CBMC vs CodeChecker

CBMC is a bounded model checker for C and C++ programs, available for Linux, macOS, and Windows. It checks memory safety, including array bounds and pointer use, along with several forms of undefined behavior and user-specified assertions. Its language range includes C89, C99, most of C11 and C17, and extensions from GCC, Clang, and Visual Studio. CBMC verifies by unwinding program loops and passing the resulting equation to a decision procedure. It can check C and C++ I/O equivalence with languages such as Verilog, and generate test cases for branch, decision, path, and MC/DC coverage. Listed language features include arrays, dynamic memory, nondeterminism, assumptions, assertions, and selected C++ features such as classes, templates, and STL containers. A MiniSat-based bit-vector solver is included; Boolector, CVC5, and Z3 are supported but must be installed separately. CBMC is free at free under a BSD 4-clause license. The Windows and macOS distributions are command-line tools without a GUI.

CodeChecker is free, open-source static-analysis infrastructure built on LLVM and Clang Static Analyzer tooling. Its command-line tools run supported analyzers against a JSON compilation database and generate reports. The web interface stores, filters, compares, and visualizes findings, including code bug paths, while reviewers can comment and set status. Reanalysis can be limited to changed files and their dependencies. Listed language coverage includes C/C++, C#, Java, Python, JavaScript, TypeScript, Go, and Markdown. Integrations cover Gerrit, GitLab, and a reusable GitHub Actions workflow. A Visual Studio Code extension runs analysis, reanalyzes saved files, and browses reports. Servers can run locally or in Docker, with PostgreSQL or SQLite storage and configurable authentication. CodeChecker requires Python 3.11 or later.