Argthtjtr

For example, I have some code like this:

#include<stdio.h>

#include<stdlib.h>

#include<string.h>



char *func(char *p) {

    p = malloc(32);

    memcpy(p, "hello", 6);

    return p;

}



int main() {

  char *s = NULL;

  char *s2 = NULL;

  s2 = func(s);

  printf("%sn", s2);

  free(s2);

  return 1;

}

The code will work, but has a potential error that s will not point to *p(Suppose the programmer's intention is to allocate memory to s,). One can quickly find the error because it is very simple. But in a large project with many many codes, sometimes it is very hard to find an error like this. gcc -Wall -Wextra does not give warnings.

Are there any tools that can find out this kind of error?

There is actually little wrong with that code other than abyssmal variable names :-)

A copy of s is passed into the function as p, you change p then return it, finally assigning it to s2. At no point is s (or p or s2) used in a way that would cause undefined behaviour, unless the malloc fails, which is something you should account for:

p = malloc(32);

if (p != NULL) memcpy(p, "hello", 6); // why not str[n]cpy ?

However, in terms of tools you can use to find problems, there are many. For example, linters, compilers with good diagnostic methods, memory trackers like valgrind, and debuggers like gdb.

By far the most important tool is the wetware inside that skull of yours, especially with your addition of:

Suppose the programmer's intention is to allocate memory to s.

I can think of no other tool that will catch the programmer's intention in that case. It's no different to figuring out the intent was to add two to a variable when the code states:

i++;