Use clang-check / clang-analyze

[jabbenseth]

http://clang-analyzer.llvm.org/

harder and more rules (and some bugs leading to false positives):
http://oclint.org/

Both of them need compile_commands. They are generated with catkin_make -DCMAKE_EXPORT_COMPILE_COMMANDS=ON in /path/to/catkin_workspace/build/.

syntax for clang:
clang-check -analyze -p </path/to/catkin_workspace/build/> <file_0> <file_1> <...>

syntax for oclint is similar:
oclint -p </path/to/catkin_workspace/build/> <file_0> <file_1> <..>

A main issue with static analyzers is that they check included files as well and find issues in ros packages or libraries not maintained by us.