Static Code Analysis
Wipro’s SCA platform is completely platform independent. It is an inter-procedural, path-sensitive, flow-sensitive and context-sensitive, extensible framework for C, C++ and Java.

The analysis can be either aggressive or focus on false positives reduction. It can also optionally check for any user-defined error definable as a state machine. It understands symbolic evaluation, pointer aliasing, dynamic memory areas etc.

The types of error detection are:

• Common functionality
• Special functionality (like deadlocks, race conditions, dynamic buffer overflow etc.)
• Performance
• Statistical
• API (statistical and non statistical)
• Security
• Migration
• User-extended
• Language specific (STL errors for C++ etc)

Results so far and future plans:

• A weak prototype has found hundreds of critical bugs in a variety of code bases (open source, client-supplied, robust, prototype etc.)
• Detected error categories include: Null pointer dereferencing, memory leaks, file descriptor leaks, buffer overflow, locking violations, un-initialized variables, array index out of bounds, unreachable code and use after free
• Plan to build a variety of “skin libraries” that cover domain / platform / architecture / technology specific necessities