...
Klocwork Version 8.0.4.16 can detect violations of this rule with the FNH.MIGHT, FNH.MUST, FUM.GEN.MIGHT, FUM.GEN.MUST, FUM.ZERO.MIGHT, and FUM.ZERO.MUST checkers.
Compass/ROSE could can detect some violations of this rule by looking for any pointer that is assigned to point to non-dynamic memory (eg a literal initialized value or a static variable or a local variable), and is later passed to free().
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
...