In practice there is much overlap because functions with large stack variables automatically use a large amount of stack space. After a checker gives a warning about a potential problem we manually inspect these warnings to see if they are likely to be real errors. We annotate each warning message with a label. The warning may be a bug or it might be a false positive. In other words, the query results will only show warnings not older than the version specified.
Checkers output diagnostic information to help pinpoint the cause of each warning message.
For example, the NULL checker will print out a message saying what function was called that could produce a NULL pointer. I don't see the error at the specified line. It may be necessary to look over the entire function where a warning is specified. Checker-specific heuristics that rank how sure the checker is that the condition is a bug 4. When we import the errors into the database we eliminate similar errors that have the same starting line number.