For high-integrity stuff, we use SPARK (
http://www.sparkada.com/)
- a design-by-contract subset of Ada95 that is entirely designed-from-scratch
for verification purposes.
The verification system implements Hoare-logic and is supported by a
theorem prover. Buffer Overflow is only one of many basic correctness
properties that can be verified. Properties that can be verified
are only limited to what can be expressed as an assertion in first-order
logic.
SPARK is a small language (compared to C++ or Java...) but the
depth and soundness of verification is unmatched by anything like
FindBugs, SPLINT, ESC/Java or any of the other tools for the "popular"
languages.
(If you don't know or care what soundness is in the context of static
analysis, then you've probably missed the point of this post...
:-) )
- Rod Chapman, Praxis