[zuzun]

They can't detect a bug in code you never run. These were problems with the curl API, not the curl command line program.

[amadvance]

Coverity is a static analyzer, and it can detect bugs in code that is not run.