from http://www.rstcorp.com/its4/

ITS4 scans source code, looking for function calls that are
potentially dangerous. For some calls, ITS4 tries to perform some code
analysis to determine how risky the call is. In each case, ITS4
provides a problem report, including a short description of the
potential problem and suggestions on how to fix the code.

ITS4 and its source code are provided here for non-commercial use to
the security community.

-d.