Software Engineering Institute

In this 2008 presentation, David Svoboda outlines the technical details of the CERT Rosecheckers tool, including how to get it running, static analysis concepts, and how it is built upon the ROSE open source compiler infrastructure. Rosecheckers tool performs static analysis on C/C++ source files, and it is designed to enforce the rules in the CERT C Coding standard. ROSE was developed at Lawrence Livermore National Laboratory (LLNL) and is an open source compiler infrastructure to build source-to-source program transformation and analysis tools for large-scale C(C89 and C98), C++(C++98 and C++11), UPC, Fortran (77/95/2003), OpenMP, Java, Python and PHP applications. Although some material in the presentation (such as tool downloads from school machines) is specific for Carnegie Mellon students, it has helpful information for anyone starting to use Rosecheckers.