Over the past few months I've been using static code analysis tools such as cppcheck, Coverity Scan and also smatch on various open source projects. I've generally found that most open source code is fairly well written, however, most suffer a common pattern of bugs on the error handling paths. Typically, these are not free'ing up memory or freeing up memory incorrectly. Other frequent bugs are not initialising variables and overly complex code paths that introduce subtle bugs when certain rare conditions are occur. Most of these bugs are small and very rarely hit; some of these just silently do things wrong while others can potentially trigger segmentation faults.
The --force option in cppcheck to force the checking of every build configuration has been very useful in finding code paths that are rarely built, executed or tested and hence are likely to contain bugs.
I'm coming to the conclusion that whenever I have to look at some new code I should take 5 minutes or so throwing it at various static code analysis tools to see what pops out and being a good citizen and fixing these and sending these upstream. It's not too much effort and helps reduce some of those more obscure bugs that rarely bite but do linger around in code.
