Black Duck Coverity vs Clang Static Analyzer

Black Duck Coverity is a paid static analysis solution for finding security vulnerabilities and code quality defects in source code before software ships. It analyzes code without executing it, scanning across files and libraries in entire codebases. Black Duck lists support for 22 programming languages and more than 250 frameworks, along with standards including MISRA, AUTOSAR, ISO 26262, PCI DSS, CERT C/C++/Java, DISA STIG, OWASP Top 10, and CWE Top 25. Coverity is TÜV SÜD certified for IEC 61508-3 support-tool requirements and qualified for use up to ASIL D under ISO 26262 and Level A under DO-178C. The Code Sight IDE plug-in offers real-time results, issue summaries, and code fixes. IDE, SCM, and CI integrations can trigger scans on commits and pull requests; listed connections include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, and others. Deployment can be fully air-gapped on premises, including Kubernetes clusters. Pricing is customized to team size and codebase and supplied by quote.

Clang Static Analyzer finds selected bugs in C, C++, and Objective-C programs. It uses symbolic execution to examine paths through code across function calls, and is part of the open-source Clang project. The analyzer is also implemented as a reusable C++ library for other tools and applications. Official releases include scan-build, a command-line tool for analyzing a codebase. On macOS, users can invoke it from Xcode; it can also run alongside clang-tidy when clang-analyzer checks are enabled. Clang-based IDEs may integrate the analyzer directly, and the documentation covers scan-build and CodeChecker. It runs on Linux, macOS, and Windows, and is self-hosted. The tool only detects bugs it has been designed to find, and analysis can take much longer than compilation. Some algorithms have exponential worst-case time, and results may include false positives. The listed free plan costs nothing.