...
Fortify SCA Version 5.0 is able to detect violations when an array is declared in a function and then a pointer to that array is returned.
The tool Compass Rose is able to detect automatically detects returning pointers to local variables but is not able to detect all violations of this rule. Detecting more general cases, such as examples where static pointers are set to local variables which then go out of ocope woul dbe difficult.
The Coverity Prevent RETURN_LOCAL checker finds many instances where a function will return a pointer to a local stack variable. Coverity Prevent cannot discover all violations of this rule, so further verification is necessary.
...