Checked C

1. ikos

   1 16 2,964 5.1 C++

   Static analyzer for C/C++ based on the theory of Abstract Interpretation.

   

   In theory, sound static analyzers could be another method by which this is achieved in existing projects. They claim to be able to catch all instances of this. Some examples of sound static analyzers include:

   https://www.absint.com/astree/index.htm

   https://github.com/NASA-SW-VnV/ikos

   https://github.com/static-analysis-engineering/CodeHawk-C

   I have planned to try using this on OpenZFS for a while, but I am still busy reviewing and fixing reports made by conventional static analyzers. I plan to look into these next.

   That said, at least one of them claims to be able to prove the absence of issues in C that checked C explicitly says it cannot prevent. The obvious one is use-after-free.

2. InfluxDB

   www.influxdata.com featured

   InfluxDB – Built for High-Performance Time Series Workloads. InfluxDB 3 OSS is now GA. Transform, enrich, and act on time series data directly in the database. Automate critical tasks and eliminate the need to move data externally. Download now.

   

3. CodeHawk-C

   2 2 29 7.5 Python

   CodeHawk C Analyzer: sound static analysis of memory safety (undefined behavior)

   

   In theory, sound static analyzers could be another method by which this is achieved in existing projects. They claim to be able to catch all instances of this. Some examples of sound static analyzers include:

   https://www.absint.com/astree/index.htm

   https://github.com/NASA-SW-VnV/ikos

   https://github.com/static-analysis-engineering/CodeHawk-C

   I have planned to try using this on OpenZFS for a while, but I am still busy reviewing and fixing reports made by conventional static analyzers. I plan to look into these next.

   That said, at least one of them claims to be able to prove the absence of issues in C that checked C explicitly says it cannot prevent. The obvious one is use-after-free.

4. checkedc

   3 21 3,235 4.3 C

   Checked C is an extension to C that lets programmers write C code with bounds checking and improved type-safety. The goal is to let people easily make their existing C code type-safe and eliminate entire classes of errors.

   

5. checkedc-llvm-project

   4 1 16 4.5 C++

   This was a fork of Checked C clang used from 2021-2024. The changes have been merged into the original Checked C clang repo, which is now at https://github.com/checkedc/checkedc-clang.

   

   Note that active development seems to be continuing here:

   https://github.com/secure-sw-dev/checkedc-llvm-project

6. c2nim

   5 7 514 4.1 Nim

   c2nim is a tool to translate Ansi C code to Nim. The output is human-readable Nim code that is meant to be tweaked by hand before and after the translation process.

   

   Well I'm 99.5% certain at least. Even now I'm uncertain of the C syntax. And I've not been bold enough to test 3rd order C function pointers. I figure that's probably C code you don't wanna touch if possible.

   https://github.com/nim-lang/c2nim/blob/11f2c5363dfe7e8c7c8ce...

   The other annoying one is that "signed" and "unsigned" are basically adjectives, but "long" can be both a type and a modifier. So it's difficult to parse unless you're the target C compiler. Technically you can, but you have to use backtracking.

7. CompCert

   6 40 1,984 9.0 Coq

   The CompCert formally-verified C compiler

   

   Does anybody know how does this compare to https://compcert.org/ ?

8. dmd

   7 155 3,122 9.9 D

   dmd D Programming Language compiler

   

   > difficult to parse

   Not really. Just create a bit mask.

   https://github.com/dlang/dmd/blob/master/compiler/src/dmd/cp...

9. SaaSHub

   www.saashub.com featured

   SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

   

10. codeql

    8 23 8,302 10.0 CodeQL

    CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security

    

11. archive-program

    9 8 3,028 0.0

    The GitHub Archive Program & Arctic Code Vault

    

12. wuffs

    10 95 4,509 9.4 C

    Wrangling Untrusted File Formats Safely

    

    That sounds a bit like what WUFFS is doing

    WUFFS: https://github.com/google/wuffs

13. static-analysis

    11 15 13,796 9.1 Rust

    ⚙️ A curated list of static analysis (SAST) tools and linters for all programming languages, config files, build tools, and more. The focus is on tools which improve code quality.

    

    https://github.com/analysis-tools-dev/static-analysis

14. noplate

    12 5 47 8.2 C

    generic data structures

    

Suggest a related project