is important to know if such a tool is effective in finding all types of errors and especially the critical ones for ensuring product quality. It is also a matter of major importance to know how efficient a tool is with respect to the size of th