in reply to gnarf

first, start by enabling as picky compiler warnings as possible and fix all those issues. Then throw clang-tidy / scan-build at it and they will report more. In curl we then use two commercial ones (free to use for open source): CodeSonar and Coverity, which often find additional issues.

Then recently we also use ZeroPath which finds an additional crazy amount of potential problems.

This entry was edited (3 days ago)